A real-time network security threat early warning analysis method and system

Abstract

The present invention discloses a real-time network security threat early warning analysis method and system, and relates to the field of network security technology. The real-time network security threat early warning analysis method continuously obtains historical transmission data of several historical periods of network information transmission and current transmission data of the current period, and performs preprocessing; performs data analysis on the historical transmission data of each historical period of network information transmission after preprocessing, and obtains a historical transmission data set of network information transmission. The present invention dynamically generates a network security threat assessment value by integrating the current network stability and security indicators, and implements graded early warning accordingly, so that the security strategy can be adjusted according to the real-time changes of the network status. This dynamic risk assessment and graded response mechanism can take the most appropriate protective measures for different levels of threats, improve resource utilization efficiency and reduce unnecessary operational intervention, making network security management more efficient and economical.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a real-time network security threat early warning analysis method and system. Background Art

[0002] With the rapid development of information technology, network security threats are becoming increasingly serious. The means and forms of network attacks are constantly evolving, posing huge security risks to various organizations and individuals. Traditional network security protection measures have become difficult to cope with complex and changeable attack behaviors. The frequency of network security incidents has increased significantly, bringing significant impacts on social and economic development.

[0003] At present, the sources of network security threats mainly include malware, phishing, distributed denial of service attacks (DDoS), data leakage, etc. Attackers use various technical means to exploit vulnerabilities and security flaws in network systems to launch attacks, resulting in data loss, service interruptions and damage to brand reputation. At the same time, the concealment and complexity of attack behaviors make it increasingly difficult to detect and respond in a timely manner.

[0004] Prior art, such as the invention patent application with announcement number: CN112217803A, discloses a real-time network security threat early warning analysis method and its device. The real-time network security threat early warning analysis method includes the following steps: 1) Establish a sound network security management system; 2) Encrypt data and database; 3) Real-time database and cloud computing interact to perform security early warning analysis and processing on data; 4) Isolate risky data and issue warnings to terminals; 5) Risky data can be comprehensively analyzed and evaluated in combination with historical data and the latest technology, and network security threats can be displayed in real time in the form of a map to give terminal warnings; 6) Risk-free data passes through the firewall of the network terminal system. The present invention belongs to the field of network security technology, and specifically refers to a real-time network security threat early warning analysis method and its device that detects user and service terminal equipment information security data in real time, and interconnects security protection information to form a multi-faceted fusion correlation analysis of the system.

[0005] Based on the above solution, it is found that the limitations of the existing technology include at least the following problems. First, the existing technology is relatively passive in real-time network security analysis, and mainly reacts by analyzing the logs of security incidents that have occurred. This method is difficult to effectively foresee and defend against unknown or ongoing threats. This passive security situation awareness and lack of linkage warning capabilities mean that once a network attack is detected, it is easy to cause irreparable losses. Secondly, the existing technology lacks the ability to effectively integrate and correlate multi-dimensional information security data, making it difficult to achieve the synergistic effect of security data, resulting in security defense facilities being difficult to fully resist multi-faceted security threats, thereby limiting security monitoring data from becoming an effective resource for upper-level security decision-making. Summary of the invention

[0006] In view of the deficiencies in the prior art, the present invention provides a real-time network security threat early warning analysis method and system, which solves the problem that the prior art is relatively passive in real-time network security analysis and mainly reacts by analyzing logs of security incidents that have occurred. This method is difficult to effectively foresee and defend against unknown or ongoing threats. This passive security situation awareness and lack of linkage early warning capabilities mean that once a network attack is detected, it is easy to cause irreparable losses. Secondly, the prior art lacks the ability to effectively integrate and correlate multi-dimensional information security data, making it difficult to achieve the synergistic effect of security data, resulting in security defense facilities being difficult to fully resist multi-faceted security threats, thereby limiting the problem of security monitoring data becoming an effective resource for upper-level security decision-making.

[0007] To achieve the above objectives, the present invention is implemented through the following technical solutions: a real-time network security threat warning analysis method, comprising the following steps: continuously acquiring historical transmission data of several historical time periods of network information transmission and current transmission data of the current time period, and performing preprocessing; performing data analysis on the historical transmission data of each historical time period of the preprocessed network information transmission to obtain a historical transmission data set of the network information transmission; analyzing the current transmission data of the current time period of the preprocessed network information transmission with the historical transmission data set to obtain a current network stability index and a current network security index of the network information transmission, and performing a comprehensive analysis to obtain a current network security threat assessment value of the network information transmission; comparing and analyzing the current network security threat assessment value of the network information transmission with a preset network security threat assessment threshold, and taking corresponding threat warning measures based on the comparison and analysis results, wherein the security threat assessment threshold includes a first security threat assessment threshold and a second security threat assessment threshold.

[0008] Furthermore, the historical transmission data specifically includes historical transmission rate values, historical connection request quantity values, historical delay time values, historical packet loss rate values, historical data volume values ​​of each encrypted data packet of each encryption protocol, and historical data volume values ​​of each unencrypted data packet of each unencrypted protocol; the current transmission data specifically includes current transmission rate values, current connection request quantity values, current delay time values, current packet loss rate values, current data volume values ​​of each encrypted data packet of each encryption protocol, and current data volume values ​​of each unencrypted data packet of each unencrypted protocol; the historical transmission data set specifically includes historical transmission rate value benchmark values, historical connection request quantity value benchmark values, historical delay time benchmark values, historical packet loss rate benchmark values, historical encrypted data benchmark values, and historical unencrypted data benchmark values.

[0009] Furthermore, the specific steps for obtaining the historical transmission data set of network information transmission are as follows: combine the moving exponential average method to analyze the historical transmission rate value, historical connection request quantity value, historical delay time value, historical packet loss rate value, historical data volume value of each encrypted data packet of each encryption protocol, and historical data volume value of each unencrypted data packet of each unencrypted protocol for each historical period of network information transmission, and obtain the historical transmission rate value benchmark value, historical connection request quantity value benchmark value, historical delay time benchmark value, historical packet loss rate value benchmark value, historical encrypted data benchmark value, and historical unencrypted data benchmark value of network information transmission, and mark them as the historical transmission data set of network information transmission.

[0010] Furthermore, the specific formula for calculating the historical transmission rate value benchmark value of network information transmission is as follows:

[0011]

[0012] Among them, LcJ is the historical transmission rate benchmark value of network information transmission, LcS t is the historical transmission rate value of the tth historical period of network information transmission, LcS t-1 is the historical transmission rate value of the t-1th historical period of network information transmission, LmJ is the historical encryption data benchmark value of network information transmission, JmS tij is the historical data volume of the jth encrypted data packet of the i-th encryption protocol in the t-th historical period of network information transmission, JmS (t-1)ij It is the historical data volume value of the jth unencrypted data packet of the ith unencrypted protocol in the t-1th historical period of network information transmission, t=1,2,3,…,t0, t0 is the number of historical periods, i=1,2,3,…,i0, i0 is the type of encryption protocol, j=1,2,3,…,j0, j0 is the number of encrypted data packets.

[0013] Furthermore, the specific steps for obtaining the network stability index of network information transmission are as follows: read the historical transmission rate value benchmark value, the historical delay time benchmark value, and the historical packet loss rate value benchmark value in the historical transmission data set of network information transmission; analyze the current transmission rate value, current delay, and current packet loss rate value of the current period of network information transmission with the historical transmission rate value benchmark value, the historical delay time benchmark value, and the historical packet loss rate value benchmark value respectively to obtain the current transmission rate value change value, the current delay change value, and the current packet loss rate value change value of the network information transmission; conduct a comprehensive analysis of the current transmission rate value change value, the current delay change value, and the current packet loss rate value change value of the network information transmission to obtain the network stability index of the network information transmission.

[0014] Furthermore, the specific formulas for calculating the transmission rate change value, current delay change value, current packet loss rate change value, and current network stability index of network information transmission are as follows: Among them, CsB is the current transmission rate value change value of network information transmission, DsC is the current transmission rate value of the current period of network information transmission, LcJ is the historical transmission rate value benchmark value of network information transmission, YcB is the current delay change value of network information transmission, DyC is the current delay time value of the current period of network information transmission, YcJ is the historical delay time benchmark value of network information transmission, DaB is the current packet loss rate value change value of the current period of network information transmission, DaL is the current packet loss rate value of the current period of network information transmission, DbJ is the historical packet loss rate benchmark value of network information transmission, WdX is the current network stability index of network information transmission, α1 is the preset weighting coefficient of the current transmission rate value change value of network information transmission, α2 is the preset weighting coefficient of the current delay change value of network information transmission, α3 is the preset weighting coefficient of the current packet loss rate value change value of the current period of network information transmission, and α1+α2+α3=1, e is a natural constant.

[0015] Furthermore, the specific steps for obtaining the current network security index of network information transmission are as follows: read the historical transmission rate value benchmark value, the historical connection request quantity value benchmark value, the historical encrypted data benchmark value, and the historical unencrypted data benchmark value in the historical transmission data set of network information transmission; analyze the current transmission rate value, the current connection request quantity value, and the historical transmission rate value benchmark value and the historical connection request quantity value benchmark value of the current period of network information transmission in combination with the Euclidean distance method to obtain the current transmission state deviation of network information transmission; analyze the current data volume value of each encrypted data packet of each current encryption protocol in the current period of network information transmission, the current data volume value of each unencrypted data packet of each current unencrypted protocol, the historical encrypted data benchmark value, and the historical unencrypted data benchmark value to obtain the current network threat index of network information transmission; perform weighted analysis on the obtained current network threat index and current network transmission deviation of network information transmission to obtain the current network security index of network information transmission.

[0016] Furthermore, the specific formula for calculating the current network security threat assessment value of network information transmission is as follows: Among them, DwG is the current network security threat assessment value of network information transmission, WdX is the current network stability index of network information transmission, δ1 is the preset weighting coefficient of the current network stability index of network information transmission, WaX is the current network security index of network information transmission, δ2 is the preset weighting coefficient of the current network security index of network information transmission, and δ1+δ2=1, e is a natural constant.

[0017] Furthermore, the specific steps for taking corresponding threat warning measures based on the comparison and analysis results are as follows: if the current network security threat assessment value of network information transmission is lower than the preset first security threat assessment threshold, it is a low-risk network threat; if the current network security threat assessment value of network information transmission is higher than or equal to the preset first security threat assessment threshold, and lower than the second security threat assessment threshold, it is a medium-risk network threat; if the current network security threat assessment value of network information transmission is higher than or equal to the preset second security threat assessment threshold, it is a high-risk network threat.

[0018] A real-time network security threat early warning analysis system comprises: a data acquisition module, a data analysis module, a comprehensive analysis module and an early warning processing module; the data acquisition module is used to continuously acquire historical transmission data of several historical time periods of network information transmission and current transmission data of a current time period, and perform preprocessing; the data analysis module is used to perform data analysis on the historical transmission data of each historical time period of the preprocessed network information transmission to obtain a historical transmission data set of the network information transmission; the comprehensive analysis module is used to analyze the current transmission data of the current time period of the preprocessed network information transmission with the historical transmission data set to obtain a current network stability index and a current network security index of the network information transmission, and perform a comprehensive analysis to obtain a current network security threat assessment value of the network information transmission; the early warning processing module is used to compare and analyze the current network security threat assessment value of the network information transmission with a preset network security threat assessment threshold, and take corresponding threat early warning measures based on the comparison and analysis results, wherein the security threat assessment threshold comprises a first security threat assessment threshold and a second security threat assessment threshold.

[0019] The present invention has the following beneficial effects:

[0020] (1) This real-time network security threat warning analysis method dynamically generates a network security threat assessment value by integrating the current network stability and security indicators, and implements graded warnings based on this value, so that the security strategy can be adjusted according to the real-time changes in the network status. This dynamic risk assessment and graded response mechanism can take the most appropriate protection measures for different levels of threats, improve resource utilization efficiency and reduce unnecessary operational intervention, making network security management more efficient and economical.

[0021] (2) This real-time network security threat warning analysis method can more accurately assess the security status of the network by comparing the baseline value established by the historical data set with the current data in real time. The use of mathematical models such as the moving exponential average method and the Euclidean distance method not only improves the scientific nature of the analysis, but also enhances the processing capabilities in complex data environments, making security assessments more accurate.

[0022] (3) This real-time network security threat warning analysis method can detect and respond to network security threats in a timely manner through real-time monitoring and analysis. Compared with the traditional response based on existing events, it greatly improves the foresight and initiative of defense. Through continuous data collection and real-time threat assessment, the system can predict and take measures before threats are formed, thereby reducing potential security risks.

[0023] (4) The real-time network security threat warning analysis system significantly improves the maintainability and scalability of the system by decomposing the real-time network security threat warning system into four modules: data acquisition, data analysis, comprehensive analysis, and warning measures. Each module is responsible for handling specific tasks, making the entire system more flexible and easy to upgrade and expand. For example, if it is necessary to introduce new data analysis technology or improve the warning mechanism, the corresponding module can be upgraded separately without redesigning the entire system. This modular design not only reduces the complexity of system maintenance, but also enhances the adaptability to future technological development, ensuring the long-term effective operation of the system and adapting to the ever-changing network security environment.

[0024] Of course, any product implementing the present invention does not necessarily need to achieve all of the advantages described above at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 This is a flow chart of a real-time network security threat early warning analysis method of the present invention.

[0026] Figure 2 The present invention is a flowchart of the specific steps of obtaining a network stability index for network information transmission in a real-time network security threat early warning analysis method.

[0027] Figure 3 This is a block diagram of a real-time network security threat early warning analysis system of the present invention. DETAILED DESCRIPTION

[0028] The embodiment of the present application solves the problem that the existing technology is relatively passive in real-time network security analysis through a real-time network security threat early warning analysis method and system. It mainly reacts by analyzing the logs of security incidents that have occurred. This method is difficult to effectively foresee and defend against unknown or ongoing threats. This passive security situation awareness and lack of linkage early warning capabilities mean that once a network attack is detected, it is easy to cause irreparable losses. Secondly, the existing technology lacks the ability to effectively integrate and correlate multi-dimensional information security data, making it difficult to achieve the synergistic effect of security data, resulting in security defense facilities being difficult to fully resist multi-faceted security threats, thereby limiting the problem of security monitoring data becoming an effective resource for upper-level security decision-making.

[0029] The overall idea of ​​the problem in the embodiment of this application is as follows:

[0030] First, continuously acquire and preprocess the historical and current period data of network information transmission, including historical transmission rate, number of connection requests, delay time, packet loss rate, and data volume of encrypted and unencrypted protocols. Secondly, analyze the preprocessed historical data, and use the moving exponential average method to establish the historical benchmark value of each indicator to form a historical transmission data set. Then, compare and analyze the current transmission data with the historical benchmark value, calculate the current network stability index and network security index, and comprehensively obtain the current network security threat assessment value. Finally, compare the current security threat assessment value with the preset security threat assessment threshold, and take corresponding early warning measures according to the results, such as calibrating it as a low-risk, medium-risk or high-risk network threat, and implement corresponding security measures.

[0031] See also Figure 1 The embodiment of the present invention provides a technical solution: a real-time network security threat early warning analysis method, comprising the following steps: continuously acquiring historical transmission data of several historical time periods (for example: 5 seconds) of network information transmission and current transmission data of a current time period (the same time window as the historical time period, i.e., 5 seconds, and the time window obtained here is regarded as an instantaneous state), and performing preprocessing; performing data analysis on the historical transmission data of each historical time period of the preprocessed network information transmission to obtain a historical transmission data set of the network information transmission; analyzing the current transmission data of the current time period of the preprocessed network information transmission with the historical transmission data set to obtain a current network stability index and a current network security index of the network information transmission, and performing a comprehensive analysis to obtain a current network security threat assessment value of the network information transmission; comparing and analyzing the current network security threat assessment value of the network information transmission with a preset network security threat assessment threshold, and taking corresponding threat early warning measures based on the comparison and analysis results, the security threat assessment threshold comprising a first security threat assessment threshold (i.e., a preliminary warning line indicating a network security state) and a second security threat assessment threshold (i.e., a serious warning line indicating a network security state).

[0032] The historical transmission data specifically includes the historical transmission rate value, the historical connection request number value, the historical delay time value, the historical packet loss rate value, the historical data volume value of each encrypted data packet of each encryption protocol, and the historical data volume value of each unencrypted data packet of each unencrypted protocol. The current transmission data specifically includes the current transmission rate value, the current connection request number value, the current delay time value, the current packet loss rate value, the current data volume value of each encrypted data packet of each encryption protocol, and the current data volume value of each unencrypted data packet of each unencrypted protocol. The historical transmission data set specifically includes the historical transmission rate value baseline value, the historical connection request number value baseline value, the historical delay time baseline value, the historical packet loss rate baseline value, the historical encrypted data baseline value, and the historical unencrypted data baseline value.

[0033] The historical transmission rate value is the amount of data transmitted over the network during a historical period, and is obtained through a network monitoring tool (such as Wireshark).

[0034] The value of the number of historical connection requests is the number of requests initiated by the client to establish communication with the server during the historical period, which is obtained by checking the firewall log.

[0035] The historical delay time value is the time taken for network information to be transmitted from the transmitter to the receiver during the historical period, which is obtained through the network management system (such as Zabbix, Nagios, SolarWinds, etc.).

[0036] The historical packet loss rate is the percentage of data packets lost when network information is transmitted during the historical period, which is obtained through the network management system (such as Zabbix, Nagios, SolarWinds, etc.).

[0037] The current data volume value of each encrypted data packet of each encryption protocol is the number of bytes of each encrypted data packet, which is obtained through traffic monitoring tools such as NetFlow and sFlow.

[0038] The historical data volume value of each unencrypted data packet of each unencrypted protocol, that is, the number of bytes of each unencrypted data packet, is obtained through traffic monitoring tools such as NetFlow and sFlow.

[0039] The current transmission rate value is the amount of data transmitted on the network during the current period, which is obtained through a network monitoring tool (such as Wireshark).

[0040] The current number of connection requests is the number of requests that the client initiates to establish communication with the server during the current period, which can be obtained by checking the firewall log.

[0041] The current delay time value is the time taken for network information to be transmitted from the transmitter to the receiver during the current period, which is obtained through the network management system (such as Zabbix, Nagios, SolarWinds, etc.).

[0042] The current packet loss rate value is the percentage of data packets lost when network information is transmitted during the current period, and is obtained through a network management system (such as Zabbix, Nagios, SolarWinds, etc.).

[0043] The current data volume value of each encrypted data packet of each encryption protocol is the number of bytes of each encrypted data packet, which is obtained through traffic monitoring tools such as NetFlow and sFlow.

[0044] The current data volume value of each unencrypted data packet of each unencrypted protocol, that is, the number of bytes of each unencrypted data packet, is obtained through traffic monitoring tools such as NetFlow and sFlow.

[0045] Specifically, the specific steps for obtaining the historical transmission data set of network information transmission are as follows: combine the moving exponential average method to analyze the historical transmission rate value, historical connection request quantity value, historical delay time value, historical packet loss rate value, historical data volume value of each encrypted data packet of each encryption protocol, and historical data volume value of each unencrypted data packet of each unencrypted protocol for each historical period of network information transmission, and obtain the historical transmission rate value benchmark value, historical connection request quantity value benchmark value, historical delay time benchmark value, historical packet loss rate value benchmark value, historical encrypted data benchmark value, and historical unencrypted data benchmark value of network information transmission, and mark them as the historical transmission data set of network information transmission.

[0046] The specific formula for calculating the baseline value of the historical transmission rate of network information transmission is as follows:

[0047]

[0048] Among them, LcJ is the historical transmission rate benchmark value of network information transmission, LcS t is the historical transmission rate value of the tth historical period of network information transmission, LcS t-1 is the historical transmission rate value of the t-1th historical period of network information transmission, LmJ is the historical encryption data benchmark value of network information transmission, JmS tij is the historical data volume of the jth encrypted data packet of the i-th encryption protocol in the t-th historical period of network information transmission, JmS (t-1)ij It is the historical data volume value of the jth unencrypted data packet of the ith unencrypted protocol in the t-1th historical period of network information transmission, t=1,2,3,…,t0, t0 is the number of historical periods, i=1,2,3,…,i0, i0 is the type of encryption protocol, j=1,2,3,…,j0, j0 is the number of encrypted data packets.

[0049] Among them, the calculation logic of the historical connection request quantity benchmark value, the historical delay time benchmark value, the historical packet loss rate benchmark value, and the historical transmission rate benchmark value of network information transmission are consistent, and the calculation formula is also consistent.

[0050] The calculation logic and calculation formula of the historical unencrypted data baseline value and the historical encrypted data baseline value of network information transmission are consistent.

[0051] In this implementation scheme, the historical benchmark value is calculated by using the moving exponential average method. This method can smooth the random fluctuations of past data and provide a more stable and reliable benchmark value. This method can effectively reduce the impact of accidental factors on the analysis results, thereby improving the accuracy and consistency of data processing. For example, the average calculation of key performance indicators such as transmission rate, delay time, packet loss rate, etc. can reflect the real performance of the network over a long period of time, rather than being affected by abnormal data in a short period of time. By accurately analyzing historical and current data and establishing benchmark values, network administrators can more effectively monitor and diagnose changes in network conditions, which not only helps to optimize the configuration of network resources, such as Bandwidth allocation, cache management, etc., can also formulate more reasonable response strategies based on the detected network performance trends. For example, if the data for a certain period of time shows that the delay and packet loss rate continue to be higher than the baseline value, it may indicate network congestion or equipment failure, which requires timely adjustment or maintenance. By analyzing the number of data packets for each encrypted and unencrypted protocol and setting a baseline value, the understanding and control of network traffic patterns can be enhanced, which is particularly critical for identifying potential security threats such as DDoS attacks and unauthorized data access. Through continuous monitoring of these indicators, the security team can quickly discover abnormal patterns, activate defense mechanisms, and reduce or avoid the impact of possible security incidents on the network.

[0052] Specifically, Figure 2 As shown, the specific steps for obtaining the network stability index of network information transmission are as follows: read the historical transmission rate value benchmark value, the historical delay time benchmark value, and the historical packet loss rate value benchmark value in the historical transmission data set of network information transmission; analyze the current transmission rate value, current delay, and current packet loss rate value of the current period of network information transmission with the historical transmission rate value benchmark value, the historical delay time benchmark value, and the historical packet loss rate value benchmark value respectively to obtain the current transmission rate value change value of network information transmission (i.e., the difference between the transmission rate of the current period and the historical transmission rate value benchmark value), the current delay change value (i.e., the difference between the delay of the current period and the historical delay time benchmark value), and the current packet loss rate value change value (i.e., the difference between the packet loss rate of the current period and the historical packet loss rate value benchmark value); conduct a comprehensive analysis of the current transmission rate value change value, the current delay change value, and the current packet loss rate value change value of network information transmission to obtain the network stability index of network information transmission.

[0053] The specific formulas for calculating the transmission rate change value, current delay change value, current packet loss rate change value, and current network stability index of network information transmission are as follows: Among them, CsB is the current transmission rate value change value of network information transmission, DsC is the current transmission rate value of the current period of network information transmission, LcJ is the historical transmission rate value benchmark value of network information transmission, YcB is the current delay change value of network information transmission, DyC is the current delay time value of the current period of network information transmission, YcJ is the historical delay time benchmark value of network information transmission, DaB is the current packet loss rate value change value of the current period of network information transmission, DaL is the current packet loss rate value of the current period of network information transmission, DbJ is the historical packet loss rate benchmark value of network information transmission, WdX is the current network stability index of network information transmission, α1 is the preset weighting coefficient of the current transmission rate value change value of network information transmission, α2 is the preset weighting coefficient of the current delay change value of network information transmission, α3 is the preset weighting coefficient of the current packet loss rate value change value of the current period of network information transmission, and α1+α2+α3=1, e is a natural constant, usually taken as 2.71.

[0054] It needs to be explained that the preset process of α1, α2, and α3 is: obtain the current transmission rate value change value, the current delay change value, and the current packet loss rate value change value of the network information transmission, and perform sum analysis to obtain the network stability and value of the network information transmission, and perform proportion analysis on the current transmission rate value change value, the current delay change value, and the current packet loss rate value change value of the network information transmission respectively with the network stability and value, and use the proportion analysis results as the corresponding weighting coefficients.

[0055] Among them, the calculation data example of the current network stability index of network information transmission is as follows:

[0056] Table 1 Example of calculation data of current network stability index of network information transmission

[0057] 1 2 3 4 5 DsC 195.500 202.750 210.250 190.250 205.600 LqCy 198.750 198.750 198.750 198.750 198.750 Cb 0.016 0.020 0.056 0.042 0.034 DYNAMIC 42.500 35.500 41.750 44.240 38.170 Yj Y 39.500 39.500 39.500 39.500 39.500 Yj Y 0.072 0.096 0.055 0.113 0.033 Da 0.031 0.028 0.033 0.032 0.027 DbJ 0.030 0.030 0.030 0.030 0.030 DaB 0.033 0.065 0.095 0.065 0.095 <![CDATA[α1]]> 0.132 0.110 0.272 0.191 0.210 <![CDATA[α2]]> 0.595 0.531 0.267 0.514 0.204 <![CDATA[α3]]> 0.273 0.359 0.461 0.295 0.586 WXj 1.522 1.554 1.514 1.556 1.481

[0058] In the table, DsC is the current transmission rate value of the current period of network information transmission, in units of Mbps; LcJ is the historical transmission rate value benchmark value of network information transmission, in units of Mbps; CsB is the current transmission rate value change value of network information transmission, DyC is the current delay time value of the current period of network information transmission, in units of ms; YcJ is the historical delay time benchmark value of network information transmission, in units of ms; YcB is the current delay change value of network information transmission, DaL is the current packet loss rate value of the current period of network information transmission, DbJ is the historical packet loss rate benchmark value of network information transmission, DaB is the current packet loss rate value change value of the current period of network information transmission, α1 is the preset weighting coefficient of the current transmission rate value change value of network information transmission, α2 is the preset weighting coefficient of the current delay change value of network information transmission, α3 is the preset weighting coefficient of the current packet loss rate value change value of network information transmission in the current period, and WdX is the network stability index of network information transmission.

[0059] The first set of data: the current transmission rate value of network information transmission is: 195.500; the historical transmission rate value of network information transmission is: 198.750; the current transmission rate value change value of network information transmission is approximately: 0.016; the current delay time value of network information transmission in the current period is: 42.500; the historical delay time benchmark value of network information transmission is: 39.500; the current delay change value of network information transmission is approximately: 0.072; the current packet loss rate value of network information transmission in the current period is: 0.0 31; the historical packet loss rate baseline value of network information transmission is: 0.030; the current packet loss rate value change value of the current period of network information transmission is approximately: 0.033; the weighting coefficient of the preset current transmission rate value change value of network information transmission is approximately: 0.132; the weighting coefficient of the preset current delay change value of network information transmission is approximately: 0.595; the weighting coefficient of the current packet loss rate value change value of the current period of network information transmission is approximately: 0.273; the network stability index of network information transmission is approximately: 1.522.

[0060] The second set of data: the current transmission rate value of network information transmission is: 202.750; the historical transmission rate value of network information transmission is: 198.750; the current transmission rate value change value of network information transmission is approximately: 0.020; the current delay time value of network information transmission in the current period is: 35.500; the historical delay time benchmark value of network information transmission is: 39.500; the current delay change value of network information transmission is approximately: 0.096; the current packet loss rate value of network information transmission in the current period is: 0.0 28; the historical packet loss rate baseline value of network information transmission is: 0.030; the current packet loss rate value change value of the current period of network information transmission is approximately: 0.065; the weighting coefficient of the preset current transmission rate value change value of network information transmission is approximately: 0.110; the weighting coefficient of the preset current delay change value of network information transmission is approximately: 0.531; the weighting coefficient of the current packet loss rate value change value of the current period of network information transmission is approximately: 0.359; the network stability index of network information transmission is approximately: 1.554.

[0061] The third set of data: the current transmission rate value of network information transmission is: 210.250; the historical transmission rate value of network information transmission is: 198.750; the current transmission rate value change value of network information transmission is approximately: 0.056; the current delay time value of network information transmission in the current period is: 41.750; the historical delay time benchmark value of network information transmission is: 39.500; the current delay change value of network information transmission is approximately: 0.055; the current packet loss rate value of network information transmission in the current period is: 0.0 33; the historical packet loss rate benchmark value of network information transmission is: 0.030; the current packet loss rate value change value of the current period of network information transmission is approximately: 0.095; the weighting coefficient of the preset current transmission rate value change value of network information transmission is approximately: 0.272; the weighting coefficient of the preset current delay change value of network information transmission is approximately: 0.267; the weighting coefficient of the current packet loss rate value change value of the current period of network information transmission is approximately: 0.461; the network stability index of network information transmission is approximately: 1.514.

[0062] The fourth set of data: the current transmission rate value of network information transmission is: 190.250; the historical transmission rate value of network information transmission is: 198.750; the current transmission rate value change value of network information transmission is approximately: 0.042; the current delay time value of network information transmission in the current period is: 44.240; the historical delay time benchmark value of network information transmission is: 39.500; the current delay change value of network information transmission is approximately: 0.113; the current packet loss rate value of network information transmission in the current period is: 0.0 32; the historical packet loss rate baseline value of network information transmission is: 0.030; the current packet loss rate value change value of the current period of network information transmission is approximately: 0.065; the weighting coefficient of the preset current transmission rate value change value of network information transmission is approximately: 0.191; the weighting coefficient of the preset current delay change value of network information transmission is approximately: 0.514; the weighting coefficient of the current packet loss rate value change value of the current period of network information transmission is approximately: 0.295; the network stability index of network information transmission is approximately: 1.556.

[0063] The fifth set of data: the current transmission rate value of network information transmission is: 205.600; the historical transmission rate value of network information transmission is: 198.750; the current transmission rate value change value of network information transmission is approximately: 0.034; the current delay time value of network information transmission in the current period is: 38.170; the historical delay time benchmark value of network information transmission is: 39.500; the current delay change value of network information transmission is approximately: 0.033; the current packet loss rate value of network information transmission in the current period is: 0.0 27; the historical packet loss rate baseline value of network information transmission is: 0.030; the current packet loss rate value change value of the current period of network information transmission is approximately: 0.095; the weighting coefficient of the preset current transmission rate value change value of network information transmission is approximately: 0.210; the weighting coefficient of the preset current delay change value of network information transmission is approximately: 0.204; the weighting coefficient of the preset current packet loss rate value change value of the current period of network information transmission is approximately: 0.586; the network stability index of network information transmission is approximately: 1.481.

[0064] In this implementation scheme, by collecting and analyzing the data of the current period and the historical period in real time, this method can immediately reflect the changes in the network status. This dynamic analysis helps network administrators understand the network performance in real time, discover and respond to network changes in a timely manner, thereby achieving faster fault diagnosis and more effective bandwidth management. Through specific mathematical models and calculation formulas, such as the calculation of transmission rate change values, delay change values, and packet loss rate change values, this method provides a quantitative measurement standard for changes in network performance. This precise data support allows network managers to formulate strategies based on specific values, such as adjusting routing strategies, increasing bandwidth, or optimizing network configuration, to improve the overall stability of the network. and efficiency. Using historical data sets as a reference and combining them with current data changes for analysis can more effectively predict possible network failures and performance degradation trends. For example, if the current packet loss rate change value is significantly higher than the historical standard, it may indicate that the network is about to face congestion or attack, allowing administrators to intervene in advance and take measures to avoid more serious network problems. By analyzing the differences between current and historical data and calculating network stability indicators, network managers can more accurately identify deficiencies or excesses in resource allocation. This method makes resource allocation more efficient and risk management more precise, which helps to improve network resource utilization and reduce cost waste caused by network problems.

[0065] Specifically, the specific steps for obtaining the current network security index of network information transmission are as follows: read the historical transmission rate value benchmark value, the historical connection request number value benchmark value, the historical encrypted data benchmark value, and the historical unencrypted data benchmark value in the historical transmission data set of network information transmission; analyze the current transmission rate value, the current connection request number value, and the historical transmission rate value benchmark value and the historical connection request number value benchmark value of the current period of network information transmission in combination with the Euclidean distance method to obtain the current transmission state deviation of network information transmission (that is, the degree of difference between the current network transmission state and the historical benchmark state); analyze the current data volume value of each encrypted data packet of each current encryption protocol in the current period of network information transmission, the current data volume value of each unencrypted data packet of each current unencrypted protocol, and the historical encrypted data benchmark value and the historical unencrypted data benchmark value to obtain the current network threat index of network information transmission (that is, the degree of potential security threat faced by the network); perform weighted analysis on the obtained current network threat index and current network transmission deviation of network information transmission to obtain the current network security index of network information transmission.

[0066] Among them, the specific formulas for calculating the current transmission state deviation degree, current network threat index, and current network security index of network information transmission are as follows: Wherein, DbZ is the current transmission state deviation of network information transmission, DcS is the current transmission rate value of network information transmission, LcJ is the historical transmission rate value benchmark value of network information transmission, DqS is the current connection request quantity value of the current period of network information transmission, LqJ is the historical connection request quantity value benchmark value of network information transmission, DsH is the current network threat index of network information transmission, JmZ is the historical encrypted data benchmark value of network information transmission, WJm is the historical unencrypted data benchmark value of network information transmission, and DjM is the historical encrypted data benchmark value of network information transmission. ij is the current data volume of the jth encrypted data packet of the i-th encryption protocol in the current period of network information transmission, DjM mn is the current data volume value of the nth unencrypted data packet of the mth encryption protocol in the current period of network information transmission, WaX is the current network security index of network information transmission, β1 is the weighted coefficient of the current transmission state deviation of the preset network information transmission, β2 is the weighted coefficient of the current network threat index of the preset network information transmission, and β1+β2=1, i=1,2,3,…,i0, i0 is the type of encryption protocol, j=1,2,3,…,j0, j0 is the number of encrypted data packets, m=1,2,3,…,m0, m0 is the type of unencrypted protocol, n=1,2,3,…,n0, n0 is the number of unencrypted data packets, and e is a natural constant, usually taken as 2.71.

[0067] It needs to be explained that the preset process of β1 and β2 is: obtain the current transmission state deviation of network information transmission and the current network threat index, and perform sum analysis to obtain the current threat nature and value of network information transmission, and perform proportion analysis on the current transmission state deviation of network information transmission and the current network threat index and the current threat nature and value respectively, and use the proportion analysis results as the corresponding weighting coefficients.

[0068] Among them, the Euclidean distance method is used to calculate the distance between two points on a plane. Here, the transmission rate and the number of connection requests are regarded as two points in space, and their coordinates are (current transmission rate value, historical transmission rate value benchmark value) and (current connection request number value, historical connection request number benchmark value).

[0069] In this implementation scheme, by calculating the deviation between the current network state and the historical benchmark state, the method can accurately identify and quantify the anomalies of network behavior. Using Euclidean distance to compare the current state with the historical benchmark can intuitively reveal small changes in network behavior, thereby helping the security team to promptly discover possible security incidents or configuration errors. This method converts abstract network behavior into specific numerical distances, providing a clear and easy-to-understand indicator to evaluate the health of the network. By combining multiple dimensions such as transmission rate and number of connection requests, the security of the network can be comprehensively evaluated by calculating the deviation and threat index. This method not only considers a single indicator, but also combines multiple key indicators to form a multi-faceted network security assessment. Such a comprehensive assessment helps to capture possible security incidents that may be detected by a single indicator. The system can dynamically adjust security policies according to real-time changes in network behavior by comparing current data with historical data and using dynamic weighting coefficients. The setting of weighting coefficients depends on the relationship between current data and historical data, so that security responses can be more in line with actual network conditions. For example, if the encryption rate of data packets increases abnormally within a certain period of time, it may indicate the risk of information leakage or network attacks. The system can automatically adjust the response strategy, strengthen monitoring or take preventive measures, and use the Euclidean distance method to analyze network security, which simplifies the interpretation process of complex data. By simplifying multi-dimensional data into a single security indicator, network administrators can evaluate network conditions and make decisions more quickly, which is especially important for environments that require rapid response to network events.

[0070] Specifically, the specific formula for calculating the current network security threat assessment value of network information transmission is as follows: Among them, DwG is the current network security threat assessment value of network information transmission, WdX is the current network stability index of network information transmission, δ1 is the preset weighting coefficient of the current network stability index of network information transmission, WaX is the current network security index of network information transmission, δ2 is the preset weighting coefficient of the current network security index of network information transmission, and δ1+δ2=1, e is a natural constant, usually taken as 2.71.

[0071] It needs to be explained that the preset process of δ1 and δ2 is: obtain the current network stability index and the current network security index of network information transmission, and perform de-sum analysis to obtain the threat and value of network information transmission, and perform proportion analysis on the current network stability index and the current network security index of network information transmission with the threat and value respectively, and use the proportion analysis results as the corresponding weighting coefficients.

[0072] In this implementation scheme, the overall network security threat is evaluated by calculating the network stability index and the network security index, and then combining their weighted coefficients. This method can more accurately judge the security status of the network. This is not just a simple monitoring of a certain aspect of the network, but a comprehensive consideration of the stability and security of the network, thereby providing a more comprehensive security assessment. The weighted coefficient is dynamically set by summing and proportioning the current network stability index and network security index. This approach allows the system to flexibly adjust the evaluation parameters according to the actual changes in the current network status. This dynamic adjustment can make the security system more sensitive to any slight changes in the network status, thereby When faced with potential security threats, they can be discovered and countermeasures can be taken earlier. The weighting coefficient is set based on the current network status to ensure the accuracy of the security assessment. For example, if the network stability suddenly decreases, this change will be given a higher weight in the threat assessment, reflecting its possible negative impact on network security. On the contrary, if the network operates stably, the system can adjust its strategy and pay more attention to other potential security risks. By accurately quantifying network security threats, preventive measures can be planned and implemented more effectively. For example, based on accurate threat assessment values, you can decide whether you need to immediately upgrade firewalls, add encryption measures, or reconfigure network resources to defend against identified security risks.

[0073] Specifically, the specific steps for taking corresponding threat warning measures based on the comparison and analysis results are as follows: if the current network security threat assessment value of network information transmission is lower than the preset first security threat assessment threshold, it is a low-risk network threat (the security of network transmission is relatively high, and there is no obvious security threat at present), and the current network status and activity are recorded for routine monitoring. At the same time, no special security measures are required, and the system can continue to collect data for subsequent analysis; if the current network security threat assessment value of network information transmission is higher than or equal to the preset first security threat assessment threshold, and lower than the second security threat assessment threshold, it is a medium-risk network threat (there is a potential network security threat). , which requires attention), and triggers an alarm to send a notification to the network administrator, reminding of potential security risks, increasing network monitoring efforts, observing whether there is abnormal traffic or activity, and performing stricter access control and traffic filtering on specific network nodes; if the current network security threat assessment value of network information transmission is higher than or equal to the preset second security threat assessment threshold, it is a high-risk network threat (the network security threat is serious and is about to be attacked), and emergency measures should be taken immediately, such as triggering the system's automatic defense mechanism, restricting or stopping related network transmission, blocking suspicious traffic, and launching an emergency response plan. The administrator should immediately implement full network traffic monitoring and log analysis to identify the source and means of attack.

[0074] In this implementation scheme, by classifying security threats into three levels: low, medium, and high, and taking corresponding measures according to the severity of the threats, it is possible to ensure the rational allocation of resources. When the risk is low, there is no excessive intervention to save resources, while when the risk is high, resources are concentrated to respond. Such a graded response ensures that security resources are not wasted when it is unnecessary, and at the same time, sufficient security can be provided when it is really needed. By timely identifying and responding to security threats of different levels, this method can intervene before the threat develops to a more serious stage. For medium-risk network threats, further deterioration of security incidents can be prevented by enhanced monitoring and early warning. Such timely early warning and preventive measures reduce potential losses and the success rate of attacks. Based on the current The security measures are adjusted dynamically based on the current network security threat assessment value, which makes security management more in line with the actual network status and can flexibly adjust security policies to adapt to changes in the network environment. For example, when a high-level security threat is detected, emergency response measures are automatically triggered, such as restricting network transmission and blocking suspicious traffic. Such dynamic and automated responses reduce the pressure of manual operations and improve processing speed and efficiency. By setting specific response measures for each level of security threats, from routine monitoring to emergency response, this comprehensive security measure ensures the security of the network environment under any circumstances. This comprehensive security management strategy strengthens the overall control of network security threats, thereby effectively reducing the possibility and potential impact of security incidents.

[0075] See also Figure 3 The embodiment of the present invention provides a technical solution: a real-time network security threat early warning analysis system, comprising: a data acquisition module, a data analysis module, a comprehensive analysis module, and an early warning processing module; the data acquisition module is used to continuously acquire historical transmission data of several historical time periods of network information transmission and current transmission data of the current time period, and perform preprocessing; the data analysis module is used to perform data analysis on the historical transmission data of each historical time period of the preprocessed network information transmission to obtain a historical transmission data set of the network information transmission; the comprehensive analysis module is used to analyze the current transmission data of the current time period of the preprocessed network information transmission with the historical transmission data set to obtain the current network stability index and the current network security index of the network information transmission, and perform comprehensive analysis to obtain the current network security threat assessment value of the network information transmission; the early warning processing module is used to compare and analyze the current network security threat assessment value of the network information transmission with a preset network security threat assessment threshold, and take corresponding threat early warning measures based on the comparison and analysis results, and the security threat assessment threshold includes a first security threat assessment threshold (i.e., a preliminary warning line indicating the network security status) and a second security threat assessment threshold (i.e., a serious warning line indicating the network security status).

[0076] In summary, this application has at least the following effects:

[0077] By integrating the current network stability and security indicators, dynamically generating network security threat assessment values, and implementing graded warnings accordingly, it is possible to adjust security policies according to real-time changes in network status. This dynamic risk assessment and graded response mechanism can take the most appropriate protective measures for different levels of threats, improve resource utilization efficiency and reduce unnecessary operational interventions, making network security management more efficient and economical.

[0078] By using the benchmark values ​​established by historical data sets and comparing them with current data in real time, the security status of the network can be assessed more accurately. The use of mathematical models such as the moving exponential average method and the Euclidean distance method not only improves the scientific nature of the analysis, but also enhances the processing capabilities in complex data environments, making security assessments more accurate.

[0079] Through real-time monitoring and analysis, network security threats can be discovered and responded to in a timely manner. Compared with traditional responses based on incidents that have already occurred, the foresight and initiative of defense are greatly improved. Through continuous data collection and real-time threat assessment, the system can predict and take measures before threats form, thereby reducing potential security risks.

[0080] By decomposing the real-time network security threat warning system into four modules: data acquisition, data analysis, comprehensive analysis, and warning processing, the maintainability and scalability of the system are significantly improved. Each module is responsible for handling specific tasks, making the entire system more flexible and easy to upgrade and expand. For example, if it is necessary to introduce new data analysis technology or improve the warning mechanism, the corresponding module can be upgraded separately without redesigning the entire system. This modular design not only reduces the complexity of system maintenance, but also enhances the adaptability to future technological development, ensuring the long-term effective operation of the system and adapting to the ever-changing network security environment.

[0081] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0082] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A real-time network security threat early warning analysis method, characterized in that: The following steps are involved: Continuously obtain historical transmission data of several historical periods of network information transmission and current transmission data of the current period, and perform preprocessing; Performing data analysis on the historical transmission data of each historical period of the preprocessed network information transmission to obtain a historical transmission data set of the network information transmission; Analyze the current transmission data of the current period of the preprocessed network information transmission with the historical transmission data set to obtain the current network stability index and the current network security index of the network information transmission, and conduct a comprehensive analysis to obtain the current network security threat assessment value of the network information transmission; Compare and analyze the current network security threat assessment value of the network information transmission with the preset network security threat assessment threshold, and take corresponding threat warning measures based on the comparison and analysis results, wherein the security threat assessment threshold includes a first security threat assessment threshold and a second security threat assessment threshold; The historical transmission data specifically includes historical transmission rate values, historical connection request quantity values, historical delay time values, historical packet loss rate values, historical data volume values ​​of each encrypted data packet of each encryption protocol, and historical data volume values ​​of each unencrypted data packet of each unencrypted protocol; the current transmission data specifically includes current transmission rate values, current connection request quantity values, current delay time values, current packet loss rate values, current data volume values ​​of each encrypted data packet of each encryption protocol, and current data volume values ​​of each unencrypted data packet of each unencrypted protocol; the historical transmission data set specifically includes historical transmission rate value benchmark values, historical connection request quantity value benchmark values, historical delay time benchmark values, historical packet loss rate benchmark values, historical encrypted data benchmark values, and historical unencrypted data benchmark values; The specific formula for calculating the current network security threat assessment value of network information transmission is as follows: Among them, DwG is the current network security threat assessment value of network information transmission, WdX is the current network stability index of network information transmission, δ1 is the preset weighting coefficient of the current network stability index of network information transmission, WaX is the current network security index of network information transmission, δ2 is the preset weighting coefficient of the current network security index of network information transmission, and δ1+δ2=1, e is a natural constant.

2. The real-time network security threat early warning analysis method according to claim 1 is characterized in that: The specific steps to obtain the historical transmission data set of network information transmission are as follows: Combined with the moving exponential average method, the historical transmission rate values, historical connection request quantity values, historical delay time values, historical packet loss rate values, historical data volume values ​​of each encrypted data packet of each encryption protocol, and historical data volume values ​​of each unencrypted data packet of each unencrypted protocol of each historical period of network information transmission are analyzed to obtain the historical transmission rate value benchmark value, historical connection request quantity value benchmark value, historical delay time benchmark value, historical packet loss rate value benchmark value, historical encrypted data benchmark value, and historical unencrypted data benchmark value of network information transmission, and mark them as the historical transmission data set of network information transmission.

3. The real-time network security threat early warning analysis method according to claim 2 is characterized in that: The specific formula for calculating the baseline value of the historical transmission rate of network information transmission is as follows: Among them, LcJ is the historical transmission rate benchmark value of network information transmission, LcS t is the historical transmission rate value of the tth historical period of network information transmission, LcS t-1 is the historical transmission rate value of the t-1th historical period of network information transmission, LmJ is the historical encryption data benchmark value of network information transmission, JmS tij is the historical data volume of the jth encrypted data packet of the i-th encryption protocol in the t-th historical period of network information transmission, JmS( t-1 ) ij It is the historical data volume value of the jth unencrypted data packet of the ith unencrypted protocol in the t-1th historical period of network information transmission, t=1,2,3,…,t0, t0 is the number of historical periods, i=1,2,3,…,i0, i0 is the type of encryption protocol, j=1,2,3,…,j0, j0 is the number of encrypted data packets.

4. The real-time network security threat early warning analysis method according to claim 1 is characterized in that: The specific steps to obtain the network stability index of network information transmission are as follows: Read the historical transmission rate value benchmark value, the historical delay time benchmark value, and the historical packet loss rate value benchmark value in the historical transmission data set of network information transmission; Analyze the current transmission rate value, current delay, current packet loss rate value of the current period of network information transmission with the historical transmission rate value benchmark value, historical delay time benchmark value, and historical packet loss rate value benchmark value respectively to obtain the current transmission rate value change value, current delay change value, and current packet loss rate value change value of network information transmission; A comprehensive analysis is performed on the change values ​​of the current transmission rate value, the current delay change value, and the current packet loss rate value of the network information transmission to obtain the network stability index of the network information transmission.

5. The real-time network security threat early warning analysis method according to claim 4 is characterized in that: The specific formulas for calculating the transmission rate change value, current delay change value, current packet loss rate change value, and current network stability index of network information transmission are as follows: Among them, CsB is the current transmission rate value change value of network information transmission, DsC is the current transmission rate value of the current period of network information transmission, LcJ is the historical transmission rate value benchmark value of network information transmission, YcB is the current delay change value of network information transmission, DyC is the current delay time value of the current period of network information transmission, YcJ is the historical delay time benchmark value of network information transmission, DaB is the current packet loss rate value change value of the current period of network information transmission, DaL is the current packet loss rate value of the current period of network information transmission, DbJ is the historical packet loss rate benchmark value of network information transmission, WdX is the current network stability index of network information transmission, α1 is the preset weighting coefficient of the current transmission rate value change value of network information transmission, α2 is the preset weighting coefficient of the current delay change value of network information transmission, α3 is the preset weighting coefficient of the current packet loss rate value change value of the current period of network information transmission, and α1+α2+α3=1, e is a natural constant.

6. The real-time network security threat early warning analysis method according to claim 1 is characterized in that: The specific steps to obtain the current network security index of network information transmission are as follows: Read the historical transmission rate value benchmark value, the historical connection request quantity value benchmark value, the historical encrypted data benchmark value, and the historical unencrypted data benchmark value in the historical transmission data set of network information transmission; Combined with the Euclidean distance method, the current transmission rate value, the current connection request quantity value, the historical transmission rate value benchmark value, and the historical connection request quantity value benchmark value of the current period of network information transmission are analyzed to obtain the current transmission state deviation of network information transmission; Analyze the current data volume value of each encrypted data packet of each current encryption protocol, the current data volume value of each unencrypted data packet of each current unencrypted protocol, the historical encrypted data baseline value, and the historical unencrypted data baseline value in the current period of network information transmission to obtain the current network threat index of network information transmission; The current network threat index and the current network transmission deviation of the obtained network information transmission are weighted analyzed to obtain the current network security index of the network information transmission.

7. The real-time network security threat early warning analysis method according to claim 1 is characterized in that: The specific steps for taking corresponding threat warning measures based on the comparison and analysis results are as follows: If the current network security threat assessment value of the network information transmission is lower than the preset first security threat assessment threshold, it is a low-risk network threat; If the current network security threat assessment value of the network information transmission is higher than or equal to the preset first security threat assessment threshold, and lower than the second security threat assessment threshold, it is a medium-risk network threat; If the current network security threat assessment value of the network information transmission is higher than or equal to a preset second security threat assessment threshold, it is a high-risk network threat.

8. A real-time network security threat early warning analysis system, applying the real-time network security threat early warning analysis method according to any one of claims 1 to 7, characterized in that: include: Data acquisition module, data analysis module, comprehensive analysis module, early warning processing module; The data acquisition module is used to continuously acquire historical transmission data of several historical time periods of network information transmission and current transmission data of the current time period, and perform preprocessing; The data analysis module is used to analyze the historical transmission data of each historical period of the pre-processed network information transmission to obtain a historical transmission data set of the network information transmission; The comprehensive analysis module is used to analyze the current transmission data of the current period of the preprocessed network information transmission with the historical transmission data set to obtain the current network stability index and the current network security index of the network information transmission, and to perform comprehensive analysis to obtain the current network security threat assessment value of the network information transmission; The early warning processing module is used to compare and analyze the current network security threat assessment value of network information transmission with a preset network security threat assessment threshold, and take corresponding threat early warning measures based on the comparison and analysis results. The security threat assessment threshold includes a first security threat assessment threshold and a second security threat assessment threshold.

Images