An adaptive network defense system and method for network security

Abstract

The present invention discloses an adaptive network defense system and method for network security, which relates to the field of network attack and defense technology, including: evaluating the basic risk coefficient of user equipment; taking the typical range of program operation parameters in the historical operation log as the ideal threshold of the corresponding program, and judging whether the operation parameters of each program exceed the ideal threshold of the corresponding program; constructing a network security adaptive situation awareness model according to the operation data of the abnormal program to be confirmed, analyzing the abnormal operation index of the real-time program of the device, correcting the abnormal index of the real-time program based on the basic risk coefficient of the user equipment, obtaining the abnormal operation index of the corrected program, classifying the abnormal operation index of the corrected abnormal program according to the risk level, and generating corresponding solutions according to the classification results; the advantages of the present invention are: improving the detection accuracy of worm mining viruses without attack purposes.

Description

Technical Field

[0001] The present invention relates to the technical field of network attack and defense, and in particular to an adaptive network defense system and method for network security. Background Art

[0002] Cybersecurity refers to a collection of technologies and practices designed to protect information in network connections from unauthorized access, use, disclosure, destruction or modification, and to ensure the integrity and availability of data. This includes but is not limited to preventing malware attacks, hacking and other forms of cybercrime, as well as maintaining the normal operation of information systems and the security of user privacy.

[0003] The existing network defense method is to detect and manage abnormal software by analyzing the unauthorized behavior of monitoring software. However, since mining worm viruses do not attack the data files of the device and their goal is to steal the user's device bandwidth and computing power resources for mining, conventional unauthorized and attack monitoring cannot identify such mining worm viruses, resulting in higher load on the user's device and reduced device life. Summary of the invention

[0004] In order to solve the above technical problems, an adaptive network defense system and method for network security are provided. The technical solution solves the above-mentioned existing network defense means that the unauthorized behavior of the monitoring software is analyzed to achieve detection and management of abnormal software. However, since mining worm viruses will not attack the data files of the device and aim to steal the user's device bandwidth and computing power resources for mining, conventional unauthorized and attack monitoring cannot identify such mining worm viruses, resulting in higher device load and reduced device life.

[0005] In order to achieve the above purpose, the technical solution adopted by the present invention is:

[0006] An adaptive network defense method for network security, comprising:

[0007] Record the user's historical operation records, analyze the operation behavior of the user's device, and evaluate the basic risk factor of the user's device;

[0008] Based on the historical operation log of the device, the typical range of the program operation parameters in the historical operation log is used as the ideal threshold value of the corresponding program;

[0009] Determine whether the operating parameters of each program exceed the ideal threshold of the corresponding program. If not, it is determined to be normal. If so, it is determined to be abnormal. Filter out the abnormally operating programs and record them as abnormal programs to be confirmed.

[0010] Based on the abnormal program to be confirmed, an index source file where the abnormal program to be confirmed is located is searched, a source code pointer target in the source file is compiled, and running data of the abnormal program to be confirmed is obtained;

[0011] Based on the abnormal program operation data to be confirmed, a network security adaptive situation awareness model is constructed to analyze the abnormal operation index of the real-time program of the device;

[0012] Correcting the abnormal operation index of the real-time running program based on the basic risk coefficient of the user device to obtain the abnormal operation index of the corrected abnormal program;

[0013] Classify the abnormal operation index of the abnormal correction program according to the danger level, and generate corresponding solutions based on the classification results;

[0014] The calculation expression of the abnormal operation index of the modified abnormal program is:

[0015] ;

[0016] In the formula, To correct the abnormal operation index of abnormal programs, is the basic risk factor of the user's device, is the abnormal operation index of the jth program of the device.

[0017] Preferably, recording the user's historical operation records, analyzing the operation behavior of the user's device, and evaluating the basic risk factor of the user's device specifically include:

[0018] Based on logistics regression, establish equipment risk probability assessment model;

[0019] Based on the user's historical operation records, risk operations are extracted from the historical operation records to obtain operation feature data of the user's device; the operation features include but are not limited to: risky download operations, risky connection operations, risky login operations, and risky access operations;

[0020] Performing normalization processing on the operation characteristic data of the user equipment to obtain an operation characteristic vector of the user equipment;

[0021] Based on the device risk probability assessment model, the operation feature vector of the user device is input as an independent variable, the gradient of the loss function with respect to each feature is calculated by differentiation, the weight vector and the bias term are updated according to the calculated gradient, and the risk probability of the operation feature vector of the user device is output as an independent variable;

[0022] Merge similar items of the risk probability of the operation feature vector of the user device to obtain a risk probability array of the operation feature vector of the user device;

[0023] Assign a weight to each element in the risk probability array of the operation feature vector of the user device according to the contribution of the risk probability of the operation feature vector of the user device to the risk event;

[0024] Calculate the basic risk coefficient of the user device according to the risk probability array of the operation feature vector of the user device and the risk probability weight of the operation feature vector of the user device;

[0025] Among them, the equipment risk probability assessment model expression is:

[0026] ;

[0027] In the formula, is a prediction function used to calculate a given set of parameters and the operating feature vector The risk probability when is the label value (1,0) of the i-th observation, is the i-th operation feature vector, is the parameter set of the model, is the weight vector, For transposition, is the bias term.

[0028] The basic risk coefficient calculation expression of the user equipment is:

[0029] ;

[0030] In the formula, is the basic risk factor of the user's device, is the weight of the i-th operation feature vector.

[0031] Preferably, based on the historical operation log of the device, taking the typical range of the operation parameters of the program in the historical operation log as the ideal threshold value of the corresponding program specifically includes:

[0032] Based on the historical operation log of the device, the operation parameters of the program in the log are divided according to the unit time to obtain the operation parameters of the program in several time periods;

[0033] Based on the running parameters of several time periods of the program, several time periods of the program are used as observation windows, and the running parameters are used as observation data;

[0034] Based on the observed data in the observation window, calculate the quartile of the program running resource usage corresponding to the observed data in each observation window;

[0035] Based on the quartiles of the program running resource usage corresponding to the observed data in the observation window, the difference between the upper quartile and the lower quartile is calculated as the interquartile range;

[0036] Based on the upper and lower quartiles and the interquartile range, the typical range of operating parameters was calculated as the ideal threshold value for the corresponding procedure;

[0037] Among them, the calculation expression of the typical range of operating parameters is:

[0038] ;

[0039] in, is the lower limit of the typical range of operating parameters, is the upper limit of the typical range of operating parameters, is the lower quartile, is the upper quartile, k is the adjustment parameter, and its value is 2. is the interquartile range.

[0040] Preferably, building a network security adaptive situation awareness model based on the abnormal program operation data to be confirmed, and analyzing the abnormal operation index of the real-time program of the device specifically includes:

[0041] Based on the abnormal program running data to be confirmed, marking abnormal activities in the abnormal program running data as deviation running feature data of the abnormal program;

[0042] The normal operation parameters of the program in the historical operation log are packaged as a training set, the genetic neural network is trained, and the deviation operation feature data of the abnormal program is used as input to verify the network security adaptive situation awareness model that can detect abnormal program activities;

[0043] Obtain the background process running data of the device's real-time program, substitute the program's background process running data into the network security adaptive situation awareness model, analyze the degree of deviation of the process running data of each program, and calculate the abnormal running index of the device's real-time program;

[0044] Among them, the network security adaptive situation awareness model expression is:

[0045] ;

[0046] In the formula, is the abnormal operation index of the jth program of the device, The actual value of the background process running data for the jth program, is the average function, is the baseline value corresponding to the background process running data of the jth program, The total number of running data for the background process of the program.

[0047] Furthermore, an adaptive network defense system for network security is proposed, which is used to implement the adaptive network defense method for network security as described above, including:

[0048] A basic risk coefficient assessment module is used to record the user's historical operation records, analyze the operation behavior of the user's device, and assess the basic risk coefficient of the user's device;

[0049] A threshold setting module, which is used to use a typical range of program operation parameters in the historical operation log as an ideal threshold value of the corresponding program based on the historical operation log of the device;

[0050] The abnormality judgment module is electrically connected to the threshold setting module. The abnormality judgment module is used to judge whether the operating parameters of each program exceed the ideal threshold of the corresponding program. If not, it is judged as normal. If so, it is judged as abnormal. The abnormally operating programs are screened and recorded as abnormal programs to be confirmed;

[0051] A program abnormal operation index evaluation module, the program abnormal operation index evaluation module is electrically connected to the abnormal judgment module, and the program abnormal operation index evaluation module is used to build a network security adaptive situation awareness model based on the abnormal program operation data to be confirmed, and analyze the abnormal operation index of the real-time program of the device;

[0052] A correction module, the correction module is electrically connected to the basic risk coefficient evaluation module and the program abnormal operation index evaluation module, and the correction module is used to correct the abnormal operation index of the real-time running program based on the basic risk coefficient of the user device to obtain the abnormal operation index of the corrected abnormal program;

[0053] The classification solution module is electrically connected to the correction module. The classification solution module is used to classify the abnormal operation index of the corrected abnormal program according to the danger level and generate a corresponding solution according to the classification result.

[0054] Optionally, the basic risk factor assessment module includes:

[0055] The first model building unit builds an equipment risk probability assessment model based on logistics regression;

[0056] A risk feature labeling unit extracts risky operations based on the user's historical operation records and obtains operation feature data of the user's device;

[0057] A vector unit, performing normalization processing according to the operation characteristic data of the user equipment to obtain an operation characteristic vector of the user equipment;

[0058] The risk prediction unit, based on the device risk probability assessment model, takes the operation feature vector of the user device as an independent variable input, calculates the gradient of the loss function with respect to each feature by differentiation, updates the weight vector and the bias term according to the calculated gradient, and outputs the risk probability of the operation feature vector of the user device as an independent variable;

[0059] A merging unit, merging similar items of the risk probability of the operation feature vector of the user equipment to obtain an array of the risk probability of the operation feature vector of the user equipment;

[0060] A weighting unit assigns a weight to each element in the risk probability array of the operation feature vector of the user device according to the contribution of the risk probability of the operation feature vector of the user device to the risk event;

[0061] The first calculation unit calculates a basic risk coefficient of the user equipment according to the risk probability array of the operation feature vector of the user equipment and the risk probability weight of the operation feature vector of the user equipment.

[0062] Optionally, the program abnormal operation index evaluation module includes:

[0063] An abnormal feature marking unit, based on the abnormal program running data to be confirmed, marks abnormal activities in the abnormal program running data as deviation running feature data of the abnormal program;

[0064] The second model building unit packages the normal operation parameters of the program in the historical operation log into a training set, trains the genetic neural network, and uses the deviation operation feature data of the abnormal program as input to verify the network security adaptive situation awareness model that can detect abnormal activities of the program;

[0065] The second calculation unit obtains the background process running data of the real-time program of the device, substitutes the background process running data of the program into the network security adaptive situation awareness model, analyzes the deviation degree of the process running data of each program, and calculates the abnormal operation index of the real-time program of the device.

[0066] Compared with the prior art, the present invention has the following beneficial effects:

[0067] The present invention proposes an adaptive network defense solution for network security, which analyzes the abnormal operation index of the program by dynamically adjusting the monitoring threshold and introducing the basic risk coefficient of the user, and uses the basic risk coefficient to correct the abnormal operation index of the program, analyzes the abnormal state of the program, and improves the worm mining virus detection accuracy of the device. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 It is a flow chart of an adaptive network defense method for network security;

[0069] Figure 2 A flow chart of a method for evaluating the basic risk factor of a user's device;

[0070] Figure 3 Flowchart of the ideal threshold method for setting the procedure;

[0071] Figure 4 A flow chart of a method for analyzing abnormal operation index of a real-time program of a device;

[0072] Figure 5 The framework diagram of an adaptive network defense system for network security. DETAILED DESCRIPTION

[0073] The following description is used to disclose the present invention so that those skilled in the art can implement the present invention. The preferred embodiments described below are only examples, and those skilled in the art may think of other obvious variations.

[0074] Reference Figure 1 As shown, an adaptive network defense method for network security includes:

[0075] Record the user's historical operation records, analyze the operation behavior of the user's device, and evaluate the basic risk factor of the user's device;

[0076] Based on the historical operation log of the device, the typical range of the operation parameters of the program in the historical operation log is used as the ideal threshold of the corresponding program, and the typical range of the operation parameters refers to the resource occupancy rate of the historical program;

[0077] Determine whether the operating parameters of each program exceed the ideal threshold of the corresponding program. If not, it is determined to be normal. If so, it is determined to be abnormal. Filter out the abnormally operating programs and record them as abnormal programs to be confirmed.

[0078] Based on the abnormal program to be confirmed, an index source file where the abnormal program to be confirmed is located is searched, a source code pointer target in the source file is compiled, and running data of the abnormal program to be confirmed is obtained;

[0079] Based on the abnormal program operation data to be confirmed, a network security adaptive situation awareness model is constructed to analyze the abnormal operation index of the real-time program of the device;

[0080] Correcting the abnormal operation index of the real-time running program based on the basic risk coefficient of the user device to obtain the abnormal operation index of the corrected abnormal program;

[0081] Classify the abnormal operation index of the abnormal correction program according to the danger level, and generate corresponding solutions based on the classification results;

[0082] The calculation expression of the abnormal operation index of the modified abnormal program is:

[0083] ;

[0084] In the formula, To correct the abnormal operation index of abnormal programs, is the basic risk factor of the user's device, is the abnormal operation index of the jth program of the device.

[0085] This solution obtains the basic risk coefficient of the device by analyzing the user's operation behavior. The larger the coefficient, the greater the risk of the device being infected by the network mining worm virus. Secondly, the program running status in the device is monitored, suspicious programs are screened out, the abnormal running index of abnormal programs is analyzed, and the abnormal running index of abnormal programs is corrected using the basic risk coefficient of the device. According to the minor or serious abnormality corresponding to the abnormal running index of the corrected abnormal program, measures are taken to record abnormal logs, send alarms, or immediately stop software running and perform system repairs;

[0086] It should be noted that compiling the source code pointer target in the source file and obtaining the running data of the abnormal program to be confirmed means recording the network activity data and system call data of the abnormal program to be confirmed when it is running after reverse compiling or running the program using the built-in virtual machine to obtain the running characteristics of the abnormal program to be confirmed.

[0087] Reference Figure 2 As shown, the user's historical operation records are recorded, the operation behavior of the user's device is analyzed, and the basic risk factor of the user's device is evaluated, which specifically includes:

[0088] Based on logistics regression, establish equipment risk probability assessment model;

[0089] Based on the user's historical operation records, risk operations are extracted from the historical operation records to obtain operation feature data of the user's device; the operation features include but are not limited to: risky download operations, risky connection operations, risky login operations, and risky access operations;

[0090] Performing normalization processing on the operation characteristic data of the user equipment to obtain an operation characteristic vector of the user equipment;

[0091] Based on the device risk probability assessment model, the operation feature vector of the user device is input as an independent variable, the gradient of the loss function with respect to each feature is calculated by differentiation, the weight vector and the bias term are updated according to the calculated gradient, and the risk probability of the operation feature vector of the user device is output as an independent variable;

[0092] Merge similar items of the risk probability of the operation feature vector of the user device to obtain a risk probability array of the operation feature vector of the user device;

[0093] Assign a weight to each element in the risk probability array of the operation feature vector of the user device according to the contribution of the risk probability of the operation feature vector of the user device to the risk event;

[0094] Calculate the basic risk coefficient of the user device according to the risk probability array of the operation feature vector of the user device and the risk probability weight of the operation feature vector of the user device;

[0095] Among them, the equipment risk probability assessment model expression is:

[0096] ;

[0097] In the formula, is a prediction function used to calculate a given set of parameters and the operating feature vector The risk probability when is the label value (1,0) of the i-th observation, is the i-th operation feature vector, is the parameter set of the model, is the weight vector, For transposition, is the bias term.

[0098] The basic risk coefficient calculation expression of the user equipment is:

[0099] ;

[0100] In the formula, is the basic risk factor of the user's device, is the weight of the i-th operation feature vector.

[0101] It can be understood that the basic risk coefficient provides a quantitative method to determine the potential security threat level faced by the user's device under the current operation behavior. When the basic risk coefficient is higher, it means that the current device is at greater risk of being infected by worms. Therefore, analyzing the impact of the basic risk coefficient on the abnormal state of the program can further improve the accuracy of anomaly detection.

[0102] Reference Figure 3 As shown, based on the historical operation log of the device, the typical range of the program operation parameters in the historical operation log is used as the ideal threshold value of the corresponding program, specifically including:

[0103] Based on the historical operation log of the device, the operation parameters of the program in the log are divided according to the unit time to obtain the operation parameters of the program in several time periods;

[0104] Based on the running parameters of several time periods of the program, several time periods of the program are used as observation windows, and the running parameters are used as observation data;

[0105] Based on the observed data in the observation window, calculate the quartile of the program running resource usage corresponding to the observed data in each observation window;

[0106] Based on the quartiles of the program running resource usage corresponding to the observed data in the observation window, the difference between the upper quartile and the lower quartile is calculated as the interquartile range;

[0107] Based on the upper and lower quartiles and the interquartile range, the typical range of operating parameters was calculated as the ideal threshold value for the corresponding procedure;

[0108] Among them, the calculation expression of the typical range of operating parameters is:

[0109] ;

[0110] in, is the lower limit of the typical range of operating parameters, is the upper limit of the typical range of operating parameters, is the lower quartile, is the upper quartile, k is the adjustment parameter, and its value is 2. is the interquartile range.

[0111] It is understandable that by analyzing the interval between the upper and lower four weeks, namely the IQR, it is possible to identify which changes are common and constitute "normal fluctuations", while those far away from this interval may be trends of potential problems. By setting the typical range of operating parameters, the ideal monitoring threshold can be adaptively adjusted to capture true anomalies and reduce false alarms caused by random fluctuations.

[0112] Reference Figure 4 As shown in the figure, based on the abnormal program operation data to be confirmed, a network security adaptive situation awareness model is constructed to analyze the abnormal operation index of the real-time program of the device, including:

[0113] Based on the abnormal program running data to be confirmed, marking abnormal activities in the abnormal program running data as deviation running feature data of the abnormal program;

[0114] The normal operation parameters of the program in the historical operation log are packaged as a training set, the genetic neural network is trained, and the deviation operation feature data of the abnormal program is used as input to verify the network security adaptive situation awareness model that can detect abnormal program activities;

[0115] Obtain the background process running data of the device's real-time program, substitute the program's background process running data into the network security adaptive situation awareness model, analyze the degree of deviation of the process running data of each program, and calculate the abnormal running index of the device's real-time program;

[0116] Among them, the network security adaptive situation awareness model expression is:

[0117] ;

[0118] In the formula, is the abnormal operation index of the jth program of the device, The actual value of the background process running data for the jth program, is the average function, is the baseline value corresponding to the background process running data of the jth program, The total number of running data for the background process of the program.

[0119] It is understandable that when a device is infected with an abnormal program, the goal of the abnormal program may not be to attack a specific data file, but to occupy the device bandwidth and device disk for the purpose of mining virus programs. This type of virus program will be started when the load on the user device is light. Therefore, by observing the network activity data and system call data in the background process and analyzing the degree of deviation between the abnormal program activity and normal activity, the abnormal operation index of the device's real-time program can be analyzed.

[0120] Further, see Figure 5 As shown, based on the same inventive concept of an adaptive network defense method for network security, an adaptive network defense system for network security is proposed, comprising:

[0121] A basic risk coefficient assessment module is used to record the user's historical operation records, analyze the operation behavior of the user's device, and assess the basic risk coefficient of the user's device;

[0122] A threshold setting module, which is used to use a typical range of program operation parameters in the historical operation log as an ideal threshold value of the corresponding program based on the historical operation log of the device;

[0123] The abnormality judgment module is electrically connected to the threshold setting module. The abnormality judgment module is used to judge whether the operating parameters of each program exceed the ideal threshold of the corresponding program. If not, it is judged as normal. If so, it is judged as abnormal. The abnormally operating programs are screened and recorded as abnormal programs to be confirmed;

[0124] A program abnormal operation index evaluation module, the program abnormal operation index evaluation module is electrically connected to the abnormal judgment module, and the program abnormal operation index evaluation module is used to build a network security adaptive situation awareness model based on the abnormal program operation data to be confirmed, and analyze the abnormal operation index of the real-time program of the device;

[0125] A correction module, the correction module is electrically connected to the basic risk coefficient evaluation module and the program abnormal operation index evaluation module, and the correction module is used to correct the abnormal operation index of the real-time running program based on the basic risk coefficient of the user device to obtain the abnormal operation index of the corrected abnormal program;

[0126] The classification solution module is electrically connected to the correction module. The classification solution module is used to classify the abnormal operation index of the corrected abnormal program according to the danger level and generate a corresponding solution according to the classification result.

[0127] Among them, the basic risk factor assessment module includes:

[0128] The first model building unit builds an equipment risk probability assessment model based on logistics regression;

[0129] A risk feature labeling unit extracts risky operations based on the user's historical operation records and obtains operation feature data of the user's device;

[0130] A vector unit, performing normalization processing according to the operation characteristic data of the user equipment to obtain an operation characteristic vector of the user equipment;

[0131] The risk prediction unit, based on the device risk probability assessment model, takes the operation feature vector of the user device as an independent variable input, calculates the gradient of the loss function with respect to each feature by differentiation, updates the weight vector and the bias term according to the calculated gradient, and outputs the risk probability of the operation feature vector of the user device as an independent variable;

[0132] A merging unit, merging similar items of the risk probability of the operation feature vector of the user equipment to obtain an array of the risk probability of the operation feature vector of the user equipment;

[0133] A weighting unit assigns a weight to each element in the risk probability array of the operation feature vector of the user device according to the contribution of the risk probability of the operation feature vector of the user device to the risk event;

[0134] The first calculation unit calculates a basic risk coefficient of the user equipment according to the risk probability array of the operation feature vector of the user equipment and the risk probability weight of the operation feature vector of the user equipment.

[0135] Among them, the program abnormal operation index evaluation module includes:

[0136] An abnormal feature marking unit, based on the abnormal program running data to be confirmed, marks abnormal activities in the abnormal program running data as deviation running feature data of the abnormal program;

[0137] The second model building unit packages the normal operation parameters of the program in the historical operation log into a training set, trains the genetic neural network, and uses the deviation operation feature data of the abnormal program as input to verify the network security adaptive situation awareness model that can detect abnormal activities of the program;

[0138] The second calculation unit obtains the background process running data of the real-time program of the device, substitutes the background process running data of the program into the network security adaptive situation awareness model, analyzes the deviation degree of the process running data of each program, and calculates the abnormal running index of the real-time program of the device;

[0139] The process of using an adaptive network defense system for network security is as follows:

[0140] Step 1: Establish equipment risk probability assessment model based on logistics regression;

[0141] Step 2: Based on the user's historical operation records, risk operations are extracted from the historical operation records to obtain the operation feature data of the user's device;

[0142] Step 3: Perform normalization processing on the operation characteristic data of the user equipment to obtain an operation characteristic vector of the user equipment;

[0143] Step 4: Based on the device risk probability assessment model, the operation feature vector of the user device is input as an independent variable, the gradient of the loss function with respect to each feature is calculated by differentiation, the weight vector and the bias term are updated according to the calculated gradient, and the risk probability of the operation feature vector of the user device is output as an independent variable;

[0144] Step 5: Merge similar items of the risk probability of the operation feature vector of the user device to obtain a risk probability array of the operation feature vector of the user device;

[0145] Step 6: assign a weight to each element in the risk probability array of the operation feature vector of the user device according to the contribution of the risk probability of the operation feature vector of the user device to the risk event;

[0146] Step 7: Calculate the basic risk coefficient of the user device according to the risk probability array of the operation feature vector of the user device and the risk probability weight of the operation feature vector of the user device.

[0147] Step 8: The threshold setting module is used to use the typical range of the program operation parameters in the historical operation log as the ideal threshold of the corresponding program based on the historical operation log of the device;

[0148] Step 9: The abnormality judgment module is electrically connected to the threshold setting module, and the abnormality judgment module is used to judge whether the operating parameters of each program exceed the ideal threshold of the corresponding program;

[0149] Step 10: Based on the abnormal program running data to be confirmed, marking abnormal activities in the abnormal program running data as deviation running feature data of the abnormal program;

[0150] Step 11: Pack the normal operation parameters of the program in the historical operation log into a training set, train the genetic neural network, and use the deviation operation feature data of the abnormal program as input to verify the network security adaptive situation awareness model that can detect abnormal program activities;

[0151] Step 12: Obtain the background process running data of the real-time program of the device, substitute the background process running data of the program into the network security adaptive situation awareness model, analyze the deviation degree of the process running data of each program, and calculate the abnormal running index of the real-time program of the device;

[0152] Step 13: Correcting the abnormal operation index of the real-time running program based on the basic risk coefficient of the user device to obtain the abnormal operation index of the corrected abnormal program;

[0153] Step 14: Classify the abnormal operation index of the corrected abnormal program according to the danger level, and generate a corresponding solution based on the classification result.

[0154] In summary, the advantages of the present invention are: by dynamically adjusting the monitoring threshold and introducing the user's basic risk coefficient, analyzing the abnormal operation index of the program, using the basic risk coefficient to correct the abnormal operation index of the program, analyzing the abnormal state of the program, and improving the worm mining virus detection accuracy of the device.

[0155] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The above embodiments and descriptions only describe the principles of the present invention. The present invention may be subject to various changes and improvements without departing from the spirit and scope of the present invention. These changes and improvements fall within the scope of the present invention. The scope of protection claimed by the present invention is defined by the attached claims and their equivalents.

Claims

1. An adaptive network defense method for network security, characterized in that: include: Record the user's historical operation records, analyze the operation behavior of the user's device, and evaluate the basic risk factor of the user's device; Based on the historical operation log of the device, the typical range of the operation parameters of the program in the historical operation log is used as the ideal threshold of the corresponding program, and the typical range of the operation parameters refers to the resource occupancy rate of the historical program; Determine whether the operating parameters of each program exceed the ideal threshold of the corresponding program. If not, it is determined to be normal. If so, it is determined to be abnormal. Filter out the abnormally operating programs and record them as abnormal programs to be confirmed. Based on the abnormal program to be confirmed, an index source file where the abnormal program to be confirmed is located is searched, a source code pointer target in the source file is compiled, and running data of the abnormal program to be confirmed is obtained; Based on the abnormal program operation data to be confirmed, a network security adaptive situation awareness model is constructed to analyze the abnormal operation index of the real-time program of the device; Correcting the abnormal operation index of the real-time running program based on the basic risk coefficient of the user device to obtain the abnormal operation index of the corrected abnormal program; Classify the abnormal operation index of the abnormal correction program according to the danger level, and generate corresponding solutions based on the classification results; The calculation expression of the abnormal operation index of the modified abnormal program is: ； In the formula, To correct the abnormal operation index of abnormal programs, is the basic risk factor of the user's device, is the abnormal operation index of the jth program of the device.

2. The adaptive network defense method for network security according to claim 1, characterized in that: Record the user's historical operation records, analyze the operation behavior of the user's device, and evaluate the basic risk factor of the user's device, including: Based on logistics regression, establish equipment risk probability assessment model; Based on the user's historical operation records, risk operations are extracted from the historical operation records to obtain operation feature data of the user's device; the operation features include but are not limited to: risky download operations, risky connection operations, risky login operations, and risky access operations; Performing normalization processing on the operation characteristic data of the user equipment to obtain an operation characteristic vector of the user equipment; Based on the device risk probability assessment model, the operation feature vector of the user device is input as an independent variable, the gradient of the loss function with respect to each feature is calculated by differentiation, the weight vector and the bias term are updated according to the calculated gradient, and the risk probability of the operation feature vector of the user device is output as an independent variable; Merge similar items of the risk probability of the operation feature vector of the user device to obtain a risk probability array of the operation feature vector of the user device; Assign a weight to each element in the risk probability array of the operation feature vector of the user device according to the contribution of the risk probability of the operation feature vector of the user device to the risk event; Calculate the basic risk coefficient of the user device according to the risk probability array of the operation feature vector of the user device and the risk probability weight of the operation feature vector of the user device; Among them, the equipment risk probability assessment model expression is: ； In the formula, is a prediction function used to calculate a given set of parameters and the operating feature vector The risk probability when is the label value (1,0) of the i-th observation, is the ith operation feature vector, is the parameter set of the model, is the weight vector, For transposition, is the bias term; The basic risk coefficient calculation expression of the user equipment is: ； In the formula, is the basic risk factor of the user's device, is the weight of the i-th operation feature vector.

3. The adaptive network defense method for network security according to claim 2, characterized in that: Based on the historical operation logs of the device, the typical range of the program operation parameters in the historical operation logs is used as the ideal threshold value of the corresponding program, which includes: Based on the historical operation log of the device, the operation parameters of the program in the log are divided according to the unit time to obtain the operation parameters of the program in several time periods; Based on the running parameters of several time periods of the program, several time periods of the program are used as observation windows, and the running parameters are used as observation data; Based on the observed data in the observation window, calculate the quartile of the program running resource usage corresponding to the observed data in each observation window; Based on the quartiles of the program running resource usage corresponding to the observed data in the observation window, the difference between the upper quartile and the lower quartile is calculated as the interquartile range; Based on the upper and lower quartiles and the interquartile range, the typical range of operating parameters was calculated as the ideal threshold value for the corresponding procedure; Among them, the calculation expression of the typical range of operating parameters is: ； in, is the lower limit of the typical range of operating parameters, is the upper limit of the typical range of operating parameters, is the lower quartile, is the upper quartile, k is the adjustment parameter, and its value is 2. is the interquartile range.

4. The adaptive network defense method for network security according to claim 3, characterized in that: According to the abnormal program operation data to be confirmed, a network security adaptive situation awareness model is constructed to analyze the abnormal operation index of the real-time program of the device, including: Based on the abnormal program running data to be confirmed, marking abnormal activities in the abnormal program running data as deviation running feature data of the abnormal program; The normal operation parameters of the program in the historical operation log are packaged as a training set, the genetic neural network is trained, and the deviation operation feature data of the abnormal program is used as input to verify the network security adaptive situation awareness model that can detect abnormal program activities; Obtain the background process running data of the device's real-time program, substitute the program's background process running data into the network security adaptive situation awareness model, analyze the degree of deviation of the process running data of each program, and calculate the abnormal running index of the device's real-time program; Among them, the network security adaptive situation awareness model expression is: ； In the formula, is the abnormal operation index of the jth program of the device, The actual value of the background process running data for the jth program, is the average function, is the baseline value corresponding to the background process running data of the jth program, The total number of running data for the background process of the program.

5. An adaptive network defense system for network security, characterized in that: Used to implement an adaptive network defense method based on network security as described in any one of claims 1 to 4, comprising: A basic risk coefficient assessment module is used to record the user's historical operation records, analyze the operation behavior of the user's device, and assess the basic risk coefficient of the user's device; A threshold setting module, which is used to use a typical range of program operation parameters in the historical operation log as an ideal threshold value of the corresponding program based on the historical operation log of the device; The abnormality judgment module is electrically connected to the threshold setting module. The abnormality judgment module is used to judge whether the operating parameters of each program exceed the ideal threshold of the corresponding program. If not, it is judged as normal. If so, it is judged as abnormal. The abnormally operating programs are screened and recorded as abnormal programs to be confirmed; A program abnormal operation index evaluation module, the program abnormal operation index evaluation module is electrically connected to the abnormal judgment module, and the program abnormal operation index evaluation module is used to build a network security adaptive situation awareness model based on the abnormal program operation data to be confirmed, and analyze the abnormal operation index of the real-time program of the device; A correction module, the correction module is electrically connected to the basic risk coefficient evaluation module and the program abnormal operation index evaluation module, and the correction module is used to correct the abnormal operation index of the real-time running program based on the basic risk coefficient of the user device to obtain the abnormal operation index of the corrected abnormal program; The classification solution module is electrically connected to the correction module. The classification solution module is used to classify the abnormal operation index of the corrected abnormal program according to the danger level and generate a corresponding solution according to the classification result.

6. The adaptive network defense system for network security according to claim 5, characterized in that: The basic risk factor assessment module includes: The first model building unit builds an equipment risk probability assessment model based on logistics regression; The risk feature labeling unit extracts risky operations based on the historical operation records of the user and obtains the operation feature data of the user's device; A vector unit, performing normalization processing according to the operation characteristic data of the user equipment to obtain an operation characteristic vector of the user equipment; The risk prediction unit, based on the device risk probability assessment model, takes the operation feature vector of the user device as an independent variable input, calculates the gradient of the loss function with respect to each feature by differentiation, updates the weight vector and the bias term according to the calculated gradient, and outputs the risk probability of the operation feature vector of the user device as an independent variable; A merging unit, merging similar items of the risk probability of the operation feature vector of the user equipment to obtain an array of the risk probability of the operation feature vector of the user equipment; A weighting unit assigns a weight to each element in the risk probability array of the operation feature vector of the user device according to the contribution of the risk probability of the operation feature vector of the user device to the risk event; The first calculation unit calculates a basic risk coefficient of the user equipment according to the risk probability array of the operation feature vector of the user equipment and the risk probability weight of the operation feature vector of the user equipment.

7. The adaptive network defense system for network security according to claim 5, characterized in that: The program abnormal operation index evaluation module includes: An abnormal feature marking unit, based on the abnormal program running data to be confirmed, marks abnormal activities in the abnormal program running data as deviation running feature data of the abnormal program; The second model building unit packages the normal operation parameters of the program in the historical operation log into a training set, trains the genetic neural network, and uses the deviation operation feature data of the abnormal program as input to verify the network security adaptive situation awareness model that can detect abnormal activities of the program; The second calculation unit obtains the background process running data of the real-time program of the device, substitutes the background process running data of the program into the network security adaptive situation awareness model, analyzes the deviation degree of the process running data of each program, and calculates the abnormal operation index of the real-time program of the device.

Images