Network security detection system and method based on defense attack

Abstract

The invention discloses a network security detection system and method based on defense attack, and relates to the technical field of network security detection.The method comprises the steps that feature scores of target network operation parameter items are calculated through the deviation rate of the target network operation parameter items, the arrangement sequence of the target network operation parameter items is analyzed, and feature network operation parameter items are determined; calculating a comprehensive safety risk index of the feature time point; calculating a comprehensive security risk index range of the network security threat level; and calculating an error rate in a system updating period, updating the comprehensive security risk index formula when the error rate does not meet a set error threshold value range, and automatically triggering a risk alarm when the updated real-time network security risk level and the times of continuously reaching or exceeding the reference level are equal to a set risk times threshold value. Therefore, the misjudgment rate is effectively reduced, and the accuracy of network security detection is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security detection, and in particular to a network security detection system and method based on defense against attacks. Background Art

[0002] With the rapid development of information technology and the increasing complexity of network environments, traditional network security detection systems are facing more and more challenges. Currently, widely used security protection measures such as firewalls, intrusion detection systems, and intrusion prevention systems often respond only after an attack is detected. They lack preventive measures and cannot effectively defend against advanced persistent threats.

[0003] Modern cyber attacks are highly hidden, targeted, and complex, such as phishing attacks, ransomware, and internal threats. These attacks can often bypass the detection of traditional protection systems, posing a serious threat to enterprises and individual users. In addition, attackers use social engineering, hybrid attacks, and other means to make it difficult for traditional security mechanisms to detect and respond in a timely manner.

[0004] In response to the above problems, the current mainstream network security detection systems mainly monitor a single type of data and are unable to perform network security detection based on the correlation between different data, resulting in a high misjudgment rate. Therefore, a network security detection system and method based on defense against attacks is needed to analyze the correlation between data, thereby effectively reducing the misjudgment rate and improving the accuracy of network security detection. Summary of the invention

[0005] The purpose of the present invention is to provide a network security detection system and method based on defense attack to solve the problems raised in the prior art.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions: a network security detection method based on defense attack, the method comprising:

[0007] Step S100: In the Internet data center system, extract the historical monitoring period records with security risks and set them as feature records; there are several sampling time points in the feature records, collect the parameter values ​​of the target network operation parameter items in the feature records, and calculate the deviation rate of the target network operation parameter items;

[0008] Step S200: Calculate the characteristic score of the target network operation parameter item according to the deviation rate of the target network operation parameter item, analyze the arrangement order of the target network operation parameter item, and determine the characteristic network operation parameter item;

[0009] Step S300: When a characteristic network operation parameter item is abnormal in the sampling result of a certain sampling time point, the sampling time point is set as a characteristic time point, and the comprehensive security risk index of the characteristic time point is calculated; the network security threat level of the characteristic time point is obtained, and the comprehensive security risk index range of the network security threat level is calculated;

[0010] Step S400: within a real-time monitoring cycle, evaluate the real-time network security risk level at each sampling time point and prompt the user, while obtaining user feedback information;

[0011] Step S500: combining a plurality of continuous monitoring cycles to obtain a system update cycle, and calculating an error rate within the system update cycle, wherein the error rate includes a true positive rate, a false positive rate, a true negative rate, and a false negative rate. When the error rate does not meet a set error threshold range, executing step S600;

[0012] Step S600: Update the comprehensive security risk index formula, evaluate the updated real-time network security risk level at each sampling time point, and compare it with the network security risk baseline level; when the updated real-time network security risk level continuously reaches or exceeds the baseline level for a number of times equal to the set risk number threshold, a risk alarm will be automatically triggered.

[0013] Furthermore, step S100 includes:

[0014] Step S101: Collect and summarize historical monitoring period records with security risks through the Internet data center system to obtain a feature record set A={A1, A2, ..., An}, where A1, A2, ..., An represent the 1st, 2nd, ..., nth feature records respectively;

[0015] Wherein, An={An1, An2, ..., Anm}, wherein An1, An2, ..., Anm respectively represent the 1st, 2nd, ..., mth network operation parameter items in the nth feature record where abnormalities occur, and the network operation parameter items where abnormalities occur are set as target network operation parameter items;

[0016] Step S102: In any feature record, any sampling time point at which the sampling result of any target network operation parameter item is abnormal is collected, and the parameter value of the target network operation parameter item monitored at the sampling time point is obtained to obtain a parameter value set of the target network operation parameter item;

[0017] Step S103: According to the parameter value set of the target network operation parameter item, the deviation rate of the target network operation parameter item is calculated by the following formula:

[0018]

[0019] Among them, Y nq It is expressed as the deviation rate of the qth target network operation parameter item in the nth feature record, B nqa It is represented by the ath parameter value in the qth target network operation parameter item set in the nth feature record, B q Denote the standard threshold of the qth target network operation parameter item, v denotes the total number of parameter values ​​in the target network operation parameter item set, and the deviation rate of the target network operation parameter item of any feature record is obtained;

[0020] The Internet data center system determines whether there are security risks in the network during operation and collects data on security risks. The network operation parameters include bandwidth usage, user access frequency, abnormal access behavior, etc. These operation parameters can be used to determine whether the network is under attack.

[0021] Because in different feature records, the parameter values ​​of the target network operation parameter items obtained at each sampling time point are different, it is necessary to analyze the deviation rate of the target network operation parameter items.

[0022] Further, step S200 includes:

[0023] Step S201: According to the target network operation parameter item of any feature record, the feature record where any target network operation parameter item is located is summarized to obtain the feature record set of the target network operation parameter item as B{B1, B2, ..., Bp}, wherein B1, B2, ..., Bp represent the 1st, 2nd, ..., pth feature records of the target network operation parameter item; in the feature record set of the target network operation parameter item, the deviation rate of the target network operation parameter item in any feature record is obtained, and the feature score of the target network operation parameter item is calculated according to the following feature score formula:

[0024]

[0025] Among them, Z represents the characteristic score of the target network operation parameter item, Y b The deviation rate of the target network operation parameter item represented by the bth feature record in the feature record set of the target network operation parameter item; the feature record sets of all target network operation parameter items are input into the feature scoring formula to obtain the feature scores of all target network operation parameter items;

[0026] Step S202: sorting all target network operation parameter items from high to low according to the characteristic scores, determining the bit sequence of each target network operation parameter item, setting a quantity threshold of the target network operation parameter item, comparing the bit sequence of the target network operation parameter item with the quantity threshold, and when the bit sequence of the target network operation parameter item is less than or equal to the quantity threshold, setting the target network operation parameter item as a characteristic network operation parameter item;

[0027] By analyzing the characteristic scores of the target network operation parameter items, the accuracy of the data is further improved, providing data support for judging the characteristic network operation parameter items.

[0028] Furthermore, step S300 includes:

[0029] Step S301: in a feature record set, a sampling result of a certain sampling time point in a feature record is obtained. If there is an abnormal feature network operation parameter item in the sampling result, the sampling time point is set as a feature time point;

[0030] Step S302: At a certain characteristic time point in the characteristic record, the parameter values ​​of the characteristic network operation parameter items are collected, and the comprehensive security risk index at a certain characteristic time point is calculated according to the following comprehensive security risk index formula:

[0031]

[0032] Among them, X nt It is expressed as the comprehensive security risk index of the t-th feature time point in the n-th feature record, B ntc It is represented as the parameter value of the cth feature network operation parameter item at the tth feature time point in the nth feature record, D c It is represented as the weight of the cth characteristic network operation parameter item, and E is represented as the bias value of the comprehensive security risk index formula;

[0033] Step S303: Obtain the network security threat level of a certain characteristic time point in the characteristic record, and form a training data group with the comprehensive security risk index of the characteristic time point, collect the training data groups of the same network security threat level, collect the maximum and minimum values ​​of the comprehensive security risk index in the collection, and set the maximum and minimum values ​​of the comprehensive security risk index as the comprehensive security risk index range of the network security threat level;

[0034] Because it is necessary to analyze the data when the characteristic network operation parameter items are abnormal, it is necessary to collect data at characteristic time points. Through the comprehensive security risk index formula, the characteristic network operation parameter items are combined together to provide data support for determining the comprehensive security risk index range of the network security threat level.

[0035] Furthermore, step S400 includes:

[0036] Step S401: In the Internet data center system, characteristic network operation parameter items are monitored, and within a real-time monitoring cycle, real-time parameter values ​​of characteristic network operation parameter items at any sampling time point are obtained, and the real-time parameter values ​​of the characteristic network operation parameter items are input into the comprehensive security risk index formula to obtain the real-time comprehensive security risk index at the sampling time point;

[0037] Step S402: Match the real-time comprehensive security risk index at the sampling time point with the comprehensive security risk index range of the network security threat level, evaluate the real-time network security threat level at the sampling time point, send the real-time network security threat level to the user, and obtain feedback information from the user;

[0038] User feedback information is used to evaluate whether the real-time network security threat level at the sampling time point is correct.

[0039] Furthermore, step S500 includes:

[0040] Step S501: combining a plurality of continuous real-time monitoring cycles, setting the combination as a system update cycle, wherein there are a plurality of sampling time points in the system update cycle, obtaining user feedback information at any sampling time point, extracting the user feedback information, and obtaining feedback results of the network security threat level at the sampling time point;

[0041] Step S502: at any sampling time point, if the system monitoring and evaluation result is that there is a network security threat level, when the feedback result is that there is a network security threat level, the sampling time point is set to a true positive time point, and when the feedback result is that there is no network security threat level, the sampling time point is set to a false positive time point; if the system monitoring and evaluation result is that there is no network security threat level, when the feedback result is that there is a network security threat level, the sampling time point is set to a false negative time point, and when the feedback result is that there is no network security threat level, the sampling time point is set to a true negative time point;

[0042] Step S503: Obtain the number of true positive, false positive, true negative and false negative time points within the system update cycle, and calculate the frequency of occurrence of the true positive, false positive, true negative and false negative time points to obtain the true positive rate, false positive rate, true negative rate and false negative rate. When the false positive rate does not meet the false positive rate threshold range or the false negative rate does not meet the false negative rate threshold range, execute step S600;

[0043] Because users may experience fluctuations during use, misjudgments may occur.

[0044] Furthermore, step S600 includes:

[0045] Step S601: Obtain the true positive rate and false positive rate within the system update cycle, and update the comprehensive security risk index formula according to the following formula:

[0046]

[0047] Among them, X' t It is expressed as the comprehensive safety risk index at the t-th sampling time point, B tc It is represented as the parameter value of the cth feature network operation parameter item at the tth sampling time point, TPR is represented as the true positive rate of the system update cycle, FPR is represented as the false positive rate of the system update cycle, f1 and f2 are represented as the weights of the true positive rate and the false positive rate respectively;

[0048] Step S602: After the comprehensive security risk index formula is updated, the characteristic network operation parameter items are monitored, and within a real-time monitoring cycle, the real-time parameter values ​​of the characteristic network operation parameter items at any sampling time point are obtained, and the real-time parameter values ​​of the characteristic network operation parameter items are input into the updated comprehensive security risk index formula to obtain the updated real-time comprehensive security risk index at the sampling time point;

[0049] Step S603: Match the updated real-time comprehensive security risk index at the sampling time point with the comprehensive security risk index range of the network security threat level, evaluate the updated real-time network security threat level at the sampling time point, and compare it with the network security risk baseline level; when the updated real-time network security risk level continuously reaches or exceeds the baseline level for a number of times equal to the set risk number threshold, a risk alarm will be automatically triggered;

[0050] After the system automatically updates the comprehensive security risk index formula, a relatively high-risk network security threat level still appears. It is possible that the system has indeed been attacked by a network attack, but the user is not aware of it. Therefore, when the risk frequency threshold is reached, a risk alarm needs to be triggered to notify the staff to make manual judgments.

[0051] In order to better implement the above method, a network security detection system based on defense attack is also proposed, which includes a historical monitoring cycle recording module, a characteristic network operation parameter item module, a comprehensive security risk index module, a real-time monitoring module, a system update module and an early warning module;

[0052] Historical monitoring cycle record module: In the Internet data center system, historical monitoring cycle records with security risks are extracted and set as feature records; there are several sampling time points in the feature record, and the parameter values ​​of the target network operation parameter items in the feature record are collected to calculate the deviation rate of the target network operation parameter items;

[0053] Characteristic network operation parameter item module: according to the deviation rate of the target network operation parameter item, calculate the characteristic score of the target network operation parameter item, analyze the arrangement order of the target network operation parameter item, and determine the characteristic network operation parameter item;

[0054] Comprehensive security risk index module: when there is an abnormal characteristic network operation parameter item in the sampling result of a certain sampling time point, the sampling time point is set as the characteristic time point, and the comprehensive security risk index of the characteristic time point is calculated; the network security threat level of the characteristic time point is obtained, and the comprehensive security risk index range of the network security threat level is calculated;

[0055] Real-time monitoring module: In a real-time monitoring cycle, it evaluates the real-time network security risk level at each sampling time point and prompts the user, while obtaining user feedback information;

[0056] System update module: combining a plurality of continuous monitoring cycles to obtain a system update cycle, and calculating an error rate within the system update cycle, wherein the error rate includes a true positive rate, a false positive rate, a true negative rate, and a false negative rate. When the error rate does not meet a set error threshold range, executing step S600;

[0057] Early warning module: Update the comprehensive security risk index formula, evaluate the real-time target network security risk level at each sampling time point after the update, and compare it with the network security risk baseline level; when the real-time target network security risk level continuously reaches or exceeds the baseline level for a number of times equal to the set risk number threshold, a risk alarm will be automatically triggered.

[0058] Furthermore, the characteristic network operation parameter item module includes a characteristic scoring calculation unit and a characteristic network operation parameter item determination unit:

[0059] A feature scoring calculation unit: summarizes the feature records of any target network operation parameter item, obtains a feature record set of the target network operation parameter item, obtains the deviation rate of the target network operation parameter item in any feature record, and calculates the feature score of the target network operation parameter item;

[0060] A characteristic network operation parameter item determination unit is provided: all target network operation parameter items are sorted from high to low according to the characteristic scores, the bit sequence of each target network operation parameter item is determined, a quantity threshold of the target network operation parameter item is set, the bit sequence of the target network operation parameter item is compared with the quantity threshold, and when the bit sequence of the target network operation parameter item is less than or equal to the quantity threshold, the target network operation parameter item is set as the characteristic network operation parameter item.

[0061] Furthermore, the comprehensive security risk index module includes a comprehensive security risk index calculation unit and a network security threat level range unit:

[0062] A unit for calculating a comprehensive safety risk index: in a characteristic record set, a sampling result of a certain sampling time point in the characteristic record is obtained. In the sampling result, if there is an abnormal characteristic network operation parameter item, the sampling time point is set as a characteristic time point; at a certain characteristic time point in the characteristic record, a parameter value of the characteristic network operation parameter item is collected, and a comprehensive safety risk index of a certain characteristic time point is calculated;

[0063] Network security threat level range unit: obtain the network security threat level at a certain feature time point in the feature record, and form a training data group with the comprehensive security risk index of the feature time point, collect the training data groups of the same network security threat level, collect the maximum and minimum values ​​of the comprehensive security risk index in the collection, and set the maximum and minimum values ​​of the comprehensive security risk index as the comprehensive security risk index range of the network security threat level.

[0064] Compared with the prior art, the present invention has the following beneficial effects: collecting parameter values ​​of target network operation parameter items in feature records, calculating the deviation rate of the target network operation parameter items; calculating the feature scores of the target network operation parameter items according to the deviation rate of the target network operation parameter items, analyzing the arrangement order of the target network operation parameter items, and determining the characteristic network operation parameter items. This method can avoid human subjective judgment of which is the characteristic network operation parameter item, thereby ensuring the accuracy of subsequent analysis;

[0065] When a characteristic network operation parameter item is abnormal in the sampling result of a certain sampling time point, the sampling time point is set as the characteristic time point, and the comprehensive security risk index of the characteristic time point is calculated; the network security threat level of the characteristic time point is obtained, and the comprehensive security risk index range of the network security threat level is calculated. Through this method, the comprehensive security risk index is linked to the network security threat level, which provides data support for the subsequent analysis of the real-time network security threat level;

[0066] In a real-time monitoring cycle, the real-time network security risk level at each sampling time point is evaluated and prompted to the user, and user feedback information is obtained at the same time; the error rate within the system update cycle is calculated. When the error rate does not meet the set error threshold range, the comprehensive security risk index formula is updated, and the updated real-time network security risk level at each sampling time point is evaluated and compared with the network security risk baseline level; when the updated real-time network security risk level continuously reaches or exceeds the baseline level for a number of times equal to the set risk number threshold, a risk alarm will be automatically triggered. Through this method, the comprehensive security risk index formula can be automatically updated according to user feedback, and the risk alarm can be automatically triggered according to the number of times the updated real-time network security risk level appears, thereby effectively reducing the misjudgment rate and improving the accuracy of network security detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] Figure 1 The present invention is a flowchart of a network security detection method based on defense attack. DETAILED DESCRIPTION

[0068] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0069] See also Figure 1 The present invention provides a technical solution: a network security detection method based on defense attack, the method comprising:

[0070] Step S100: In the Internet data center system, extract the historical monitoring period records with security risks and set them as feature records; there are several sampling time points in the feature records, collect the parameter values ​​of the target network operation parameter items in the feature records, and calculate the deviation rate of the target network operation parameter items;

[0071] Wherein, step S100 includes:

[0072] Step S101: Collect and summarize historical monitoring period records with security risks through the Internet data center system to obtain a feature record set A={A1, A2, ..., An}, where A1, A2, ..., An represent the 1st, 2nd, ..., nth feature records respectively;

[0073] Wherein, An={An1, An2, ..., Anm}, wherein An1, An2, ..., Anm respectively represent the 1st, 2nd, ..., mth network operation parameter items in the nth feature record where abnormalities occur, and the network operation parameter items where abnormalities occur are set as target network operation parameter items;

[0074] Step S102: In any feature record, any sampling time point at which the sampling result of any target network operation parameter item is abnormal is collected, and the parameter value of the target network operation parameter item monitored at the sampling time point is obtained to obtain a parameter value set of the target network operation parameter item;

[0075] Step S103: According to the parameter value set of the target network operation parameter item, the deviation rate of the target network operation parameter item is calculated by the following formula:

[0076]

[0077] Among them, Y nq It is expressed as the deviation rate of the qth target network operation parameter item in the nth feature record, B nqa It is represented by the ath parameter value in the qth target network operation parameter item set in the nth feature record, B q It is represented as the standard threshold of the qth target network operation parameter item, v is represented as the total number of parameter values ​​in the target network operation parameter item set, and the deviation rate of the target network operation parameter item of any feature record is obtained.

[0078] For example, in the first feature record, the results are abnormal sampling time points T1, T2, and T3. The packet loss rate obtained by sampling at time point T1 is 5%, the packet loss rate obtained by sampling at time point T2 is 15%, and the packet loss rate obtained by sampling at time point T3 is 10%. The standard threshold of the packet loss rate is 1%, and the deviation rate of the packet loss rate of the first feature record is 900%.

[0079] Step S200: Calculate the characteristic score of the target network operation parameter item according to the deviation rate of the target network operation parameter item, analyze the arrangement order of the target network operation parameter item, and determine the characteristic network operation parameter item;

[0080] Wherein, step S200 includes:

[0081] Step S201: According to the target network operation parameter item of any feature record, the feature record where any target network operation parameter item is located is summarized to obtain the feature record set of the target network operation parameter item as B{B1, B2, ..., Bp}, wherein B1, B2, ..., Bp represent the 1st, 2nd, ..., pth feature records of the target network operation parameter item; in the feature record set of the target network operation parameter item, the deviation rate of the target network operation parameter item in any feature record is obtained, and the feature score of the target network operation parameter item is calculated according to the following feature score formula:

[0082]

[0083] Among them, Z represents the characteristic score of the target network operation parameter item, Y b The deviation rate of the target network operation parameter item represented by the bth feature record in the feature record set of the target network operation parameter item; the feature record sets of all target network operation parameter items are input into the feature scoring formula to obtain the feature scores of all target network operation parameter items;

[0084] Step S202: sorting all target network operation parameter items from high to low according to the characteristic scores, determining the bit sequence of each target network operation parameter item, setting a quantity threshold of the target network operation parameter item, comparing the bit sequence of the target network operation parameter item with the quantity threshold, and when the bit sequence of the target network operation parameter item is less than or equal to the quantity threshold, setting the target network operation parameter item as a characteristic network operation parameter item;

[0085] For example, the characteristic score of packet loss rate is 900, the characteristic score of delay is 50, and the characteristic score of bandwidth utilization is 200. The sorting results are packet loss rate, bandwidth utilization, and delay. The quantity threshold of target network operation parameter items is 2, and packet loss rate and bandwidth utilization are characteristic network operation parameter items.

[0086] Step S300: When a characteristic network operation parameter item is abnormal in the sampling result of a certain sampling time point, the sampling time point is set as a characteristic time point, and the comprehensive security risk index of the characteristic time point is calculated; the network security threat level of the characteristic time point is obtained, and the comprehensive security risk index range of the network security threat level is calculated;

[0087] Wherein, step S300 includes:

[0088] Step S301: in a feature record set, a sampling result of a certain sampling time point in a feature record is obtained. If there is an abnormal feature network operation parameter item in the sampling result, the sampling time point is set as a feature time point;

[0089] Step S302: At a certain characteristic time point in the characteristic record, the parameter values ​​of the characteristic network operation parameter items are collected, and the comprehensive security risk index at a certain characteristic time point is calculated according to the following comprehensive security risk index formula:

[0090]

[0091] Among them, X nt It is expressed as the comprehensive security risk index of the t-th feature time point in the n-th feature record, B ntc It is represented as the parameter value of the cth feature network operation parameter item at the tth feature time point in the nth feature record, D c It is represented as the weight of the cth characteristic network operation parameter item, and E is represented as the bias value of the comprehensive security risk index formula;

[0092] Step S303: Obtain the network security threat level of a certain characteristic time point in the characteristic record, and form a training data group together with the comprehensive security risk index of the characteristic time point, collect the training data groups of the same network security threat level, collect the maximum and minimum values ​​of the comprehensive security risk index in the collection, and set the maximum and minimum values ​​of the comprehensive security risk index as the comprehensive security risk index range of the network security threat level.

[0093] Step S400: within a real-time monitoring cycle, evaluate the real-time network security risk level at each sampling time point and prompt the user, while obtaining user feedback information;

[0094] Wherein, step S400 includes:

[0095] Step S401: In the Internet data center system, characteristic network operation parameter items are monitored, and within a real-time monitoring cycle, real-time parameter values ​​of characteristic network operation parameter items at any sampling time point are obtained, and the real-time parameter values ​​of the characteristic network operation parameter items are input into the comprehensive security risk index formula to obtain the real-time comprehensive security risk index at the sampling time point;

[0096] Step S402: Match the real-time comprehensive security risk index at the sampling time point with the comprehensive security risk index range of the network security threat level, evaluate the real-time network security threat level at the sampling time point, send the real-time network security threat level to the user, and obtain feedback information from the user.

[0097] Step S500: combining a plurality of continuous monitoring cycles to obtain a system update cycle, and calculating an error rate within the system update cycle, wherein the error rate includes a true positive rate, a false positive rate, a true negative rate, and a false negative rate. When the error rate does not meet a set error threshold range, executing step S600;

[0098] Wherein, step S500 includes:

[0099] Step S501: combining a plurality of continuous real-time monitoring cycles, setting the combination as a system update cycle, wherein there are a plurality of sampling time points in the system update cycle, obtaining user feedback information at any sampling time point, extracting the user feedback information, and obtaining feedback results of the network security threat level at the sampling time point;

[0100] Step S502: at any sampling time point, if the system monitoring and evaluation result is that there is a network security threat level, when the feedback result is that there is a network security threat level, the sampling time point is set to a true positive time point, and when the feedback result is that there is no network security threat level, the sampling time point is set to a false positive time point; if the system monitoring and evaluation result is that there is no network security threat level, when the feedback result is that there is a network security threat level, the sampling time point is set to a false negative time point, and when the feedback result is that there is no network security threat level, the sampling time point is set to a true negative time point;

[0101] Step S503: Obtain the number of true positive, false positive, true negative and false negative time points within the system update cycle, and calculate the frequency of occurrence of true positive, false positive, true negative and false negative time points to obtain the true positive rate, false positive rate, true negative rate and false negative rate. When the false positive rate does not meet the false positive rate threshold range or the false negative rate does not meet the false negative rate threshold range, execute step S600.

[0102] Step S600: Update the comprehensive security risk index formula, evaluate the updated real-time network security risk level at each sampling time point, and compare it with the network security risk baseline level; when the updated real-time network security risk level continuously reaches or exceeds the baseline level for a number of times equal to the set risk number threshold, a risk alarm will be automatically triggered;

[0103] Wherein, step S600 includes:

[0104] Step S601: Obtain the true positive rate and false positive rate within the system update cycle, and update the comprehensive security risk index formula according to the following formula:

[0105]

[0106] Among them, X' t It is expressed as the comprehensive safety risk index at the t-th sampling time point, B tc It is represented as the parameter value of the cth feature network operation parameter item at the tth sampling time point, TPR is represented as the true positive rate of the system update cycle, FPR is represented as the false positive rate of the system update cycle, f1 and f2 are represented as the weights of the true positive rate and the false positive rate respectively;

[0107] Step S602: After the comprehensive security risk index formula is updated, the characteristic network operation parameter items are monitored, and within a real-time monitoring cycle, the real-time parameter values ​​of the characteristic network operation parameter items at any sampling time point are obtained, and the real-time parameter values ​​of the characteristic network operation parameter items are input into the updated comprehensive security risk index formula to obtain the updated real-time comprehensive security risk index at the sampling time point;

[0108] Step S603: Match the updated real-time comprehensive security risk index at the sampling time point with the comprehensive security risk index range of the network security threat level, evaluate the updated real-time network security threat level at the sampling time point, and compare it with the network security risk baseline level; when the updated real-time network security risk level continuously reaches or exceeds the baseline level for a number of times equal to the set risk number threshold, a risk alarm will be automatically triggered.

[0109] In order to better implement the above method, a network security detection system based on defense attack is also proposed, which includes a historical monitoring cycle recording module, a characteristic network operation parameter item module, a comprehensive security risk index module, a real-time monitoring module, a system update module and an early warning module;

[0110] Historical monitoring cycle record module: In the Internet data center system, historical monitoring cycle records with security risks are extracted and set as feature records; there are several sampling time points in the feature record, and the parameter values ​​of the target network operation parameter items in the feature record are collected to calculate the deviation rate of the target network operation parameter items;

[0111] Characteristic network operation parameter item module: according to the deviation rate of the target network operation parameter item, calculate the characteristic score of the target network operation parameter item, analyze the arrangement order of the target network operation parameter item, and determine the characteristic network operation parameter item;

[0112] Among them, the characteristic network operation parameter item module includes a characteristic scoring calculation unit and a characteristic network operation parameter item determination unit:

[0113] A feature scoring calculation unit: summarizes the feature records of any target network operation parameter item, obtains a feature record set of the target network operation parameter item, obtains the deviation rate of the target network operation parameter item in any feature record, and calculates the feature score of the target network operation parameter item;

[0114] A characteristic network operation parameter item determination unit is provided: all target network operation parameter items are sorted from high to low according to the characteristic scores, the bit sequence of each target network operation parameter item is determined, a quantity threshold of the target network operation parameter item is set, the bit sequence of the target network operation parameter item is compared with the quantity threshold, and when the bit sequence of the target network operation parameter item is less than or equal to the quantity threshold, the target network operation parameter item is set as the characteristic network operation parameter item.

[0115] Comprehensive security risk index module: when there is an abnormal characteristic network operation parameter item in the sampling result of a certain sampling time point, the sampling time point is set as the characteristic time point, and the comprehensive security risk index of the characteristic time point is calculated; the network security threat level of the characteristic time point is obtained, and the comprehensive security risk index range of the network security threat level is calculated;

[0116] Among them, the comprehensive security risk index module includes a comprehensive security risk index calculation unit and a network security threat level range unit:

[0117] A unit for calculating a comprehensive safety risk index: in a characteristic record set, a sampling result of a certain sampling time point in the characteristic record is obtained. In the sampling result, if there is an abnormal characteristic network operation parameter item, the sampling time point is set as a characteristic time point; at a certain characteristic time point in the characteristic record, a parameter value of the characteristic network operation parameter item is collected, and a comprehensive safety risk index of a certain characteristic time point is calculated;

[0118] Network security threat level range unit: obtain the network security threat level at a certain feature time point in the feature record, and form a training data group with the comprehensive security risk index of the feature time point, collect the training data groups of the same network security threat level, collect the maximum and minimum values ​​of the comprehensive security risk index in the collection, and set the maximum and minimum values ​​of the comprehensive security risk index as the comprehensive security risk index range of the network security threat level.

[0119] Real-time monitoring module: In a real-time monitoring cycle, it evaluates the real-time network security risk level at each sampling time point and prompts the user, while obtaining user feedback information;

[0120] System update module: combining a plurality of continuous monitoring cycles to obtain a system update cycle, and calculating an error rate within the system update cycle, wherein the error rate includes a true positive rate, a false positive rate, a true negative rate, and a false negative rate. When the error rate does not meet a set error threshold range, executing step S600;

[0121] Early warning module: Update the comprehensive security risk index formula, evaluate the real-time target network security risk level at each sampling time point after the update, and compare it with the network security risk baseline level; when the real-time target network security risk level continuously reaches or exceeds the baseline level for a number of times equal to the set risk number threshold, a risk alarm will be automatically triggered.

[0122] It will be apparent to those skilled in the art that the invention is not limited to the details of the exemplary embodiments described above and that the invention can be implemented in other specific forms without departing from the spirit or essential features of the invention. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description, and it is intended that all variations falling within the meaning and scope of the equivalent elements of the claims be included in the invention. Any reference numeral in a claim should not be considered as limiting the claim to which it relates.

Claims

1. A network security detection method based on defense attack, characterized in that: Methods include: Step S100: In the Internet data center system, extract the historical monitoring period records with security risks and set them as feature records; there are several sampling time points in the feature records, collect the parameter values ​​of the target network operation parameter items in the feature records, and calculate the deviation rate of the target network operation parameter items; Step S200: Calculate the characteristic score of the target network operation parameter item according to the deviation rate of the target network operation parameter item, analyze the arrangement order of the target network operation parameter item, and determine the characteristic network operation parameter item; Step S300: When a characteristic network operation parameter item is abnormal in the sampling result of a certain sampling time point, the sampling time point is set as a characteristic time point, and the comprehensive security risk index of the characteristic time point is calculated; the network security threat level of the characteristic time point is obtained, and the comprehensive security risk index range of the network security threat level is calculated; Step S400: within a real-time monitoring cycle, evaluate the real-time network security risk level at each sampling time point and prompt the user, while obtaining user feedback information; Step S500: combining a plurality of continuous monitoring cycles to obtain a system update cycle, and calculating an error rate within the system update cycle, wherein the error rate includes a true positive rate, a false positive rate, a true negative rate, and a false negative rate. When the error rate does not meet a set error threshold range, executing step S600; Step S600: Update the comprehensive security risk index formula, evaluate the updated real-time network security risk level at each sampling time point, and compare it with the network security risk baseline level; when the updated real-time network security risk level continuously reaches or exceeds the baseline level for a number of times equal to the set risk number threshold, a risk alarm will be automatically triggered.

2. A network security detection method based on defense attack according to claim 1, characterized in that: The step S100 includes the following steps: Step S101: Collect and summarize historical monitoring period records with security risks through the Internet data center system to obtain a feature record set A={A1, A2, ..., An}, where A1, A2, ..., An represent the 1st, 2nd, ..., nth feature records respectively; Wherein, An={An1, An2, ..., Anm}, wherein An1, An2, ..., Anm respectively represent the 1st, 2nd, ..., mth network operation parameter items in the nth feature record where abnormalities occur, and the network operation parameter items where abnormalities occur are set as target network operation parameter items; Step S102: In any feature record, any sampling time point at which the sampling result of any target network operation parameter item is abnormal is collected, and the parameter value of the target network operation parameter item monitored at the sampling time point is obtained to obtain a parameter value set of the target network operation parameter item; Step S103: According to the parameter value set of the target network operation parameter item, the deviation rate of the target network operation parameter item is calculated by the following formula: Among them, Y nq It is expressed as the deviation rate of the qth target network operation parameter item in the nth feature record, B nqa It is represented by the ath parameter value in the qth target network operation parameter item set in the nth feature record, B q It is represented as the standard threshold of the qth target network operation parameter item, v is represented as the total number of parameter values ​​in the target network operation parameter item set, and the deviation rate of the target network operation parameter item of any feature record is obtained.

3. A network security detection method based on defense attack according to claim 2, characterized in that: The step S200 includes the following steps: Step S201: According to the target network operation parameter item of any feature record, the feature record where any target network operation parameter item is located is summarized to obtain the feature record set of the target network operation parameter item as B{B1, B2, ..., Bp}, wherein B1, B2, ..., Bp represent the 1st, 2nd, ..., pth feature records of the target network operation parameter item; in the feature record set of the target network operation parameter item, the deviation rate of the target network operation parameter item in any feature record is obtained, and the feature score of the target network operation parameter item is calculated according to the following feature score formula: Among them, Z represents the characteristic score of the target network operation parameter item, Y b The deviation rate of the target network operation parameter item represented by the bth feature record in the feature record set of the target network operation parameter item; the feature record sets of all target network operation parameter items are input into the feature scoring formula to obtain the feature scores of all target network operation parameter items; Step S202: Sort all target network operation parameter items from high to low according to the characteristic scores, determine the bit sequence of each target network operation parameter item, set a quantity threshold of the target network operation parameter item, compare the bit sequence of the target network operation parameter item with the quantity threshold, and when the bit sequence of the target network operation parameter item is less than or equal to the quantity threshold, set the target network operation parameter item as the characteristic network operation parameter item.

4. A network security detection method based on defense attack according to claim 3, characterized in that: The step S300 includes the following steps: Step S301: in a feature record set, a sampling result of a certain sampling time point in a feature record is obtained. If there is an abnormal feature network operation parameter item in the sampling result, the sampling time point is set as a feature time point; Step S302: At a certain characteristic time point in the characteristic record, the parameter values ​​of the characteristic network operation parameter items are collected, and the comprehensive security risk index at a certain characteristic time point is calculated according to the following comprehensive security risk index formula: Among them, X nt It is expressed as the comprehensive security risk index of the t-th feature time point in the n-th feature record, B ntc It is represented as the parameter value of the cth feature network operation parameter item at the tth feature time point in the nth feature record, D c It is represented as the weight of the cth characteristic network operation parameter item, and E is represented as the bias value of the comprehensive security risk index formula; Step S303: Obtain the network security threat level of a certain characteristic time point in the characteristic record, and form a training data group together with the comprehensive security risk index of the characteristic time point, collect the training data groups of the same network security threat level, collect the maximum and minimum values ​​of the comprehensive security risk index in the collection, and set the maximum and minimum values ​​of the comprehensive security risk index as the comprehensive security risk index range of the network security threat level.

5. A network security detection method based on defense attack according to claim 4, characterized in that: The step S400 includes the following steps: Step S401: In the Internet data center system, characteristic network operation parameter items are monitored, and within a real-time monitoring cycle, real-time parameter values ​​of characteristic network operation parameter items at any sampling time point are obtained, and the real-time parameter values ​​of the characteristic network operation parameter items are input into the comprehensive security risk index formula to obtain the real-time comprehensive security risk index at the sampling time point; Step S402: Match the real-time comprehensive security risk index at the sampling time point with the comprehensive security risk index range of the network security threat level, evaluate the real-time network security threat level at the sampling time point, send the real-time network security threat level to the user, and obtain feedback information from the user.

6. A network security detection method based on defense attack according to claim 5, characterized in that: The step S500 includes the following steps: Step S501: combining a plurality of continuous real-time monitoring cycles, setting the combination as a system update cycle, wherein there are a plurality of sampling time points in the system update cycle, obtaining user feedback information at any sampling time point, extracting the user feedback information, and obtaining feedback results of the network security threat level at the sampling time point; Step S502: at any sampling time point, if the system monitoring and evaluation result is that there is a network security threat level, when the feedback result is that there is a network security threat level, the sampling time point is set to a true positive time point, and when the feedback result is that there is no network security threat level, the sampling time point is set to a false positive time point; if the system monitoring and evaluation result is that there is no network security threat level, when the feedback result is that there is a network security threat level, the sampling time point is set to a false negative time point, and when the feedback result is that there is no network security threat level, the sampling time point is set to a true negative time point; Step S503: Obtain the number of true positive, false positive, true negative and false negative time points within the system update cycle, and calculate the frequency of occurrence of true positive, false positive, true negative and false negative time points to obtain the true positive rate, false positive rate, true negative rate and false negative rate. When the false positive rate does not meet the false positive rate threshold range or the false negative rate does not meet the false negative rate threshold range, execute step S600.

7. A network security detection method based on defense attack according to claim 6, characterized in that: The step S600 includes the following steps: Step S601: Obtain the true positive rate and false positive rate within the system update cycle, and update the comprehensive security risk index formula according to the following formula: Among them, X' t It is expressed as the comprehensive safety risk index at the t-th sampling time point, B tc It is represented as the parameter value of the cth feature network operation parameter item at the tth sampling time point, TPR is represented as the true positive rate of the system update cycle, FPR is represented as the false positive rate of the system update cycle, f1 and f2 are represented as the weights of the true positive rate and the false positive rate respectively; Step S602: After the comprehensive security risk index formula is updated, the characteristic network operation parameter items are monitored, and within a real-time monitoring cycle, the real-time parameter values ​​of the characteristic network operation parameter items at any sampling time point are obtained, and the real-time parameter values ​​of the characteristic network operation parameter items are input into the updated comprehensive security risk index formula to obtain the updated real-time comprehensive security risk index at the sampling time point; Step S603: Match the updated real-time comprehensive security risk index at the sampling time point with the comprehensive security risk index range of the network security threat level, evaluate the updated real-time network security threat level at the sampling time point, and compare it with the network security risk baseline level; when the updated real-time network security risk level continuously reaches or exceeds the baseline level for a number of times equal to the set risk number threshold, a risk alarm will be automatically triggered.

8. A network security detection system based on defense attack, used to implement a network security detection method based on defense attack as described in any one of claims 1 to 7, characterized in that: The system includes a historical monitoring cycle recording module, a characteristic network operation parameter item module, a comprehensive security risk index module, a real-time monitoring module, a system update module and an early warning module; The historical monitoring cycle recording module: in the Internet data center system, extracts historical monitoring cycle records with security risks and sets them as feature records; there are several sampling time points in the feature record, collects parameter values ​​of target network operation parameter items in the feature record, and calculates the deviation rate of the target network operation parameter items; The characteristic network operation parameter item module: calculates the characteristic score of the target network operation parameter item according to the deviation rate of the target network operation parameter item, analyzes the arrangement order of the target network operation parameter item, and determines the characteristic network operation parameter item; The comprehensive security risk index module: when a characteristic network operation parameter item is abnormal in the sampling result of a certain sampling time point, the sampling time point is set as a characteristic time point, and the comprehensive security risk index of the characteristic time point is calculated; the network security threat level of the characteristic time point is obtained, and the comprehensive security risk index range of the network security threat level is calculated; The real-time monitoring module: evaluates the real-time network security risk level at each sampling time point within a real-time monitoring cycle and prompts the user, while obtaining user feedback information; The system update module: combines a plurality of continuous monitoring cycles to obtain a system update cycle, calculates an error rate within the system update cycle, wherein the error rate includes a true positive rate, a false positive rate, a true negative rate, and a false negative rate, and when the error rate does not meet a set error threshold range, executes step S600; The early warning module updates the comprehensive security risk index formula, evaluates the real-time target network security risk level at each sampling time point after the update, and compares it with the network security risk baseline level; When the real-time target network security risk level reaches or exceeds the benchmark level for a number of consecutive times equal to the set risk number threshold, a risk alarm will be automatically triggered.

9. A network security detection system based on defense against attacks according to claim 8, characterized in that: The characteristic network operation parameter item module includes a characteristic scoring calculation unit and a characteristic network operation parameter item determination unit: The feature scoring calculation unit: summarizes the feature records of any target network operation parameter item to obtain a feature record set of the target network operation parameter item, obtains the deviation rate of the target network operation parameter item in any feature record, and calculates the feature score of the target network operation parameter item; The characteristic network operation parameter item determination unit is configured to sort all target network operation parameter items from high to low according to the characteristic scores, determine the bit sequence of each target network operation parameter item, set a quantity threshold of the target network operation parameter item, compare the bit sequence of the target network operation parameter item with the quantity threshold, and when the bit sequence of the target network operation parameter item is less than or equal to the quantity threshold, set the target network operation parameter item as the characteristic network operation parameter item.

10. A network security detection system based on defense against attacks according to claim 8, characterized in that: The comprehensive security risk index module includes a comprehensive security risk index calculation unit and a network security threat level range unit: The unit for calculating the comprehensive security risk index: in the feature record set, obtaining a sampling result of a certain sampling time point in the feature record, and in the sampling result, if there is an abnormal feature network operation parameter item, setting the sampling time point as the feature time point; At a certain characteristic time point in the characteristic record, the parameter values ​​of the characteristic network operation parameter items are collected, and the comprehensive security risk index at a certain characteristic time point is calculated; The network security threat level range unit obtains the network security threat level of a certain feature time point in the feature record, and forms a training data group with the comprehensive security risk index of the feature time point, collects the training data groups of the same network security threat level, collects the maximum and minimum values ​​of the comprehensive security risk index in the collection, and sets the maximum and minimum values ​​of the comprehensive security risk index as the comprehensive security risk index range of the network security threat level.

Images