A network security intelligent protection method and system based on intrinsic security mechanism

Abstract

The present invention discloses a network security intelligent protection method and system based on an intrinsic security mechanism, which relates to the field of network security technology. The main scheme is: real-time monitoring of network data flow and network flow historical data, respectively calculating the flow mutation index F m , Protocol Abnormal Index P a and port abnormality indicator Port a And make anomaly judgments; calculate the comprehensive anomaly index I, preset thresholds to judge the network traffic status, and trigger the inherent security mechanism protection when the network traffic is seriously abnormal; calculate the risk assessment value R and the rule strength ACL of access control, and take different measures for network traffic anomalies; detect intrusion prevention systems, calculate detection sensitivity S and current attack update frequency F new , further calculate the current network access control policy strength C new , update the network's access control policy in real time; this method has an inherent security mechanism that can immediately protect against serious anomalies and continuously learn and optimize security protection strategies to adapt to changes in the network environment and new security threats.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security intelligent protection method and system based on an intrinsic security mechanism. Background Art

[0002] In the traditional network security protection system, it is often mainly dependent on border protection methods. These technologies set up checkpoints at the network border to filter and monitor the traffic in and out of the network to prevent external malicious attacks. However, with the continuous evolution of attack technology, attackers are becoming more and more adept at finding loopholes in border protection and using various hidden channels to infiltrate the network. At the same time, access control, as another common traditional protection method, can limit the access rights of different users to network resources, but it often seems powerless when facing complex internal attacks and abuse of rights. Internal personnel use legitimate rights to perform malicious operations, or due to negligence, security vulnerabilities are exploited.

[0003] In addition, with the widespread application of emerging technologies such as the Internet of Things, cloud computing, and big data, the scale and complexity of the network have exploded; the large number of IoT devices has blurred the network boundaries, increasing the risk of attacks. In the cloud computing environment, the sharing and dynamic allocation of resources have brought huge challenges to security management; the storage and processing of big data are also easy to become the target of attackers. Once the data is leaked, it will cause serious consequences.

[0004] Most existing network security protection systems are passive and rely mainly on known attack features for detection. This approach is often unable to detect and prevent attacks in a timely manner when faced with new types of attacks and unknown threats. Moreover, passive protection systems only respond after the attack occurs, and the response time is long, making it difficult to effectively curb the spread of attacks, which may result in serious losses. Summary of the invention

[0005] 1. Technical issues to be solved

[0006] In view of the shortcomings of the prior art, the present invention provides a network security intelligent protection method and system based on an intrinsic security mechanism. The method and system determine the abnormal state by calculating multiple types of indicators, trigger the intrinsic security mechanism to protect against serious anomalies. The method evaluates risks and calculates rule strength based on historical data, detects intrusions into the system and updates the access control policy strength, and dynamically adjusts protection measures to respond to network changes and new security threats, thus solving the problems of incomplete monitoring, passive defense, delayed response, and inflexible policy adjustment.

[0007] (II) Technical solution

[0008] To achieve the above objectives, the present invention is implemented through the following technical solutions: a network security intelligent protection method based on an intrinsic security mechanism, comprising the following steps:

[0009] Obtain real-time data and historical data of network traffic;

[0010] Based on the real-time data of network traffic, calculate the traffic mutation index F m , Protocol Abnormal Index P a and port abnormality indicator Port a , and make abnormal judgments respectively; when one of the indicators is abnormal, according to the traffic mutation indicator F m , Protocol Abnormal Index P a and port abnormality indicator Port a Calculate the comprehensive abnormal index I, preset the comprehensive abnormal index threshold, compare the comprehensive abnormal index I with the comprehensive abnormal index threshold, and judge the abnormal state of network traffic; when the network traffic is seriously abnormal, immediately trigger the inherent security mechanism for protection;

[0011] Based on the historical data of network traffic, the risk assessment value R is calculated; based on the risk assessment value R, the rule strength ACL of the access control is calculated, the rule strength threshold is preset, the rule strength ACL is compared with the rule strength threshold, and different measures are taken for abnormal network traffic based on the comparison results; based on the historical data of network traffic, the detection sensitivity S and the current attack update frequency F are calculated new , based on the detection sensitivity S to evaluate the monitoring sensitivity state; based on the current attack update frequency F new Adjust network security policies; calculate the current network access control policy strength C based on historical network traffic data new , and based on the current network access control policy strength C new Adjust access control policies.

[0012] In the above preferred solution of the network security intelligent protection method based on the intrinsic security mechanism: the traffic mutation index F is calculated. m The method is as follows:

[0013] Calculate the average network traffic F per unit time T avg , the calculation formula is:

[0014]

[0015] Where F(t) represents the network traffic size at time point t, the value of t is 1, 2, 3...H, and H is a positive integer;

[0016] The formula for calculating the standard deviation σ of flow rate within unit time T is:

[0017]

[0018] Monitor network traffic data in real time and obtain the current traffic F current , according to the average network traffic F avg and the flow standard deviation σ, calculate the flow mutation index F m , the formula based on is:

[0019]

[0020] Preset traffic mutation index threshold F th , when |F m |>F th When the network traffic is abnormal, it is considered that there is a sudden change.

[0021] In the preferred embodiment of the network security intelligent protection method based on the intrinsic security mechanism: the protocol anomaly index P is calculated. a The method is as follows:

[0022] Calculate the traffic proportion P of different protocol data within a period of time i , the formula based on is:

[0023]

[0024] Among them, F i is the traffic proportion of the i-th protocol data, i is 1, 2, 3...n; n is the number of protocols, which is a positive integer;

[0025] Calculate the average traffic percentage P of historical protocol data i，avg , the calculation formula is:

[0026]

[0027] in, is the traffic proportion of the i-th protocol data in the k-th historical time, where k is 1, 2, 3...M; M is the number of historical time periods, which is a positive integer;

[0028] Get the traffic proportion P of different protocol data at the current moment i，current , calculate the protocol anomaly index P a , the formula based on is:

[0029]

[0030] Preset protocol data abnormal threshold P th , when P a >P th When the network traffic is detected, it is determined that there is a protocol anomaly.

[0031] In the preferred solution of the network security intelligent protection method based on the intrinsic security mechanism: calculating the port abnormality index Port a The method is as follows:

[0032] Calculate the traffic proportion of common ports within a period of time s , the calculation formula is:

[0033]

[0034] Among them, F s ′ is the traffic proportion of the sth commonly used port, and the value of s is 1, 2, 3...m; m is the number of commonly used ports, and the value is a positive integer;

[0035] Calculate the average value of historical common port data Port s，avg , the formula based on is:

[0036]

[0037] in, is the traffic proportion of the sth commonly used port in the kth historical time period, and the value of k is 1, 2, 3...M;

[0038] Monitor network traffic data in real time and obtain the traffic proportion of different commonly used ports at the current moment. s，current , calculate the port abnormality index Port a , the formula based on is:

[0039]

[0040] Preset port abnormal indicator threshold Port th , when Port a >Port th When the network traffic is abnormal, it is considered that there is a port anomaly.

[0041] In the preferred solution of the network security intelligent protection method based on the intrinsic security mechanism: based on the traffic mutation index F m , Protocol Abnormal Index P a and port abnormality indicator Port a , calculate the comprehensive abnormal index I, based on the formula:

[0042] I=α×F m +β×P a +γ×Port a

[0043] Among them, α is the traffic mutation index F m The weight coefficient is 0.1 to 0.3; β is the protocol abnormality index Pa The weight coefficient of, with a value range of 0.3 to 0.4; γ is the port anomaly index Port a The weight coefficient of, with a value range of 0.3 to 0.5; and α + β + γ = 1;

[0044] The comprehensive anomaly index threshold includes the first anomaly index threshold I1 and the second anomaly index threshold I2, and I1 < I2:

[0045] When I ≤ I1, the network traffic is normal;

[0046] When I1 < I ≤ I2, the network traffic is mildly abnormal, and a warning measure is issued;

[0047] When I > I2, the network traffic is severely abnormal, and the endogenous security mechanism is started for protection.

[0048] In a preferred scheme of the above network security intelligent protection method based on the endogenous security mechanism: The network traffic historical data includes the risk score S of the source IP address IP , the risk score S of the protocol type Protocol , the risk score S of the port Port and the risk score S of the traffic pattern TrafficPattern ;

[0049] Calculate the risk assessment value R according to the network traffic historical data, and the formula is:

[0050] R = λ × S IP + μ × S Protocol + ν × S Port + ξ × S TrafficPattern

[0051] Among them, λ is the weight coefficient of the risk score S of the source IP address IP , with a value range of 0.2 to 0.4; μ is the weight coefficient of the risk score S of the protocol type Protocol , with a value range of 0.1 to 0.4; ν is the weight coefficient of the risk score S of the port Port , with a value range of 0.2 to 0.4; ξ is the weight coefficient of the risk score S of the traffic pattern Tra , with a value range of 0.2 to 0.3; and λ + μ + ν + ξ = 1.

[0052] In a preferred scheme of the above network security intelligent protection method based on the endogenous security mechanism: Based on the risk assessment value R, calculate the rule strength ACL of access control, and the calculation formula is:

[0053] ACL = ρ × R + A

[0054] Among them, ρ is the coefficient of the rule strength of the ACL, and its value ranges from [1, 5]; A is the rule strength value of the basic ACL, and its value ranges from [1, 3].

[0055] The rule strength thresholds include the rule strength threshold one ACL1 and the rule strength threshold two ACL2:

[0056] When 0 ≤ ACL < ACL1, record the abnormal network traffic but do not block it;

[0057] When ACL1 ≤ ACL < ACL2, perform traffic rate limiting;

[0058] When ACL ≥ ACL2, completely block the traffic.

[0059] In the preferred solution of the above network security intelligent protection method based on the endogenous security mechanism: the method for detecting the intrusion detection and prevention system is:

[0060] The network traffic historical data also includes the initial detection sensitivity S0. The detection sensitivity S is calculated according to the initial detection sensitivity S0, and the formula is:

[0061]

[0062] Among them, is the influence coefficient of the rule strength ACL, and its value ranges from 0 to 1;

[0063] Preset the detection sensitivity threshold. The detection sensitivity threshold includes the detection sensitivity threshold one S low and the detection sensitivity threshold two S high , and S low < S high :

[0064] When S < S low , the monitoring sensitivity is low, and there is a risk of missed reports;

[0065] When S low ≤ S ≤ S high , the monitoring sensitivity is within a reasonable range;

[0066] When S > S high , the detection sensitivity is high, and the risk of false alarms increases;

[0067] Obtain the attack update frequency F z according to the update frequency of the system before adjustment, and calculate the current attack update frequency F new , and the formula is:

[0068]

[0069] Among them, Adjustment coefficient for attack update frequency F z with a value range of 0 to 1;

[0070] Preset the current attack update frequency threshold F th :

[0071] When F new ≤F th the current attack update frequency is within a reasonable range, and the network security policy operation is maintained;

[0072] When F new >F th the current attack update frequency is high, and the adjustment and update of the network security policy are accelerated.

[0073] In a preferred solution of the above network security intelligent protection method based on the endogenous security mechanism: The method for calculating the current network access control policy strength C new is as follows:

[0074] The network traffic historical data also includes the network access control policy strength C;

[0075] Calculate the current network access control policy strength C new based on the network access control policy strength C, and the formula is:

[0076] C new = C + ω1×S + ω2×log(F + ε)

[0077] where ω1 is the adjustment coefficient of the detection sensitivity S, with a value range of 0.4 to 0.5; ω2 is the adjustment coefficient of the current attack update frequency F new with a value range of 0.5 to 0.6; and ω1 + ω2 = 1; ε is a positive number;

[0078] If C new ≥C, strengthen the access control policy; if C new <C, relax the access control policy.

[0079] The present invention also discloses a network security intelligent protection system based on the endogenous security mechanism for implementing the above network security intelligent protection method based on the endogenous security mechanism, including:

[0080] A traffic monitoring module for obtaining real-time data of monitored network traffic and network traffic historical data;

[0081] An anomaly judgment module for calculating the traffic mutation index F m the protocol anomaly index P a and the port anomaly index Port a, and make abnormal judgments respectively; when one of the indicators is abnormal, according to the traffic mutation indicator F m , Protocol Abnormal Index P a and port abnormality indicator Port a Calculate the comprehensive abnormal index I, preset the comprehensive abnormal index threshold, compare the comprehensive abnormal index I with the comprehensive abnormal index threshold, and judge the abnormal state of network traffic; when the network traffic is seriously abnormal, immediately trigger the inherent security mechanism for protection;

[0082] The endogenous security analysis module is used to calculate the risk assessment value R based on the historical data of network traffic; calculate the rule strength ACL of access control based on the risk assessment value R, preset the rule strength threshold, compare the rule strength ACL with the rule strength threshold, and take different measures for abnormal network traffic based on the comparison results; calculate the detection sensitivity S and the current attack update frequency F based on the historical data of network traffic new , based on the detection sensitivity S to evaluate the monitoring sensitivity state; based on the current attack update frequency F new Adjust network security policies; calculate the current network access control policy strength C based on historical network traffic data new , and based on the current network access control policy strength C new Adjust access control policies.

[0083] (III) Beneficial effects

[0084] The present invention provides a network security intelligent protection method and system based on an intrinsic security mechanism, which has the following beneficial effects:

[0085] (1) Real-time monitoring of network traffic data can promptly detect abnormal traffic in the network, so that countermeasures can be taken quickly to reduce security risks;

[0086] (2) Calculating multiple indicators of network traffic data can comprehensively and accurately identify various anomalies in network traffic; setting a comprehensive anomaly indicator I can evaluate the health of network traffic as a whole and avoid misjudgment of a single indicator; furthermore, the comparison of preset thresholds provides a clear quantitative standard for judging anomalies, making the judgment process more scientific and objective; finally, when serious anomalies are found, the inherent security mechanism is triggered in time for protection, which can quickly respond to network threats, protect the security and stable operation of the network system, and reduce the risks of data leakage and service interruption that may be caused by network attacks or abnormal traffic, thereby protecting user rights and interests and the normal development of network-related businesses;

[0087] (3) Calculating risk assessment values ​​based on historical network traffic data makes the judgment of abnormal traffic more scientific and accurate, and can better identify potential risks; determining the strength of access control rules based on risk assessment values, and then taking different measures after comparing with the threshold, helps to achieve refined management of abnormal traffic, avoiding excessive restrictions on normal access and effectively preventing risks; testing the intrusion detection and defense system and calculating relevant parameters to determine the strength of network access control policies can enable network security policies to closely adapt to the dynamic changes of network attacks and improve the network's ability to respond to attacks; real-time updating of network access control policies can ensure that network security protection is always maintained in the best state, effectively prevent network intrusions, and ensure the security, stability of the network, and the integrity and confidentiality of data. BRIEF DESCRIPTION OF THE DRAWINGS

[0088] Figure 1 A schematic diagram of the steps of a network security intelligent protection method based on an intrinsic security mechanism of the present invention; DETAILED DESCRIPTION

[0089] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0090] See also Figure 1 The present invention provides a network security intelligent protection method based on an intrinsic security mechanism, comprising the following steps:

[0091] Step 1: Obtain real-time data and historical data of network traffic;

[0092] Step 101: Deploy traffic monitoring devices at key nodes of the network using a distributed sensor network to collect network traffic data in real time, including source IP address, destination IP address, port number, protocol type, packet size, traffic rate and other information.

[0093] Real-time monitoring of network traffic data can promptly detect abnormal traffic in the network, which helps to quickly locate and resolve potential network security issues. Secondly, it can help network administrators better understand network usage in order to make reasonable resource allocation and optimization. Furthermore, by continuously monitoring network traffic data, network performance can be evaluated in real time, network congestion, delays and other problems can be discovered in a timely manner, and corresponding measures can be taken to improve network stability and reliability.

[0094] Step 2: Calculate the traffic mutation index F based on real-time network traffic data m, Protocol Abnormal Index P a and port abnormality indicator Port a , and make abnormal judgments respectively; when one of the indicators is abnormal, according to the traffic mutation indicator F m , Protocol Abnormal Index P a and port abnormality indicator Port a Calculate the comprehensive anomaly index I, preset the comprehensive anomaly index threshold, compare the comprehensive anomaly index I with the comprehensive anomaly index threshold, and judge the abnormal state of network traffic; when the network traffic is seriously abnormal, immediately trigger the inherent security mechanism for protection.

[0095] Step 201: Within a unit time T, the network traffic size F9t) at each time point t is recorded in chronological order through the Nagios network monitoring tool, and the average network traffic F avg , the formula based on is:

[0096]

[0097] Among them, F(t) represents the network traffic size at time point t, t is the sequence number of the time point, and its value is 1, 2, 3...H, which means that the unit time T is divided into H time points, and data collection is performed once at each time point. H is the number of time points divided in the unit time T, and its value is a positive integer.

[0098] It should be noted that the principle of this formula is: The principle is to calculate the average network traffic within a unit time T; where F(t) represents the proportion of network traffic at time point t, and the network traffic at all time points within the unit time T is accumulated and summed, that is, Get the total network traffic in the entire time period; then, divide this total by the unit time T. The purpose of this is to evenly distribute the total network traffic to each time unit, so as to get the average level of network traffic in this time period, that is, the average network traffic F avg .

[0099] Step 202: Based on the average network flow F avg , calculate the flow standard deviation σ within unit time T, based on the formula:

[0100]

[0101] It should be noted that the principle of this formula is: average network traffic F avg It is obtained by summing the network traffic at all time points within a unit time T and then dividing it by the unit time T. It represents the average level of network traffic during this period. For each time point t, calculate F(t)-F avg, this step is to calculate the difference between the network traffic at each time point and the average network traffic. This difference reflects the degree of deviation of the network traffic at that time point relative to the average traffic. Square each difference to get (F(t)-F avg ) 2 The purpose of squaring is to eliminate the positive and negative signs of the difference, and at the same time make the larger deviation value have a greater weight in the calculation, because the larger deviation has a greater impact on the overall discreteness; sum the squared differences of all time points In this way, the sum of the deviations at all time points is obtained; finally, this sum is divided by the length of the time period per unit time T to obtain the average square value of the deviation; then the square root is taken to obtain the standard deviation σ; the standard deviation σ reflects the network traffic around the average network traffic F in the unit time T. avg degree of volatility.

[0102] Step 203: Obtain the current network traffic F by real-time monitoring of network traffic current , according to the average network traffic F avg and the flow standard deviation σ, calculate the flow mutation index F m , the formula based on is:

[0103]

[0104] Based on the statistical analysis of a large amount of historical network traffic data, the distribution of traffic mutation indicators is determined, and the traffic mutation indicator threshold F is preset. th , when |F m |>F th When the network traffic is abnormal, it is considered that there is a sudden change.

[0105] It should be noted that the principle of this formula is: the network traffic F at the current moment current and the average network traffic F over a period of time avg The difference between the two reflects the deviation of the current flow from the average flow; if the current flow is greater than the average flow, the difference is positive, indicating that the current flow is higher than the average level; if the current flow is less than the average flow, the difference is negative, indicating that the current flow is lower than the average level; the flow standard deviation σ measures the degree of fluctuation of network flow around the average flow over a period of time; when the numerator is large and the denominator is relatively small, F m The value of F will be larger, indicating that the current network traffic has a larger mutation compared with the average traffic; on the contrary, when the numerator is small or the denominator is large, F m The value will be smaller, indicating that the mutation of the current network traffic is not obvious.

[0106] Step 204: Select Wireshark network traffic analysis software to monitor network traffic in real time, record the data traffic proportion of each protocol, and calculate the traffic proportion P of different protocol data within a period of time. i , the formula based on is:

[0107]

[0108] Among them, F i is the traffic proportion of the i-th protocol data, i is 1, 2, 3...n; n is the number of protocols, and its value is a positive integer.

[0109] It should be noted that the principle of this formula is: This formula is used to calculate the traffic proportion of different protocol data within a period of time; it compares the traffic of a specific protocol with the total traffic of all protocols to determine the relative importance or proportion of the protocol in the overall network traffic; F i is the traffic proportion of the i-th protocol data, which reflects the amount of data transmitted by a specific protocol in a time period; represents the total traffic of all protocols, where n is the number of protocols and is a positive integer. By summing up the traffic of all protocols, the total traffic of all protocols in the network during the entire time period is obtained. i When the flow rate F of the i-th protocol is i Divide by the total traffic of all protocols This ratio indicates the proportion of the traffic of the i-th protocol in the overall network traffic.

[0110] Step 205: According to the traffic proportion P of different protocol data within a period of time i , calculate the average traffic proportion P of historical protocol data i，avg , the calculation formula is:

[0111]

[0112] in, is the traffic proportion of the i-th protocol data in the k-th historical time, where k is 1, 2, 3...M; M is the number of historical time periods, which is a positive integer;

[0113] It should be noted that the principle of this formula is: Indicates the sum of the traffic proportions of the i-th protocol data in M ​​historical time periods; represents the traffic proportion of the i-th protocol in the k-th historical time period; the traffic proportion in each historical time period reflects the relative importance or activity of the protocol in a specific time period; by summing the traffic proportions of multiple historical time periods, the performance of the protocol at different time points can be comprehensively considered; M is the number of historical time periods, which represents the total number of historical time periods used to calculate the average value; divide the numerator by the denominator to obtain the average traffic proportion P of the historical protocol data i，avg , this average value reflects the average traffic share of the i-th protocol in history; if the traffic share of the protocol in the current time period deviates greatly from the historical average, it means that the network environment has changed, or the usage of the protocol has become abnormal, and further analysis and monitoring are needed.

[0114] Step 206: Obtain the current traffic proportion P of different protocol data according to the network traffic data i，current , calculate the protocol anomaly index P a , the formula based on is:

[0115]

[0116] It should be noted that the principle of this formula is: First, for each protocol i, calculate the current traffic proportion P i，current Compared with the historical average traffic ratio P i，avg The difference reflects the deviation of the current protocol traffic share from the historical average level. The square operation (P i，current -P i，avg ) 2 This is done to ensure that the difference is always non-negative and to amplify large deviations to make abnormalities more obvious. Then, the squared differences of all protocols are summed. Finally, divide the total by the number of protocols n to get the average deviation degree, and take its square root to get the protocol anomaly index P a ,The larger the value of this indicator is, the greater the degree of deviation of the ,protocol in network traffic from the historical average level, that is, the higher possibility of ,protocol abnormality.

[0117] Step 207: Collect network traffic data over a period of time, classify and organize the data, and divide it according to different protocol types to facilitate subsequent analysis of the traffic share of each protocol; calculate the mean and standard deviation of the traffic share of each protocol in the historical time period; preset the protocol data abnormal threshold P according to the mean and standard deviation th , when P a >P th When the network traffic is detected, it is determined that there is a protocol anomaly.

[0118] Step 208: Use network monitoring tools to collect traffic data of each port and calculate the traffic proportion of the commonly used ports within a period of time. s , the calculation formula is:

[0119]

[0120] Among them, F s ′ is the traffic proportion of the sth commonly used port, and the value of s is 1, 2, 3...m; m is the number of commonly used ports, and the value is a positive integer;

[0121] It should be noted that the principle of this formula is: F s ′ is the traffic proportion of the sth commonly used port, which reflects the amount of data transmitted through the port in a specific time; It is the sum of the traffic of all commonly used ports. By adding up the traffic of all commonly used ports, the total traffic transmitted by the common ports of the entire network during the time period is obtained. s When the sth common port traffic accounts for F s ′ divided by the total traffic of all commonly used ports, the result is the traffic share of the port; this share represents the proportion of the traffic of the sth commonly used port in the traffic of all commonly used ports.

[0122] Step 209: Based on the traffic proportion of the commonly used ports within a period of time, s , calculate the average value of historical commonly used port data Port s，avg , the calculation formula is;

[0123]

[0124] in, is the traffic proportion of the sth commonly used port in the kth historical time period, and the value of k is 1, 2, 3...M;

[0125] It should be noted that the principle of this formula is: First, is the traffic proportion of the sth commonly used port in the kth historical time period; by accumulating and summing these traffic proportions in M ​​different historical time periods, that is, The sum of the traffic proportions of common ports in all historical time periods is obtained; then, this sum is divided by the number of historical time periods M to obtain the average value of the historical common port data Port s，avg This average value can reflect the overall trend and average level of the traffic proportion of commonly used ports in multiple historical time periods, which helps to analyze the changes in traffic characteristics of commonly used ports in the network. If the traffic proportion of commonly used ports in a specific time period is significantly different from the average value, it suggests that an abnormal situation has occurred in the network and further monitoring and analysis are required.

[0126] Step 210: Based on the network traffic data, obtain the current traffic proportion of each commonly used port s，current , calculate the port abnormality index Port a The formula is:

[0127]

[0128] It should be noted that the principle of this formula is: First, based on the network traffic data, obtain the current traffic proportion of each commonly used port Port s，current , which means the proportion of the traffic of the sth commonly used port in the traffic of all commonly used ports at the current specific moment; for each commonly used port s, calculate (Port s，current -Port s，avg ) 2 , sum the squares of the differences of all common ports and get This sum reflects the degree of deviation of the traffic proportion of all commonly used ports at the current moment from the historical average level. Finally, divide this sum by the number of commonly used ports m and take the square root to obtain the port abnormality index Port a ; This indicator comprehensively measures the overall abnormality of commonly used ports in the current network traffic; the larger the value, the greater the deviation of the current traffic share of commonly used ports from the historical average level, and the higher the possibility of port abnormality.

[0129] Step 211: Review the security events that occurred in the network in the past, observe the performance of the port abnormality index in these events, analyze the range of port abnormality indexes corresponding to different types of security events, and take the average value of the port abnormality index as the preset port abnormality index threshold Port th Reference, when Port a >Port th When the network traffic is abnormal, it is considered that there is a port anomaly.

[0130] Step 212: Based on the traffic mutation index F m , Protocol Abnormal Index P a and port abnormality indicator Port a , calculate the comprehensive abnormal index I, based on the formula:

[0131] I=α×F m +β×P a +γ×Port a

[0132] Among them, α is the traffic mutation index F m The weight coefficient is 0.1 to 0.3; β is the protocol abnormality index P aThe weight coefficient has a value ranging from 0.3 to 0.4; γ is the port anomaly index Port a The weight coefficient has a value ranging from 0.3 to 0.5; and α + β + γ = 1.

[0133] It should be noted that the principle of this formula is as follows: This formula aims to construct a comprehensive network anomaly index I; among them, the traffic mutation index F m reflects the sudden change of network traffic within a period of time. If the traffic mutation is large, it implies abnormal events such as a sudden large amount of data transmission or a network attack in the network; the protocol anomaly index P a measures whether the use of different protocols in the network deviates from the normal mode. When the traffic ratio of a certain protocol is abnormal, there may be attacks against specific protocols or network configuration problems; the port anomaly index Port a evaluates whether the traffic ratio of common ports in the network is abnormal. Abnormal port traffic may mean security issues such as port scanning or malware using specific ports; the weight coefficients α, β, and γ are used to adjust the importance of the traffic mutation index, protocol anomaly index, and port anomaly index in the comprehensive index respectively; by multiplying the three indexes by their corresponding weight coefficients and then adding them together, the obtained comprehensive network anomaly index I can reflect the current security state of the network.

[0134] Step 213: Collect network traffic data for a period of time, calculate the mean and standard deviation of the comprehensive anomaly index in historical data, and determine the boundaries of the normal range according to a certain confidence interval, so as to obtain the first threshold I1. For severely abnormal situations, analyze the comprehensive anomaly index values when major network security events occurred in history, and use this to determine the second threshold I2;

[0135] Preset the first threshold I1 and the second threshold I2 for the comprehensive anomaly index of network traffic, and I1 < I2:

[0136] When I ≤ I1, the network traffic is normal;

[0137] When I1 < I ≤ I2, the network traffic is mildly abnormal, and an email, text message, or system notification is sent;

[0138] When I > I2, the network traffic is severely abnormal, and the endogenous security mechanism is started for protection.

[0139] By calculating the traffic mutation index, protocol anomaly index and port anomaly index, and making anomaly judgments respectively, the status of network traffic can be comprehensively monitored from different angles. This helps to discover potential security issues in a timely manner, whether it is a sudden change in traffic, abnormal behavior of the protocol or suspicious activity of the port, it can be accurately identified. When one of the indicators is abnormal, the comprehensive anomaly index I is further calculated and compared with the preset threshold, which can more comprehensively evaluate the abnormal state of network traffic and avoid the limitations of single indicator judgment. When the network traffic is seriously abnormal, the endogenous security mechanism is immediately triggered for protection, which can quickly respond to security threats and minimize potential losses. This multi-indicator monitoring and rapid protection mechanism can improve the security and stability of the network, ensure the normal operation of the network and the continuity of business, and provide users with a reliable network environment.

[0140] Step 3: Calculate the risk assessment value R based on the historical data of network traffic; calculate the rule strength ACL of access control based on the risk assessment value R, preset the rule strength threshold, compare the rule strength ACL with the rule strength threshold, and take different measures for abnormal network traffic based on the comparison results; calculate the detection sensitivity S and the current attack update frequency F based on the historical data of network traffic new , based on the detection sensitivity S to evaluate the monitoring sensitivity state; based on the current attack update frequency F new Adjust network security policies; calculate the current network access control policy strength C based on historical network traffic data new , and based on the current network access control policy strength C new Adjust access control policies.

[0141] Step 301: Establish a known malicious IP address database, compare the source IP address with the malicious address database, and assign a corresponding risk score S according to the malicious degree of the match. IP ; Classify various network protocols and determine their security levels. For example, secure protocols such as HTTPS can be assigned lower risk scores, while some old or easily attacked protocols are assigned higher risk scores. When the protocol type in the network traffic is monitored, the corresponding risk score S is assigned according to the classification of the protocol. Protocol ; Establish a high-risk port list and a low-risk port list. When a port in the network traffic is monitored, it is compared with the port list and a corresponding risk score S is assigned. Port ; Determine the risk score S by analyzing the time distribution of network traffic, traffic size change trend, data packet distribution and other characteristics TrafficPattern ;

[0142] Step 302: Risk score S of the acquired source IP address IP , Risk score S of protocol type Protocol , port risk score SPort and the risk score S of the traffic pattern TrafficPattern , calculate the risk assessment value R, based on the formula:

[0143] R=λ×S IP +μ×S Protocol +ν×S Port +ξ×S TrafficPattern

[0144] Where λ is the risk score S of the IP address IP The weight coefficient is 0.2 to 0.4; μ is the risk score S of the protocol type. Protocol The weight coefficient is 0.1 to 0.4; ν is the risk score S of the port Port The weight coefficient is 0.2 to 0.4; ξ is the risk score S of the traffic pattern. Tra The weight coefficient is between 0.2 and 0.3; and λ+μ+ν+ξ=1.

[0145] It should be noted that the principle of this formula is as follows: This formula is designed to comprehensively evaluate the security risks of the network; it is based on historical network traffic data and considers the risks of four key aspects: source IP address, protocol type, port, and traffic pattern; the risk score S for the source IP address is IP , which reflects the potential danger of a specific IP in historical data; the risk score S of the protocol type Protocol Measures the risk level of different protocols in network traffic. Some protocols that are vulnerable to attacks or have security vulnerabilities will have corresponding risk values. The risk score of the port S Port Assess the risk of different ports in network traffic. Some commonly attacked ports or ports related to high-risk applications will have specific risk scores; the risk score of the traffic pattern is S TrafficPattern It reflects whether the pattern of network traffic is abnormal; the weight coefficients λ, μ, ν and ξ in the formula respectively adjust the importance of each risk score in the overall risk assessment; the final risk assessment value R is obtained by multiplying the score of each risk factor by the corresponding weight coefficient and adding them together. A lower R value means that the network has less risk in all aspects and a better security status; a higher R value indicates that the network may have higher risks in terms of source IP address, protocol, port or traffic pattern, and further analysis and corresponding security measures are needed.

[0146] Step 303: Based on the risk assessment value R, the rule strength ACL of the access control is calculated using the following formula:

[0147] ACL=ρ×R+A

[0148] Among them, ρ is the coefficient of the rule strength ACL, and its value ranges from [1, 5]; A is the rule strength value of the basic ACL, and its value ranges from [1, 3].

[0149] It should be noted that the principle of this formula is as follows: This formula aims to determine the rule strength ACL of access control for the network security intelligent protection method based on the endogenous security mechanism. Among them, the risk assessment value R is a quantitative reflection of the current network security risk situation, which comprehensively considers various factors; the coefficient ρ takes values in the range of [1, 5], and its role is to adjust the influence degree of the risk assessment value on the final access control rule strength. When the value of ρ is relatively large, it indicates that it is more sensitive to risks, and the influence of the risk assessment value on the rule strength is greater, meaning that once a higher risk is detected, the access control will become more stringent; the rule strength value A of the basic ACL is within the range of [1, 3], which represents the default rule strength level without considering specific risk assessments and provides a basic guarantee for access control; by multiplying the risk assessment value by the coefficient, a rule strength increment based on the current risk situation is obtained, and then adding the basic rule strength value, the access control rule strength adapted to the current network security state can be determined.

[0150] Step 304: Collect network traffic data and security event records with a long time span from the intrusion detection system, analyze various security events that occurred in history, and determine the numerical values of the access control rule strength when these events occurred; calculate the statistical indicators of the occurrence frequency and impact degree of security events under different rule strengths, and according to the results of statistical analysis, preset the rule strength ACL thresholds, including rule strength threshold one ACL1 and rule strength threshold two ACL2:

[0151] When 0 ≤ ACL < ACL1, record the abnormal network traffic but do not block it;

[0152] When ACL1 ≤ ACL < ACL2, take traffic speed limiting; first limit the traffic speed to 50% of the original speed, and if the situation does not improve, further reduce the speed;

[0153] When ACL ≥ ACL2, completely block the traffic, start the emergency response process, further investigate and analyze the source and method of the attack, and take recovery measures, etc.

[0154] Step 305: Analyze the historical data of network traffic in the past period of time, including normal traffic and known attack traffic; obtain the initial detection sensitivity S0 by observing the performance of the intrusion detection and prevention system in different situations.

[0155] Step 306: The method for detecting the intrusion detection and prevention system is as follows:

[0156] According to the initial detection sensitivity S0, calculate the detection sensitivity S, and the formula based on it is:

[0157]

[0158] in, The influence coefficient of the rule strength ACL ranges from 0 to 1.

[0159] It should be noted that the principle of this formula is as follows: the formula is used to calculate the detection sensitivity of the intrusion detection and defense system; the purpose of this formula is to dynamically adjust the detection sensitivity according to the rule strength of the access control ACL to improve the system's detection ability for network security threats; S0 represents the initial detection sensitivity determined based on historical network traffic data; it reflects the basic detection capability of the system without considering the current rule strength; is the influence coefficient of rule strength ACL, ranging from 0 to 1. This coefficient is used to adjust the influence of rule strength on detection sensitivity. When it is close to 0, the rule strength has little effect on the detection sensitivity; when When it is close to 1, the rule strength has a greater impact on the detection sensitivity; ACL is the rule strength of access control, which is calculated based on the risk assessment value; the higher the rule strength, the greater the security risk faced by the network; the initial detection sensitivity S0 and the rule strength ACL are multiplied by the influence coefficient The results are added to get the current detection sensitivity S; when the rule strength ACL increases, if If is larger, the detection sensitivity S will also increase accordingly, which means that the system will detect potential security threats more sensitively.

[0160] Step 307: Collect the number of attacks, false alarms, and missed alarms of the intrusion detection and defense system in the past period of time, observe the comparison between the actual security events and the system detection results in different time periods when the detection sensitivity is at different levels; calculate the missed alarm rate and false alarm rate under different detection sensitivities; through the analysis of a large amount of historical data, preset the detection sensitivity S threshold, including the detection sensitivity threshold three S low and the detection sensitivity threshold 4S high , and S low high :

[0161] When S low When the monitoring sensitivity is low, there is a risk of underreporting;

[0162] When S low ≤S≤S high When the monitoring sensitivity is within a reasonable range;

[0163] When S>S high When the detection sensitivity is high, the risk of false alarm increases.​​

[0164] Step 308: Obtain the attack update frequency F according to the update frequency when the system is in normal operation and no adjustment is performed z , calculate the current attack update frequency F new The formula is:

[0165]

[0166] in, is the attack update frequency F z The adjustment coefficient ranges from 0 to 1.

[0167] It should be noted that the principle of this formula is: the formula is used to calculate the current attack update frequency; the purpose of this formula is to dynamically adjust the attack update frequency according to the risk assessment value so that the system can respond to changing security threats more promptly; F z It is the update frequency of the system without considering the risk assessment value, which serves as the basis for calculating the current attack update frequency; is the attack update frequency adjustment coefficient, ranging from 0 to 1. This coefficient is used to adjust the impact of the risk assessment value on the attack update frequency. When it is close to 0, the risk assessment value has little impact on the attack update frequency; when When it is close to 1, the risk assessment value has a greater impact on the attack update frequency; the higher the risk assessment value, the greater the security risk faced by the network; in the formula, the risk assessment value is multiplied by the update frequency adjustment coefficient, and then 1 is added to multiply it by the basic update frequency, thereby increasing the attack update frequency; first calculate This value represents the adjustment factor of the basic update frequency after considering the risk assessment value, and then the current attack update frequency F z Multiply it by the adjustment factor to get the attack update frequency F new .

[0168] Step 309: Collect the attack update frequency data of the system under different security states in the past period of time, perform statistical analysis on the historical data, determine the distribution of attack update frequencies under different security states, and preset the current attack update frequency F according to the results of the statistical analysis. new Threshold F th :

[0169] When F new ≤F th When the current attack update frequency is within a reasonable range, the system runs stably;

[0170] When F new >F th At the same time, the current attack update frequency is high, which accelerates the adjustment and update of network security strategies.

[0171] Step 310: Analyze the implementation of the network access control policy, the corresponding security events, and the network status over a past period of time to obtain the historical strength C of the network access control policy, and calculate the current strength C of the network access control policy new , and the formula used is:

[0172] C new = C + ω1S + ω2log(F + ε)

[0173] where ω1 is the adjustment coefficient of the detection sensitivity S, with a value range of 0.4 - 0.5; ω2 is the adjustment coefficient of the current attack update frequency F new with a value range of 0.5 - 0.6; and ω1 + ω2 = 1; ε is a positive number;

[0174] If C new ≥ C, strengthen the access control policy; if C new < C, relax the access control policy.

[0175] It should be noted that the principle of this formula is as follows: The formula is used to calculate the current strength of the network access control policy; the purpose of this formula is to comprehensively consider factors such as the historical strength of the access control policy, detection sensitivity, and attack update frequency, and dynamically adjust the access control policy to improve network security; C represents the strength of the network access control policy at other historical moments obtained based on historical data; it is the basis for calculating the strength of the new policy; ω1 is the adjustment coefficient of the detection sensitivity S, with a value range of 0.4 - 0.5; it is used to adjust the influence degree of the detection sensitivity on the strength of the access control policy; when the detection sensitivity is high, it indicates that the system has a strong perception ability of security threats, and the access control policy may need to be strengthened; therefore, the product of the detection sensitivity S and the adjustment coefficient ω1 will increase the strength of the access control policy; ω2 is the adjustment coefficient of the current attack update frequency F new with a value range of 0.5 - 0.6; it is used to adjust the influence degree of the attack update frequency on the strength of the access control policy; first, add a positive number ε to the current attack update frequency F new to avoid the situation where the logarithmic function is undefined when the attack update frequency is 0; then, take the logarithm of (F new + ε), and multiply it by the adjustment coefficient ω2; when the attack update frequency is high, it indicates that the security threats faced by the network are constantly changing, and a more stringent access control policy is required; therefore, the product of the logarithm of the attack update frequency and the adjustment coefficient ω2 will also increase the strength of the access control policy.

[0176] Adjusting network security policies according to the current attack update frequency can make the network security protection system more flexible to deal with changing security threats and improve the adaptability and effectiveness of the system. Calculating the current network access control policy strength based on historical network traffic data and adjusting the access control policy accordingly can achieve dynamic management of network resources, ensure that the network is always in the best security protection state, and provide strong guarantee for the stable operation of the network and the smooth development of business.

[0177] On the other hand, the present invention also discloses a network security intelligent protection system based on an intrinsic security mechanism, which is used to implement the network security intelligent protection method of the intrinsic security mechanism, including:

[0178] Traffic monitoring module, used to obtain real-time data and historical data of network traffic;

[0179] The abnormal judgment module is used to calculate the traffic mutation index F based on the real-time network traffic data. m , Protocol Abnormal Index P a and port abnormality indicator Port a , and make abnormal judgments respectively; when one of the indicators is abnormal, according to the traffic mutation indicator F m , Protocol Abnormal Index P a and port abnormality indicator Port a Calculate the comprehensive abnormal index I, preset the comprehensive abnormal index threshold, compare the comprehensive abnormal index I with the comprehensive abnormal index threshold, and judge the abnormal state of network traffic; when the network traffic is seriously abnormal, immediately trigger the inherent security mechanism for protection;

[0180] The endogenous security analysis module is used to calculate the risk assessment value R based on the historical data of network traffic; calculate the rule strength ACL of access control based on the risk assessment value R, preset the rule strength threshold, compare the rule strength ACL with the rule strength threshold, and take different measures for abnormal network traffic based on the comparison results; calculate the detection sensitivity S and the current attack update frequency F based on the historical data of network traffic new , based on the detection sensitivity S to evaluate the monitoring sensitivity state; based on the current attack update frequency F new Adjust network security policies; calculate the current network access control policy strength C based on historical network traffic data new , and based on the current network access control policy strength C new Adjust access control policies.

[0181] The above embodiments may be implemented in whole or in part by software, hardware, firmware or any other combination thereof. When implemented using software, the above embodiments may be implemented in whole or in part in the form of a computer program product. A person of ordinary skill in the art may appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein may be implemented in electronic hardware or in combination with computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution.

[0182] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0183] The above description is only a specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application.

Claims

1. A network security intelligent protection method based on an intrinsic security mechanism, characterized by: include: Obtain real-time data and historical data of network traffic; Calculate traffic mutation indicators based on real-time network traffic data , Protocol Abnormality Indicators and port abnormality indicators , and make abnormal judgments respectively; Calculating protocol anomaly indicators The method is as follows: Calculate the traffic proportion of different protocol data within a period of time , the formula based on is: ； in, is the traffic proportion of the i-th protocol data, i is 1, 2, 3...n; n is the number of protocols, which is a positive integer; Calculate the average traffic percentage of historical protocol data , the calculation formula is: ； in, is the traffic proportion of the i-th protocol data in the k-th historical time, where k is 1, 2, 3...M; M is the number of historical time periods, which is a positive integer; Get the traffic proportion of different protocol data at the current moment , calculate the protocol anomaly index , the formula based on is: ； Preset protocol data anomaly threshold ,when When the network traffic has protocol anomalies, the protocol anomaly index is calculated. The method is as follows: Calculate the traffic proportion of different protocol data within a period of time , the formula based on is: ； in, is the traffic proportion of the i-th protocol data, i is 1, 2, 3...n; n is the number of protocols, which is a positive integer; Calculate the average traffic percentage of historical protocol data , the calculation formula is: ； in, is the traffic proportion of the i-th protocol data in the k-th historical time, where k is 1, 2, 3...M; M is the number of historical time periods, which is a positive integer; Get the traffic proportion of different protocol data at the current moment , calculate the protocol anomaly index , the formula based on is: ； Preset protocol data anomaly threshold ,when When the network traffic is detected, it is determined that there is a protocol anomaly; Calculate port abnormality indicators The method is as follows: Calculate the traffic proportion of common ports within a period of time , the calculation formula is: ； in, For the The traffic proportion of commonly used ports, The value of is 1, 2, 3... ; is the number of commonly used ports, which must be a positive integer; Calculate the average value of historical common port data , the formula based on is: ； in, is the traffic proportion of the sth commonly used port in the kth historical time period, and the value of k is 1, 2, 3...M; Monitor network traffic data in real time to obtain the traffic proportion of different commonly used ports at the current moment , calculate the port abnormality index , the formula based on is: ； Preset port abnormality indicator threshold ,when When the network traffic is abnormal, it is considered that there is a port anomaly; When one of the indicators is abnormal, according to the traffic mutation indicator , Protocol Abnormality Indicators and port abnormality indicators The formula for calculating the comprehensive abnormal index I is: ； in, Traffic mutation indicator The weight coefficient is between 0.1 and 0.3; Protocol abnormality indicator The weight coefficient is 0.3~0.4; Port abnormality indicator The weight coefficient is between 0.3 and 0.5; + + =1; Preset the comprehensive abnormal index threshold, compare the comprehensive abnormal index I with the comprehensive abnormal index threshold, and judge the abnormal state of network traffic; when the network traffic is seriously abnormal, immediately trigger the inherent security mechanism for protection; Calculate risk assessment value based on historical network traffic data ; Network traffic history data including risk scores of source IP addresses , Risk score of protocol type , port risk score and risk scores for traffic patterns ; Calculate risk assessment value based on historical network traffic data , the formula based on is: ； in, Risk score for the source IP address The weight coefficient is between 0.2 and 0.4; Risk score for protocol type The weight coefficient is between 0.1 and 0.4; Risk score for the port The weight coefficient is between 0.2 and 0.4; Score the risk of traffic patterns The weight coefficient is between 0.2 and 0.3; and + + + =1; According to the risk assessment Calculating access control rule strength , the calculation formula is: ； in, The coefficient of the rule strength ACL, the value is ; The rule strength value of the basic ACL. ; Preset rule strength threshold to set the rule strength Compare with the rule strength threshold and take different measures for abnormal network traffic based on the comparison results; Calculate detection sensitivity S and current attack update frequency based on historical network traffic data , the network traffic history data also includes the initial detection sensitivity , according to the initial detection sensitivity The calculation of detection sensitivity S is based on the formula: ； in, Rule Strength The influence coefficient of is between 0 and 1; Get the attack update frequency based on the system's update frequency when no adjustments are made , and calculate the current attack update frequency , the formula based on is: ； in, Update frequency for attacks The adjustment coefficient is between 0 and 1; Evaluate monitoring sensitivity based on detection sensitivity S; update frequency based on current attack Adjust network security policies; calculate the strength of current network access control policies based on historical network traffic data , and based on the strength of the current network access control policy Adjust access control policies; calculate the strength of current network access control policies The method is: Network traffic history data also includes network access control policy strength ; According to the strength of network access control policy Calculate the current network access control policy strength , the formula based on is: ； in, It is the adjustment coefficient of the detection sensitivity S, and its value is 0.4~0.5; Update frequency for current attacks The adjustment coefficient is between 0.5 and 0.6; and + =1; is a positive number; like , strengthen the access control strategy; if , relax the access control policy.

2. According to claim 1, a network security intelligent protection method based on an intrinsic security mechanism is characterized by: The comprehensive abnormal index threshold includes the abnormal index first threshold and the second threshold of abnormal indicators ,and : when When , the network traffic is normal; when When the network traffic is slightly abnormal, early warning measures are issued; when When the network traffic is seriously abnormal, the inherent security mechanism is activated for protection.

3. According to claim 2, a network security intelligent protection method based on an intrinsic security mechanism is characterized by: The rule strength threshold includes rule strength threshold 1 ACL1 and rule strength threshold 2 ACL2: when 1: Record abnormal network traffic but do not block it; when When the traffic speed is limited, when When the device is in use, the traffic is completely blocked.

4. The method of network security intelligent protection based on the intrinsic security mechanism according to claim 3 is characterized by: The methods for testing the intrusion detection and prevention system are: The detection sensitivity threshold is preset, and the detection sensitivity threshold includes the detection sensitivity threshold one and detection sensitivity threshold 2 ,and : when When the monitoring sensitivity is low, there is a risk of underreporting; when When the monitoring sensitivity is within a reasonable range; when When the detection sensitivity is high, the risk of false alarm increases; Preset current attack update frequency threshold : when When the attack update frequency is within a reasonable range, the network security strategy is maintained; when At the same time, the current attack update frequency is high, which accelerates the adjustment and update of network security strategies.

5. A network security intelligent protection system based on an intrinsic security mechanism, characterized by: The method for implementing the network security intelligent protection method based on the intrinsic security mechanism described in any one of claims 1 to 4 above comprises: Traffic monitoring module, used to obtain real-time data and historical data of network traffic; Anomaly judgment module, used to calculate traffic mutation indicators based on real-time network traffic data , Protocol Abnormality Indicators and port abnormality indicators , and make abnormal judgments respectively; when one of the indicators is abnormal, according to the traffic mutation indicator , Protocol Abnormality Indicators and port abnormality indicators Calculate the comprehensive abnormal index I, preset the comprehensive abnormal index threshold, compare the comprehensive abnormal index I with the comprehensive abnormal index threshold, and judge the abnormal state of network traffic; when the network traffic is seriously abnormal, immediately trigger the inherent security mechanism for protection; Endogenous security analysis module, used to calculate risk assessment values ​​based on historical network traffic data ; Based on risk assessment value Calculating access control rule strength , preset the rule strength threshold, and set the rule strength Compare with the rule strength threshold, and take different measures for abnormal network traffic according to the comparison results; calculate the detection sensitivity S and the current attack update frequency based on the historical network traffic data , based on the detection sensitivity S to evaluate the monitoring sensitivity state; based on the current attack update frequency Adjust network security policies; calculate the strength of current network access control policies based on historical network traffic data , and based on the strength of the current network access control policy Adjust access control policies.

Images