A network security protection method based on edge computing

Abstract

The present invention discloses a network security protection method based on edge computing, which relates to the field of network security technology and includes the following security protection steps: inputting the severity value of the ith threat processed by the data processing module and the probability of occurrence of the ith threat into the network protection module, and outputting the real-time threat assessment index at the current time t, the security response priority at the current time t, and the security policy adjustment factor at the next time t+1. The present invention has the advantages of comprehensively considering factors such as the type of security threat and the scope of threat impact, so as to more accurately analyze and evaluate the severity of network threats, and also fully considers the limitations of currently available resources, and by dynamically adjusting the response priority, it ensures that the most critical security threats are handled first in the case of limited resources, has excellent intelligence, and can effectively integrate and optimize the utilization of multiple resources in the edge computing environment to a certain extent.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and specifically to a network security protection method based on edge computing. Background Art

[0002] Edge computing significantly improves the speed and efficiency of data processing by pushing data processing and storage tasks from the cloud to the edge of the network, such as IoT devices and smart terminals. However, it also brings certain security issues.

[0003] However, the existing security protection systems currently rely on traditional threat detection mechanisms, which often lag behind when facing rapidly changing network threats, making it difficult to effectively assess the severity of the threats. In addition, when determining security response priorities, the existing security protection systems may ignore the limitations of currently available resources, which may result in high-priority threats not being responded to in a timely manner when resources are tight, resulting in poor practicality. Summary of the invention

[0004] The purpose of the present invention is to provide a network security protection method based on edge computing, which solves the problems raised in the above-mentioned background technology.

[0005] To achieve the above object, the present invention provides the following technical solution: a network security protection method based on edge computing, comprising the following security protection steps:

[0006] S1: collects real-time network traffic, logs, and security event data from edge devices and cloud servers through the data collection module;

[0007] S2: The data processing module cleans, de-duplicates and formats the collected real-time network traffic, logs and security event data, and outputs the severity value of the i-th threat and the probability of occurrence of the i-th threat;

[0008] S3: Input the severity value of the i-th threat and the occurrence probability of the i-th threat processed by the data processing module into the network protection module, and output the real-time threat assessment index at the current time t, the security response priority at the current time t, and the security policy adjustment factor at the next time t+1;

[0009] S4: The real-time threat assessment index at the current time t, the security response priority at the current time t, and the security policy adjustment factor at the next time t+1 are input into the display arrangement module, and the real-time threat assessment index at the current time t, the security response priority at the current time t, and the security policy adjustment factor at the next time t+1 are summarized and displayed on the display device through the display arrangement module, and a response plan is formulated and security measures are implemented based on the security policy adjustment factor at the next time t+1.

[0010] Optionally, the network protection module includes: a real-time threat submodule, a response priority submodule, a regulation submodule and a policy control submodule.

[0011] Optionally, the processing process of the real-time threat submodule is as follows:

[0012]

[0013] in:

[0014] AOC t represents the real-time threat assessment index at the current time t;

[0015] AOC t-1 Indicates the threat assessment index at the previous time point;

[0016] A1 t represents the adjustment factor for current threats, and A2 represents the adjustment factor for historical threats;

[0017] AOCA i Represents the severity value of the i-th threat, AOCB t represents the probability of occurrence of the i-th threat;

[0018] AOCC represents the attenuation factor value;

[0019] represents the comprehensive threat assessment index;

[0020] Based on the severity value of the i-th threat AOCA t , the probability of occurrence of the i-th threat AOCB t and the current threat adjustment factor A1 t , to highlight the severity of the threat and enter the threat assessment index AOC at the previous time point t-1 , attenuation factor value AOCC and historical threat adjustment coefficient A2, output the real-time threat assessment index AOC at the current time t t .

[0021] Optionally, the processing process of the response priority submodule is as follows:

[0022]

[0023] in:

[0024] AUC t Indicates the security response priority at the current time t;

[0025] a represents the resource adjustment factor;

[0026] AUCA represents the current amount of security resources. Indicates the severity of the current threat to a given resource;

[0027] By inputting the real-time threat assessment index AOC at the current time t t The current amount of security resources AUCA is used to highlight the severity of the current threat given the resources, and the adjustment factor A1 is based on the resource adjustment factor a and the current threat t To integrate the priority of resource response, output the security response priority AUC at the current time t t .

[0028] Optionally, the processing process of the adjustment submodule is as follows:

[0029] S1:A1 t+1 =A1 t +k*(AUC t -0.8);

[0030] S2: Set the convergence conditions:

[0031] Condition 1: |A1 t+1 -A1 t |<0.05;

[0032] Condition 2: The current number of cycles is ≥ 10;

[0033] When any one of the conditions 1 and 2 is met, the loop terminates and reaches the convergence condition;

[0034] in:

[0035] A1 t+1 represents the adjustment coefficient of the threat at the next time t+1, and k represents the adjustment coefficient;

[0036] AUCB t Indicates the target security response priority, AUC t -0.8 represents the difference between the security response priority at the current time t and the target security response priority value.

[0037] Safety response priority AUC based on current time t t The difference between the target safety response priority value is used as an influencing factor, and A1 is controlled by adjusting the coefficient k. t The rate of change, and enter A1 t To output A1 t+1 , A1 t+1 Replace A1 in the Real-time Threats submodule t , to adjust the real-time threat assessment index AOC at the current time t t , and based on two convergence conditions to achieve A1 t+1The loop terminates.

[0038] Optionally, the processing process of the policy control submodule is as follows:

[0039]

[0040] in:

[0041] ALC t+1 Indicates the security policy adjustment factor for the next time t+1;

[0042] ALCA j Indicates the effectiveness value of the jth response measure, ALCB j represents the frequency of use of the jth response measure, and γ represents the number of types of safety response measures;

[0043] α represents the threat change sensitivity coefficient, and β represents the response effect adjustment factor;

[0044] α represents the changing trend of threat level, ∑ j＝1 γ(ALCA j *ALCB j ) represents the overall effectiveness of security response measures;

[0045] Input the real-time threat assessment index AOC at the current time t t and the safety response priority AUC at the current time t t , and based on the effectiveness value ALCA of the jth response measure j and the frequency of use of the jth response measure ALCB j , highlighting the effectiveness and frequency of response measures, and outputting the security policy adjustment factor ALC for the next time t+1 t+1 , to adjust the security policy factor ALC at the next time t+1 t+1 , improving the predictability of security policy adjustments.

[0046] Optionally, the data collection module uses a network traffic monitoring device and a log collector to monitor network traffic and capture data packets in real time through the network traffic monitoring device, and to collect log files through the log collector.

[0047] Optionally, the network protection module uses a database and a server to store threat information and response strategy information through the database.

[0048] Compared with the prior art, the present invention has the following beneficial effects:

[0049] 1. The present invention calculates the real-time threat assessment index at the current time t through the real-time threat submodule. The calculation of the real-time threat assessment index at the current time t can analyze and calculate the threat level of the current network environment, and through the real-time threat assessment of the real-time threat assessment index at the current time t, management personnel can timely and effectively discover and quantify these threats, and then strengthen protective measures in a targeted manner.

[0050] 2. The present invention calculates the security response priority at the current time t in the response priority submodule. The calculation of the security response priority at the current time t can set the response priority for different threat types, so that managers can make the best response decision under limited resources, thereby ensuring that key systems and data are protected in a timely and effective manner. The calculation of the security response priority at the current time t helps managers to prioritize the protection of systems and data facing the highest threats under limited resources, thereby effectively reducing the impact of potential attacks.

[0051] 3. The present invention calculates the adjustment coefficient of the threat at the next time t+1 through the adjustment submodule, and can use the adjustment coefficient of the threat at the next time t+1 to replace the adjustment coefficient of the current threat in the real-time threat submodule, so that a closed-loop feedback mechanism is formed between multiple modules of the overall method, and the system automatically adjusts the adjustment coefficient of the current threat according to the security response priority at the current time t, thereby optimizing future threat assessments. By continuously optimizing the adjustment coefficient of the current threat, the method can improve the system's sensitivity to high-priority threats.

[0052] 4. The present invention calculates the security policy adjustment factor at the next time t+1 in the policy control submodule. The calculation of the security policy adjustment factor at the next time t+1 can provide a certain reference for the formulation of a response plan, thereby facilitating managers to foresee potential security risks in advance and dynamically adjust security policies to adapt to the ever-changing threat environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 This is a flowchart of the steps of the network security protection method based on edge computing;

[0054] Figure 2 This is a schematic diagram of the overall structure of the network security protection method based on edge computing;

[0055] Figure 3 This is a structural diagram of the network protection module of the network security protection method based on edge computing. DETAILED DESCRIPTION

[0056] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0057] Regarding this network security protection method based on edge computing, it is different from the existing network security protection method based on edge computing. The existing network security protection method based on edge computing lacks targeted assessment of threats in the edge computing environment and lacks the ability to dynamically adjust response priorities. Therefore, it may not be possible to flexibly adjust strategies according to real-time situations. In addition, existing security protection methods are often fixed and rigid, and it is difficult to adapt to the ever-changing network environment and threat situation. The module of this network security protection method based on edge computing can accurately assess the severity and urgency of edge computing network threats by comprehensively considering multiple factors such as threat type and impact scope, and can also fully consider the limitations of currently available resources. By dynamically adjusting the response priority, it ensures that when resources are limited, the most critical and urgent threats are dealt with first, and can dynamically adjust security policies based on real-time data feedback to adapt to the ever-changing network environment and threat situation.

[0058] Example 1: Please refer to Figures 1 to 3 , this implementation provides a network security protection method based on edge computing, including the following security protection steps:

[0059] S1: collects real-time network traffic, logs, and security event data from edge devices and cloud servers through the data collection module;

[0060] S2: The data processing module cleans, de-duplicates and formats the collected real-time network traffic, logs and security event data, and outputs the severity value of the i-th threat and the probability of occurrence of the i-th threat;

[0061] S3: Input the severity value of the i-th threat and the occurrence probability of the i-th threat processed by the data processing module into the network protection module, and output the real-time threat assessment index at the current time t, the security response priority at the current time t, and the security policy adjustment factor at the next time t+1;

[0062] S4: input the real-time threat assessment index at the current time t, the security response priority at the current time t, and the security policy adjustment factor at the next time t+1 into the display arrangement module, summarize and display the real-time threat assessment index at the current time t, the security response priority at the current time t, and the security policy adjustment factor at the next time t+1 on the display device through the display arrangement module, and formulate a response plan and implement security measures based on the security policy adjustment factor at the next time t+1;

[0063] The network protection module includes: real-time threat submodule, response priority submodule, adjustment submodule and policy control submodule.

[0064] In this embodiment, by calculating the real-time threat assessment index at the current time t, the security response priority at the current time t, and the security policy adjustment factor at the next time t+1 in the network protection module, guidance and direction are provided for formulating response plans and implementing security measures in the display sorting module. The network security threats in the edge computing environment are constantly changing, so the response plan and the implementation of security measures also need to be adjusted accordingly. The close connection between step S3 and step S4 ensures that the security policy can be adjusted in time to adapt to the new threat situation, thereby maintaining the timeliness and effectiveness of security protection;

[0065] The real-time threat assessment index AOC at the current time t t The calculation can understand the threat level of the current network environment. The formulation of the response plan needs to fully consider this assessment result to ensure that the response is targeted at the most important threats. By quantifying the threat level at the current point in time, it provides users with a comprehensive network threat view, which helps to identify potential security risks, including various threats faced by edge devices and cloud servers. Edge computing pushes computing and data storage to the edge of the network. Although this improves response speed and reduces bandwidth requirements, it also exposes edge devices and cloud servers to a wider range of potential attack surfaces. Through AOC t Real-time threat assessment allows managers to identify and quantify these threats in a timely manner, thereby strengthening protective measures in a targeted manner;

[0066] The safety response priority AUC at the current time t t The AUC is used to calculate the response priorities for different threat types. The response plan needs to arrange the execution order of response measures according to this priority order to ensure that key threats are dealt with first. t It helps managers make the best response decisions when resources are limited, ensuring that key systems and data are protected in a timely and effective manner. t Computing helps managers prioritize the protection of systems and data facing the highest threats when resources are limited, thereby effectively mitigating the impact of potential attacks;

[0067] The security policy adjustment factor ALC at the next time t+1 t+1 The calculation of ALC can provide a certain reference for the formulation of response plans. For example, if it is predicted that a certain type of threat will increase in the future, then the preventive measures against this type of threat can be considered in advance in the current response plan. t+1 It helps managers to foresee potential security risks in advance and dynamically adjust security policies to adapt to the ever-changing threat environment;

[0068] Existing traditional security defense methods often focus on single-point defense and lack comprehensive perception and collaborative defense capabilities of the entire network environment. t , AUC t and ALC t+1 By combining the two, managers can obtain a comprehensive and dynamic view of network security situation, which helps users understand the correlation and development trend between different threats, so as to formulate more coordinated and effective defense strategies.

[0069] See also Figures 1 to 3 , the processing process of the real-time threat submodule is as follows:

[0070]

[0071] in:

[0072] AOC t represents the real-time threat assessment index at the current time t;

[0073] AOC t-1 Indicates the threat assessment index at the previous time point;

[0074] A1 t represents the adjustment factor for current threats, and A2 represents the adjustment factor for historical threats;

[0075] AOCA i Represents the severity value of the i-th threat, AOCB i represents the probability of occurrence of the i-th threat;

[0076] AOCA i Refers to the severity of each security event or log entry. The severity can be assessed and analyzed based on the nature of the event, potential impact, or historical data;

[0077] AOCB i Refers to the probability of each event or log entry actually occurring. In actual applications, the probability may be based on statistics and analysis of historical data. The determination of probability may involve in-depth analysis of traffic patterns, user behavior, or system status.

[0078] AOCC represents the attenuation factor value, which is used to reduce the impact of historical threats on current assessments;

[0079] AOC t-1 *AOCC is obtained by analyzing historical network traffic, logs, and security events and used to build predictions about current and future situations;

[0080] AOCC is an attenuation factor used to adjust the impact of past situations on the current situation. It is a value less than 1, thus ensuring that the impact of past information on the current situation gradually weakens over time;

[0081] represents the comprehensive threat assessment index;

[0082] This part directly relies on real-time network traffic, logs and security event data. This security protection system parses this data, extracts relevant events or entries, and evaluates their severity and probability of occurrence;

[0083] Based on the severity value of the i-th threat AOCA t , the probability of occurrence of the i-th threat AOCB t and the current threat adjustment factor A1 t , to highlight the severity of the threat and enter the threat assessment index AOC at the previous time point t-1 , attenuation factor value AOCC and historical threat adjustment coefficient A2, output the real-time threat assessment index AOC at the current time t t ;

[0084] The operation combines AOCA t and AOCB t , and then combines the severity of the threat and the probability of occurrence. Considering the severity of the threat or the probability of occurrence alone may not be enough to fully assess the actual risk of the threat. By comprehensively considering the two, a more comprehensive threat assessment indicator is obtained, while taking into account the potential destructive power of the threat and the possibility of its occurrence.

[0085] In this embodiment, AOC tThe calculation can accurately reflect the security situation in the current network environment, provide basic data for subsequent security response and policy adjustment, and help to timely discover and quantify potential threats in the network, so that users can formulate targeted defense measures based on specific data. At the same time, the introduction of AOCC also takes into account the timeliness and dynamics of threats, improving the accuracy and practicality of the evaluation. Compared with existing security protection methods, which may focus on the detection and response of a single threat and lack a comprehensive evaluation of the entire network environment, this module realizes a comprehensive and real-time evaluation of the network environment by comprehensively considering multiple threat factors and historical data, providing more comprehensive and accurate data support for security protection;

[0086] AOC t It provides a quantitative indicator to measure the overall threat level in the network environment at a specific time t. This index combines multiple threat factors, such as the severity of the threat, the probability of occurrence, and the attenuation effect of historical threats, so that users can intuitively understand the current security situation and use AOC to t , users can determine whether emergency response measures are needed, as well as the priority and scale of the response. Higher AOC t The value may indicate that immediate action is needed to mitigate or eliminate the potential threat and by t By monitoring the value, users can promptly discover the rising trend of threats or new threat sources, thereby providing early warning and taking preventive measures. t The value can be used to evaluate the effectiveness of existing security measures. t The value remains at a low level, indicating that the current security policy is effective. t An increase indicates the need to reassess and adjust security strategies.

[0087] See also Figures 1 to 3 , the processing process of the response priority submodule is as follows:

[0088]

[0089] in:

[0090] AUC t Indicates the security response priority at the current time t;

[0091] a represents the resource adjustment factor;

[0092] AUCA represents the current amount of security resources. Indicates the severity of the current threat to a given resource;

[0093] By inputting the real-time threat assessment index AOC at the current time t tThe current amount of security resources AUCA is used to highlight the severity of the current threat given the resources, and the adjustment factor A1 is based on the resource adjustment factor a and the current threat t To integrate the priority of resource response, output the security response priority AUC at the current time t t ;

[0094] AUCA is specifically expressed as CPU utilization, which is used to evaluate whether there is enough computing power to handle additional security tasks through the current CPU idle ratio; AUCA can also be expressed as memory availability, that is, the remaining amount of memory, which is used to store temporary data and run security software; AUCA can also represent network bandwidth, which is used to transmit security-related data or traffic through the remaining network bandwidth. t AUCA is an important consideration. If some resources are very tight, for example, CPU utilization is high, then even if a threat is very severe, its response priority may need to be lowered because there may not be enough resources to deal with it effectively. On the contrary, if resources are sufficient, then responses to those with higher threats can be given higher priority.

[0095] In this embodiment, this module is extended based on the calculation of the real-time threat submodule. t The calculation of AUC reflects which security response measures should be taken in priority under different threat scenarios to maximize resource utilization efficiency and security protection effect. Different from the existing network security protection methods, which may lack clear priority sorting, leading to unreasonable resource allocation and low response efficiency, this module optimizes resource allocation and improves response efficiency, making security protection more efficient and accurate. t It can calculate the priority of response measures to be taken in different threat scenarios, which helps security teams make the best decisions under limited resources, thereby ensuring that key systems and data are protected in a timely and effective manner. By clarifying the response priority, AUC t It can help users quickly determine which threats need to be prioritized, thereby improving the efficiency and accuracy of the response. t The value of can guide users to develop specific response strategies, including selecting appropriate response tools, technologies and processes, and determining the timing and scope of the response. t Changes in AUC t They will also adjust accordingly, helping to continuously evaluate and improve their response strategies to adapt to the ever-changing threat environment.

[0096] See also Figures 1 to 3 , the processing of the adjustment submodule is as follows:

[0097] S1:A1 t+1=A1 t +k*(AUC t -0.8);

[0098] S2: Set the convergence conditions:

[0099] Condition 1: |A1 t+1 -A1 t |<0.05;

[0100] Condition 2: The current number of cycles is ≥ 10;

[0101] When any one of the conditions 1 and 2 is met, the loop terminates and reaches the convergence condition;

[0102] in:

[0103] A1 t+1 represents the adjustment coefficient of the threat at the next time t+1, k represents the adjustment coefficient, and k is used to control A1 t rate of change;

[0104] AUCB t Indicates the target security response priority, AUC t -0.8 represents the difference between the security response priority at the current time t and the target security response priority value;

[0105] Safety response priority AUC based on current time t t The difference between the target safety response priority value is used as an influencing factor, and A1 is controlled by adjusting the coefficient k. t The rate of change, and enter A1 t To output A1 t+1 , A1 t+1 Replace A1 in the Real-time Threats submodule t , to adjust the real-time threat assessment index AOC at the current time t t , and based on two convergence conditions to achieve A1 t+1 The loop terminates.

[0106] In this embodiment, this module adopts the form of cyclic optimization and adjustment to make it dynamically adjustable, which helps the system adapt to market changes more quickly and improves overall performance. By adjusting the k value, it is easy to control the speed and amplitude of the adjustment, so that the system is neither too radical nor too conservative. In addition, this module has an automatic adjustment form, which reduces the need for human intervention, improves efficiency and accuracy, and because A1 t Based on AUC t Dynamically adjust to more accurately assess the severity and urgency of different threats, and based on AUC tBased on the feedback from the user, this module can more reasonably allocate resources to the threats that need to be dealt with most, by continuously optimizing the adjustment coefficient A1 of the current threat. t , and thus the method increases the system's sensitivity to high-priority threats, so the system can respond to these threats more quickly and take corresponding measures;

[0107] By AUC t To update A1 t The value of AUC forms a closed-loop feedback mechanism among multiple modules of the overall method, which allows the method system to t To automatically adjust the severity of the threat to A1 t , thereby optimizing future threat assessments. If AUC t A high value indicates that the current threat is more serious or the response measures are not effective enough, and thus the A1 t The value of A1 is increased t The edge computing network security protection system can pay more attention to these high-priority threats, thereby calculating AOC t , and vice versa when AUC t When the A1 is low, the edge computing network security protection system can appropriately reduce the A1 t , thereby reducing the system's excessive attention to low-priority threats, AUC t It not only reflects the urgency of the threat, but also includes certain resource allocation requirements, in conjunction with adjusting A1 t The system can better balance the resource allocation between different threats, ensuring that key threats are dealt with in a timely and effective manner, and this form of convergence termination can ensure that A1 t Optimized stability makes A1 t After the final optimization, the fluctuation can be reduced, making the system as a whole more stable and effective.

[0108] See also Figures 1 to 3 , the processing process of the policy control submodule is as follows:

[0109]

[0110] in:

[0111] ALC t+1 Indicates the security policy adjustment factor for the next time t+1;

[0112] ALCA j Indicates the effectiveness value of the jth response measure, ALCB j represents the frequency of use of the jth response measure, and γ represents the number of types of safety response measures;

[0113] α represents the threat change sensitivity coefficient, which is used to control The ratio change between ALC t+1 β represents the response effect adjustment factor, which is used to balance the impact of response effect and historical data on strategy adjustment;

[0114] α represents the changing trend of threat level, ∑ j＝1 γ(ALCA j *ALCB j ) represents the overall effectiveness of security response measures;

[0115] Input the real-time threat assessment index AOC at the current time t t and the safety response priority AUC at the current time t t , and based on the effectiveness value ALCA of the jth response measure j and the frequency of use of the jth response measure ALCB j , highlighting the effectiveness and frequency of response measures, and outputting the security policy adjustment factor ALC for the next time t+1 t+1 , to adjust the security policy factor ALC at the next time t+1 t+1 , improving the predictability of security policy adjustments.

[0116] In this embodiment, this module reflects how to adjust security policies to deal with potential threats based on current and future security situations. t+1 The calculation of ALC comprehensively considers multiple factors, can predict future security trends and make adjustments in advance, thereby enhancing the predictability and initiative of security protection, and providing a scientific basis for the dynamic adjustment of security strategies. Different from the existing edge computing network security protection methods, which may lack scientificity and predictability, and thus make the strategy lag behind the development of threats, this module is for ALC t+1 The calculation realizes the dynamic adjustment and continuous optimization of security policies, making security protection more adaptable to the rapid changes in the network environment, and through ALC t+1 ALC can dynamically adjust its security policies to adapt to the ever-changing threat environment. t+1 Computing improves the predictability of security policy adjustments, allowing users to more effectively protect their networks and systems from damage by predicting and preparing for potential threats in advance.

[0117] In the specific implementation process, the four modules in this method are used to form a system of network security protection methods based on edge computing;

[0118] By substituting the severity value of the ith threat and the probability of occurrence of the ith threat into the real-time threat submodule, the real-time threat assessment index at the current time t is calculated. By calculating the real-time threat assessment index at the current time t, the threat level of the current network environment can be analyzed and calculated, and the AOC t Real-time threat assessment allows managers to identify and quantify these threats in a timely manner, and then strengthen protective measures in a targeted manner;

[0119] Among them: AOC t It directly reflects the severity and urgency of the threat in the current network environment. The evaluation result can be directly used as the threshold condition for triggering network security response. For example, when AOC t When a preset threshold is exceeded, the system can automatically trigger a security response mechanism, which can initiate an emergency security scan, isolate suspicious devices, and notify the security maintenance team. t The system can take a series of preventive measures, such as strengthening monitoring, adjusting firewall rules, improving the sensitivity of intrusion detection systems, and other emergency response plans;

[0120] Based on the thresholds mentioned above, an implementation method may be provided:

[0121] First, low threat threshold: AOC t <55, within this range, the current network environment is considered relatively safe and no additional security measures are needed;

[0122] Second, medium threat threshold: 50 ≤ AOC t <100, when AOC t When this range is reached, the system may issue a warning to alert the administrator to potential security threats and prepare to take appropriate preventive measures;

[0123] Third, high threat threshold: AOC t ≥100, when AOC t When this threshold is exceeded, the system should immediately trigger an alarm and automatically execute a series of emergency response measures, such as isolating the affected system and starting the backup and recovery process.

[0124] By substituting the real-time threat assessment index at the current time t and the adjustment coefficient of the current threat into the response priority submodule, the security response priority at the current time t is calculated. By calculating the security response priority at the current time t, the response priority is set for different threat types, which is convenient for managers to make the best response decision under limited resources, thereby ensuring that key systems and data are protected in a timely and effective manner. AUC tComputing helps managers prioritize the protection of systems and data facing the highest threats when resources are limited, thereby effectively mitigating the impact of potential attacks;

[0125] Where: AUC t It is determined based on the severity of the threat and the availability of current resources. The system can t The value of AUC determines which threats to prioritize, ensuring that the most critical and urgent problems can be solved first when resources are limited. t The system can automatically allocate resources, such as human and computing resources, to the highest priority threats or provide administrators with clear response guidance based on the value of the threat.

[0126] By substituting the security response priority at the current time t into the adjustment submodule, the adjustment coefficient of the threat at the next time t+1 is calculated, and the adjustment coefficient of the threat at the next time t+1 is used to replace the adjustment coefficient of the current threat in the real-time threat submodule, and the cycle and update are performed according to the convergence condition, so that a closed-loop feedback mechanism is formed between multiple modules of the overall method. This mechanism allows the method system to adjust the AUC according to the AUC. t To automatically adjust the severity of the threat to A1 t , thereby optimizing future threat assessments, and by continuously optimizing the adjustment factor A1 of the current threat t , and thus this method increases the sensitivity of the system to high priority threats;

[0127] By substituting the real-time threat assessment index at the current time t and the security response priority at the current time t into the policy control submodule, the security policy adjustment factor ALC at the next time t+1 is calculated. t+1 ,The calculation of the security policy adjustment factor at the next time t+1 can provide a certain reference for the formulation of the response plan, which makes it easier for managers to foresee potential security risks in advance and dynamically adjust security policies to adapt to the ever-changing threat environment;

[0128] ALC-based t+1 The system can automatically adjust security policies based on the value of the security policy, including: updating firewall rules, optimizing intrusion detection system configuration and strengthening encryption measures, or providing administrators with suggestions for policy adjustments to improve the overall network security.

[0129] Example 2: Please refer to Figure 1 , Figure 2 and Figure 3 In this embodiment, the data collection module uses a network traffic monitoring device and a log collector. The network traffic monitoring device monitors network traffic in real time and captures data packets, and the log collector collects log files.

[0130] In this embodiment, a network traffic monitoring device is deployed in the network for real-time monitoring of network traffic and capturing data packets, while a log collector is used to collect log files from servers, applications, etc., thereby ensuring the quality of the collected data and acquiring reliable and effective data sources, providing a basis for subsequent computational analysis.

[0131] In this embodiment, the network protection module uses a database and a server to store threat information and response strategy information through the database.

[0132] In this embodiment, the network protection module specifically includes a threat intelligence database, a response strategy database and a prediction model server. The threat intelligence database stores known threat information, attack patterns and other data, and cooperates with the real-time threat sub-module to quickly identify potential threats in the network, providing a decision-making basis for timely response. The response strategy database stores a database of response strategies corresponding to different threat types, and cooperates with the response priority sub-module to ensure that key threats are given priority and improve response efficiency and accuracy. The prediction model in the server and the network protection module facilitate users to predict future threat situations, so that potential threats can be foreseen in advance and security strategies can be dynamically adjusted, thereby improving the adaptability and flexibility of the overall computing network security protection system.

[0133] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A network security protection method based on edge computing, characterized in that: The following safety precautions are included: S1: collects real-time network traffic, logs, and security event data from edge devices and cloud servers through the data collection module; S2: The data processing module cleans, de-duplicates and formats the collected real-time network traffic, logs and security event data, and outputs the severity value of the i-th threat and the probability of occurrence of the i-th threat; S3: Input the severity value of the i-th threat and the probability of occurrence of the i-th threat processed by the data processing module into the network protection module, and output the real-time threat assessment index at the current time t, the security response priority at the current time t, and the security policy adjustment factor at the next time t+1; S4: input the real-time threat assessment index at the current time t, the security response priority at the current time t, and the security policy adjustment factor at the next time t+1 into the display arrangement module, summarize and display the real-time threat assessment index at the current time t, the security response priority at the current time t, and the security policy adjustment factor at the next time t+1 on the display device through the display arrangement module, and formulate a response plan and implement security measures based on the security policy adjustment factor at the next time t+1; The network protection module includes: Real-time threat submodule, response priority submodule, regulation submodule, and policy control submodule; The processing process of the real-time threat submodule is as follows: in: AOC t represents the real-time threat assessment index at the current time t; AOC t-1 Indicates the threat assessment index at the previous time point; A1 t represents the adjustment factor for current threats, and A2 represents the adjustment factor for historical threats; AOCA i Represents the severity value of the i-th threat, AOCB t represents the probability of occurrence of the i-th threat; AOCC represents the attenuation factor value; represents the comprehensive threat assessment index; Based on the severity value of the i-th threat AOCA t , the probability of occurrence of the i-th threat AOCB t and the current threat adjustment factor A1 t , to highlight the severity of the threat and enter the threat assessment index AOC at the previous time point t-1 , attenuation factor value AOCC and historical threat adjustment coefficient A2, output the real-time threat assessment index AOC at the current time t t ; The processing process of the response priority submodule is as follows: in: AUC t Indicates the security response priority at the current time t; a represents the resource adjustment factor; AUCA represents the current amount of security resources. Indicates the severity of the current threat to a given resource; By inputting the real-time threat assessment index AOC at the current time t t The current amount of security resources AUCA is used to highlight the severity of the current threat given the resources, and the adjustment factor A1 is based on the resource adjustment factor a and the current threat t To integrate the priority of resource response, output the security response priority AUC at the current time t t ; The processing process of the adjustment submodule is as follows: S1: A1 t+1 =A1 t +k*(AUC t -0.8); S2: Set the convergence conditions: Condition 1: |A1 t+1 -A1 t |<0.05; Condition 2: The current number of cycles is ≥ 10; When any one of the conditions 1 and 2 is met, the loop terminates and reaches the convergence condition; in: A1 t+1 represents the adjustment coefficient of the threat at the next time t+1, and k represents the adjustment coefficient; AUCB t Indicates the target security response priority, AUC t -0.8 represents the difference between the security response priority at the current time t and the target security response priority value; Safety response priority AUC based on current time t t The difference between the target safety response priority value is used as an influencing factor, and A1 is controlled by adjusting the coefficient k. t The rate of change, and enter A1 t To output A1 t+1 , A1 t+1 Replace A1 in the Real-time Threats submodule t , to adjust the real-time threat assessment index AOC at the current time t t , and based on two convergence conditions to achieve A1 t+1 The loop terminates; The processing process of the strategy control submodule is as follows: in: ALC t+1 Indicates the security policy adjustment factor for the next time t+1; ALCA j Indicates the effectiveness value of the jth response measure, ALCB j represents the frequency of use of the jth response measure, and γ represents the number of types of safety response measures; α represents the threat change sensitivity coefficient, and β represents the response effect adjustment factor; Indicates the changing trend of threat level, ∑ j＝1 γ(ALCA j *ALCB j ) represents the overall effectiveness of security response measures; Input the real-time threat assessment index AOC at the current time t t and the safety response priority AUC at the current time t t , and based on the effectiveness value ALCA of the jth response measure j and the frequency of use of the jth response measure ALCB j , highlighting the effectiveness and frequency of response measures, and outputting the security policy adjustment factor ALC for the next time t+1 t+1 , to adjust the security policy factor ALC at the next time t+1 t+1 , improving the predictability of security policy adjustments.

2. The network security protection method based on edge computing according to claim 1 is characterized in that: The data collection module uses a network flow monitoring device and a log collector to monitor network flow and capture data packets in real time through the network flow monitoring device, and to collect log files through the log collector.

3. The network security protection method based on edge computing according to claim 1 is characterized in that: The network protection module uses a database and a server to store threat information and response strategy information through the database.

Images