A threat early warning system based on network traffic big data

Abstract

The present invention discloses a threat early warning system based on network traffic big data, which relates to the technical field of nuclear power plant network early warning. Based on the traffic data in each time window, the fluctuation of the silent period is analyzed, and the silent period difference factor Jcyz is calculated. By analyzing the silent period difference factor, it is possible to preliminarily judge whether there is a risk of APT attack in the cross-regional communication process; at the same time, the abnormal time window is further analyzed, the abnormal time series is constructed, the data transmission behavior after the end of the silent period is detected, the abnormal transmission deviation Ycqc is identified, and then the protocol switching rate Xqpz is calculated in combination with the traffic data set. Through the analysis of these data indicators, the typical low-frequency and intermittent communication mode in APT attacks can be further captured.

Description

Technical Field

[0001] The present invention relates to the technical field of nuclear power plant network early warning, and in particular to a threat early warning system based on network traffic big data. Background Art

[0002] Nuclear power plants are highly complex and sensitive critical infrastructures that involve the generation, control and management of nuclear energy, and their security is of vital importance. Multiple functional areas in the network architecture of nuclear power plants need to communicate with each other to ensure the stability of nuclear reactions, real-time transmission of data and coordinated operation of the system. The communication between these functional areas is often achieved through cross-regional network transmission, and network security issues are particularly important in the field of nuclear power plants. Especially in the face of increasingly complex network threats, how to ensure the security of cross-regional communications has become a key challenge. Specifically, in the communication and transmission process between the functional areas in nuclear power plants, APT (Advanced Persistent Threat) attack analysis has become one of the key defense areas. APT attacks are usually highly concealed and have a long penetration time. Attackers control infected systems to perform long-term theft and control operations. Therefore, timely detection of APT attacks during cross-regional communication has become a key task to ensure the network security of nuclear power plants.

[0003] At present, in high-security scenarios such as nuclear power plants, existing network security protection technologies mostly rely on traditional firewalls, intrusion detection systems (IDS) and rule-based security policies. However, APT (Advanced Persistent Threat) attacks are highly concealed and complex. Attackers can penetrate the network for a long time and use silent periods and low-frequency data packet transmission to avoid triggering existing security protection systems. Especially in the communication process between different functional areas in a nuclear power plant, the existing system usually relies on simple traffic monitoring or rule matching methods, which makes it difficult to effectively capture the hidden characteristics of APT attacks. It ignores the fact that during the communication process between the functional areas, the silent period in different states and the traffic state after the silent period may hide the footprints of APT attacks, resulting in attackers being able to use low-frequency data transmission to evade detection. Summary of the invention

[0004] In view of the deficiencies in the prior art, the present invention provides a threat warning system based on network traffic big data, which solves the problems in the above-mentioned background technology.

[0005] To achieve the above objectives, the present invention is implemented through the following technical solutions: a threat warning system based on network traffic big data, including a cross-regional communication module, a risk analysis module, a silent period anomaly analysis module and a threat warning module;

[0006] The cross-region communication module is used to monitor the network traffic status between the functional areas in the nuclear power plant in real time in advance to generate cross-region traffic data information, and construct a traffic data set through statistics;

[0007] The risk analysis module is used to preset a time window, analyze the fluctuation of the silent period in each time window during each cross-zone communication process based on the time window and the traffic data set, so as to calculate the silent period difference factor Jcyz in the corresponding time window, and preliminarily judge whether there is an APT attack risk in the corresponding cross-zone communication process based on the silent period difference factor Jcyz, and identify the abnormal time window;

[0008] The silent period abnormality analysis module is used to construct an abnormal time series according to the abnormal time window identified in the risk analysis module, and analyze the transmission behavior after each silent period in the abnormal time series to obtain the abnormal transmission deviation Ycqc, and set constraints on the abnormal transmission deviation Ycqc to identify the abnormal silent period, and calculate the protocol switching rate Xqpz based on the abnormal silent period and in combination with the traffic data set;

[0009] The threat warning module is used to construct a threat model using convolutional neural network technology, and input the protocol switching rate Xqpz and the abnormal transmission deviation Ycqc into the threat model. After linear normalization processing, the threat assessment index Wgzs is fitted to obtain the threat assessment index. If the threat assessment index Wgzs exceeds the preset assessment threshold, a threat warning is issued and defense measures are executed.

[0010] Preferably, the cross-region communication module includes a monitoring unit and a processing unit;

[0011] The monitoring unit is used to monitor the network traffic status between the functional areas in the nuclear power plant in real time in advance to generate cross-area traffic data information, wherein the cross-area traffic data information includes source IP, destination IP, data packet size, protocol type, communication timestamp, data packet interval time, cycle length Jsc of each silent period in the corresponding time window during each cross-area process, amount of data transmitted after each silent period Scz, and protocol type of each data packet in each silent period; wherein the functional areas include reactor area, control area, management and safety assurance area, and auxiliary functional area;

[0012] The processing unit is used to clean the cross-regional traffic data information, remove noise and duplicate data, convert the cleaned data into a unified format so that its range falls between 0 and 1, and fill in the missing data through interpolation.

[0013] Preferably, the risk analysis module includes a preliminary analysis unit and a timing identification unit;

[0014] The preliminary analysis unit uses a preset time window and combines the traffic data set to analyze the fluctuation of the silent period in each time window during each cross-zone communication process to calculate the silent period difference factor Jcyz in the corresponding time window. The silent period difference factor Jcyz is specifically obtained in the following manner:

[0015] ;

[0016] Where n is the number of silent periods in the corresponding time window, i=1, 2, 3, ..., n, It is expressed as the duration of the ith silent period in the corresponding time window, It is expressed as the average period length of all silent periods in the corresponding time window.

[0017] Preferably, the timing identification unit is used to pre-set an abnormal threshold, and compare and analyze the abnormal threshold with the silent period difference factor Jcyz to preliminarily determine whether there is an APT attack risk in the corresponding cross-zone communication process. The specific preliminary judgment content is as follows:

[0018] If the silent period difference factor Jcyz exceeds the abnormal threshold, it will be preliminarily determined that there is no APT attack risk in the corresponding cross-zone communication process, and the current time window will be marked as a normal time window;

[0019] If the silent period difference factor Jcyz does not exceed the abnormal threshold, it will be preliminarily determined that there is an APT attack risk in the corresponding cross-zone communication process, and the current time window will be marked as an abnormal time window.

[0020] Preferably, the silent period abnormality analysis module includes an aggregation unit, a post-period transmission analysis unit, and a frequent switching analysis unit;

[0021] The aggregation unit is used to sort several groups of abnormal time windows and normal time windows in chronological order according to the abnormal time windows and normal time windows marked in the time series identification unit, and after aggregation, to construct abnormal time series and normal time series respectively.

[0022] Preferably, the post-period transmission analysis unit is used to analyze the transmission behavior status after each silent period in the abnormal time series based on the abnormal time series to obtain the abnormal transmission deviation Ycqc after the corresponding silent period, and the abnormal transmission deviation Ycqc is obtained by the following formula:

[0023] ;

[0024] In the formula, when When , this formula is valid; among them, It is expressed as the average of the total amount of data transmitted after all silent periods in a normal time series. It is expressed as the amount of data transmitted after the corresponding silent period in the abnormal time series ends.

[0025] Preferably, the frequent switching analysis unit is used to extract the current The silent period corresponding to the time is initially recorded as the abnormal silent period. According to the distribution of the abnormal silent period, the abnormal recovery frequency Yhq is obtained. Through statistics, several groups of abnormal silent periods are summarized into a silent period abnormal set. According to the silent period abnormal set, the flow data after the end of the silent period corresponding to the silent period abnormal set is extracted from the flow data set to calculate the protocol switching rate Xqpz. The protocol switching rate Xqpz is obtained by the following formula:

[0026] ;

[0027] This formula checks each data packet in the silent period exception set one by one to monitor whether the protocol type of the previous data packet and the current data packet is different. If they are different, a protocol switch is accumulated once;

[0028] Where, m represents the data packet data in the abnormal set during the silent period; j=1, 2, 3, ..., m; Represents the protocol type of the jth data packet; Represents the protocol type of the j-1th packet, where is an indicator function whose value is either 1 or 0.

[0029] Preferably, the threat warning module includes a model building unit, a comprehensive analysis unit and a comparison unit;

[0030] The model building unit is used to use convolutional neural network technology to preliminarily build an original model, and train and test the original model with data in the traffic data set, and use the trained original model as a state recognition model, respectively obtain feature information in the state recognition model, and train and test the state recognition model with the acquired feature information, combine the identification of abnormal time windows and abnormal silent periods, use the trained state recognition model as a threat model, and train the trained threat model to fit and obtain the threat assessment index Wgzs.

[0031] Preferably, the comprehensive analysis unit is used to output the threat model to obtain a threat assessment index Wgzs, and the threat assessment index Wgzs is obtained by the following formula:

[0032] ;

[0033] In the formula, It is expressed as the average of the total amount of data transmitted after all silent periods in the abnormal time series. Expressed as abnormal recovery frequency, Expressed as the protocol switching rate, , and are weight values, Expressed as a correction constant, where , and The specific value is set by the user according to the situation.

[0034] Preferably, the comparison unit is used to pre-set an evaluation threshold, and compare and analyze the evaluation threshold with the threat assessment index Wgzs to comprehensively determine whether there is an APT attack when communicating between functional areas in the nuclear power plant. The specific comparison content is as follows:

[0035] If the threat assessment index Wgzs exceeds the assessment threshold, it means that there is an APT attack when the functional areas in the current nuclear power plant communicate with each other, and the constructed silent period anomaly set is regarded as the silent period anomaly set of the APT attack. At this time, all communications with the external network will be immediately cut off, and network isolation will be implemented for all functional areas within the nuclear power plant;

[0036] If the threat assessment index Wgzs does not exceed the assessment threshold, it means that there is no APT attack when communicating between the functional areas in the current nuclear power plant, and monitoring and analysis will be required at this time.

[0037] The present invention provides a threat early warning system based on network traffic big data, which has the following beneficial effects:

[0038] (1) The system monitors the network traffic status between various functional areas in the nuclear power plant in real time and generates cross-area traffic data information, which helps to timely reflect the communication behavior between various functional areas and ensure the transparency and controllability of network traffic, so as to prepare for effectively reducing potential security threats in network blind spots. At the same time, based on the traffic data in each time window, the fluctuation of the silent period is analyzed and the silent period difference factor Jcyz is calculated. Through the analysis of the silent period difference factor, it is possible to preliminarily judge whether there is a risk of APT attack in the cross-area communication process and accurately identify the abnormal time window. This enables the system to detect APT attacks through subtle changes in communication behavior in the early stage, thereby providing early warning. The silent period anomaly analysis module further analyzes the abnormal time window identified by the risk analysis module, constructs an abnormal time series, detects the data transmission behavior after the end of the silent period, identifies the abnormal transmission deviation Ycqc, and then calculates the protocol switching rate Xqpz in combination with the traffic data set. Through the analysis of these data indicators, the typical low-frequency and intermittent communication mode in APT attacks can be further captured, and abnormal behavior in protocol switching can be identified, thereby refining the accuracy of threat detection. The threat warning module uses convolutional neural network technology to build a threat model, and inputs the protocol switching rate Xqpz and abnormal transmission deviation Ycqc into the model to fit the threat assessment index Wgzs. Through this automated threat assessment process, the system can accurately measure the APT attack risk. When the assessment index exceeds the preset threshold, the system automatically issues a warning signal and quickly executes corresponding defense measures. This intelligent warning mechanism maximizes the speed and accuracy of network security response, thereby enhancing the overall defense capability of the nuclear power plant.

[0039] (2) The system can quickly identify abnormal behavior in cross-regional communications and locate potential attack risk time periods through silent period difference analysis and abnormal time window marking. This precise time window analysis allows the system to focus on specific abnormal behavior time periods, thereby further improving the efficiency and response speed of APT attack identification and effectively ensuring the security of communications between various functional areas within the nuclear power plant.

[0040] (3) The system ensures that abnormal behavior will not be ignored by continuously monitoring and comparing the silent period behavior. The post-period transmission analysis unit can conduct a detailed analysis of the transmission behavior after each silent period based on the abnormal time series, and obtain the abnormal transmission deviation Ycqc after the silent period. This analysis process can deeply explore potential APT attack behaviors, because attackers usually use a small number of data packets for covert C2 communication after the silent period. By analyzing the amount of data transmission after the silent period, the system can capture those low-frequency, intermittent small data transmission behaviors and effectively identify the hidden activities of APT attacks, especially when the data volume is small and does not show obvious abnormalities. Through the silent period anomaly analysis module of the system, the system can identify those hidden APT attack behaviors that do not have obvious communication fluctuations on the surface, but have no obvious data volume deviation after the silent period, based on abnormal time series. This method is particularly suitable for detecting APT attacks carried out in a low-frequency and low-traffic manner, because attackers often use these characteristics to evade traditional traffic monitoring tools. By detecting the difference in data transmission after the silent period, the system can issue an alarm in time when potential attackers steal data and conduct command and control C2 communications, thereby improving the defense level of nuclear power plant network security.

[0041] (4) Through the frequent switching analysis unit, the system can extract the corresponding abnormal silent period based on the analysis results in the post-transmission analysis unit, and preliminarily mark it as an abnormal silent period, thereby effectively narrowing the scope of APT attack analysis and making subsequent detection and protection more efficient and centralized. At the same time, the system checks the data packets in the abnormal silent period set one by one and calculates the protocol switching rate Xqpz. This switching rate can effectively monitor the frequent switching behavior of the protocol. APT attackers often use multiple protocols for covert communication to bypass the security detection system. By detecting the protocol switching behavior of the data packets during the abnormal silent period, the system can identify whether the attacker is using different protocols for C2 communication or other malicious operations. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 This is a block diagram of a threat early warning system based on network traffic big data in the present invention. DETAILED DESCRIPTION

[0043] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0044] Example 1

[0045] See also Figure 1 , the present invention provides a threat warning system based on network traffic big data, including a cross-regional communication module, a risk analysis module, a silent period anomaly analysis module and a threat warning module;

[0046] The cross-region communication module is used to monitor the network traffic status between the functional areas in the nuclear power plant in real time in advance to generate cross-region traffic data information, and construct a traffic data set through statistics;

[0047] The risk analysis module is used to preset a time window, analyze the fluctuation of the silent period in each time window during each cross-zone communication process based on the time window and the traffic data set, so as to calculate the silent period difference factor Jcyz in the corresponding time window, and preliminarily judge whether there is an APT attack risk in the corresponding cross-zone communication process based on the silent period difference factor Jcyz, and identify the abnormal time window;

[0048] The silent period abnormality analysis module is used to construct an abnormal time series according to the abnormal time window identified in the risk analysis module, and analyze the transmission behavior after each silent period in the abnormal time series to obtain the abnormal transmission deviation Ycqc, and set constraints on the abnormal transmission deviation Ycqc to identify the abnormal silent period, and calculate the protocol switching rate Xqpz based on the abnormal silent period and in combination with the traffic data set;

[0049] The threat warning module is used to construct a threat model using convolutional neural network technology, and input the protocol switching rate Xqpz and the abnormal transmission deviation Ycqc into the threat model. After linear normalization processing, the threat assessment index Wgzs is fitted to obtain the threat assessment index. If the threat assessment index Wgzs exceeds the preset assessment threshold, a threat warning is issued and defense measures are executed.

[0050] During the operation of this system, through real-time monitoring of the cross-regional communication module, the system can obtain detailed flow data information between the functional areas in the nuclear power plant and construct a flow data set. This mechanism can ensure accurate analysis of cross-regional communication behaviors, thereby preventing communication anomalies or data leakage. Traditional systems may only be based on local flow monitoring, and do not consider the specific analysis of cross-regional communications. In order to avoid blind spots, this system has carried out cross-regional analysis; the risk analysis module can quickly identify abnormal time windows in cross-regional communications through time window-based flow fluctuation analysis and calculation of the silent period difference factor Jcyz, and preliminarily determine whether there is a risk of APT attacks. The silent period anomaly analysis module further constructs abnormal time series, analyzes the transmission behavior after the silent period, and combines the abnormal transmission deviation Ycqc for a deeper analysis, and effectively improves the detection accuracy of APT attacks by calculating the protocol switching rate Xqpz. This mechanism makes up for The traditional traffic analysis system is difficult to capture the low-frequency communication behavior during the silent period. It can give early warning before the APT attack has caused serious consequences. Through the threat warning module, the system uses convolutional neural network technology to build a threat model, inputs the protocol switching rate Xqpz and the abnormal transmission deviation Ycqc into the model for analysis, and fits the threat assessment index Wgzs through linear normalization processing. This intelligent evaluation method not only improves the accuracy of APT attack detection, but also can automatically issue threat warnings and take defensive measures. This data-driven intelligent warning method effectively reduces the false alarm rate and further improves the ability to respond to complex APT attack behaviors. When it is identified that the threat assessment index Wgzs exceeds the preset threshold, the system can automatically execute corresponding defense measures, quickly isolate the potentially affected network area, and prevent the APT attack from further spreading. This automated defense method shortens the time to respond to threats as much as possible and improves the overall network security protection capability of the nuclear power plant. In short, through multi-level data analysis and intelligent warning models, the system can further effectively identify, analyze and respond to APT attacks in nuclear power plants, thereby improving the network security protection level of nuclear power plants.

[0051] Example 2

[0052] Please refer to Figure 1 ,Specifically: the cross-region communication module includes a monitoring unit and a processing unit;

[0053] The monitoring unit is used to monitor the network traffic status between the functional areas in the nuclear power plant in real time in advance to generate cross-area traffic data information, wherein the cross-area traffic data information includes source IP, destination IP, data packet size, protocol type, communication timestamp, data packet interval time, cycle length Jsc of each silent period in the corresponding time window during each cross-area process, amount of data transmitted after each silent period Scz, and protocol type of each data packet in each silent period; wherein the functional areas include reactor area, control area, management and safety assurance area, and auxiliary functional area;

[0054] The processing unit is used to clean the cross-regional traffic data information, remove noise and duplicate data, convert the cleaned data into a unified format, so that its range falls between 0 and 1, and fill in the missing data by interpolation. Through the monitoring unit of the cross-regional communication module, the system can monitor the communication traffic status between various functional areas (such as reactor area, control area, management and safety assurance area and auxiliary functional area) in the nuclear power plant in real time, and generate detailed cross-regional traffic data information. Through multi-faceted monitoring of this information, the system can obtain detailed traffic data under the complex network environment inside the nuclear power plant, further ensure accurate tracking of communication behaviors between various functional areas, and effectively improve the transparency of network traffic and the integrity of data analysis. The processing unit cleans the monitored cross-regional traffic data information, removes noise and duplicate data, and unifies the cleaned data into a standardized format to ensure the validity and consistency of the data. In addition, the processing unit fills in the missing data by interpolation to ensure that all data dimensions are intact, prevent analysis errors caused by data loss, and thus improve the accuracy of silent period analysis and APT attack detection.

[0055] The risk analysis module includes a preliminary analysis unit and a timing identification unit;

[0056] The preliminary analysis unit uses a preset time window and combines the traffic data set to analyze the fluctuation of the silent period in each time window during each cross-zone communication process to calculate the silent period difference factor Jcyz in the corresponding time window. The silent period difference factor Jcyz is specifically obtained in the following manner:

[0057] ;

[0058] Where n is the number of silent periods in the corresponding time window, i=1, 2, 3, ..., n, It is expressed as the duration of the ith silent period in the corresponding time window, It is expressed as the average period length of all silent periods in the corresponding time window.

[0059] The above-mentioned silent period refers to when no data packet transmission behavior (that is, no traffic) is detected within a certain time window. The system identifies this period as a silent period. As time goes by, the system will record the number of occurrences of all silent periods in the time window to obtain the number of silent periods.

[0060] The period length Jsc of each silent period in the corresponding time window refers to the start time and end time of each silent period;

[0061] The timing identification unit is used to pre-set an abnormal threshold, and compare and analyze the abnormal threshold with the silent period difference factor Jcyz to preliminarily determine whether there is an APT attack risk in the corresponding cross-zone communication process. The specific preliminary judgment content is as follows:

[0062] If the silent period difference factor Jcyz exceeds the abnormal threshold, it will be preliminarily determined that there is no APT attack risk in the corresponding cross-zone communication process, and the current time window will be marked as a normal time window;

[0063] If the silent period difference factor Jcyz does not exceed the abnormal threshold, it will be preliminarily determined that there is an APT attack risk in the corresponding cross-zone communication process, and the current time window will be marked as an abnormal time window.

[0064] In this embodiment, through the preliminary analysis unit in the risk analysis module, the system can calculate the fluctuation of the silent period in each time window based on the preset time window and the cross-regional traffic data set, and further calculate the silent period difference factor Jcyz, which can accurately measure the fluctuation degree of the silent period in each time window by analyzing the deviation between the silent period cycle length and the average cycle length. The system can detect subtle anomalies in cross-regional communications through this factor, thereby discovering possible signs of APT attacks in advance. Through the timing recognition unit, the system can compare and analyze the silent period difference factor Jcyz with the threshold according to the preset abnormal threshold, so as to preliminarily determine whether there is an APT attack risk in the cross-regional communication process. If the difference factor does not exceed the abnormal threshold, the system will automatically mark the current time window as an abnormal time window and determine that there may be an APT attack risk. The automated APT attack detection and early warning mechanism ensures a rapid response to potential threats, further reduces the lag and misjudgment risk of human intervention, and thus improves the system's detection capability for advanced persistent threats.

[0065] Example 3

[0066] Please refer to Figure 1 ,Specifically: the silent period abnormality analysis module includes an aggregation unit, a post-period transmission analysis unit and a frequent switching analysis unit;

[0067] The aggregation unit is used to sort several groups of abnormal time windows and normal time windows in chronological order according to the abnormal time windows and normal time windows marked in the time series identification unit, and after aggregation, to construct abnormal time series and normal time series respectively.

[0068] The post-period transmission analysis unit is used to analyze the transmission behavior status after each silent period in the abnormal time series based on the abnormal time series, so as to obtain the abnormal transmission deviation Ycqc after the corresponding silent period. The abnormal transmission deviation Ycqc is obtained by the following formula:

[0069] ;

[0070] In the formula, when When , this formula is valid; among them, It is expressed as the average of the total amount of data transmitted after all silent periods in a normal time series. It is expressed as the amount of data transmitted after the corresponding silent period in the abnormal time series ends, which refers to the size of the data packet transmitted after the corresponding silent period ends.

[0071] The abnormal transmission deviation Ycqc after the corresponding silent period reflects the deviation of the data transmission volume after the silent period. The larger the value of the abnormal transmission deviation Ycqc, the greater the amount of data transmitted after the corresponding silent period in the abnormal time series. The smaller it is, the more likely it is to indicate an abnormal recovery situation, such as covert communication in an APT attack;

[0072] The amount of data Scz transmitted after each of the above-mentioned silent periods is detected by network traffic monitoring tools. These tools are usually embedded in network devices (such as switches, routers, firewalls, and intrusion detection systems) to monitor each data packet passing through the network.

[0073] In this embodiment, through the aggregation unit, the system can sort and summarize several groups of time windows according to the abnormal and normal time windows marked in the time series identification unit. By constructing abnormal time series and normal time series, the system can effectively distinguish the difference between abnormal behavior and normal behavior, and then provide a clear time series data basis for subsequent transmission behavior analysis. This design can help the system better grasp the specific behavior time period in APT attacks and further avoid misjudgment of normal traffic. The later transmission analysis unit can analyze the transmission behavior after each silent period based on the abnormal time series and identify the transmission mode under abnormal conditions. By calculating the abnormal transmission deviation Ycqc after the silent period, the system can quantify the difference between the amount of data transmitted after each silent period in the abnormal time series and the normal behavior. This type of deviation analysis can accurately capture the hidden transmission behavior in APT attacks, such as low-frequency data packets or small data volume transmission, and effectively improve the system's ability to identify advanced threats. The system defines the calculation method of the abnormal transmission deviation Ycqc in a formulaic way, uses the average value of the amount of transmission data in the normal time series as a benchmark, and compares it with the amount of data in the abnormal time series. In this way, the system can dynamically adapt to different network environments and communication loads, automatically adjust the analysis standards, and ensure that it can maintain a high degree of sensitivity and accuracy under various operating conditions, thereby reducing false positives and false negatives. Compared with traditional detection methods, the system further improves the detection performance of APT attacks, especially for small-scale transmission behaviors hidden in normal traffic. By aggregating normal and abnormal time series and deeply analyzing the transmission behavior deviation after the end of the silent period, it can more accurately identify potential APT attack behaviors in cross-regional communications.

[0074] Example 4

[0075] Please refer to Figure 1 Specifically: the frequent switching analysis unit is used to extract the current The silent period corresponding to the time is initially recorded as the abnormal silent period. According to the distribution of the abnormal silent period, the abnormal recovery frequency Yhq is obtained. Through statistics, several groups of abnormal silent periods are summarized into a silent period abnormal set. According to the silent period abnormal set, the flow data after the end of the silent period corresponding to the silent period abnormal set is extracted from the flow data set to calculate the protocol switching rate Xqpz. The protocol switching rate Xqpz is obtained by the following formula:

[0076] ;

[0077] This formula checks each data packet in the silent period exception set one by one to monitor whether the protocol type of the previous data packet and the current data packet is different. If they are different, a protocol switch is accumulated once;

[0078] Where, m represents the data packet data in the abnormal set during the silent period; j=1, 2, 3, ..., m; The protocol type of the jth data packet, for example, HTTP, HTTPS, DNS, and ICMP; It is represented as the protocol type of the j-1th data packet, that is, the protocol type of the previous data packet of the jth data packet; Is an indicator function, whose value is 1 or 0, used to determine whether the protocol has changed. If the protocol of the current data packet is different from that of the previous data packet, this item is 1, indicating that the protocol switching has occurred. If the protocols are the same, this item is 0, indicating that there is no protocol switching. If two functional areas in a nuclear power plant frequently switch protocol types during a communication session, this may indicate an abnormality, such as the covert communication mode of an APT attack, because the attacker may use different protocols to hide C2 communications or evade security detection;

[0079] The protocol type of each data packet during the above-mentioned silent periods is obtained through deep packet inspection (DPI) technology to identify the protocol type in the data packet.

[0080] In this embodiment, through the abnormal silent period identified by the post-transmission analysis unit, the frequent switching analysis unit can extract the silent period data corresponding to these abnormal silent periods, and calculate the abnormal recovery frequency Yhq through the distribution of the abnormal silent period. This process enables the system to effectively identify and summarize the abnormal silent period behaviors related to potential APT attacks and generate a silent period abnormal set. Through the summarized silent period abnormal set, the system can quickly locate the time periods that are most likely to hide APT attacks in large-scale cross-regional communications, providing an efficient basis for subsequent in-depth analysis. Through the frequent switching analysis unit, the system can analyze the data packets in each silent period one by one, check whether the protocol types of the two data packets before and after have changed, and if the protocol types before and after are different, the protocol switching behavior is accumulated once. Since APT attackers often hide their communications by using different protocols, or bypass traditional security detection mechanisms by frequently switching protocols, the system can further capture the abnormal behaviors of these frequently switched protocols through the calculation of the protocol switching rate Xqpz, and accurately identify possible APT attacks. This detailed analysis at the protocol level effectively improves the detection accuracy of hidden attacks. In the present invention, the calculation method of the protocol switching rate Xqpz is to perform a detailed inspection on each data packet protocol in the silent period abnormal set, not only focusing on the end data volume of the silent period, but also monitoring the switching of the protocol type in particular. C2 communication in APT attacks often evades monitoring through hidden and complex protocol switching, and maintains low data flow transmission by frequently switching different protocol types. The protocol switching rate Xqpz can discover these hidden abnormal behaviors by analyzing the switching frequency of different types of protocols. This method extracts relevant traffic data from the silent period abnormal set to ensure that even the smallest protocol switching can be identified during the APT attack process, thereby improving the system's monitoring capability for complex communication behaviors in APT attacks as much as possible. In summary, through the frequent switching analysis unit, the system can calculate the protocol switching rate Xqpz based on the silent period abnormal set, conduct in-depth analysis of the multi-protocol switching behavior in the abnormal time period, and accurately identify the APT attacks hidden in the legitimate traffic. The protocol switching rate analysis of the system improves the accuracy of APT attack detection, especially for low-frequency covert communication and complex attack behaviors in multi-protocol environments, providing more efficient security protection means.

[0081] Example 5

[0082] Please refer to Figure 1 ,Specifically: the threat warning module includes a model building unit, a ,comprehensive analysis unit and a comparison unit;

[0083] The model building unit is used to use convolutional neural network technology to preliminarily build an original model, and train and test the original model with data in the traffic data set, and use the trained original model as a state recognition model, respectively obtain feature information in the state recognition model, and train and test the state recognition model with the acquired feature information, combine the identification of abnormal time windows and abnormal silent periods, use the trained state recognition model as a threat model, and train the trained threat model to fit and obtain the threat assessment index Wgzs.

[0084] The comprehensive analysis unit is used to output the threat model to obtain a threat assessment index Wgzs, and the threat assessment index Wgzs is obtained by the following formula:

[0085] ;

[0086] In the formula, It is expressed as the average of the total amount of data transmitted after all silent periods in the abnormal time series. Expressed as abnormal recovery frequency, Expressed as the protocol switching rate, , and are weight values, Expressed as a correction constant, where , and The specific value is set by the user according to the situation;

[0087] Among them, the average value of the total amount of data transmitted after all silent periods in the abnormal time series The acquisition method is to obtain the abnormal transmission deviation Ycqc after each silent period in the post-period transmission analysis unit, and obtain it by summing and taking the average thereof.

[0088] In this embodiment, through the model building unit, the system uses convolutional neural network technology to build the original model, and trains and tests with the flow data set inside the nuclear power plant, continuously optimizes the performance of the model, and after multiple rounds of training, the system generates a state recognition model, which can accurately extract the flow feature information related to APT attacks. By combining the recognition of abnormal time windows and abnormal silent periods, the system further optimizes the threat model. This process enables the model to capture complex threat behaviors in the nuclear power plant network environment and effectively identify them, greatly improving the early detection capability of APT attacks. The comprehensive analysis unit comprehensively evaluates the security status of the internal network of the nuclear power plant through the threat assessment index Wgzs according to the trained threat model, wherein the threat assessment index Wgzs provides a comprehensive quantitative measurement of potential threats, which helps to more accurately identify possible APT attacks. Compared with the traditional single indicator detection method, the evaluation index of multiple parameters further improves the accuracy and reliability of the system to detect threats. Through multiple rounds of training and fitting processes, the threat model can adapt to different network environments and traffic patterns to ensure that it can also operate efficiently in a complex nuclear power plant network structure. The system can continuously adjust the threat model through new data to ensure that its detection capability remains in a relatively good state. With the continuous expansion and update of the traffic data set, the accuracy of the threat model will be further improved, ensuring that it can cope with the ever-changing attack methods, especially providing more accurate early warning and protection when facing advanced persistent threats (APT). By comprehensively analyzing the data transmission behavior in the abnormal time series, the system can identify those hidden APT attacks that are usually not captured by traditional detection systems. In summary, the system uses convolutional neural network technology to construct and optimize the threat model, combined with multi-parameter evaluation and adaptive training, to further improve the detection capability of APT attacks in the nuclear power plant network environment. By generating an accurate threat assessment index Wgzs, the system makes the early warning of APT attacks more efficient and provides user-adjustable flexibility to ensure that the system can continuously provide relatively better threat detection and defense means for different network environments and security needs.

[0089] Example 6

[0090] Please refer to Figure 1 Specifically: the comparison unit is used to pre-set an evaluation threshold, and compare and analyze the evaluation threshold with the threat assessment index Wgzs to comprehensively determine whether there is an APT attack when communicating between functional areas in the nuclear power plant. The specific comparison content is as follows:

[0091] If the threat assessment index Wgzs exceeds the assessment threshold, it means that there is an APT attack when communicating between the functional areas in the current nuclear power plant, and the constructed silent period anomaly set is regarded as the silent period anomaly set of the APT attack. At this time, all communications with the external network will be immediately cut off, especially the communication of data flow to the target server after the abnormal silent period is detected. This helps prevent APT attackers from further infiltrating or stealing data through the network, and implements network isolation for all functional areas within the nuclear power plant, isolating the affected areas from other functional areas, preventing the attack from continuing to spread to other key areas (such as control areas and reactor areas) through lateral movement, and strictly restricting cross-regional communications between functional areas in the nuclear power plant, especially restricting the communication between low-security areas such as auxiliary areas and office areas and core control areas, preventing APT attacks from infiltrating the control area or reactor area through non-core areas;

[0092] If the threat assessment index Wgzs does not exceed the assessment threshold, it means that there is no APT attack when communicating between the functional areas in the current nuclear power plant, and monitoring and analysis will be required at this time.

[0093] In this embodiment, the comparison unit compares and analyzes the threat assessment index Wgzs through the set evaluation threshold, and can comprehensively judge whether there is an APT attack in the communication between the functional areas in the nuclear power plant. Through the automatic calculation and analysis of the threat assessment index, the system can accurately detect the potential risk of APT attacks, especially when the threat assessment index exceeds the threshold, indicating that the system has successfully captured the signs of APT attacks. This evaluation mechanism effectively improves the detection accuracy of APT attacks in nuclear power plants, ensuring that timely warnings and defensive measures can be taken. When the system determines that there is an APT attack, effective isolation measures can be taken immediately. First, the system will automatically cut off all communications with external networks, especially those data streams pointing to the target server after the detected abnormal silent period ends, to prevent APT attackers from further infiltrating or stealing sensitive data. Secondly, the system implements network isolation for each functional area within the nuclear power plant to prevent APT attacks from spreading to the core functional area through lateral movement. This automated isolation mechanism further reduces the risk of APT attacks spreading and protects the critical infrastructure of the nuclear power plant. At the same time, the system conducts in-depth analysis of all existing cross-regional data flows, marks abnormal communication behaviors, and records communication paths. This function helps to track the specific behavior paths of APT attacks, prevent the leakage of sensitive data, and strengthen the security management of cross-regional communications. When the threat assessment index Wgzs does not exceed the set assessment threshold, the system will not immediately take mandatory isolation or disconnection measures, but will keep track of the network status through continuous monitoring and analysis. This threshold-based judgment mechanism effectively prevents false alarms, ensuring that the system can detect APT attacks with high accuracy while further avoiding unnecessary interference to normal communications. Through continuous monitoring, the system can make timely adjustments and responses when signs of future attacks appear, thereby achieving long-term security protection. The system provides an accurate APT attack risk assessment mechanism through the comparison unit, and automatically executes a series of isolation and defense measures when an APT attack is detected, further avoiding the further spread of the attack and data leakage. At the same time, through cross-regional communication restrictions and abnormal traffic analysis, the system can effectively improve the overall protection capabilities of the nuclear power plant network security. When no APT attack is detected, the system maintains continuous monitoring and analysis to ensure that the system is always under control and prevent the spread of potential threats.

[0094] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A threat early warning system based on network traffic big data, characterized by: It includes cross-regional communication module, risk analysis module, silent period anomaly analysis module and threat warning module; The cross-region communication module is used to monitor the network traffic status between the functional areas in the nuclear power plant in real time in advance to generate cross-region traffic data information, and construct a traffic data set through statistics; The risk analysis module is used to preset a time window, analyze the fluctuation of the silent period in each time window during each cross-zone communication process based on the time window and the traffic data set, so as to calculate the silent period difference factor Jcyz in the corresponding time window, and preliminarily judge whether there is an APT attack risk in the corresponding cross-zone communication process based on the silent period difference factor Jcyz, and identify the abnormal time window; The risk analysis module includes a preliminary analysis unit and a timing identification unit; The preliminary analysis unit uses a preset time window and combines the traffic data set to analyze the fluctuation of the silent period in each time window during each cross-zone communication process to calculate the silent period difference factor Jcyz in the corresponding time window. The silent period difference factor Jcyz is specifically obtained in the following manner: ； Where n is the number of silent periods in the corresponding time window, i=1, 2, 3, ..., n, It is expressed as the duration of the ith silent period in the corresponding time window, It is expressed as the average cycle length of all silent periods in the corresponding time window; The silent period abnormality analysis module is used to construct an abnormal time series according to the abnormal time window identified in the risk analysis module, and analyze the transmission behavior after each silent period in the abnormal time series to obtain the abnormal transmission deviation Ycqc, and set constraints on the abnormal transmission deviation Ycqc to identify the abnormal silent period, and calculate the protocol switching rate Xqpz based on the abnormal silent period and in combination with the traffic data set; The silent period abnormality analysis module includes an aggregation unit, a post-period transmission analysis unit, and a frequent switching analysis unit; The post-period transmission analysis unit is used to analyze the transmission behavior status after each silent period in the abnormal time series based on the abnormal time series, so as to obtain the abnormal transmission deviation Ycqc after the corresponding silent period. The abnormal transmission deviation Ycqc is obtained by the following formula: ； In the formula, when When , this formula is valid; among them, It is expressed as the average of the total amount of data transmitted after all silent periods in a normal time series. It is expressed as the amount of data transmitted after the corresponding silent period in the abnormal time series ends; The frequent switching analysis unit is used to extract the current The silent period corresponding to the time is initially recorded as the abnormal silent period. According to the distribution of the abnormal silent period, the abnormal recovery frequency Yhq is obtained. Through statistics, several groups of abnormal silent periods are summarized into a silent period abnormal set. According to the silent period abnormal set, the flow data after the end of the silent period corresponding to the silent period abnormal set is extracted from the flow data set to calculate the protocol switching rate Xqpz. The protocol switching rate Xqpz is obtained by the following formula: ； This formula checks each data packet in the silent period exception set one by one to monitor whether the protocol type of the previous data packet and the current data packet is different. If they are different, a protocol switch is accumulated once; Where, m represents the data packet data in the abnormal set during the silent period; j=1, 2, 3, ..., m; Represents the protocol type of the jth data packet; Represents the protocol type of the j-1th packet, where is an indicator function whose value is 1 or 0; The threat warning module is used to construct a threat model using convolutional neural network technology, and input the protocol switching rate Xqpz and the abnormal transmission deviation Ycqc into the threat model. After linear normalization, the threat assessment index Wgzs is obtained by fitting. If the threat assessment index Wgzs exceeds the preset assessment threshold, a threat warning is issued and defense measures are executed. The threat warning module includes a model building unit, a comprehensive analysis unit and a comparison unit; The comprehensive analysis unit is used to output the threat model to obtain a threat assessment index Wgzs, and the threat assessment index Wgzs is obtained by the following formula: ； In the formula, It is expressed as the average of the total amount of data transmitted after all silent periods in the abnormal time series. Expressed as abnormal recovery frequency, Expressed as the protocol switching rate, , and are weight values, Expressed as a correction constant, where , and The specific value is set by the user according to the situation.

2. The threat early warning system based on network traffic big data according to claim 1 is characterized by: The cross-region communication module includes a monitoring unit and a processing unit; The monitoring unit is used to monitor the network traffic status between the functional areas in the nuclear power plant in real time in advance to generate cross-area traffic data information, wherein the cross-area traffic data information includes source IP, destination IP, data packet size, protocol type, communication timestamp, data packet interval time, cycle length Jsc of each silent period in the corresponding time window during each cross-area process, amount of data transmitted after each silent period Scz, and protocol type of each data packet in each silent period; wherein the functional areas include reactor area, control area, management and safety assurance area, and auxiliary functional area; The processing unit is used to clean the cross-regional traffic data information, remove noise and duplicate data, convert the cleaned data into a unified format so that its range falls between 0 and 1, and fill in the missing data through interpolation.

3. The threat early warning system based on network traffic big data according to claim 1 is characterized by: The timing identification unit is used to pre-set an abnormal threshold, and compare and analyze the abnormal threshold with the silent period difference factor Jcyz to preliminarily determine whether there is an APT attack risk in the corresponding cross-zone communication process. The specific preliminary judgment content is as follows: If the silent period difference factor Jcyz exceeds the abnormal threshold, it will be preliminarily determined that there is no APT attack risk in the corresponding cross-zone communication process, and the current time window will be marked as a normal time window; If the silent period difference factor Jcyz does not exceed the abnormal threshold, it will be preliminarily determined that there is an APT attack risk in the corresponding cross-zone communication process, and the current time window will be marked as an abnormal time window.

4. The threat early warning system based on network traffic big data according to claim 3 is characterized by: The aggregation unit is used to sort several groups of abnormal time windows and normal time windows in chronological order according to the abnormal time windows and normal time windows marked in the time series identification unit, and after aggregation, to construct abnormal time series and normal time series respectively.

5. The threat early warning system based on network traffic big data according to claim 4 is characterized in that: The model building unit is used to use convolutional neural network technology to preliminarily build an original model, and train and test the original model with data in the traffic data set, and use the trained original model as a state recognition model, respectively obtain feature information in the state recognition model, and train and test the state recognition model with the acquired feature information, combine the identification of abnormal time windows and abnormal silent periods, use the trained state recognition model as a threat model, and train the trained threat model to fit and obtain the threat assessment index Wgzs.

6. The threat early warning system based on network traffic big data according to claim 5 is characterized by: The comparison unit is used to pre-set the evaluation threshold, and compare and analyze the evaluation threshold with the threat assessment index Wgzs to comprehensively determine whether there is an APT attack when communicating between functional areas in the nuclear power plant. The specific comparison content is as follows: If the threat assessment index Wgzs exceeds the assessment threshold, it means that there is an APT attack when the functional areas in the current nuclear power plant communicate with each other, and the constructed silent period anomaly set is regarded as the silent period anomaly set of the APT attack. At this time, all communications with the external network will be immediately cut off, and network isolation will be implemented for all functional areas within the nuclear power plant; If the threat assessment index Wgzs does not exceed the assessment threshold, it means that there is no APT attack when communicating between the functional areas in the current nuclear power plant, and monitoring and analysis will be required at this time.

Images