A network security management method and system based on big data model

Abstract

The present invention discloses a network security management method and system based on a big data model, which relates to the field of data management technology, including: obtaining all communication node information in a communication network; classifying all communication nodes in the communication network; evaluating and generating individual indicators of communication nodes; generating general indicator functions of each communication node class respectively; determining the communication resource occupancy data of the communication nodes in the communication network, and comprehensively evaluating whether the communication nodes have data anomalies based on the individual indicators of the communication nodes and the general indicator functions of the communication node classes corresponding to the communication nodes; and outputting all communication nodes with additional abnormal identifications. The advantages of the present invention are: it can effectively identify the abnormal data status appearing in the communication nodes, and through comprehensive analysis from all aspects, it can quickly and accurately check the communication nodes in abnormal status, so as to realize efficient comprehensive management of the communication network.

Description

Technical Field

[0001] The present invention relates to the technical field of data management, and in particular to a network security management method and system based on a big data model. Background Art

[0002] The existing network security management platform lacks comprehensive analysis of data changes in the communication resources occupied by communication nodes, is insensitive to identifying abnormalities in communication node data, and cannot accurately and quickly check communication nodes in abnormal states. Summary of the invention

[0003] In order to solve the above technical problems, a network security management method and system based on a big data model are provided. This technical solution solves the problems that the existing communication node management platform mentioned above lacks a comprehensive and all-round analysis of the data changes of the communication resources occupied by the communication nodes, is insensitive to the recognition of abnormalities in the communication node data, and cannot accurately and quickly check the communication nodes in abnormal states.

[0004] In order to achieve the above purpose, the technical solution adopted by the present invention is:

[0005] A network security management method based on a big data model, comprising:

[0006] Get information about all communication nodes in the communication network;

[0007] Based on the communication node attributes, all communication nodes in the communication network are classified to obtain several communication node classes;

[0008] Based on the historical change log of the communication resource usage of each communication node in the communication network, the individual indicators of the communication nodes are evaluated and generated;

[0009] Generate a general indicator function for each communication node class based on the recent historical change log of the communication resource usage of all communication nodes in the communication network;

[0010] Determine the communication resource occupancy data of the communication nodes in the communication network, and comprehensively evaluate whether the communication nodes have data anomalies based on the individual indicators of the communication nodes and the general indicator function of the communication node class corresponding to the communication nodes. If so, add an abnormal flag to the communication nodes, otherwise, do not respond;

[0011] Output all communication nodes with additional abnormal identification, and audit the communication status of the communication nodes with additional abnormal identification.

[0012] Preferably, the evaluation and generation of individual indicators of communication nodes based on the historical change log of the communication resource occupancy of each communication node in the communication network specifically includes:

[0013] Determine several evaluation criteria for communication resource usage;

[0014] Based on each evaluation scale of communication resource occupancy, a communication resource occupancy fitting value of a communication node under each evaluation scale is predicted based on a fitting prediction method;

[0015] Determine an evaluation loss value of an estimated value of communication resource occupancy of a communication node under each evaluation scale, and determine a fitting weight of each evaluation scale based on the evaluation loss value;

[0016] Based on the fitting weight of each evaluation scale and the fitting value of the communication resource occupancy of the communication node under each evaluation scale, the communication resource occupancy estimation value of the communication node is calculated by the estimation calculation formula;

[0017] The estimated value of the communication resource occupancy of the communication node is recorded as the individual indicator of the communication node;

[0018] The estimation calculation formula is specifically:

[0019]

[0020] In the formula, is the estimated value of the communication resource occupancy of the communication node, is the fitting weight of the ith evaluation scale, is the fitting value of the communication resource occupancy of the communication node under the i-th evaluation scale, is the total number of evaluation scales.

[0021] Preferably, the method of predicting the communication resource occupancy fitting value of the communication node under each evaluation scale based on each evaluation scale based on fitting prediction specifically includes:

[0022] Based on each evaluation scale, select a number of communication resource occupancy history values ​​of communication nodes corresponding to the evaluation scale from the historical change log of communication resource occupancy, and record them as sample data of the evaluation scale;

[0023] The sample data of the evaluation scale are numbered in order from the earliest to the latest time;

[0024] According to the fitting formula, the communication resource occupancy fitting value of the communication node under the evaluation scale is calculated;

[0025] The fitting formula is:

[0026]

[0027] In the formula, is the communication resource occupancy fitting value of the communication node, Sample data numbered j, is the total number of sample data.

[0028] Preferably, the step of determining the estimated value of the communication resource occupancy of the communication node under each evaluation scale and determining the fitting weight of each evaluation scale based on the estimated value of the communication resource occupancy of the communication node under each evaluation scale specifically includes:

[0029] The calculation formula for the assessed loss value is:

[0030]

[0031] In the calculation formula of the evaluation loss value, The estimated loss value for the estimated occupation of communication resources;

[0032] The fitting weights of the evaluation scale are:

[0033]

[0034] In the formula, is the estimated loss value of the communication resource occupancy of the communication node under the i-th evaluation scale, is the maximum value of the estimated loss value of the communication resource occupancy of the communication node under all evaluation scales, It is the minimum value of the evaluation loss value of the communication resource occupancy estimate of the communication node under all evaluation scales.

[0035] Preferably, the generating of the general indicator function for each communication node class based on the recent historical change log of the communication resource occupancy of all communication nodes in the communication network specifically includes:

[0036] Set an analysis period;

[0037] Retrieve the change curve of communication resource occupancy of all communication nodes under the communication node class over time during the analysis period;

[0038] Based on the change curve of communication resource occupancy over time in the analysis period, a function of communication resource occupancy over time in the analysis period is fitted;

[0039] The general indicator function of the communication node class is as follows:

[0040]

[0041] In the formula, It is a general indicator function of the communication node class. is the derivative function of the function of the hth communication node's communication resource occupancy changing with time during the analysis period, It is the total number of communication nodes under the communication node class.

[0042] Preferably, the comprehensive evaluation of whether the communication node has data anomalies specifically includes:

[0043] The difference between the estimated value of the communication resource occupancy of the communication node and the actual value of the communication resource occupancy of the communication node is compared with the estimated value of the communication resource occupancy to obtain an individual evaluation deviation index of the communication node;

[0044] The individual evaluation deviation indicators of all communication nodes under the communication node class are organized into the individual evaluation deviation indicator set A corresponding to the communication node class. ,in, is the individual evaluation deviation index of the hth communication node under the communication node class;

[0045] Based on the general indicator function of the communication node class, the category evaluation deviation index of the communication node is calculated and formed into a category evaluation deviation index set B corresponding to the communication node class. ,in, Evaluate the deviation index for the class of the hth communication node under the communication node class;

[0046] Based on the comprehensive evaluation formula, the comprehensive deviation index of the communication node is calculated, and it is determined whether the comprehensive deviation index of the communication node is greater than a preset value. If so, it is determined that there is data anomaly in the communication node. If not, it is determined that there is no data anomaly in the communication node.

[0047] The calculation formula of the category evaluation deviation index is:

[0048] in, The duration of the analysis cycle;

[0049] The comprehensive evaluation formula is specifically:

[0050]

[0051] In the formula, It is the comprehensive deviation index of the hth communication node under the communication node class.

[0052] Furthermore, a network security management system based on a big data model is proposed, which is used to implement the network security management method based on a big data model as described above, including:

[0053] A storage module, the storage module is used to store the communication network including all communication node information;

[0054] A classification module, the classification module is electrically connected to the storage module, and the classification module is used to classify all communication nodes in the communication network based on communication node attributes to obtain a plurality of communication node classes;

[0055] A fitting evaluation module, the fitting evaluation module is electrically connected to the classification module, and is used to evaluate and generate individual indicators of communication nodes based on the historical change log of communication resource occupancy of each communication node in the communication network, and to generate a general indicator function for each communication node class based on the recent historical change log of communication resource occupancy of all communication nodes in the communication network;

[0056] A communication node analysis module, the communication node analysis module is electrically connected to the fitting evaluation module, and is used to determine the communication resource occupancy data of the communication nodes in the communication network, and comprehensively evaluate whether the communication nodes have data anomalies based on the individual indicators of the communication nodes and the general indicator function of the communication node class corresponding to the communication nodes. If so, an abnormal flag is added to the communication node, and if not, no response is made;

[0057] An output module, the output module is electrically connected to the communication node analysis module, and the output module is used to output all communication nodes with additional abnormal identifications.

[0058] Optionally, the fitting assessment module includes:

[0059] An individual analysis unit, the individual analysis unit is used to evaluate and generate individual indicators of communication nodes based on a historical change log of communication resource occupancy of each communication node in the communication network;

[0060] A category analysis unit, wherein the category analysis unit is used to generate a general indicator function for each communication node class based on a recent historical change log of the communication resource occupancy of all communication nodes in the communication network.

[0061] Optionally, the communication node analysis module includes:

[0062] An individual fitting unit, wherein the individual fitting unit is used to compare a difference obtained by subtracting an estimated value of the communication resource occupancy of the communication node from an actual value of the communication resource occupancy of the communication node with the estimated value of the communication resource occupancy, to obtain an individual evaluation deviation index of the communication node, and to organize the individual evaluation deviation indexes of all communication nodes under the communication node class into an individual evaluation deviation index set A corresponding to the communication node class;

[0063] A category fitting unit, the category fitting unit is used to calculate the category evaluation deviation index of the communication node based on the general index function of the communication node class, and form a category evaluation deviation index set B corresponding to the communication node class;

[0064] A comprehensive fitting unit, wherein the comprehensive fitting unit is used to calculate the comprehensive deviation index of the communication node based on the comprehensive evaluation formula, and to determine whether the comprehensive deviation index of the communication node is greater than a preset value. If so, it is determined that there is data anomaly in the communication node; if not, it is determined that there is no data anomaly in the communication node.

[0065] Compared with the prior art, the present invention has the following beneficial effects:

[0066] The present invention proposes a network security management solution based on a big data model. By performing a fitting analysis on the communication resource occupancy values ​​of communication nodes in multiple dimensions, the individual indicators of the communication resource occupancy of communication nodes under normal conditions are predicted. At the same time, the category change attributes brought about by the different attributes of the communication nodes are combined to comprehensively evaluate the communication resource occupancy data of the communication nodes. The abnormal data status appearing in the communication nodes can be effectively identified. Through a comprehensive analysis from all aspects, the communication nodes in abnormal status can be quickly and accurately checked, thereby realizing efficient comprehensive management of the communication network. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] Figure 1 This is a flow chart of the network security management method based on the big data model proposed by the present invention;

[0068] Figure 2 A flow chart of a method for generating individual indicators of communication nodes for evaluation of the present invention;

[0069] Figure 3 A flow chart of a method for predicting the communication resource occupancy fitting value of a communication node under each evaluation scale by a fitting prediction method of the present invention;

[0070] Figure 4 A flow chart of a method for generating a general-purpose indicator function for each communication node class of the present invention;

[0071] Figure 5 This is a flow chart of the method for comprehensively evaluating whether a communication node has data anomalies according to the present invention. DETAILED DESCRIPTION

[0072] The following description is used to disclose the present invention so that those skilled in the art can implement the present invention. The preferred embodiments described below are only examples, and those skilled in the art may think of other obvious variations.

[0073] Reference Figure 1 As shown, a network security management method based on a big data model includes:

[0074] Get information about all communication nodes in the communication network;

[0075] Based on the communication node attributes, all communication nodes in the communication network are classified to obtain several communication node classes;

[0076] Based on the historical change log of the communication resource usage of each communication node in the communication network, the individual indicators of the communication nodes are evaluated and generated;

[0077] Generate a general indicator function for each communication node class based on the recent historical change log of the communication resource usage of all communication nodes in the communication network;

[0078] Determine the communication resource occupancy data of the communication nodes in the communication network, and comprehensively evaluate whether the communication nodes have data anomalies based on the individual indicators of the communication nodes and the general indicator function of the communication node class corresponding to the communication nodes. If so, add an abnormal flag to the communication nodes, otherwise, do not respond;

[0079] Output all communication nodes with additional abnormal identification, and audit the communication status of the communication nodes with additional abnormal identification.

[0080] Through the fitting analysis of the communication resource occupancy values ​​of communication nodes in multiple dimensions, the individual indicators of communication resource occupancy of communication nodes under normal conditions are predicted. At the same time, combined with the category change attributes brought about by the different attributes of communication nodes, a comprehensive evaluation of the communication resource occupancy data of communication nodes is performed, which can effectively identify the abnormal data status in the communication nodes.

[0081] Reference Figure 2 As shown in FIG, based on the historical change log of the communication resource usage of each communication node in the communication network, the individual indicators of the communication nodes generated by the evaluation specifically include:

[0082] Determine several evaluation criteria for communication resource usage;

[0083] Based on each evaluation scale of communication resource occupancy, a communication resource occupancy fitting value of a communication node under each evaluation scale is predicted based on a fitting prediction method;

[0084] Determine an evaluation loss value of an estimated value of communication resource occupancy of a communication node under each evaluation scale, and determine a fitting weight of each evaluation scale based on the evaluation loss value;

[0085] Based on the fitting weight of each evaluation scale and the fitting value of the communication resource occupancy of the communication node under each evaluation scale, the communication resource occupancy estimation value of the communication node is calculated by the estimation calculation formula;

[0086] The estimated value of the communication resource occupancy of the communication node is recorded as the individual indicator of the communication node;

[0087] The specific calculation formula for the estimation is:

[0088]

[0089] In the formula, is the estimated value of the communication resource occupancy of the communication node, is the fitting weight of the ith evaluation scale, is the fitting value of the communication resource occupancy of the communication node under the i-th evaluation scale, is the total number of evaluation scales.

[0090] It is understandable that changes in communication resource occupancy may occur in different cycles, such as annual cycle changes, seasonal cycle changes, monthly cycle changes, and other different time scales. In this embodiment, when evaluating the estimated value of communication resource occupancy of a communication node, full consideration is given to the impact of various time scale cycles on changes in communication resource occupancy, effectively ensuring that the calculated estimated value of communication resource occupancy matches the actual communication behavior of the communication node, thereby realizing individual matching calculations for the communication nodes.

[0091] Reference Figure 3 As shown, based on each evaluation scale of communication resource occupancy, the communication resource occupancy fitting value of the communication node under each evaluation scale is predicted based on the fitting prediction method, specifically including:

[0092] Based on each evaluation scale, select a number of communication resource occupancy history values ​​of communication nodes corresponding to the evaluation scale from the historical change log of communication resource occupancy, and record them as sample data of the evaluation scale;

[0093] The sample data of the evaluation scale are numbered in order from the earliest to the latest time;

[0094] According to the fitting formula, the communication resource occupancy fitting value of the communication node under the evaluation scale is calculated;

[0095] The fitting formula is:

[0096]

[0097] In the formula, is the communication resource occupancy fitting value of the communication node, Sample data numbered j, is the total number of sample data.

[0098] Determine the evaluation loss value of the communication resource occupancy estimate of the communication node under each evaluation scale, and determine the fitting weight of each evaluation scale based on the evaluation loss value, specifically including:

[0099] The calculation formula for the assessed loss value is:

[0100]

[0101] In the calculation formula of the evaluation loss value, The estimated loss value for the estimated occupation of communication resources;

[0102] The fitted weights for the evaluation scale are:

[0103]

[0104] In the formula, is the estimated loss value of the communication resource occupancy of the communication node under the i-th evaluation scale, is the maximum value of the estimated loss value of the communication resource occupancy of the communication node under all evaluation scales, It is the minimum value of the evaluation loss value of the communication resource occupancy estimate of the communication node under all evaluation scales.

[0105] In this scheme, linear prediction is used to predict the fitting value of communication resource occupancy of communication nodes at each evaluation scale, and the fitting weight of each evaluation scale is dynamically allocated based on the function loss value between the collected sample data and the linear model. It can be understood that the larger the function loss value between the collected sample data and the linear model, the more the data changes at this scale cannot be explained by the linear model, and the error in the fitting value of communication resource occupancy at this scale is larger. Based on this, the fitting weight for this scale is smaller.

[0106] Reference Figure 4 As shown, based on the recent historical change logs of the communication resource usage of all communication nodes in the communication network, the general indicator functions for each communication node class are generated separately, including:

[0107] Set an analysis period;

[0108] Retrieve the change curve of communication resource occupancy of all communication nodes under the communication node class over time during the analysis period;

[0109] Based on the change curve of communication resource occupancy over time in the analysis period, a function of communication resource occupancy over time in the analysis period is fitted;

[0110] The general indicator function of the communication node class is as follows:

[0111]

[0112] In the formula, It is a general indicator function of the communication node class. is the derivative function of the function of the hth communication node's communication resource occupancy changing with time during the analysis period, It is the total number of communication nodes under the communication node class.

[0113] Reference Figure 5 As shown, the comprehensive evaluation of whether there is data anomaly in the communication node specifically includes:

[0114] The difference between the estimated value of the communication resource occupancy of the communication node and the actual value of the communication resource occupancy of the communication node is compared with the estimated value of the communication resource occupancy to obtain an individual evaluation deviation index of the communication node;

[0115] The individual evaluation deviation indicators of all communication nodes under the communication node class are organized into the individual evaluation deviation indicator set A corresponding to the communication node class. ,in, is the individual evaluation deviation index of the hth communication node under the communication node class;

[0116] Based on the general indicator function of the communication node class, the category evaluation deviation index of the communication node is calculated and formed into a category evaluation deviation index set B corresponding to the communication node class. ,in, Evaluate the deviation index for the class of the hth communication node under the communication node class;

[0117] Based on the comprehensive evaluation formula, the comprehensive deviation index of the communication node is calculated, and it is determined whether the comprehensive deviation index of the communication node is greater than a preset value. If so, it is determined that there is data anomaly in the communication node. If not, it is determined that there is no data anomaly in the communication node.

[0118] The calculation formula for the category evaluation deviation index is:

[0119] in, The duration of the analysis cycle;

[0120] The comprehensive evaluation formula is as follows:

[0121]

[0122] In the formula, It is the comprehensive deviation index of the hth communication node under the communication node class.

[0123] It can be understood that communication nodes of the same category usually have consistency in the network communication status, that is, there will be a similar synchronous rise or a similar synchronous fall. Based on this, the category evaluation deviation index is used in this scheme to evaluate the consistency of data changes between a communication node and other communication nodes of the same category. At the same time, combined with the deviation between the actual value and the estimated value of the communication node, the data status of the communication node is comprehensively evaluated, which can effectively evaluate whether there is any abnormality in the communication node in the overall communication network, and conduct rapid verification of the communication node in a timely manner.

[0124] Furthermore, based on the same inventive concept as the above-mentioned network security management method based on the big data model, this solution also proposes a network security management system based on the big data model, including:

[0125] A storage module, the storage module is used to store the communication network including all communication node information;

[0126] A classification module, the classification module is electrically connected to the storage module, and the classification module is used to classify all communication nodes in the communication network based on communication node attributes to obtain a plurality of communication node classes;

[0127] A fitting evaluation module, the fitting evaluation module is electrically connected to the classification module, and is used to evaluate and generate individual indicators of communication nodes based on the historical change log of communication resource occupancy of each communication node in the communication network, and to generate a general indicator function for each communication node class based on the recent historical change log of communication resource occupancy of all communication nodes in the communication network;

[0128] A communication node analysis module, the communication node analysis module is electrically connected to the fitting evaluation module, and the communication node analysis module is used to determine the communication resource occupancy data of the communication node in the communication network, and comprehensively evaluate whether the communication node has data anomalies based on the individual index of the communication node and the general index function of the communication node class corresponding to the communication node. If so, an abnormal flag is added to the communication node, and if not, no response is made;

[0129] The output module is electrically connected to the communication node analysis module, and is used to output all communication nodes with additional abnormal identifications.

[0130] Optionally, the fit assessment module includes:

[0131] An individual analysis unit, the individual analysis unit is used to evaluate and generate individual indicators of communication nodes based on a historical change log of communication resource occupancy of each communication node in the communication network;

[0132] The category analysis unit is used to generate a general indicator function for each communication node class based on the recent historical change log of the communication resource occupancy of all communication nodes in the communication network.

[0133] Optionally, the communication node analysis module includes:

[0134] The individual fitting unit is used to compare the difference between the estimated value of the communication resource occupancy of the communication node and the actual value of the communication resource occupancy of the communication node with the estimated value of the communication resource occupancy, obtain the individual evaluation deviation index of the communication node, and organize the individual evaluation deviation indexes of all communication nodes under the communication node class into an individual evaluation deviation index set A corresponding to the communication node class;

[0135] A category fitting unit, which is used to calculate the category evaluation deviation index of the communication node based on the general index function of the communication node class, and form a category evaluation deviation index set B corresponding to the communication node class;

[0136] The comprehensive fitting unit is used to calculate the comprehensive deviation index of the communication node based on the comprehensive evaluation formula, and determine whether the comprehensive deviation index of the communication node is greater than a preset value. If so, it is determined that there is data anomaly in the communication node. If not, it is determined that there is no data anomaly in the communication node.

[0137] The process of using the above system is:

[0138] Step 1: The classification module classifies all communication nodes in the communication network stored by the storage module based on the communication node attributes to obtain several communication node classes;

[0139] Step 2: The fitting evaluation module calls the individual analysis unit based on the historical change log of the communication resource occupancy of each communication node in the communication network to evaluate and generate the individual index of the communication node, and at the same time calls the category analysis unit based on the recent historical change log of the communication resource occupancy of all communication nodes in the communication network to generate the general index function of each communication node class;

[0140] Step 3: The communication node analysis module calls the individual fitting unit to compare the difference between the estimated communication resource occupancy value of the communication node and the actual communication resource occupancy value of the communication node with the estimated communication resource occupancy value, and obtains the individual evaluation deviation index of the communication node, and organizes the individual evaluation deviation indicators of all communication nodes under the communication node class into an individual evaluation deviation indicator set A corresponding to the communication node class, and at the same time calls the category fitting unit based on the general indicator function of the communication node class to calculate the category evaluation deviation index of the communication node, and organizes it into a category evaluation deviation indicator set B corresponding to the communication node class;

[0141] Step 4: The communication node analysis module calls the comprehensive fitting unit to calculate the comprehensive deviation index of the communication node based on the comprehensive evaluation formula, and determines whether the comprehensive deviation index of the communication node is greater than the preset value. If so, it is determined that there is data anomaly in the communication node. If not, it is determined that there is no data anomaly in the communication node.

[0142] Step 5: The output module outputs all communication nodes with additional abnormal identification in any visible form such as sound or light.

[0143] In summary, the advantages of the present invention are that it can effectively identify abnormal data status in communication nodes, and through comprehensive analysis from all aspects, it can quickly and accurately check communication nodes with abnormal status, thereby achieving efficient comprehensive management of the communication network.

[0144] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The above embodiments and descriptions only describe the principles of the present invention. The present invention may be subject to various changes and improvements without departing from the spirit and scope of the present invention. These changes and improvements fall within the scope of the present invention. The scope of protection claimed by the present invention is defined by the attached claims and their equivalents.

Claims

1. A network security management method based on a big data model, characterized in that: include: Get information about all communication nodes in the communication network; Based on the communication node attributes, all communication nodes in the communication network are classified to obtain several communication node classes; Based on the historical change log of the communication resource usage of each communication node in the communication network, the individual indicators of the communication nodes are evaluated and generated; Generate a general indicator function for each communication node class based on the recent historical change log of the communication resource usage of all communication nodes in the communication network; Determine the communication resource occupancy data of the communication nodes in the communication network, and comprehensively evaluate whether the communication nodes have data anomalies based on the individual indicators of the communication nodes and the general indicator function of the communication node class corresponding to the communication nodes. If so, add an abnormal flag to the communication nodes, otherwise, do not respond; Output all communication nodes with additional abnormal identification, and review the communication status of the communication nodes with additional abnormal identification; The evaluation and generation of individual indicators of communication nodes based on the historical change log of the communication resource occupancy of each communication node in the communication network specifically includes: Determine several evaluation criteria for communication resource usage; Based on each evaluation scale of communication resource occupancy, a communication resource occupancy fitting value of a communication node under each evaluation scale is predicted based on a fitting prediction method; Determine an evaluation loss value of an estimated value of communication resource occupancy of a communication node under each evaluation scale, and determine a fitting weight of each evaluation scale based on the evaluation loss value; Based on the fitting weight of each evaluation scale and the fitting value of the communication resource occupancy of the communication node under each evaluation scale, the communication resource occupancy estimation value of the communication node is calculated by the estimation calculation formula; The estimated value of the communication resource occupancy of the communication node is recorded as the individual indicator of the communication node; The specific estimation formula is: In the formula, Z pre is the estimated value of the communication resource occupancy of the communication node, α i is the fitting weight of the i-th evaluation scale, Z i is the communication resource occupancy fitting value of the communication node under the i-th evaluation scale, and n is the total number of evaluation scales; The general indicator function for each communication node class is generated based on the recent historical change log of the communication resource occupancy of all communication nodes in the communication network, specifically including: Set an analysis period; Retrieve the change curve of communication resource occupancy of all communication nodes under the communication node class over time during the analysis period; Based on the change curve of communication resource occupancy over time in the analysis period, a function of communication resource occupancy over time in the analysis period is fitted; The general indicator function of the communication node class is as follows: Where F(t) is the general indicator function of the communication node class, f' h (t) is the derivative function of the function of the hth communication node communication resource occupancy under the communication node class changing with time during the analysis period, and H is the total number of communication nodes under the communication node class; The comprehensive evaluation of whether the communication node has data anomalies specifically includes: The difference between the estimated value of the communication resource occupancy of the communication node and the actual value of the communication resource occupancy of the communication node is compared with the estimated value of the communication resource occupancy to obtain an individual evaluation deviation index of the communication node; The individual evaluation deviation indicators of all communication nodes under the communication node class are organized into the individual evaluation deviation indicator set A corresponding to the communication node class, A = {a1…a h …a H }, where a h is the individual evaluation deviation index of the hth communication node under the communication node class; Based on the general indicator function of the communication node class, the category evaluation deviation index of the communication node is calculated, and a category evaluation deviation index set B corresponding to the communication node class is formed, B = {b1…b h …b H }, where b h Evaluate the deviation index for the class of the hth communication node under the communication node class; Based on the comprehensive evaluation formula, the comprehensive deviation index of the communication node is calculated, and it is determined whether the comprehensive deviation index of the communication node is greater than a preset value. If so, it is determined that there is data anomaly in the communication node. If not, it is determined that there is no data anomaly in the communication node. The calculation formula of the category evaluation deviation index is: Where T is the duration of the analysis cycle; The comprehensive evaluation formula is specifically: In the comprehensive evaluation formula, C h It is the comprehensive deviation index of the hth communication node under the communication node class.

2. A network security management method based on a big data model according to claim 1, characterized in that: The method of predicting the communication resource occupancy fitting value of the communication node under each evaluation scale based on each evaluation scale based on the fitting prediction method specifically includes: Based on each evaluation scale, select a number of communication resource occupancy history values ​​of communication nodes corresponding to the evaluation scale from the historical change log of communication resource occupancy, and record them as sample data of the evaluation scale; The sample data of the evaluation scale are numbered in order from the earliest to the latest time; According to the fitting formula, the communication resource occupancy fitting value of the communication node under the evaluation scale is calculated; The fitting formula is: Where p0 is the communication resource occupancy fitting value of the communication node, p j The sample data numbered is j, and m is the total number of sample data.

3. A network security management method based on a big data model according to claim 2, characterized in that: The step of determining the estimated value of the communication resource occupation of the communication node under each evaluation scale and determining the fitting weight of each evaluation scale based on the estimated value specifically includes: The calculation formula of the assessed loss value is: In the calculation formula for evaluating the loss value, R loss The estimated loss value for the estimated occupation of communication resources; The fitting weights of the evaluation scale are: In the formula, R loss i is the estimated loss value of the communication resource occupancy of the communication node under the i-th evaluation scale, R loss max is the maximum value of the estimated loss value of the communication resource occupancy of the communication node under all evaluation scales, R loss min It is the minimum value of the evaluation loss value of the communication resource occupancy estimate of the communication node under all evaluation scales.

4. A network security management system based on a big data model, characterized in that: A method for implementing a network security management method based on a big data model as claimed in any one of claims 1 to 3, comprising: A storage module, the storage module is used to store the communication network including all communication node information; A classification module, the classification module is electrically connected to the storage module, and the classification module is used to classify all communication nodes in the communication network based on communication node attributes to obtain a plurality of communication node classes; A fitting evaluation module, the fitting evaluation module is electrically connected to the classification module, and is used to evaluate and generate individual indicators of communication nodes based on the historical change log of communication resource occupancy of each communication node in the communication network, and to generate a general indicator function for each communication node class based on the recent historical change log of communication resource occupancy of all communication nodes in the communication network; A communication node analysis module, the communication node analysis module is electrically connected to the fitting evaluation module, and is used to determine the communication resource occupancy data of the communication nodes in the communication network, and comprehensively evaluate whether the communication nodes have data anomalies based on the individual indicators of the communication nodes and the general indicator function of the communication node class corresponding to the communication nodes. If so, an abnormal flag is added to the communication node, and if not, no response is made; An output module, the output module is electrically connected to the communication node analysis module, and the output module is used to output all communication nodes with additional abnormal identifications.

5. A network security management system based on a big data model according to claim 4, characterized in that: The fitting assessment module includes: An individual analysis unit, the individual analysis unit is used to evaluate and generate individual indicators of communication nodes based on a historical change log of communication resource occupancy of each communication node in the communication network; A category analysis unit, wherein the category analysis unit is used to generate a general indicator function for each communication node class based on a recent historical change log of the communication resource occupancy of all communication nodes in the communication network.

6. A network security management system based on a big data model according to claim 5, characterized in that: The communication node analysis module includes: An individual fitting unit, wherein the individual fitting unit is used to compare a difference obtained by subtracting an estimated value of the communication resource occupancy of the communication node from an actual value of the communication resource occupancy of the communication node with the estimated value of the communication resource occupancy, to obtain an individual evaluation deviation index of the communication node, and to organize the individual evaluation deviation indexes of all communication nodes under the communication node class into an individual evaluation deviation index set A corresponding to the communication node class; A category fitting unit, the category fitting unit is used to calculate the category evaluation deviation index of the communication node based on the general index function of the communication node class, and form a category evaluation deviation index set B corresponding to the communication node class; A comprehensive fitting unit, wherein the comprehensive fitting unit is used to calculate the comprehensive deviation index of the communication node based on the comprehensive evaluation formula, and to determine whether the comprehensive deviation index of the communication node is greater than a preset value. If so, it is determined that there is data anomaly in the communication node; if not, it is determined that there is no data anomaly in the communication node.

Images