Method, device, electronic device and storage medium for predicting network security status

Abstract

The present invention relates to the field of network security technology, and in particular to a prediction method, device, electronic device and storage medium for network security status, the method comprising: calculating the target transition probability of transferring from each network security state to each network security state according to the initial transition probability of transferring from each network security state to each network security state corresponding to each actual network security state sequence; calculating the predicted probability of each network security state at the next moment according to the actual network security state at the previous moment, the actual network security state at the current moment and the target transition probability of transferring from each network security state to each network security state; determining the network security state with the largest predicted probability as the predicted network security state at the next moment. The present application can predict the network security state at the next moment, avoids obtaining a large amount of training data, reduces prediction errors, and shortens prediction time.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method, device, electronic device and storage medium for predicting network security status. Background Art

[0002] Traditional network security status prediction methods mainly use single learning machine methods such as neural networks and support vector machines. Single learning machine methods require a large amount of training data, but it is very difficult to obtain a large amount of training data for network security data. Therefore, the prediction error of traditional methods is relatively large and time-consuming. Summary of the invention

[0003] In view of this, the purpose of the present application is to provide a method, device, electronic device and storage medium for predicting network security status, which can predict the network security status, avoid obtaining a large amount of training data, reduce prediction errors, and shorten prediction time.

[0004] In a first aspect, an embodiment of the present application provides a method for predicting a network security status, the method for predicting a network security status comprising:

[0005] Acquire multiple actual network security status sequences obtained by dividing the actual network security status in the current time period according to a preset period; the duration of the current time period is the target duration; the target duration is updated based on the predicted network security status and the actual network security status at each target moment in the current target time period;

[0006] Calculate the initial transition probability of transferring from each network security state to each network security state corresponding to each actual network security state sequence;

[0007] Calculate the target transition probability of transferring from each network security state to each network security state according to the initial transition probability of transferring from each network security state to each network security state corresponding to each actual network security state sequence;

[0008] According to the actual network security status at the previous moment, the actual network security status at the current moment, and the target transition probability from each network security status to each network security status, the predicted probability of each network security status at the next moment is calculated;

[0009] The network security state with the highest predicted probability is determined as the predicted network security state at the next moment.

[0010] In a possible implementation, the target duration is updated through the following steps:

[0011] Obtain the predicted network security status and actual network security status at each target time within the current target time period;

[0012] Calculate the predicted network status value and the actual network status value according to the predicted network security status and the actual network security status at all target moments respectively;

[0013] Calculating a prediction error index corresponding to the target duration according to a difference between the predicted value of the network status and the actual value of the network status;

[0014] The target duration is updated according to a numerical relationship between the prediction error index and a preset error index.

[0015] In a possible implementation manner, updating the target duration according to a numerical relationship between the prediction error index and a preset error index includes:

[0016] If the prediction error index is less than the preset error index, the sum of the current target duration and the first preset duration is determined as the latest target duration;

[0017] If the prediction error index is greater than or equal to the preset error index, the sum of the current target duration and the second preset duration is determined as the latest target duration; and the first preset duration is less than the second preset duration.

[0018] In a possible implementation manner, calculating the initial transition probabilities of transitioning from each network security state to each network security state corresponding to each actual network security state sequence includes:

[0019] The initial transition probability from each network security state to each network security state corresponding to the actual network security state sequence is calculated according to the following formula:

[0020]

[0021] Among them, P(S j |S i ) is the network security state S from the i-th network i Transfer to the jth network security state S j The initial transition probability, T is the time period corresponding to the actual network security status sequence, The actual network security state at time t in the actual network security state sequence is the i-th network security state, The actual network security state at time t+1 in the actual network security state sequence is the jth network security state, is the number of actual network security states at time t that are the i-th network security state and at time t+1 that are the j-th network security state in the actual network security state sequence, The actual network security state at time t in the actual network security state sequence is the i-th network security state Si The number of

[0022] In a possible implementation, the calculating of target transition probabilities of transferring from each network security state to each network security state according to initial transition probabilities of transferring from each network security state to each network security state corresponding to each actual network security state sequence includes:

[0023] The average values ​​of all initial transition probabilities from each network security state to each network security state corresponding to all actual network security state sequences are calculated to obtain the target transition probability from each network security state to each network security state.

[0024] In a possible implementation, the step of calculating the predicted probability of each network security state at the next moment according to the actual network security state at the previous moment, the actual network security state at the current moment, and the target transition probability of transitioning from each network security state to each network security state includes:

[0025] The target transition probability from the actual network security state at the previous moment to the actual network security state at the current moment is calculated and multiplied by the target transition probability from the actual network security state at the current moment to each network security state, and the predicted probability of each network security state at the next moment is obtained.

[0026] In a second aspect, an embodiment of the present application further provides a device for predicting a network security status, the device comprising:

[0027] An acquisition module, used to acquire a plurality of actual network security status sequences obtained by dividing the actual network security status in the current time period according to a preset period; the duration of the current time period is a target duration; the target duration is updated based on the predicted network security status and the actual network security status at each target moment in the current target time period;

[0028] A calculation module, used to calculate the initial transition probability from each network security state to each network security state corresponding to each actual network security state sequence;

[0029] The calculation module is further used to calculate the target transition probability of transferring from each network security state to each network security state according to the initial transition probability of transferring from each network security state to each network security state corresponding to each actual network security state sequence;

[0030] The calculation module is further used to calculate the predicted probability of each network security state at the next moment according to the actual network security state at the previous moment, the actual network security state at the current moment, and the target transition probability of transferring from each network security state to each network security state;

[0031] The determination module is used to determine the network security state with the highest predicted probability as the predicted network security state at the next moment.

[0032] In a possible implementation, the acquisition module is specifically used to obtain the predicted network security status and the actual network security status at each target moment in the current target time period; calculate the network status prediction value and the network status actual value according to the predicted network security status and the actual network security status at all target moments respectively; calculate the prediction error index corresponding to the target duration according to the difference between the network status prediction value and the network status actual value; and update the target duration according to the numerical relationship between the prediction error index and the preset error index.

[0033] In a third aspect, an embodiment of the present application further provides an electronic device, comprising: a processor, a storage medium and a bus, wherein the storage medium stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the storage medium through the bus, and the processor executes the machine-readable instructions to perform the steps of the method for predicting the network security status as described in any one of the first aspects.

[0034] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method for predicting the network security status as described in any one of the first aspects are executed.

[0035] The embodiment of the present application provides a prediction method, device, electronic device and storage medium for network security status, the method comprising: obtaining multiple actual network security status sequences obtained by dividing according to preset periods from the actual network security status in the current time period; the duration of the current time period is the target duration; the target duration is updated based on the predicted network security status and the actual network security status at each target moment in the current target time period; calculating the initial transition probability of transferring from each network security state to each network security state corresponding to each actual network security status sequence; calculating the target transition probability of transferring from each network security state to each network security state according to the initial transition probability of transferring from each network security state to each network security state corresponding to each actual network security status sequence; calculating the predicted probability of each network security state at the next moment according to the actual network security state at the previous moment, the actual network security state at the current moment and the target transition probability of transferring from each network security state to each network security state; determining the network security state with the largest predicted probability as the predicted network security state at the next moment. The present application determines the predicted network security state at the next moment by the target transition probability of transferring from each network security state to each network security state determined by the actual network security status sequence in the current time period, thereby avoiding obtaining a large amount of training data, reducing prediction errors and shortening prediction duration. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0037] Figure 1 A flowchart of a method for predicting network security status provided by an embodiment of the present application is shown;

[0038] Figure 2 A flowchart showing another method for predicting network security status provided by an embodiment of the present application is shown;

[0039] Figure 3 A schematic diagram showing the structure of a device for predicting network security status provided by an embodiment of the present application is shown;

[0040] Figure 4 A schematic structural diagram of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0041] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented out of sequence, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the present application, or remove one or more operations from the flowchart.

[0042] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0043] In order to enable those skilled in the art to use the content of this application, the following implementation is provided in conjunction with a specific application scenario, "the field of network security technology". For those skilled in the art, the general principles defined herein can be applied to other embodiments and application scenarios without departing from the spirit and scope of this application. Although this application is mainly described around the field of "network security technology", it should be understood that this is only an exemplary embodiment.

[0044] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0045] The following is a detailed description of a method for predicting network security status provided in an embodiment of the present application.

[0046] Reference Figure 1 As shown, it is a flowchart of a method for predicting network security status provided by an embodiment of the present application. The exemplary steps of the embodiment of the present application are described below:

[0047] S101: Acquire multiple actual network security status sequences obtained by dividing the actual network security status in the current time period according to preset periods.

[0048] In the implementation manner of the present application, the network security status may include multiple network security statuses such as excellent, good, general, poor, extremely poor, and high risk. The actual network security status in the current time period is divided according to the preset period, and the duration corresponding to the actual network security status sequence obtained after the division is the same as the preset period. Among them, the duration of the current time period is the target duration; the target duration is updated based on the predicted network security status and the actual network security status at each target moment in the current target time period.

[0049] For example, if the target duration is 3 minutes, the current time is 2:10, and the preset period is 1 minute, the actual network security status from 2:07 to 2:10 is obtained, and the actual network security status from 2:07 to 2:10 is divided according to the preset period, and the actual network security status sequence from 2:07 to 2:08, the actual network security status sequence from 2:08 to 2:09, and the actual network security status sequence from 2:09 to 2:10 can be obtained.

[0050] Specifically, obtaining the actual network security status in the current time period includes: obtaining network security information in the current time period from security monitoring equipment and a log recording system; determining the number of physical resource blocks (PRBs) at each moment through the network security information at each moment in the current time period; wherein PRB is a basic transmission unit in wireless communication; determining the ratio of the number of physical resource blocks (PRBs) at each moment to the total number of physical resource blocks (PRBs) in the network as the network security value at each moment; determining the network security status corresponding to the network security value range at each moment as the actual network security status corresponding to each moment; processing the actual network security status corresponding to all moments through an unbiased grayscale model to obtain the actual network security status in the current time period.

[0051] For example, when the network security value > 70%, the network security status is excellent. When 50% < network security value < 70%, the network security status is good. When 40% < network security value < 50%, the network security status is fair. When 20% < network security value < 30%, the network security status is poor. When 10% < network security value < 20%, the network security status is very poor. When the network security value < 10%, the network security status is high risk.

[0052] Among them, different network security states correspond to different network security value ranges. Unbiased grayscale model is a concept in the field of statistics and data analysis, which involves the unbiasedness of the model, that is, the average value of the model's estimated value in a large number of repeated sampling should be the same as the true value of the parameter to be estimated. Unbiasedness is an important criterion for evaluating the quality of an estimator, which means that the mathematical expectation of the estimator is equal to the true value of the estimated parameter. In science and technology, the practical significance of unbiased estimation lies in the absence of systematic errors, that is, no matter what distribution the population follows, its sample mean is always an unbiased estimate of the population mean. In addition, the average of unbiased estimators is close to the true value of the estimated parameter under multiple repetitions, which ensures the reliability and accuracy of the estimate.

[0053] Here, the security monitoring equipment (such as intrusion detection system (IDS), intrusion prevention system (IPS), firewall, etc.) deployed in advance in the communication network monitors and records network traffic, connection requests, malicious behavior and other security-related network security information in real time, and stores network security events, attack records, abnormal behavior and other network security information through the log recording system. At the same time, an audit mechanism is established to regularly check and analyze the logs to extract network security information about the network security status.

[0054] In addition, the embodiments of the present application can use automated tools or scripts to extract and process network security information in security monitoring equipment and logging systems to ensure the accuracy and completeness of network security information. By establishing a suitable data storage and management system for storing and managing network security status data, which can include databases, data warehouses, or big data platforms, etc., to ensure the security, accessibility, and scalability of the data. Apply appropriate data analysis and mining techniques to perform statistics and analysis on the collected network security status data. Use data visualization tools and algorithms to establish an unbiased grayscale model to process the raw data, explore the patterns, laws, and trends in the data, and gain a deep understanding of the network security situation.

[0055] Furthermore, the target duration is updated through the following steps: obtaining the predicted network security status and the actual network security status at each target moment in the current target time period; calculating the predicted network status value and the actual network status value according to the predicted network security status and the actual network security status at the target moment respectively; determining the prediction error index corresponding to the target duration according to the difference between the predicted network status value and the actual network status value; and updating the target duration according to the numerical relationship between the prediction error index and the preset error index.

[0056] Here, by updating the target duration, the amount of data on the actual network security status within the current time period can be adjusted, which can ensure the accuracy of the prediction and control the amount of calculation.

[0057] S102: Calculate the initial transition probability from each network security state to each network security state corresponding to each actual network security state sequence.

[0058] In the implementation manner of the present application, based on the actual network security state at each moment in each actual network security state sequence, the initial transition probability from each network security state to each network security state corresponding to each actual network security state sequence is determined.

[0059] For example, the initial transition probability of transferring from network security state 1 to each network security state 2 can be understood as the initial probability that the actual network security state at the next moment is network security state 2 when the actual network security state at the current moment is network security state 1.

[0060] For example, the network security state includes network security state 1, network security state 2, and network security state 3, and the actual network security state sequence includes sequence A and sequence B. The initial transition probability of transferring from each network security state to each network security state corresponding to the actual network security state sequence A includes: determining the initial transition probability of transferring from network security state 1 to network security state 1, the initial transition probability of transferring from network security state 1 to network security state 2, the initial transition probability of transferring from network security state 1 to network security state 3, the initial transition probability of transferring from network security state 2 to network security state 1, the initial transition probability of transferring from network security state 2 to network security state 2, the initial transition probability of transferring from network security state 2 to network security state 3, the initial transition probability of transferring from network security state 3 to network security state 1, the initial transition probability of transferring from network security state 3 to network security state 2, and the initial transition probability of transferring from network security state 3 to network security state 3. The content of determining the initial transition probability of transferring from each network security state to each network security state corresponding to the actual network security state sequence B is the same as that of the actual network security state sequence A.

[0061] Specifically, the initial transition probability from each network security state to each network security state corresponding to the actual network security state sequence is calculated according to the following formula:

[0062]

[0063] Among them, P(S j |S i ) is the network security state S from the i-th network i Transfer to the jth network security state S j The initial transition probability, T is the time period corresponding to the actual network security status sequence, The actual network security state at time t in the actual network security state sequence is the i-th network security state, The actual network security state at time t+1 in the actual network security state sequence is the jth network security state, is the number of actual network security states at time t that are the i-th network security state and at time t+1 that are the j-th network security state in the actual network security state sequence, The actual network security state at time t in the actual network security state sequence is the i-th network security state S i The number of

[0064] In the scenario example, the network security status includes network security status 1 (i.e., the network security status is good), network security status 2 (i.e., the network security status is poor), and network security status 3 (i.e., the network security status is extremely poor). The actual network security status sequence includes {the actual network security status corresponding to the first moment is network security status 1, the actual network security status corresponding to the second moment is network security status 3, the actual network security status corresponding to the third moment is network security status 1, the actual network security status corresponding to the fourth moment is network security status 3, the actual network security status corresponding to the fifth moment is network security status 1, and the actual network security status corresponding to the sixth moment is network security status 2}; when calculating the initial transition probability from network security status 1 to network security status 3: The number is 2, specifically refers to the actual network security status 1 at the first moment and the actual network security status 3 at the second moment, the actual network security status 1 at the third moment and the actual network security status 3 at the fourth moment; The number is 3, specifically, the actual network security state corresponding to the first moment is network security state 1, the actual network security state corresponding to the third moment is network security state 1, and the actual network security state corresponding to the fifth moment is network security state 1; therefore, P(S j |S i ) is 2 / 3.

[0065] S103 : Calculate target transition probabilities of transferring from each network security state to each network security state according to initial transition probabilities of transferring from each network security state to each network security state corresponding to each actual network security state sequence.

[0066] For example, the target transition probability of transferring from network security state 1 to each network security state 2 can be understood as the target probability that the actual network security state at the next moment is network security state 2 when the actual network security state at the current moment is network security state 1.

[0067] Specifically, the average values ​​of all initial transition probabilities from each network security state to each network security state corresponding to all actual network security state sequences are calculated to obtain the target transition probability from each network security state to each network security state.

[0068] For example, the initial transition probability from network security state 1 to network security state 2 corresponding to the actual network security state sequence A is 0.3, the initial transition probability from network security state 1 to network security state 2 corresponding to the actual network security state sequence B is 0.5, and the initial transition probability from network security state 1 to network security state 2 corresponding to the actual network security state sequence C is 0.4, then the target transition probability from network security state 1 to network security state 2 is (0.3+0.5+0.4) / 3=0.4.

[0069] S104, calculating the predicted probability of each network security state at the next moment according to the actual network security state at the previous moment, the actual network security state at the current moment, and the target transition probability from each network security state to each network security state.

[0070] In the implementation manner of the present application, the greater the predicted probability of the network security state at the next moment is, the more likely the actual network security state at the next moment is that network security state.

[0071] Specifically, the product of the target transition probability of transferring from the actual network security state at the previous moment to the actual network security state at the current moment and the target transition probability of transferring from the actual network security state at the current moment to each network security state is calculated to obtain the predicted probability of each network security state at the next moment.

[0072] Taking "calculating the predicted probability of network security state 1 at the next moment" as an example, the actual network security state at the previous moment is network security state 3, and the actual network security state at the current moment is network security state 2. The target transition probability of transferring from network security state 3 to network security state 2 is 0.6, and the target transition probability of transferring from network security state 2 to network security state 1 is 0.3. Then the predicted probability of network security state 1 at the next moment is 0.6*0.3=0.18.

[0073] S105: Determine the network security state with the highest predicted probability as the predicted network security state at the next moment.

[0074] Reference Figure 2 As shown, it is a flow chart of another method for predicting network security status provided by an embodiment of the present application. The exemplary steps of the embodiment of the present application are described below:

[0075] S201. Obtain the predicted network security status and the actual network security status at each target time in the current target time period.

[0076] S202: Calculate a predicted network status value and an actual network status value according to the predicted network security status and the actual network security status at all target moments.

[0077] In the implementation manner of the present application, each network security state corresponds to a unique preset state value. The average value of the preset state values ​​corresponding to the predicted network security states at all target moments is determined as the predicted network state value. The average value of the preset state values ​​corresponding to the actual network security states at all target moments is determined as the actual network state value.

[0078] S203: Determine a prediction error index corresponding to the target duration according to a difference between the predicted value of the network status and the actual value of the network status.

[0079] Specifically, the difference between the predicted value of the network status and the actual value of the network status is substituted into the following formula to calculate the prediction error index corresponding to the target duration:

[0080]

[0081] Among them, P miss is the prediction error index corresponding to the target duration, S prediction is the network status prediction value, S reality is the actual value of the network status, S prediction -S reality It is the difference between the predicted value of the network status and the actual value of the network status.

[0082] S204: Update the target duration according to the numerical relationship between the prediction error index and the preset error index.

[0083] In the implementation manner of the present application, the larger the prediction error index is, the less accurate the prediction result is, and the target duration needs to be increased. The smaller the prediction error index is, the more accurate the prediction result is, and the target duration can be appropriately increased or shortened.

[0084] Specifically, if the prediction error index is less than the preset error index, the sum of the current target duration and the first preset duration is determined as the latest target duration; if the prediction error index is greater than or equal to the preset error index, the sum of the current target duration and the second preset duration is determined as the latest target duration; the first preset duration is less than the second preset duration. The first preset duration can be a negative number, that is, the number of actual network security states in the current time period is reduced.

[0085] Here, the larger the number of actual network security states, the more accurate the prediction result, but when the number of actual network security states is too large, the amount of calculation will be too large. This application can update the target duration by predicting the numerical relationship between the error index and the preset error index, and then adjust the number of actual network security states obtained in the current time period, thereby ensuring both prediction efficiency and prediction accuracy.

[0086] Based on the same inventive concept, an information processing device corresponding to the information processing method is also provided in the embodiment of the present application. Since the principle of solving the problem by the device in the embodiment of the present application is similar to the above-mentioned information processing method in the embodiment of the present application, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0087] Reference Figure 3 FIG. 1 is a schematic diagram of a network security status prediction device provided in an embodiment of the present application, wherein the network security status prediction device includes:

[0088] The acquisition module 301 is used to obtain a plurality of actual network security status sequences obtained by dividing the actual network security status in the current time period according to a preset period; the duration of the current time period is the target duration; the target duration is updated based on the predicted network security status and the actual network security status at each target moment in the current target time period;

[0089] A calculation module 302 is used to calculate the initial transition probability from each network security state to each network security state corresponding to each actual network security state sequence;

[0090] The calculation module 302 is further used to calculate the target transition probability of transferring from each network security state to each network security state according to the initial transition probability of transferring from each network security state to each network security state corresponding to each actual network security state sequence;

[0091] The calculation module 302 is further used to calculate the predicted probability of each network security state at the next moment according to the actual network security state at the previous moment, the actual network security state at the current moment, and the target transition probability of transferring from each network security state to each network security state;

[0092] The determination module 303 is used to determine the network security state with the highest predicted probability as the predicted network security state at the next moment.

[0093] In a possible implementation, the acquisition module 301 is specifically used to obtain the predicted network security status and the actual network security status at each target moment in the current target time period; calculate the network status prediction value and the network status actual value according to the predicted network security status and the actual network security status at all target moments respectively; calculate the prediction error index corresponding to the target duration according to the difference between the network status prediction value and the network status actual value; and update the target duration according to the numerical relationship between the prediction error index and the preset error index.

[0094] The embodiment of the present application provides a prediction device for a network security state, which includes: an acquisition module, which is used to acquire a plurality of actual network security state sequences obtained by dividing the actual network security state in a current time period according to a preset period; the duration of the current time period is a target duration; the target duration is updated based on the predicted network security state and the actual network security state at each target moment in the current target time period; a calculation module, which is used to calculate the initial transition probability of transferring from each network security state to each network security state corresponding to each actual network security state sequence; the calculation module is also used to calculate the target transition probability of transferring from each network security state to each network security state according to the initial transition probability of transferring from each network security state to each network security state corresponding to each actual network security state sequence; the calculation module is also used to calculate the predicted probability of each network security state at the next moment according to the actual network security state at the previous moment, the actual network security state at the current moment, and the target transition probability of transferring from each network security state to each network security state; a determination module, which is used to determine the network security state with the largest predicted probability as the predicted network security state at the next moment. The present application determines the target transition probability from each network security state to each network security state through the actual network security state sequence in the current time period, and determines the predicted network security state at the next moment, thereby avoiding the acquisition of a large amount of training data, reducing prediction errors, and shortening prediction time.

[0095] like Figure 4 As shown, an electronic device 400 provided in an embodiment of the present application includes: a processor 401, a memory 402 and a bus, wherein the memory 402 stores machine-readable instructions executable by the processor 401. When the electronic device is running, the processor 401 communicates with the memory 402 through the bus, and the processor 401 executes the machine-readable instructions to perform the steps of the method for predicting the network security status as described above.

[0096] Specifically, the memory 402 and the processor 401 can be general-purpose memories and processors, which are not specifically limited here. When the processor 401 runs the computer program stored in the memory 402, the method for predicting the network security status can be executed.

[0097] Corresponding to the above-mentioned network security status prediction method, an embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned network security status prediction method are executed.

[0098] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the system and device described above can refer to the corresponding process in the method embodiment, and will not be repeated in this application. In the several embodiments provided in this application, it should be understood that the disclosed system, device and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0099] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0100] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0101] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the information processing method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks, or optical disks.

[0102] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for predicting network security status, characterized in that: The method for predicting the network security status includes: Acquire multiple actual network security status sequences obtained by dividing the actual network security status in the current time period according to a preset period; the duration of the current time period is the target duration; the target duration is updated based on the predicted network security status and the actual network security status at each target moment in the current target time period; Calculate the initial transition probability of transferring from each network security state to each network security state corresponding to each actual network security state sequence; Calculate the target transition probability of transferring from each network security state to each network security state according to the initial transition probability of transferring from each network security state to each network security state corresponding to each actual network security state sequence; According to the actual network security status at the previous moment, the actual network security status at the current moment, and the target transition probability from each network security status to each network security status, the predicted probability of each network security status at the next moment is calculated; Determine the network security state with the highest predicted probability as the predicted network security state at the next moment; The target duration is updated through the following steps: obtaining the predicted network security status and the actual network security status at each target moment in the current target time period; calculating the predicted network status value and the actual network status value according to the predicted network security status and the actual network security status at all target moments respectively; calculating the prediction error index corresponding to the target duration according to the difference between the predicted network status value and the actual network status value; if the prediction error index is less than the preset error index, determining the sum of the current target duration and the first preset duration as the latest target duration; if the prediction error index is greater than or equal to the preset error index, determining the sum of the current target duration and the second preset duration as the latest target duration; the first preset duration is less than the second preset duration.

2. The method for predicting network security status according to claim 1, characterized in that: The calculating of the initial transition probabilities of transitioning from each network security state to each network security state corresponding to each actual network security state sequence includes: The initial transition probability from each network security state to each network security state corresponding to the actual network security state sequence is calculated according to the following formula: Among them, P(S j |S i ) is the network security state S from the i-th network i Transfer to the jth network security state S j The initial transition probability, T is the time period corresponding to the actual network security status sequence, The actual network security state at time t in the actual network security state sequence is the i-th network security state, The actual network security state at time t+1 in the actual network security state sequence is the jth network security state, is the number of actual network security states at time t that are the i-th network security state and at time t+1 that are the j-th network security state in the actual network security state sequence, The actual network security state at time t in the actual network security state sequence is the i-th network security state S i The number of 3. The method for predicting network security status according to claim 2, characterized in that: The step of calculating the target transition probability of transferring from each network security state to each network security state according to the initial transition probability of transferring from each network security state to each network security state corresponding to each actual network security state sequence includes: The average values ​​of all initial transition probabilities from each network security state to each network security state corresponding to all actual network security state sequences are calculated to obtain the target transition probability from each network security state to each network security state.

4. The method for predicting network security status according to claim 1, characterized in that: The step of calculating the predicted probability of each network security state at the next moment according to the actual network security state at the previous moment, the actual network security state at the current moment, and the target transition probability of transitioning from each network security state to each network security state includes: The target transition probability from the actual network security state at the previous moment to the actual network security state at the current moment is calculated and multiplied by the target transition probability from the actual network security state at the current moment to each network security state, and the predicted probability of each network security state at the next moment is obtained.

5. A device for predicting network security status, characterized in that: The network security status prediction device comprises: An acquisition module, used to acquire a plurality of actual network security status sequences obtained by dividing the actual network security status in the current time period according to a preset period; the duration of the current time period is a target duration; the target duration is updated based on the predicted network security status and the actual network security status at each target moment in the current target time period; A calculation module, used to calculate the initial transition probability from each network security state to each network security state corresponding to each actual network security state sequence; The calculation module is further used to calculate the target transition probability of transferring from each network security state to each network security state according to the initial transition probability of transferring from each network security state to each network security state corresponding to each actual network security state sequence; The calculation module is further used to calculate the predicted probability of each network security state at the next moment according to the actual network security state at the previous moment, the actual network security state at the current moment, and the target transition probability of transferring from each network security state to each network security state; A determination module, used to determine the network security state with the highest predicted probability as the predicted network security state at the next moment; The target duration is updated through the following steps: obtaining the predicted network security status and the actual network security status at each target moment in the current target time period; calculating the predicted network status value and the actual network status value according to the predicted network security status and the actual network security status at all target moments respectively; calculating the prediction error index corresponding to the target duration according to the difference between the predicted network status value and the actual network status value; if the prediction error index is less than the preset error index, determining the sum of the current target duration and the first preset duration as the latest target duration; if the prediction error index is greater than or equal to the preset error index, determining the sum of the current target duration and the second preset duration as the latest target duration; the first preset duration is less than the second preset duration.

6. An electronic device, characterized in that: include: A processor, a storage medium and a bus, wherein the storage medium stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the storage medium communicate via the bus, and the processor executes the machine-readable instructions to perform the steps of the method for predicting the network security status as described in any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method for predicting the network security status according to any one of claims 1 to 4 are executed.

Images