A network security situation assessment method, device, medium and product

Abstract

This application discloses a network security situation assessment method, device, medium, and product, relating to the field of network security. The method includes: obtaining network traffic data within a set time period to obtain a network traffic data set; classifying each network traffic data in the network traffic data set based on a network security situation assessment model; calculating a network security situation value based on the category of each network traffic data to determine the network security situation; the network security situation assessment model includes a feature extraction network, a recurrent neural network, and a fully connected layer connected in sequence; the feature extraction network uses full-dimensional dynamic convolution and a multi-scale efficient channel attention mechanism to extract features from the network traffic data, the recurrent neural network performs time series modeling on the features output by the feature extraction network, and the fully connected layer determines the category of the network traffic data based on the time series data output by the recurrent neural network. This application improves the accuracy of network security situation assessment.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network security situation assessment method, device, medium and product. Background Art

[0002] With the continuous development of Internet infrastructure and the emergence of new applications, network scale continues to expand, topologies become increasingly complex, and network security issues become increasingly prominent. Traditional network security measures are no longer able to meet the current complex network security needs. Therefore, there is an urgent need for advanced technologies that can comprehensively assess network security situation. Network security situational awareness technology has the advantage of integrating information resources. By comprehensively analyzing data such as network traffic, behavior logs, and security events, it can promptly identify abnormal activities and potential threats in the network, allowing timely response measures to be taken, thereby improving the security and reliability of network systems.

[0003] Network security situation assessment technology evaluates the security status of network systems by collecting and analyzing information such as the operating status of each component in the network, security incidents, and attack behaviors. Existing network security situation assessment models are generally based on convolutional neural networks. However, when convolutional neural networks have strong temporal dependencies on data, they may not be able to capture complex patterns in time series. Given the increasing complexity of network security, existing network security situation assessment models struggle to accurately assess network security. Summary of the Invention

[0004] The purpose of this application is to provide a network security situation assessment method, equipment, medium and product that can improve the accuracy of network security situation assessment.

[0005] To achieve the above objectives, this application provides the following solutions:

[0006] In a first aspect, the present application provides a network security situation assessment method, comprising:

[0007] Obtain network traffic data within a set period of time to obtain a network traffic data set;

[0008] Based on the network security situation assessment model, each network flow data in the network flow data set is classified respectively to determine the category of each network flow data; the network security situation assessment model is pre-trained using a training sample set, and the training sample set includes multiple groups of network flow sample data and corresponding categories; the network security situation assessment model includes a feature extraction network, a recurrent neural network and a fully connected layer connected in sequence; the feature extraction network uses full-dimensional dynamic convolution and multi-scale efficient channel attention mechanism to extract features from the network flow data, the recurrent neural network performs time series modeling on the features output by the feature extraction network, and the fully connected layer determines the category of the network flow data based on the time series data output by the recurrent neural network;

[0009] A network security situation value is calculated according to the category of each network traffic data to determine the network security situation within the set time period.

[0010] In a second aspect, the present application provides a computer device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above-mentioned network security situation assessment method.

[0011] In a third aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which implements the above-mentioned network security situation assessment method when executed by a processor.

[0012] In a fourth aspect, the present application provides a computer program product, including a computer program, which implements the above-mentioned network security situation assessment method when executed by a processor.

[0013] According to the specific embodiments provided in this application, this application discloses the following technical effects:

[0014] The present application provides a network security situation assessment method, device, medium and product. In the network security situation assessment model, Omni-Dimensional Dynamic Convolution (ODConv) and Multi-Scale Efficient Channel Attention Mechanism (MSECA) are used to extract features from network traffic data. ODConv can gradually reduce the size of the feature map and increase the number of channels. Combined with MSECA, a focus strategy for different channels can be implemented. While retaining detailed information, it can capture broader and more comprehensive semantic information, thereby improving the model's ability to capture data features. A recurrent neural network (Bidirectional Recurrent Neural Network, BiGRU) is used to perform time series modeling on the features output by the feature extraction network. The spatiotemporal correlation of the data is comprehensively considered, so that the network security situation assessment model can better understand the temporal relationships and patterns in the time series data, thereby improving the accuracy of the network security situation assessment. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0016] Figure 1 This is an application environment diagram of a network security situation assessment method in one embodiment of the present application;

[0017] Figure 2 A flowchart of a network security situation assessment method provided in one embodiment of the present application;

[0018] Figure 3 A schematic diagram of the calculation process of the network security situation value provided in one embodiment of the present application;

[0019] Figure 4 Schematic diagram of the training process of the network security situation assessment model;

[0020] Figure 5 A schematic diagram of the structure of a network security situation assessment model provided in one embodiment of the present application;

[0021] Figure 6 Schematic diagram of the full-dimensional dynamic convolutional layer;

[0022] Figure 7 Schematic diagram of the efficient channel attention mechanism layer;

[0023] Figure 8 Schematic diagram of the multi-scale efficient channel attention mechanism layer;

[0024] Figure 9 A schematic diagram of the structure of a computer device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0025] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0026] In order to make the above-mentioned purposes, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0027] The network security situation assessment method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be set up separately, or it can be integrated on the server 104, or it can be placed on the cloud or other servers. The terminal 102 can send the network traffic data to be processed to the server 104. After receiving the network traffic data to be processed, the server 104 classifies it based on the network security situation assessment model and calculates the network security situation value. The server 104 can feedback the obtained network security situation value to the terminal 102. In addition, in some embodiments, the network security situation assessment method can also be implemented separately by the server 104 or the terminal 102.

[0028] Terminal 102 may include, but is not limited to, various desktop computers, laptops, smartphones, tablet computers, IoT devices, and portable wearable devices. IoT devices may include smart speakers, smart TVs, smart air conditioners, and smart car devices. Portable wearable devices may include smart watches, smart bracelets, and head-mounted devices. Server 104 may be implemented as a standalone server or a server cluster consisting of multiple servers, or may be a cloud server.

[0029] In an exemplary embodiment, Figure 2 and Figure 3As shown, a network security situation assessment method is provided. The method is executed by a computer device, specifically a computer device such as a terminal or a server, or a terminal and a server. In the embodiment of the present application, the method is applied to Figure 1 Taking the server 104 in FIG. 1 as an example, the method includes the following steps 201 to 203. In which:

[0030] Step 201: Acquire network traffic data within a set period to obtain a network traffic data set.

[0031] Specifically, the network traffic data within a set period is first acquired, and then the network traffic data within the set period is sequentially digitized, standardized, and normalized to obtain a network traffic data set.

[0032] The network traffic data includes multiple values. After preprocessing, the network traffic data is 196-feature data and is converted into a 14*14 feature map.

[0033] Step 202: Based on the network security situation assessment model, classify each network traffic data in the network traffic data set to determine the category of each network traffic data.

[0034] The network security situation assessment model is obtained by pre-training using a training sample set, and the training sample set includes multiple groups of network traffic sample data and corresponding categories.

[0035] Furthermore, if Figure 4 As shown, in the training process of the network security situation assessment model, the network traffic sample data is first preprocessed. This application processes the UNSW-NB15 dataset, and the processing operations include: digitization, standardization and normalization operations.

[0036] ① Numericalization: Using UNSW_NB15_testing-set.csv and UNSW_NB15_training-set.csv, which contain a total of 43 features, we used one-hot encoding to convert non-numeric features in the dataset into numerical features to ensure that all data is digital, thereby facilitating the cybersecurity situation assessment model to learn data features.

[0037] ② Standardization: In order to reduce the impact of outliers on the classification results, the network traffic sample data is converted into a data set with a mean of 0 and a variance of 1 according to the mean and standard deviation of the network traffic sample data.

[0038] ③ Normalization: Since the values ​​of different eigenvalues ​​may vary greatly, normalization is used to scale the data proportionally and bring them into the same small range. Specifically, the maximum value normalization method is used to normalize the eigenvalues ​​to between 0 and 1.

[0039] The preprocessed data is then divided into a training set, a test set, and a validation set. A batch of samples is selected from the training set to train the network security situation assessment model. Each round of training determines whether the generalization ability of the model has improved. If so, the model is saved. If not, the next round of training is continued until the number of training times reaches the upper limit. The optimizer is used to optimize the parameters of the network security situation assessment model, and then the validation set is sent to the network security situation assessment model for training. Then, the result is compared with the previous result. If the result is better than the previous result, the network security situation assessment model of this training is saved and the training continues. Otherwise, the above process is continued until the number of training cycles is reached. The test set is then sent to the trained network security situation assessment model for evaluation. Specifically, the test set is first sent to the network security situation assessment model for classification, and then the network security situation value is calculated.

[0040] In one exemplary embodiment, the UNSW-NB15 dataset contains ten types of network traffic data: Normal, Analysis, Reconnaissance, Fuzzers, Denial of Service (DoS), Generic, Shellcode, Worms, Backdoor, and Exploits. The UNSW-NB15 dataset does not contain true state values, so this application uses the following calculation method to quantify the state value representing the degree of network security over a certain period.

[0041] First, the types in the UNSW-NB15 dataset are numerically processed, corresponding to ten types from 0 to 9. The final output of the network security situation assessment model is an integer from 0 to 9 to identify different categories.

[0042] According to the order of each sample collected in the UNSW-NB15 dataset, every 3000 samples are regarded as an period. The impact factors corresponding to the attacks in the dataset are shown in Table 1.

[0043] Table 1 Attack impact factors of the UNSW-NB15 dataset

[0044] Attack Type Normal Analysis Reconnaissance Fuzzers DoS Impact Factor 1 2 3 4 5 Attack Type Generic Shellcode Worms Exploits Backdoor Impact Factor 6 7 8 9 10

[0045] This application quantifies the above 10 types of network traffic data and obtains the impact factor of each type of network traffic data. The network security situation value is intended to quantify the network security status and can intuitively reflect the overall security status of the network. The network security situation value proposed in this application is calculated by first calculating the network security situation value based on the impact factor of each type of network traffic data, and then normalizing the network security situation value to obtain the network security situation value.

[0046] like Figure 5 As shown, the network security situation assessment model includes a feature extraction network, a recurrent neural network, and a fully connected layer, which are connected in sequence. The feature extraction network uses full-dimensional dynamic convolution and a multi-scale efficient channel attention mechanism to extract features from network traffic data. The recurrent neural network performs time series modeling on the features output by the feature extraction network. The fully connected layer determines the category of network traffic data based on the time series data output by the recurrent neural network.

[0047] In this application, step 202 includes:

[0048] (1) For any network traffic data in the network traffic dataset, the feature extraction network is used to extract features of the network traffic data using full-dimensional dynamic convolution and multi-scale efficient channel attention mechanism to obtain network traffic features.

[0049] The feature extraction network includes a first feature extraction unit, a second feature extraction unit and a third feature extraction unit which are connected in sequence.

[0050] The first feature extraction unit includes a convolutional layer, a multi-scale efficient channel attention mechanism layer, a batch normalization layer and an activation function connected in sequence.

[0051] The second feature extraction unit includes a full-dimensional dynamic convolution layer, a multi-scale efficient channel attention mechanism layer, a maximum pooling layer, a batch normalization layer and an activation function connected in sequence.

[0052] The third feature extraction unit includes a full-dimensional dynamic convolution layer, an efficient channel attention mechanism (ECA) layer, a maximum pooling layer, a batch normalization layer and an activation function connected in sequence.

[0053] The scales of the multi-scale efficient channel attention mechanism layers of the first feature extraction unit and the second feature extraction unit are different. The third feature extraction unit only uses the ECA layer for channel attention, which is more suitable for feature extraction of network security data and can reduce computational complexity and improve efficiency.

[0054] Network traffic data first enters the first feature extraction unit, where it is expanded through a convolutional layer to increase the number of channels. It then uses a multi-scale, efficient channel attention mechanism layer to perform channel-wise attention and feature extraction. Finally, a batch normalization layer and activation function are applied to process the features.

[0055] The features extracted by the first feature extraction unit are fed into the second feature extraction unit. A full-dimensional dynamic convolution layer dynamically adjusts the convolution kernel for feature extraction, reducing the size of the feature map and expanding the number of channels. A multi-scale efficient channel attention mechanism layer then focuses on channel-wise feature extraction. A maximum pooling layer retains key features and reduces data complexity. Finally, a batch normalization layer and activation function are applied to process the features.

[0056] The features extracted by the second feature extraction unit are fed into the third feature extraction unit. A full-dimensional dynamic convolution layer adjusts the convolution kernel for feature extraction, reducing the size of the feature map and expanding the number of channels. The ECA layer then performs channel-wise attention, and a max pooling layer preserves key features and reduces data complexity. Finally, a batch normalization layer and activation function are applied to process the features.

[0057] like Figure 6 As shown, the full-dimensional dynamic convolution layer focuses on the following four dimensions of the kernel space: the spatial kernel size is k×k, the number of input channels is C in , output channel number C out And the number of convolution kernels n. First, the input data x is compressed to C by channel-by-channel global average pooling. in The feature vector is transformed into a feature vector of length , and passes through a fully connected layer and a rectified linear unit. Then, it passes through four head branches, each of which has an output size of k × k, C in ×1, C out ×1 and n×1 fully connected layers, and an activation function, where the activation functions of the 1st to 3rd head branches are Sigmoid functions, and the activation function of the 4th head branch is Sofmax function, to generate normalized attention weights on each dimension. Next, the attention weights on the four dimensions are applied to the original convolution kernel set respectively, and the adjusted convolution kernel set performs convolution operation on the input data x to obtain the output feature y. s1 ~a sm is the spatial attention weight, a c1 ~a cm is the input channel attention weight, a f1 ~a fm is the output channel attention weight, a w1 ~a wm is the convolution kernel attention weight, W1~W m is the original convolution kernel set.

[0058] like Figure 7 As shown in the figure, for each channel of the input feature map Y with height H, width W, and number of channels C, the efficient channel attention mechanism layer first performs a global pooling operation (typically average pooling) to obtain the average response of the channel in the spatial dimension. These pooled features are then processed through a one-dimensional convolution with an adaptively selected kernel size (for example, a kernel of 5) to calculate the attention weight for each channel. Finally, the calculated channel attention weights are applied to the original feature map, and the final feature representation Y' is generated by a weighted summation per channel.

[0059] like Figure 8 As shown in the figure, the multi-scale efficient channel attention mechanism layer first divides the channels into four groups by evenly distributing them for convolution operations of different scales, and then performs feature fusion at the channel level. Next, ECA is applied to each group according to the previous channel grouping to enhance channel attention capabilities. Specifically, four groups of weight information of size 1×1×C / 4 are first extracted, and feature fusion is performed at the channel level to generate overall weight information of size 1×1×C. These weights are then multiplied element-wise with the extracted features, and the resulting channel attention weights are applied to the feature map.

[0060] (2) Time series modeling of the network traffic characteristics is performed through the recurrent neural network to obtain time series data.

[0061] The recurrent neural network includes a first recurrent neural network layer, a first random dropout layer, a second recurrent neural network layer and a second random dropout layer connected in sequence.

[0062] The network traffic features are input into the recurrent neural network. Both the first and second recurrent neural network layers need to be randomly inactivated to reduce the dependency between neurons and prevent the network security situation assessment model from overfitting on the training sample set.

[0063] (3) Determine the category of the network traffic data based on the time series data through the fully connected layer.

[0064] The network security situation assessment model provided in this application fully considers the application needs of deep learning in the field of network security. First, ODConv is used to gradually reduce the size of the feature map and increase the number of channels. MSECA is combined to implement a focus strategy for different channels. Compared with the ordinary channel attention mechanism, by adjusting the channel attention at different scales, it can capture more extensive and comprehensive semantic information while retaining detailed information, which helps the model better understand the input data. It also achieves efficient allocation of channel attention, and can enable the model to adapt to various complex data features without adding a large number of parameters, thereby improving the model's ability to capture data features and thus improving the model's performance. The result of feature extraction is input into BiGRU for time series modeling. Taking into account the spatiotemporal correlation of the data, it can effectively extract the features of the data in time and space, enabling the network security situation assessment model to better understand the temporal relationships and patterns in time series data, improve the modeling ability for time-dependent data, and thus improve the accuracy of network security situation assessment.

[0065] Step 203 : Calculate the network security situation value according to the category of each network traffic data to determine the network security situation within the set time period.

[0066] The categories of network traffic data include: normal, analysis attack, reconnaissance attack, fuzz testing, denial of service, Trojan attack, vulnerability code, worm, backdoor and penetration attack.

[0067] In an exemplary embodiment, in step 203, first, according to the category of each network traffic data, the formula Calculate the network security value; where SV is the network security value, N is the number of network traffic data, T is the number of categories of network traffic data, Q i is the number of the i-th type of network traffic data in the network traffic dataset, E i is the impact factor of the i-th type of network traffic data on the network status. Then the network security status value is normalized to obtain the network security situation value.

[0068] In practical applications, after classifying the actual network traffic data through the network security situation assessment model, it is analyzed according to the actual situation, the number of traffic samples in a period is reset and the impact factor corresponding to the attack is re-quantified, the network security situation value is calculated using the same network security situation value calculation formula, and the network security situation level is divided into levels using the level classification standard.

[0069] This application further divides the network security level into four levels. The higher the network security situation value, the greater the security risk faced by the network. The level division can enable network security personnel to have a more intuitive understanding of the network security status. The correspondence between the network security situation value and the network security situation level is shown in Table 2.

[0070] Table 2 Correspondence between network security situation value and network security situation level

[0071] Network security status value Cybersecurity posture level 0.00～0.22 Safety 0.22～0.42 Low risk 0.42～0.72 Medium risk 0.72～1.00 High risk

[0072] This application uses a feature extraction network combined with BiGRU to perform network security situation assessment. After feature extraction in the feature extraction network, since network traffic data has rich time dependencies, these features are input into BiGRU for sequence modeling to better perform network security situation assessment and solve the problem that convolutional neural networks may not be able to capture complex patterns in time series when there is a strong time dependency in the data. In the feature extraction network, ODConv is used to improve the feature extraction capability, and MSECA is used to enhance the representation capability of important channels. This solves the problem of weak feature extraction capability and insufficient attention to channels in ordinary convolution during the feature extraction process, thereby improving the accuracy of network security situation assessment.

[0073] In an exemplary embodiment, a computer device is provided. The computer device may be a server or a terminal. The internal structure diagram thereof may be as follows: Figure 9 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, abbreviated as I / O) and a communication interface. The processor, memory and input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used to store network traffic data and a network security situation assessment model. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a network security situation assessment method is implemented.

[0074] Those skilled in the art will understand that Figure 9The structure shown in the figure is merely a block diagram of a portion of the structure related to the solution of the present application and does not constitute a limitation on the computer device to which the solution of the present application is applied. A specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement. In an exemplary embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor implements the steps of the above-mentioned method embodiments when executing the computer program.

[0075] In an exemplary embodiment, a computer-readable storage medium is provided, storing a computer program. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0076] In an exemplary embodiment, a computer program product is provided, including a computer program. When the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0077] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0078] Those skilled in the art will understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, database or other media used in the embodiments provided in this application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory may include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM may be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0079] The databases involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, distributed databases based on blockchains. The processors involved in the various embodiments provided herein may include, but are not limited to, general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic units, data processing logic units based on quantum computing, and the like.

[0080] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0081] This document uses specific examples to illustrate the principles and implementation methods of this application. The description of the above examples is only intended to help understand the method and core concept of this application. At the same time, for those skilled in the art, based on the concept of this application, there may be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting this application.

Claims

1. A network security situation assessment method, characterized in that: The network security situation assessment method includes: Obtain network traffic data within a set period of time to obtain a network traffic data set; Based on the network security situation assessment model, each network traffic data in the network traffic data set is classified respectively to determine the category of each network traffic data; the network security situation assessment model is pre-trained using a training sample set, and the training sample set includes multiple groups of network traffic sample data and corresponding categories; the network security situation assessment model includes a feature extraction network, a recurrent neural network and a fully connected layer connected in sequence; the feature extraction network uses full-dimensional dynamic convolution and multi-scale efficient channel attention mechanism to extract features from network traffic data, the recurrent neural network performs time series modeling on the features output by the feature extraction network, and the fully connected layer determines the network traffic according to the time series data output by the recurrent neural network. The feature extraction network includes a first feature extraction unit, a second feature extraction unit and a third feature extraction unit connected in sequence; the first feature extraction unit includes a convolution layer, a multi-scale efficient channel attention mechanism layer, a batch normalization layer and an activation function connected in sequence; the second feature extraction unit includes a full-dimensional dynamic convolution layer, a multi-scale efficient channel attention mechanism layer, a maximum pooling layer, a batch normalization layer and an activation function connected in sequence; the third feature extraction unit includes a full-dimensional dynamic convolution layer, an efficient channel attention mechanism layer, a maximum pooling layer, a batch normalization layer and an activation function connected in sequence; the full-dimensional dynamic convolution layer pays attention to the following four dimensions of the kernel space: spatial kernel size, number of input channels, number of output channels and number of convolution kernels; According to the category of each network traffic data, the formula Calculate the network security value; where SV is the network security value, N is the number of network traffic data, T is the number of categories of network traffic data, Q i is the number of the i-th type of network traffic data in the network traffic dataset, E i is the impact factor of the i-th type of network traffic data on the network status; The network security situation value is normalized to obtain a network security situation value to determine the network security situation within the set time period.

2. The network security situation assessment method according to claim 1, characterized in that: Get the network traffic data within the set time period and obtain the network traffic data set, including: Get network traffic data within a set period; The network traffic data within the set time period is sequentially digitized, standardized and normalized to obtain a network traffic data set.

3. The network security situation assessment method according to claim 1, characterized in that: Based on the network security situation assessment model, each network traffic data in the network traffic data set is classified to determine the category of each network traffic data, specifically including: For any network traffic data in the network traffic dataset, the feature extraction network is used to extract features of the network traffic data using full-dimensional dynamic convolution and multi-scale efficient channel attention mechanism to obtain network traffic features; Performing time series modeling on the network traffic characteristics through the recurrent neural network to obtain time series data; The category of the network traffic data is determined according to the time series data through the fully connected layer.

4. The network security situation assessment method according to claim 3, characterized in that: The recurrent neural network includes a first recurrent neural network layer, a first random dropout layer, a second recurrent neural network layer and a second random dropout layer connected in sequence.

5. The network security situation assessment method according to claim 1, characterized in that: The categories of network traffic data include: normal, analysis attack, reconnaissance attack, fuzz testing, denial of service, Trojan attack, vulnerability code, worm, backdoor and penetration attack.

6. A computer device comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the network security situation assessment method according to any one of claims 1 to 5.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the network security situation assessment method according to any one of claims 1 to 5 is implemented.

8. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the network security situation assessment method according to any one of claims 1 to 5 is implemented.

Images