Security event data management system based on intelligent grading

Abstract

The invention discloses a security event data management system based on intelligent grading, which relates to the technical field of security event data intelligent management and comprises a network flow collector, a log collector, a data preprocessing unit, a security event pre-grading unit, a pre-grading broadcast alarm unit, an intelligent grading unit and a central server. The data preprocessing unit analyzes network flow data and system log data, destructive event feature data need to be immediately transmitted to the security event pre-grading unit, grading is achieved without complex model calculation, and only the destructive event feature data need to be matched in the ergodic destructive security event feature database, so that the destructive event feature data can be graded. If the preset matching standard is met, the result of judging the occurrence of the security event is interacted with the preset-level broadcast alarm unit, and the preset-level broadcast alarm unit performs network broadcast alarm and sound-light alarm, so that the rapid preset level of the security event is realized, the network broadcast alarm and the sound-light alarm are simultaneously performed, and the destructiveness of the security event is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of security incident data management, and in particular to a security incident data management system based on intelligent grading. Background Art

[0002] A security incident is any event that may affect the confidentiality, integrity, availability of information systems or have a negative impact on business operations. It can be caused by malicious behavior (such as hacker attacks, virus infections, ransomware attacks, etc.), system failures, human errors, or natural disasters. The following is a specific description of security incidents: involving unauthorized data access, leakage or exposure; involving tampering, damage or destruction of data or systems; involving system or service interruptions, denial of service attacks, etc.; negatively affecting the organization's operations, reputation or financial situation; Security incidents may include but are not limited to the following types: Network attacks: such as DDoS attacks, phishing attacks, SQL injections, etc.

[0003] Malware: such as viruses, Trojans, worms, ransomware, etc.

[0004] Data Breach: Unauthorized access to or transfer of data.

[0005] System vulnerability exploit: taking advantage of security holes in software or systems.

[0006] Although the existing security incident classification technology has played an important role in improving network security protection, it also has some defects: Many classification methods rely on manual judgment, which may lead to subjectivity and inconsistency in classification results; the complexity of security incidents is increasing, and existing classification models may not be able to adapt to all types of incidents, resulting in inaccurate classification; traditional classification methods may not be able to respond to new threats or attack methods in a timely manner, resulting in lags in handling emerging security incidents; different organizations may adopt different classification standards and methods, which makes it difficult to compare and collaborate on security incidents across organizations; many classification systems train models based on historical data, which may not accurately predict or classify new attack patterns. Some classification methods may ignore the contextual information of security incidents, such as the attacker's intentions, the importance of the target assets, etc., which may lead to inaccurate classification results; existing classification systems may generate false positives (mislabeling non-security incidents as security incidents) or false negatives (failing to identify real security incidents).

[0007] In order to overcome these shortcomings, it is urgent to design a security incident data management system based on intelligent classification to improve the accuracy and efficiency of classification. Summary of the invention

[0008] In order to solve the technical problem of security incident classification, the present invention provides a security incident data management system based on intelligent classification. The following technical solutions are adopted: The security event data management system based on intelligent grading includes a network flow collector, a log collector, a data preprocessing unit, a security event predetermined level unit, a predetermined level broadcast alarm unit, an intelligent grading unit and a central server. The network flow collector is used to collect network flow data of the detected target and send the network flow data to the data preprocessing unit. The log collector collects system log data of the detected target at set time intervals. The data preprocessing unit is respectively connected to the network flow collector and the log collector for communication, and parses the network flow data and the system log data, and extracts destructive event feature data. The network flow data and the system log data are packaged into a complete security event data packet at set time intervals. The security event pre-level unit communicates and exchanges destructive event feature data with the data pre-processing unit. The security event pre-level unit is provided with a destructive security event feature database. The destructive event feature data is traversed through the destructive security event feature database for matching. When it is determined that the match reaches the set matching standard, it is determined that a destructive security event has occurred. The security event pre-level unit controls the pre-level broadcast alarm unit to perform network broadcast alarm and sound and light alarm. At set intervals, the intelligent grading unit communicates and exchanges complete security event data packets with the data pre-processing unit. Security events are graded based on the trained security event grading model. The central server is respectively communicated and connected with the security event pre-level unit, the pre-level broadcast alarm unit and the intelligent grading unit.

[0009] Optionally, the data preprocessing unit includes a preprocessing memory and a data analysis chip, wherein the preprocessing memory is respectively connected to the data output terminals of the network flow collector and the log collector, and is connected to the data input terminals of the security event pre-grading unit and the intelligent grading unit; The data analysis chip is in communication connection with the preprocessing memory, and analyzes the network flow data and the system log data respectively according to the set time interval as the analysis cycle to obtain the network flow data and the system log data based on the time series, and the network flow data and the system log data based on the time series form a complete security event data packet, and the complete security event data packet is sent to the intelligent grading unit before the next analysis cycle; The data analysis chip analyzes network traffic data and system log data in real time, extracts destructive characteristic data, and when it is determined that there is destructive security event characteristic data, the destructive security event characteristic data is immediately sent to the security event predetermined level unit.

[0010] By adopting the above technical solution, the network traffic collector can be a tool such as Pcaps, NetScout, etc., which can monitor the network traffic data captured by the detected target in real time, and the log collector can be a log collection module integrated in the detected target system, which can realize the collection of system log data; The data preprocessing unit collects the network traffic data and system log data of the network traffic collector and the log collector at a set time interval, packages the network traffic data and the system log data into a complete security event data packet after the time interval, and sends it to the intelligent grading unit; During this time interval, the data preprocessing unit needs to analyze the network traffic data and system log data in real time, and extract the destructive event feature data therein. The destructive event feature data refers to data with attack-related features, data with Trojan virus features, etc. These destructive event feature data need to be immediately transmitted to the security event pre-level unit. The security event pre-level unit does not need to undergo complex model calculations to achieve classification. It only needs to match the destructive event feature data in the traversal of the destructive security event feature database. The match can be a keyword match. If the set matching criteria are met, such as achieving multiple successful matching keywords, it can be considered that a destructive security event has occurred with a high probability. At this time, it is necessary to interact with the result of judging the occurrence of a security event with the pre-level broadcast alarm unit. The pre-level broadcast alarm unit performs network broadcast alarms and sound and light alarms. The purpose of the network broadcast alarm is to broadcast alarms on the network, such as using an APP to remind the staff of an intelligent terminal alarm, and can also warn on the large screen of the central server.

[0011] It achieves rapid pre-leveling of security incidents, and simultaneously performs network broadcast alarms and sound and light alarms, reducing the destructiveness of security incidents and enabling staff to intervene and deal with them as quickly as possible.

[0012] After setting the time interval, the data preprocessing unit packages the network traffic data and system log data into a complete security event data packet at every set time, and exchanges the complete security event data packet with the intelligent rating unit. The intelligent rating unit performs security event rating based on the trained security event rating model. The security event rating model can be a machine learning model deployment.

[0013] Optionally, set the time interval to 1-5 minutes.

[0014] By adopting the above technical solutions, the destruction of security incidents is generally very rapid. The classification of security incidents should be as fast as possible. Classifying security incidents as soon as possible will help staff to respond according to relevant predetermined plans.

[0015] Optionally, the security event predetermined level unit includes a predetermined level memory and a predetermined level computer, the data input end of the predetermined level memory communicates with the preprocessing memory to exchange destructive event feature data, the predetermined level memory stores a destructive security event feature database, the predetermined level computer is communicatively connected to the predetermined level memory, extracts key features of the destructive event feature data, uses the key features as query items to traverse the destructive security event feature database, and when the predetermined level computer determines that the matching result meets the set matching standard, it determines that a destructive security event has occurred, and exchanges the result of the destructive security event with the predetermined level broadcast alarm unit.

[0016] Optionally, the key features of the destructive event feature data are attack type, attack method, attack tool, attack network address, data modification, and data encryption; The matching standard is set as follows: for a single complete destructive security event feature data in the destructive security event feature database, if at least three key features are successfully matched, it is determined that a destructive security event has occurred.

[0017] By adopting the above technical solution, the predetermined level computer determines the occurrence of a destructive security incident based on the traversal matching of key features; First, a destructive security event feature database is constructed to store the complete standardized features of known destructive security events.

[0018] Extract key features from security event data, which can be attack type, attack method, attack tool, attack network address, data modification, data encryption, etc., and convert the extracted features into a standard format; A matching tool will be used to traverse the destructive security event feature database with key features. For a single complete destructive security event feature data, when it is determined that at least three key features are successfully matched, a destructive security event is determined to have occurred.

[0019] For example, a single complete destructive security incident includes the following characteristics: A certain area network address uses a certain attack method (including attack type, attack method, and attack tool) to achieve data modification and data encryption; If the key features are a certain area network address, data modification and data encryption, then the three key features are successfully matched, and it is determined that a destructive security incident has occurred.

[0020] Optionally, the predetermined-level broadcast alarm unit includes an alarm signal generating chip, an audible and visual alarm, and a buffer. The alarm signal generating chip is communicatively connected to a predetermined-level computer. The alarm signal generating chip controls the execution of the audible and visual alarm. When the predetermined-level computer interacts with the alarm signal generating chip to generate a signal indicating a destructive security incident, the alarm signal generating chip generates online alarm data and audible and visual alarm control instructions and stores them in the buffer. The central server interacts with the buffer to generate online alarm data and displays an online alarm screen. The alarm signal generating chip controls the audible and visual alarm to perform audible and visual alarm based on the audible and visual alarm control instructions. The audible and visual alarm is installed in the control center where the central server is located.

[0021] By adopting the above technical solution, the purpose of the pre-level broadcast alarm unit is to notify relevant staff to take emergency measures for security incidents in the shortest time possible. Two alarm modes, online and offline, are adopted. Online alarm data can enable the central server to display alarm information, and online alarm can also be realized through interactive alarm signals with staff's handheld terminals, smart phones, etc. Offline alarm is based on the sound and light alarm installed in the control center where the central server is located.

[0022] Optionally, the intelligent rating unit includes a rating memory and an analysis and rating computer, the rating memory is communicatively connected to the preprocessing memory, and exchanges complete security event data packets at set time intervals, the analysis and rating computer is communicatively connected to the rating memory, the analysis and rating computer parses the complete security event data packets to obtain complete security event data based on time series, the analysis and rating computer deploys a trained security event rating model, inputs the complete security event data based on time series into the security event rating model, the security event rating model outputs a security event rating result, and the analysis and rating computer exchanges the security event rating results with the central server.

[0023] Optionally, the security incident rating model is implemented based on a random forest model. The rating logic of the security incident rating model is: firstly extracting features related to security incident rating in the complete security incident data based on time series, and using machine learning technology to select the features that contribute most to the model's prediction capability; Suppose the feature set related to security event classification is recorded as , where each feature is standardized, n is the number of features, and the random forest model outputs the probability distribution of security events belonging to each level , m is the number of levels.

[0024] Optionally, the random forest model classification formula is as follows: ; Where L is the security event level predicted by the model, is the probability that a security incident belongs to level i.

[0025] By adopting the above technical solution, the analysis and classification computer can realize the intelligent classification of security incidents based on the random forest model, provide accurate security incident level data to the staff, and also provide related data to provide data support for the staff to respond to security incidents.

[0026] In summary, the present invention includes at least one of the following beneficial technical effects: The present invention can provide a security event data management system based on intelligent grading. The network flow collector monitors the detected target in real time to capture network flow data, and the log collector realizes the collection of system log data. The data preprocessing unit needs to analyze the network flow data and the system log data in real time, and extract the destructive event feature data therein. The destructive event feature data needs to be immediately transmitted to the security event pre-grading unit. The security event pre-grading unit does not need to perform complex model calculations to achieve grading. It only needs to match the destructive event feature data in the traversal of the destructive security event feature database. If the set matching standard is met, the result of judging the occurrence of the security event will be interacted with the pre-grading broadcast alarm unit. The pre-grading broadcast alarm unit performs network broadcast alarm and sound and light alarm, thereby realizing rapid security event pre-grading. At the same time, network broadcast alarm and sound and light alarm are performed, reducing the destructiveness of the security event, so that the staff can intervene and deal with it as soon as possible.

[0027] The data preprocessing unit packages the network traffic data and system log data into a complete security incident data packet at set intervals. The intelligent classification unit classifies security incidents based on the trained security incident classification model, providing staff with accurate security incident level data and related data to provide data support for staff to respond to security incidents. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 It is a schematic diagram of the component connection principle of the security event data management system based on intelligent grading of the present invention.

[0029] Explanation of the accompanying drawings: 1. Network traffic collector; 2. Log collector; 3. Data preprocessing unit; 31. Preprocessing memory; 32. Data analysis chip; 4. Security event pre-level unit; 41. Pre-level memory; 42. Pre-level computer; 5. Pre-level broadcast alarm unit; 51. Alarm signal generating chip; 52. Sound and light alarm; 53. Cache; 6. Intelligent grading unit; 61. Grading memory; 62. Analysis and grading computer; 7. Central server; 100. Detected target. DETAILED DESCRIPTION

[0030] The present invention is further described in detail below in conjunction with the accompanying drawings.

[0031] The embodiment of the present invention discloses a security incident data management system based on intelligent grading.

[0032] Reference Figure 1 Embodiment 1, a security event data management system based on intelligent grading, comprises a network flow collector 1, a log collector 2, a data preprocessing unit 3, a security event predetermined level unit 4, a predetermined level broadcast alarm unit 5, an intelligent grading unit 6 and a central server 7, wherein the network flow collector 1 is used to collect network flow data of a detected target 100, and send the network flow data to the data preprocessing unit 3, the log collector 2 collects system log data of the detected target 100 at set time intervals, the data preprocessing unit 3 is respectively connected to the network flow collector 1 and the log collector 2 for communication, parses the network flow data and the system log data, and extracts the destructive event feature data, and packages the network flow data and the system log data into a complete security event at set time intervals. The security event pre-level unit 4 communicates and exchanges destructive event feature data with the data pre-processing unit 3. The security event pre-level unit 4 is provided with a destructive security event feature database. The destructive event feature data is traversed through the destructive security event feature database for matching. When it is determined that the match reaches the set matching standard, it is determined that a destructive security event occurs. The security event pre-level unit 4 controls the pre-level broadcast alarm unit 5 to perform network broadcast alarm and sound and light alarm. Every set time, the intelligent grading unit 6 communicates and exchanges the complete security event data packet with the data pre-processing unit 3, and performs security event grading based on the trained security event grading model. The central server 7 is respectively communicated and connected with the security event pre-level unit 4, the pre-level broadcast alarm unit 5 and the intelligent grading unit 6.

[0033] In Embodiment 2, the data preprocessing unit 3 includes a preprocessing memory 31 and a data analysis chip 32, wherein the preprocessing memory 31 is respectively connected to the data output terminals of the network flow collector 1 and the log collector 2 in communication, and is connected to the data input terminals of the security event pre-grading unit 4 and the intelligent grading unit 6 in communication; The data analysis chip 32 is in communication connection with the preprocessing memory 31, and analyzes the network flow data and the system log data respectively according to the set time interval as the analysis cycle to obtain the network flow data and the system log data based on the time series, and the network flow data and the system log data based on the time series constitute a complete security event data packet, and the complete security event data packet is sent to the intelligent grading unit 6 before the next analysis cycle; The data analysis chip 32 analyzes the network flow data and the system log data in real time, extracts the destructive characteristic data, and immediately sends the destructive security event characteristic data to the security event predetermined level unit 4 when it is determined that there is destructive security event characteristic data.

[0034] The network traffic collector 1 may be a tool such as Pcaps or NetScout, which can monitor the detected target 100 in real time to capture network traffic data, and the log collector 2 may be a log collection module integrated in the system of the detected target 100, which can realize the collection of system log data; The data preprocessing unit 3 collects the network traffic data and system log data of the network traffic collector 1 and the log collector 2 at a set time interval, packages the network traffic data and the system log data into a complete security event data packet after the time interval, and sends it to the intelligent grading unit 6; During this time interval, the data preprocessing unit 3 needs to analyze the network traffic data and system log data in real time, and extract the destructive event feature data therein. The destructive event feature data refers to data with attack-related features, data with Trojan virus features, etc. These destructive event feature data need to be immediately transmitted to the security event pre-level unit 4. The security event pre-level unit 4 does not need to undergo complex model calculations to achieve classification. It only needs to match the destructive event feature data in the traversal of the destructive security event feature database. The match can be a keyword match. If the set matching criteria are met, such as reaching multiple keywords that are successfully matched, it can be considered that a destructive security event has occurred with a high probability. At this time, it is necessary to interact with the result of judging the occurrence of a security event with the pre-level broadcast alarm unit 5. The pre-level broadcast alarm unit 5 performs network broadcast alarms and sound and light alarms. The purpose of the network broadcast alarm is to broadcast alarms on the network, such as using an APP to remind the staff of an intelligent terminal alarm, and can also warn on the large screen of the central server 7.

[0035] It achieves rapid pre-leveling of security incidents, and simultaneously performs network broadcast alarms and sound and light alarms, reducing the destructiveness of security incidents and enabling staff to intervene and deal with them as quickly as possible.

[0036] After setting the time interval, the data preprocessing unit 3 packages the network traffic data and system log data into a complete security event data packet at every set time, and exchanges the complete security event data packet with the intelligent grading unit 6. The intelligent grading unit 6 performs security event grading based on the trained security event grading model. The security event grading model can be a machine learning model deployment.

[0037] In Example 3, the time interval is set to 1-5 minutes.

[0038] Security incidents usually cause damage very quickly, and the classification of security incidents should be as quick as possible. Classifying security incidents as soon as possible will help staff respond according to relevant predetermined plans.

[0039] Embodiment 4, the security event predetermined level unit 4 includes a predetermined level memory 41 and a predetermined level computer 42, the data input end of the predetermined level memory 41 communicates with the pre-processing memory 31 to exchange destructive event feature data, the predetermined level memory 41 stores a destructive security event feature database, the predetermined level computer 42 is communicatively connected to the predetermined level memory 41, extracts key features of the destructive event feature data, and uses the key features as query items to traverse the destructive security event feature database, when the predetermined level computer 42 determines that the matching result reaches the set matching standard, it determines that a destructive security event has occurred, and exchanges the result of the destructive security event with the predetermined level broadcast alarm unit 5.

[0040] Example 5, the key features of the destructive event feature data are attack type, attack method, attack tool, attack network address, data modification, and data encryption; The matching standard is set as follows: for a single complete destructive security event feature data in the destructive security event feature database, if at least three key features are successfully matched, it is determined that a destructive security event has occurred.

[0041] The judgment of the occurrence of a destructive security event by the predetermined level computer 42 is implemented based on the traversal matching of key features; First, a destructive security event feature database is constructed to store the complete standardized features of known destructive security events.

[0042] Extract key features from security event data, which can be attack type, attack method, attack tool, attack network address, data modification, data encryption, etc., and convert the extracted features into a standard format; A matching tool will be used to traverse the destructive security event feature database with key features. For a single complete destructive security event feature data, when it is determined that at least three key features are successfully matched, a destructive security event is determined to have occurred.

[0043] For example, a single complete destructive security incident includes the following characteristics: A certain area network address uses a certain attack method (including attack type, attack method, and attack tool) to achieve data modification and data encryption; If the key features are a certain area network address, data modification and data encryption, then the three key features are successfully matched, and it is determined that a destructive security incident has occurred.

[0044] The following are relevant code examples in the Python environment: Import numpy as np #Assume that db_features is a feature database, where each row represents a feature vector of a known security event #new_event_features is the standardized feature vector of new security events db_features = np.array([ # Example feature vector 1 [1,0,1,0,1], # Example feature vector 2 [0,1,0,1,0], #...]) new_event_features=np.array([1,0,1,0,1])#New event feature vector #Define the matching function Def match_features(new_event_features,db_features,match_threshold=3): matches=[] fori,db_feature in enumerate(db_features): # Calculate the number of matching features match_count=np.sum(new_event_features==db_feature) ifmatch_count>=match_threshold: matches.append((i,match_count)) Return matches #Execute the matching function matched_events=match_features(new_event_features,db_features) # Output the matching results ifmatched_events: print(f"The new event matches the events in the following databases (at least three key features match):") formatchinmatched_events: print(f"Event index: {match[0]}, number of matching features: {match[1]}") else:print("No events matching at least three key features were found").

[0045] Embodiment 6, the predetermined level broadcast alarm unit 5 includes an alarm signal generating chip 51, an audible and visual alarm 52 and a buffer 53, the alarm signal generating chip 51 is communicatively connected with the predetermined level computer 42, the alarm signal generating chip 51 controls the execution action of the audible and visual alarm 52, when the predetermined level computer 42 interacts with the alarm signal generating chip 51 to generate a signal of a destructive security incident, the alarm signal generating chip 51 generates online alarm data and audible and visual alarm control instructions and stores them in the buffer 53, the central server 7 interacts with the buffer 53 to generate online alarm data and displays an online alarm screen, the alarm signal generating chip 51 controls the audible and visual alarm 52 to perform audible and visual alarm based on the audible and visual alarm control instructions, and the audible and visual alarm 52 is installed in the control center where the central server 7 is located.

[0046] The purpose of the predetermined level broadcast alarm unit 5 is to notify relevant staff to deal with emergency security incidents in the shortest time possible. It adopts two alarm modes, online and offline. The online alarm data can enable the central server 7 to display the alarm information, and the online alarm can also be realized by interacting with the staff's handheld terminals, smart phones, etc. The alarm signal is realized based on the sound and light alarm 52 installed in the control center where the central server 7 is located.

[0047] Embodiment 7, the intelligent rating unit 6 includes a rating memory 61 and an analysis and rating computer 62, the rating memory 61 is communicatively connected with the preprocessing memory 31, and exchanges complete security event data packets at set time intervals, the analysis and rating computer 62 is communicatively connected with the rating memory 61, the analysis and rating computer 62 parses the complete security event data packets to obtain complete security event data based on time series, the analysis and rating computer 62 deploys a trained security event rating model, inputs the complete security event data based on time series into the security event rating model, the security event rating model outputs the security event rating results, and the analysis and rating computer 62 exchanges the security event rating results with the central server 7.

[0048] In Example 8, the security incident rating model is implemented based on the random forest model. The rating logic of the security incident rating model is: firstly, features related to the security incident rating in the complete security incident data based on time series are extracted, and the features that contribute most to the model prediction ability are selected by using machine learning technology; Suppose the feature set related to security event classification is recorded as , where each feature is standardized, n is the number of features, and the random forest model outputs the probability distribution of security events belonging to each level , m is the number of levels.

[0049] Example 9, the random forest model classification formula is as follows: ; Where L is the security event level predicted by the model, is the probability that a security incident belongs to level i.

[0050] The analysis and classification computer 62 can realize intelligent classification of security incidents based on the random forest model, provide accurate security incident level data to the staff, and also provide related data to provide data support for the staff to respond to security incidents.

[0051] Here is a code example that implements the above classification using Python and the scikit-learn library: from sklearn.ensemble import RandomForestClassifier from sklearn.preprocessing import StandardScaler from sklearn.model_selection import train_test_split from sklearn.metrics import classification_report # Assume df is a DataFrame containing complete security data # features is the feature column name # target is the target level column name # Data preprocessing df_clean = df.dropna() # remove missing values X = df_clean[features].values y = df_clean[target].values # Feature normalization scaler = StandardScaler() X_scaled=scaler.fit_transform(X) # Divide into training set and test set X_train, X_test, y_train, y_test = train_test_split(X_scaled, y,test_size=0.2, random_state=42) # Model training model=RandomForestClassifier(n_estimators=100, random_state=42) model.fit(X_train, y_train) # Model prediction y_pred = model.predict(X_test) # Evaluate the model print(classification_report(y_test, y_pred)) # Security event classification function def predict_event_level(new_event_features): new_event_features_scaled = scaler.transform([new_event_features]) probabilities = model.predict_proba(new_event_features_scaled) event_level = np.argmax(probabilities) return event_level # Example: Predicting the severity of a new security incident new_event_features = np.array([...]) # Feature vector of new event predicted_level = predict_event_level(new_event_features) print(f"The predicted security event level is: {predicted_level}").

[0052] The above are all preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention. Therefore, any equivalent changes made based on the structure, shape, and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. Security incident data management system based on intelligent grading, characterized by: The invention comprises a network flow collector (1), a log collector (2), a data preprocessing unit (3), a security event pre-level unit (4), a pre-level broadcast alarm unit (5), an intelligent grading unit (6) and a central server (7), wherein the network flow collector (1) is used to collect network flow data of a detected target (100) and send the network flow data to the data preprocessing unit (3), the log collector (2) collects system log data of the detected target (100) at set time intervals, the data preprocessing unit (3) is respectively connected to the network flow collector (1) and the log collector (2), parses the network flow data and the system log data, extracts destructive event feature data, and packages the network flow data and the system log data into a complete security event data packet at set time intervals, The full event pre-level unit (4) communicates and exchanges destructive event feature data with the data pre-processing unit (3). The security event pre-level unit (4) is provided with a destructive security event feature database. The destructive event feature data is traversed through the destructive security event feature database for matching. When it is determined that the match reaches a set matching standard, it is determined that a destructive security event has occurred. The security event pre-level unit (4) controls the pre-level broadcast alarm unit (5) to perform a network broadcast alarm and an audible and visual alarm. The intelligent grading unit (6) communicates and exchanges a complete security event data packet with the data pre-processing unit (3) at set intervals. The security event is graded based on a trained security event grading model. The central server (7) is respectively connected to the security event pre-level unit (4), the pre-level broadcast alarm unit (5) and the intelligent grading unit (6).

2. The security incident data management system based on intelligent grading according to claim 1 is characterized by: The data preprocessing unit (3) comprises a preprocessing memory (31) and a data analysis chip (32), wherein the preprocessing memory (31) is respectively communicatively connected to the data output ends of the network flow collector (1) and the log collector (2), and is communicatively connected to the data input ends of the security event pre-grading unit (4) and the intelligent grading unit (6); The data analysis chip (32) is in communication with the preprocessing memory (31), and analyzes the network flow data and the system log data respectively according to a set time interval as an analysis cycle to obtain the network flow data and the system log data based on the time sequence, and the network flow data and the system log data based on the time sequence form a complete security event data packet, and the complete security event data packet is sent to the intelligent classification unit (6) before the next analysis cycle; The data analysis chip (32) analyzes the network flow data and the system log data in real time, extracts the destructive characteristic data, and when it is determined that there is destructive security event characteristic data, immediately sends the destructive security event characteristic data to the security event predetermined level unit (4).

3. The security incident data management system based on intelligent grading according to claim 2 is characterized in that: The setting time interval is 1-5 minutes.

4. The security incident data management system based on intelligent grading according to claim 2 is characterized in that: The security event predetermined level unit (4) comprises a predetermined level memory (41) and a predetermined level computer (42). The data input end of the predetermined level memory (41) communicates and interacts with the pre-processing memory (31) to exchange destructive event feature data. The predetermined level memory (41) stores a destructive security event feature database. The predetermined level computer (42) is connected to the predetermined level memory (41) to extract key features of the destructive event feature data and use the key features as query items to traverse the destructive security event feature database. When the predetermined level computer (42) determines that the matching result reaches a set matching standard, it determines that a destructive security event has occurred and interacts with the predetermined level broadcast alarm unit (5) to generate the result of the destructive security event.

5. The security incident data management system based on intelligent grading according to claim 4 is characterized in that: The key features of destructive event feature data are attack type, attack method, attack tool, attack network address, data modification, and data encryption; The matching standard is set as follows: for a single complete destructive security event feature data in the destructive security event feature database, if at least three key features are successfully matched, it is determined that a destructive security event has occurred.

6. The security incident data management system based on intelligent grading according to claim 5 is characterized in that: The predetermined-level broadcast alarm unit (5) comprises an alarm signal generation chip (51), an audible and visual alarm (52) and a buffer (53). The alarm signal generation chip (51) is connected to the predetermined-level computer (42) for communication. The alarm signal generation chip (51) controls the execution of the audible and visual alarm (52). When the predetermined-level computer (42) and the alarm signal generation chip (51) exchange signals indicating a destructive security event, the alarm signal generation chip (51) generates online alarm data and audible and visual alarm control instructions and stores them in the buffer (53). The central server (7) exchanges the online alarm data with the buffer (53) and displays an online alarm screen. The alarm signal generation chip (51) controls the audible and visual alarm (52) to perform an audible and visual alarm based on the audible and visual alarm control instructions. The audible and visual alarm (52) is installed in a control center where the central server (7) is located.

7. The security incident data management system based on intelligent grading according to claim 6 is characterized in that: The intelligent grading unit (6) comprises a grading memory (61) and an analysis and grading computer (62). The grading memory (61) is connected to the preprocessing memory (31) in communication, and exchanges complete security event data packets at set time intervals. The analysis and grading computer (62) is connected to the grading memory (61). The analysis and grading computer (62) parses the complete security event data packets to obtain complete security event data based on a time sequence. The analysis and grading computer (62) deploys a trained security event grading model, and inputs the complete security event data based on a time sequence into the security event grading model. The security event grading model outputs a security event grading result. The analysis and grading computer (62) exchanges the security event grading result with the central server (7).

8. The security incident data management system based on intelligent grading according to claim 7 is characterized in that: The security incident classification model is implemented based on the random forest model. The classification logic of the security incident classification model is: first extract the features related to security incident classification in the complete security incident data based on time series, and use machine learning technology to select the features that contribute most to the model's prediction ability; set up The feature set related to security event classification is recorded as , where each feature is standardized, n is the number of features, and the random forest model outputs the probability distribution of security events belonging to each level , m is the number of levels.

9. The security incident data management system based on intelligent grading according to claim 8, characterized in that: The classification formula of the random forest model is as follows: ； Where L is the security event level predicted by the model, is the probability that a security incident belongs to level i.

Images