Network security processing method and system based on dynamic network

Abstract

The present invention discloses a network security processing method and system based on a dynamic network, and relates to the field of network security technology. The method includes: executing configuration management of network terminals in an intranet; establishing a monitoring data set; establishing a drive network, inputting the monitoring data set and time information into the drive network to execute drive evaluation, calling a virtual address, and executing dynamic IP updates of network terminals; performing node security impact score calculations for each monitoring point, and generating node security impact score calculation results; performing abnormal event correlation evaluation on the monitoring point, performing impact calculations on the node security impact score calculation results, and generating a comprehensive security impact score; performing network security processing according to the comprehensive security impact score and dynamic IP update results. The method solves the technical problem of inaccurate network risk identification under traditional static IP address management, resulting in untimely protection, and achieves the technical effect of improving network security protection capabilities through dynamic and real-time network security processing.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a network security processing method and system based on a dynamic network. Background Art

[0002] In today's era of rapid digital development, with the continuous deepening of enterprise informatization construction, the intranet environment has become the core support for enterprise operations and management. However, with the expansion of network scale and the increase of complexity, the security issues of intranet are becoming increasingly prominent. In the intranet environment, network terminals carry key business data and sensitive information. Once attacked or data leaked, it will cause immeasurable losses to the enterprise. The traditional static IP address management method has many limitations in intranet security, such as IP addresses are easy to track and locate, and the network topology structure is fixed. These problems make the network vulnerable to external attacks and internal threats. Summary of the invention

[0003] The present application provides a network security processing method and system based on a dynamic network, which solves the technical problem of inaccurate identification of network risks and untimely protection under traditional static IP address management.

[0004] In view of the above problems, the present application provides a network security processing method and system based on a dynamic network.

[0005] In a first aspect of the present application, a network security processing method based on a dynamic network is provided, the method comprising:

[0006] Execute configuration management of network terminals in the intranet, the configuration management includes real IP addresses, external network access IP addresses and virtual address management of dynamic conversion units; perform terminal monitoring of network terminals based on configuration management results, establish a monitoring data set, and the monitoring data set includes a device data set and a user data set; establish a drive network, the drive network includes a time drive subnetwork, an event drive subnetwork and a load drive subnetwork, input the monitoring data set and time information into the drive network to perform drive evaluation, call the virtual address based on the drive evaluation result, and perform dynamic IP update of the network terminal; calculate the node security impact score of each monitoring point through the monitoring data set, and generate a node security impact score calculation result; perform abnormal event correlation evaluation on all monitoring points, perform impact calculation on the node security impact score calculation result based on the correlation evaluation result, and generate a comprehensive security impact score; perform network security processing according to the comprehensive security impact score and dynamic IP update result.

[0007] In a second aspect of the present application, a network security processing system based on a dynamic network is provided, the system comprising:

[0008] A configuration management module, the configuration management module is used to perform configuration management of network terminals in the intranet, and the configuration management includes real IP addresses, external network access IP addresses and virtual address management of dynamic conversion units; a monitoring module, the monitoring module is used to perform terminal monitoring of network terminals based on the configuration management results, and establish a monitoring data set, the monitoring data set includes a device data set and a user data set; an update module, the update module is used to establish a drive network, the drive network includes a time drive subnetwork, an event drive subnetwork and a load drive subnetwork, the monitoring data set and time information are input into the drive network to perform drive evaluation, the virtual address is called based on the drive evaluation result, and the dynamic IP update of the network terminal is performed; a first calculation module, the first calculation module is used to calculate the node security impact score of each monitoring point through the monitoring data set, and generate a node security impact score calculation result; a second calculation module, the second calculation module is used to perform abnormal event correlation evaluation on all monitoring points, and perform impact calculation on the node security impact score calculation result based on the correlation evaluation result to generate a comprehensive security impact score; a processing module, the processing module is used to perform network security processing according to the comprehensive security impact score and the dynamic IP update result.

[0009] One or more technical solutions provided in this application have at least the following technical effects or advantages:

[0010] First, perform configuration management of network terminals in the intranet, including real IP addresses, external network access IP addresses, and virtual address management of dynamic conversion units; perform terminal monitoring of network terminals based on the configuration management results, and establish a monitoring data set, which includes a device data set and a user data set. Next, establish a drive network, which includes a time-driven subnetwork, an event-driven subnetwork, and a load-driven subnetwork. Input the monitoring data set and time information into the drive network to perform drive evaluation, call the virtual address based on the drive evaluation result, and perform dynamic IP update of the network terminal. Calculate the node security impact score of each monitoring point through the monitoring data set to generate the node security impact score calculation result. Then, perform abnormal event correlation evaluation on all monitoring points, perform impact calculation on the node security impact score calculation result based on the correlation evaluation result, and generate a comprehensive security impact score. Finally, perform network security processing based on the comprehensive security impact score and dynamic IP update results. This solves the technical problem of inaccurate network risk identification under traditional static IP address management, resulting in untimely protection. Through dynamic and real-time network security processing, the technical effect of improving network security protection capabilities is achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0012] Figure 1 A schematic diagram of a flow chart of a network security processing method based on a dynamic network provided in an embodiment of the present application;

[0013] Figure 2 A schematic diagram of the structure of a network security processing system based on a dynamic network provided in an embodiment of the present application.

[0014] Explanation of the reference numerals: configuration management module 11 , monitoring module 12 , updating module 13 , first calculation module 14 , second calculation module 15 , processing module 16 . DETAILED DESCRIPTION

[0015] The present application solves the technical problem of inaccurate identification of network risks and untimely protection under traditional static IP address management by providing a network security processing method and system based on a dynamic network.

[0016] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0017] It should be noted that the terms "including" and "having" are intended to cover non-exclusive inclusions. For example, a process, method, system, product or server that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or modules that are not explicitly listed or are inherent to these processes, methods, products or devices.

[0018] Embodiment 1, as Figure 1 As shown, the present application provides a network security processing method based on a dynamic network, wherein the method includes:

[0019] Perform configuration management of network terminals in the intranet, including real IP addresses, external network access IP addresses and virtual address management of dynamic conversion units.

[0020] By configuring and managing the network terminals in the intranet, the stable operation and security of the network can be ensured. The configuration management includes the management of the real IP address, the external network access IP address and the virtual address of the dynamic conversion unit. Specifically, a unique real IP address is assigned to each network terminal, and the real IP address information of each terminal is recorded, including the terminal name, MAC address, subnet, etc.; if the network terminal needs to access the external network, one or more external network access IP addresses are assigned to it. These IP addresses are usually obtained from the public IP address pool through technologies such as NAT (Network Address Translation) or VPN (Virtual Private Network). According to business needs and security policies, determine which terminals can access the external network, as well as the access method and authority, record and monitor the external network access behavior, and ensure that the access behavior meets the policy requirements; manage the dynamic IP addresses of network terminals by establishing a virtual address pool. The addresses in the virtual address pool can be part of the private IP address range, which is used to uniquely identify each network terminal in the intranet. Tools such as DHCP servers can be used to automate the allocation and recovery of virtual addresses. When the network terminal starts, it will send a request to the DHCP server to obtain an available virtual address. When the network terminal is shut down or disconnected, the DHCP server will recycle the address and put it back into the virtual address pool for use by other network terminals.

[0021] Terminal monitoring of the network terminal is performed based on the configuration management result, and a monitoring data set is established, wherein the monitoring data set includes a device data set and a user data set.

[0022] The configuration management results include the real IP address, the external network access IP address, and the virtual address of the dynamic conversion unit. According to the configuration results, the network terminal is monitored to obtain the status of the network terminal and user activities in real time, and then establish a monitoring data set. The monitoring data set includes a device data set and a user data set. Among them, the device data set includes fields such as device identification (such as MAC address, IP address), device type, device status, configuration information, performance data, etc., and the user data set includes fields such as user identification (such as user name, account), user behavior (such as login time, login location, access record), and user authority. Specifically, by deploying terminal monitoring tools or systems, such as SNMP (Simple Network Management Protocol) monitors, NetFlow analysis tools, terminal security management software, etc., the required device data sets and user data sets are collected. By implementing terminal monitoring and establishing a monitoring data set containing device data sets and user data sets, the status and performance of network terminals can be understood in a timely manner.

[0023] A driving network is established, wherein the driving network includes a time driving subnetwork, an event driving subnetwork and a load driving subnetwork, the monitoring data set and time information are input into the driving network to perform driving evaluation, the virtual address is called based on the driving evaluation result, and dynamic IP update of the network terminal is performed.

[0024] The dynamic IP update of the network terminal is supported by constructing a driving network, wherein the driving network includes a time-driven subnetwork, an event-driven subnetwork and a load-driven subnetwork. The time-driven subnetwork is used to receive time information (such as current time, time interval, etc.) and trigger the status check or update task of the network terminal according to the time information; the event-driven subnetwork is used to receive events from the system (such as login events, access exception events, etc.) and trigger the corresponding processing logic according to the event type; the load-driven subnetwork is used to monitor the network load (such as CPU utilization, bandwidth occupancy, etc.) and adjust the configuration or resource allocation of the network terminal according to the load situation. The monitoring data set and time information are input into the driving network to perform driving evaluation. In the driving network, according to the conditions and rules of time drive, event drive and load drive, the input monitoring data set and time information are analyzed and evaluated, and the status, performance, security status and network load of the network terminal are evaluated. Based on the driving evaluation results, it is determined whether the dynamic IP update of the network terminal is required. If an update is required, the available virtual address is called from the virtual address pool, and the dynamic IP update operation is performed to change the IP address of the network terminal from the old address to the newly called virtual address. By establishing a driver network, dynamic IP updates of network terminals can be managed more flexibly and intelligently, improving network security and stability while optimizing network performance and resource utilization.

[0025] The node safety impact score calculation of each monitoring point is performed using the monitoring data set to generate a node safety impact score calculation result.

[0026] The node safety impact score is calculated for each monitoring point according to the monitoring data set to generate the node safety impact score calculation result.

[0027] Furthermore, the calculating of the node safety impact score of each monitoring point by using the monitoring data set to generate the node safety impact score calculation result also includes:

[0028] The calculation formula for configuring the node security impact score is as follows:

[0029] Among them, K i The calculation result of the node safety impact score representing the i-th monitoring point, M i is the total number of events in the i-th monitoring point, S ip is the severity score of the pth event in the ith monitoring point, Fip is the occurrence frequency of the pth event in the ith monitoring point, R ip is the response speed of the pth event in the ith monitoring point, A ip The fitness of the p-th event in the ith monitoring point.

[0030] Preferably, the node security impact score is calculated according to the formula: Calculate the node security impact score, where K i The calculation result of the node safety impact score representing the i-th monitoring point, K i The higher it is, the worse the safety condition of the monitoring point is; i represents the total number of events in the i-th monitoring point, and the number of events at each monitoring point can be counted from the monitoring data set; S ip is the severity score of the pth event in the ith monitoring point. The severity score can be determined based on the organization's security policy and historical experience, such as 1 (low), 2 (medium), 3 (high), etc.; F ip is the occurrence frequency of the pth event in the ith monitoring point. The occurrence frequency can be quantified by counting the number of occurrences of the event within a period of time. An appropriate time period (such as day, week, month) can be selected to calculate the frequency. R ip is the response speed of the pth event in the ith monitoring point. The response speed can be defined as the length of time from the event being detected to the time when effective response measures are taken; A ip The fitness of the pth event in the ith monitoring point. The fitness can be quantified as the degree of match between the event and the current security policy, environment, or configuration. For example, if an event is an attack against a known vulnerability that has been covered by the organization's security policy, the fitness of the event is low.

[0031] An abnormal event correlation evaluation is performed on all monitoring points, and the impact calculation of the node safety impact score calculation results is performed based on the correlation evaluation results to generate a comprehensive safety impact score.

[0032] Acquire abnormal event data of all monitoring points, including timestamp, event type, source IP, target IP, etc. Use association rule learning, graph theory, time series analysis and other methods to analyze the association relationship between abnormal events at different monitoring points, including co-occurring events, temporal correlation, spatial proximity, etc. Based on the association analysis results, construct an abnormal event association network between monitoring points. The nodes in the abnormal event association network represent monitoring points, and the edges represent the association relationship between monitoring points. Based on multiple factors such as the co-occurrence frequency, time interval, and transmission path of events, assign an association strength value to each association relationship to quantify the degree of association between abnormal events at different monitoring points. Perform impact calculation on the node security impact score calculation results based on the association evaluation results to generate a comprehensive security impact score.

[0033] Furthermore, generating a comprehensive security impact score further includes:

[0034] The comprehensive security impact score is calculated using the formula:

[0035] Among them, K is the comprehensive safety impact score, N is the total number of monitoring points, and W is i Characterizes the importance of the i-th monitoring point, K i is the calculation result of the node safety impact score of the i-th monitoring point, K j is the node safety impact score calculation result of the jth monitoring point, C ij Characterizes the mutual influence coefficient between the i-th monitoring point and the j-th monitoring point, is the normalization factor, which is used to normalize the safety impact score calculation results of all monitoring points.

[0036] Preferably, the comprehensive security impact score is calculated according to the formula, where K is the comprehensive security impact score, which reflects the security status of the entire network; N is the total number of monitoring points; W i Characterizes the importance of the i-th monitoring point, reflecting the criticality of the monitoring point in the network; K i K is the calculation result of the node safety impact score of the i-th monitoring point; j is the calculation result of the node safety impact score of the jth monitoring point; C ij Characterizes the mutual influence coefficient between the i-th monitoring point and the j-th monitoring point, reflecting the degree of association between the two monitoring points; is a normalization factor used to normalize the safety impact score calculation results of all monitoring points. m and l represent any monitoring point.

[0037] Perform network security processing based on comprehensive security impact scores and dynamic IP update results.

[0038] Based on the comprehensive security impact score, the security status of the current network is evaluated. The security impact score threshold can be set. When the score exceeds the set threshold, the corresponding security response mechanism is triggered. According to the dynamic IP update results, the access mode and traffic characteristics of the IP address are analyzed to identify abnormal behaviors. Based on the behavioral analysis of the IP address, potential network security risks are evaluated. For IP addresses with high comprehensive security impact scores or abnormal behaviors, network security processing is performed, for example, isolation measures are taken, including blocking IP and restricting access.

[0039] Furthermore, the network security processing according to the comprehensive security impact score and the dynamic IP update result also includes:

[0040] Obtaining a score warning level of the comprehensive security impact score; performing an update adaptation evaluation according to the score warning level and a dynamic IP update result; and reporting a network security anomaly based on the adaptation evaluation result.

[0041] Preferably, different warning levels are defined according to the range of the comprehensive security impact score, such as security (low score), general risk (medium score), high risk (high score), emergency risk (extremely high score), etc., and corresponding score thresholds are set for each warning level. The calculated comprehensive security impact score is compared with these thresholds to determine the current score warning level; the update record of the dynamic IP is checked to analyze whether there are abnormal updates (such as unauthorized IP changes, frequent IP changes, etc.); the dynamic IP update results are combined with the score warning level to evaluate the current network status. For example, if the score warning level is high risk or emergency risk, and the dynamic IP update results also show abnormalities, a more urgent response may be required; based on the update adaptation evaluation results, the specific network security anomaly type is determined, such as IP address conflicts, unauthorized access, potential data leaks, etc., and a corresponding alarm is generated according to the anomaly type, including detailed information of the anomaly, possible impact range, recommended countermeasures, etc.

[0042] Furthermore, the method further comprises:

[0043] Determine whether the scoring warning level meets a preset level threshold; if the preset level threshold is met, generate a dynamic topology transformation instruction; control the network terminal to perform physical structure transformation with the dynamic topology transformation instruction, and perform network security processing based on the physical structure transformation result.

[0044] Preferably, the score warning level of the comprehensive security impact score is obtained, and the score warning level is compared with a preset level threshold. If the score warning level meets or exceeds the preset level threshold, one or more dynamic topology transformation instructions are generated. The dynamic topology transformation instructions describe how to adjust the network structure to reduce security risks. The dynamic topology transformation instructions may include disconnecting certain connections, rerouting traffic, enabling or disabling certain devices, and other operations; the generated dynamic topology transformation instructions are sent to the network terminal. After receiving the instructions, the network terminal (such as a router, switch, firewall, etc.) executes the corresponding physical structure transformation, including changing the connection, configuring the routing table, updating the security policy, etc.

[0045] Furthermore, the method further comprises:

[0046] Establish a historical connection database of the network terminal, perform connection analysis on the historical connection database, and establish a connection association coefficient; match a connection random number according to the connection association coefficient, perform physical structure transformation selection of the network terminal based on the connection random number, and establish a physical structure transformation result.

[0047] Preferably, historical connection data of network terminals (such as routers, switches, servers, etc.) are obtained, including the start time, end time, source address, destination address, used protocol, etc. of the connection, and the historical connection data are stored in a database to form a historical connection database of the network terminal; the historical connection data are analyzed to identify frequent connections, abnormal connections, critical connections, etc., and the connection patterns are analyzed, such as which devices often communicate with each other, and which time periods have more frequent connections, etc.; based on the connection analysis results, a correlation coefficient is defined for each connection between network terminals, and the correlation coefficient represents the connection frequency, importance, risk level, etc. between two devices, and an appropriate algorithm (such as machine learning, graph theory, etc.) is used to calculate the correlation coefficient. For example, The association coefficient is calculated based on factors such as the number of connections between two devices, the connection duration, and the amount of data transmitted; a connection random number is generated for each network terminal to ensure that each device has a unique random number; the matching result of the connection random number and the connection association coefficient is obtained by mapping the random number to the association coefficient table, and based on the matching result, an appropriate physical structure transformation is selected. For example, if the association coefficient between two devices is very high and there is a security risk in the connection between them, then you can choose to disconnect the direct connection between the two devices and route through other devices or paths; according to the selected physical structure transformation, the network terminal is configured and adjusted, including changing the routing table, enabling or disabling ports, adding or deleting devices, and other operations.

[0048] Furthermore, the method further comprises:

[0049] Acquire a historical data set of the user; extract user behavior features at multiple scales based on the historical data set, and establish a multi-scale feature extraction result, wherein the multi-scale feature extraction result carries a scale trust identifier; perform behavior authentication on the user data set through the multi-scale feature extraction result, and establish an additional outlier based on the behavior authentication result; and update the comprehensive security impact score through the additional outlier.

[0050] Preferably, a user's historical data set is obtained from a database, including the user's login records, operation records, access records, etc.; a plurality of different time or space scales, such as minutes, hours, days, weeks, etc., are determined to analyze different levels of user behavior; at each scale, behavior-related features are extracted from the user's historical data set, including the user's login frequency, access mode, operation type, abnormal behavior, etc.; the feature extraction results at each scale are integrated, and a scale trust mark is added to the feature extraction results at each scale according to the reliability and importance of each scale, so as to form a multi-scale feature set, i.e., a multi-scale feature extraction result; and the multi-scale feature extraction result is extracted by using the multi-scale feature extraction. Take the results and build a normal behavior model for the user, which can reflect the typical behavior patterns of the user at different scales; compare the user's real-time behavior with the normal behavior model to evaluate their compliance. If the real-time behavior is significantly different from the model, it may indicate abnormal behavior; based on the results of behavior authentication, calculate an additional anomaly value for each user or each behavior, which reflects the degree of deviation between the user's behavior and the normal behavior model; integrate the additional anomaly value into the calculation of the comprehensive security impact score, which can be used as an input factor for the score and its weight can be adjusted according to the actual situation; recalculate the comprehensive security impact score based on the integrated information.

[0051] In summary, the embodiments of the present application have at least the following technical effects:

[0052] First, perform configuration management of network terminals in the intranet, including real IP addresses, external network access IP addresses, and virtual address management of dynamic conversion units; perform terminal monitoring of network terminals based on the configuration management results, and establish a monitoring data set, which includes a device data set and a user data set. Next, establish a drive network, which includes a time-driven subnetwork, an event-driven subnetwork, and a load-driven subnetwork. Input the monitoring data set and time information into the drive network to perform drive evaluation, call the virtual address based on the drive evaluation result, and perform dynamic IP update of the network terminal. Calculate the node security impact score of each monitoring point through the monitoring data set to generate the node security impact score calculation result. Then, perform abnormal event correlation evaluation on all monitoring points, perform impact calculation on the node security impact score calculation result based on the correlation evaluation result, and generate a comprehensive security impact score. Finally, perform network security processing based on the comprehensive security impact score and dynamic IP update results. This solves the technical problem of inaccurate network risk identification under traditional static IP address management, resulting in untimely protection. Through dynamic and real-time network security processing, the technical effect of improving network security protection capabilities is achieved.

[0053] Embodiment 2 is based on the same inventive concept as the network security processing method based on a dynamic network in the above embodiment. Figure 2 As shown, the present application provides a network security processing system based on a dynamic network, and the system and method embodiments in the present application are based on the same inventive concept. The system includes:

[0054] Configuration management module 11, the configuration management module 11 is used to perform configuration management of network terminals in the intranet, and the configuration management includes real IP addresses, external network access IP addresses and virtual address management of dynamic conversion units; monitoring module 12, the monitoring module 12 is used to perform terminal monitoring of network terminals based on configuration management results, and establish a monitoring data set, the monitoring data set includes a device data set and a user data set; update module 13, the update module 13 is used to establish a drive network, the drive network includes a time drive sub-network, an event drive sub-network and a load drive sub-network, and the monitoring data set and time information are input into the drive network to execute the drive Evaluation, calling the virtual address based on the driving evaluation result, and executing the dynamic IP update of the network terminal; a first calculation module 14, the first calculation module 14 is used to calculate the node security impact score of each monitoring point through the monitoring data set, and generate a node security impact score calculation result; a second calculation module 15, the second calculation module 15 is used to perform abnormal event correlation evaluation on all monitoring points, and perform impact calculation on the node security impact score calculation result based on the correlation evaluation result to generate a comprehensive security impact score; a processing module 16, the processing module 16 is used to perform network security processing according to the comprehensive security impact score and the dynamic IP update result.

[0055] Furthermore, the first calculation module 14 is used to execute the following method:

[0056] The calculation formula for configuring the node security impact score is as follows: Among them, K i The calculation result of the node safety impact score representing the i-th monitoring point, M i is the total number of events in the i-th monitoring point, S ip is the severity score of the pth event in the ith monitoring point, F ip is the occurrence frequency of the pth event in the ith monitoring point, R ip is the response speed of the pth event in the ith monitoring point, A ip The fitness of the p-th event in the ith monitoring point.

[0057] Furthermore, the second calculation module 15 is used to execute the following method:

[0058] The comprehensive security impact score is calculated using the formula:

[0059] Among them, K is the comprehensive safety impact score, N is the total number of monitoring points, and W is i Characterizes the importance of the i-th monitoring point, K i is the calculation result of the node safety impact score of the i-th monitoring point, K j is the node safety impact score calculation result of the jth monitoring point, C ij Characterizes the mutual influence coefficient between the i-th monitoring point and the j-th monitoring point, is the normalization factor, which is used to normalize the safety impact score calculation results of all monitoring points.

[0060] Furthermore, the processing module 16 is used to execute the following method:

[0061] Obtaining a score warning level of the comprehensive security impact score; performing an update adaptation evaluation according to the score warning level and a dynamic IP update result; and reporting a network security anomaly based on the adaptation evaluation result.

[0062] Furthermore, the processing module 16 is used to execute the following method:

[0063] Determine whether the scoring warning level meets a preset level threshold; if the preset level threshold is met, generate a dynamic topology transformation instruction; control the network terminal to perform physical structure transformation with the dynamic topology transformation instruction, and perform network security processing based on the physical structure transformation result.

[0064] Furthermore, the processing module 16 is used to execute the following method:

[0065] Establish a historical connection database of the network terminal, perform connection analysis on the historical connection database, and establish a connection association coefficient; match a connection random number according to the connection association coefficient, perform physical structure transformation selection of the network terminal based on the connection random number, and establish a physical structure transformation result.

[0066] Furthermore, the processing module 16 is used to execute the following method:

[0067] Acquire a historical data set of the user; extract user behavior features at multiple scales based on the historical data set, and establish a multi-scale feature extraction result, wherein the multi-scale feature extraction result carries a scale trust identifier; perform behavior authentication on the user data set through the multi-scale feature extraction result, and establish an additional outlier based on the behavior authentication result; and update the comprehensive security impact score through the additional outlier.

[0068] It should be noted that the above-mentioned sequence of the embodiments of the present application is only for description and does not represent the advantages and disadvantages of the embodiments. And the above-mentioned specific embodiments of this specification are described. The processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0069] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

[0070] This specification and drawings are merely exemplary illustrations of the present application and are deemed to cover any and all modifications, variations, combinations or equivalents within the scope of the present application. Obviously, a person skilled in the art may make various modifications and variations to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the present application and its equivalents, the present application intends to include these modifications and variations.

Claims

1. A network security processing method based on a dynamic network, characterized in that: The method comprises: Perform configuration management of network terminals in the intranet, including real IP addresses, external network access IP addresses and virtual addresses of dynamic conversion units; Perform terminal monitoring of network terminals based on the configuration management result and establish a monitoring data set, wherein the monitoring data set includes a device data set and a user data set; Establishing a driving network, the driving network comprising a time driving subnetwork, an event driving subnetwork and a load driving subnetwork, inputting the monitoring data set and time information into the driving network to perform driving evaluation, calling the virtual address based on the driving evaluation result, and performing dynamic IP update of the network terminal; Calculate the node safety impact score of each monitoring point through the monitoring data set to generate a node safety impact score calculation result; Conduct abnormal event correlation evaluation on all monitoring points, perform impact calculation on the node safety impact score calculation results based on the correlation evaluation results, and generate a comprehensive safety impact score; Perform network security processing based on comprehensive security impact scores and dynamic IP update results.

2. The network security processing method based on dynamic network according to claim 1, characterized in that: The step of calculating the node safety impact score of each monitoring point through the monitoring data set to generate a node safety impact score calculation result further includes: The calculation formula for configuring the node security impact score is as follows: ； in, Characterization The node safety impact score calculation results of each monitoring point are: For the The total number of events in the monitoring points, For the Among the monitoring points The severity rating of the event, For the Among the monitoring points The frequency of an event, For the Among the monitoring points The response speed of an event, No. Among the monitoring points The fitness of an event can be quantified as the degree to which the event matches the current security policy, environment, or configuration.

3. The network security processing method based on dynamic network as claimed in claim 2, characterized in that: The generating of the comprehensive security impact score further includes: The comprehensive security impact score is calculated using the formula: ； in, For the overall security impact score, is the total number of monitoring points, Characterization The importance of each monitoring point For the The node safety impact score calculation results of each monitoring point are: For the The node safety impact score calculation results of each monitoring point are: Characterization Monitoring points and The mutual influence coefficient of the monitoring points is , Respectively represent , Safety impact scores of two different monitoring points, is the normalization factor, which is used to normalize the safety impact score calculation results of all monitoring points.

4. The network security processing method based on dynamic network according to claim 1, characterized in that: The network security processing according to the comprehensive security impact score and the dynamic IP update result also includes: Obtaining a score warning level of the comprehensive security impact score; Perform update adaptation evaluation according to the scoring warning level and dynamic IP update result; Report network security anomalies based on the adaptation evaluation results.

5. The network security processing method based on dynamic network as claimed in claim 4, characterized in that: The method further comprises: Determine whether the scoring warning level meets a preset level threshold; If the preset level threshold is met, a dynamic topology transformation instruction is generated; The network terminal is controlled by the dynamic topology transformation instruction to perform physical structure transformation, and network security processing is performed based on the physical structure transformation result.

6. The network security processing method based on dynamic network as claimed in claim 5, characterized in that: The method further comprises: Establishing a historical connection database of the network terminal, and performing connection analysis on the historical connection database to establish a connection correlation coefficient; The connection random number is matched according to the connection association coefficient, and the physical structure transformation selection of the network terminal is performed based on the connection random number to establish a physical structure transformation result.

7. The network security processing method based on dynamic network as claimed in claim 1, characterized in that: The method further comprises: Get the user's historical data set; Extracting user behavior features at multiple scales according to the historical data set, and establishing a multi-scale feature extraction result, wherein the multi-scale feature extraction result carries a scale trust mark; Performing behavior authentication of the user data set through the multi-scale feature extraction result, and establishing additional outliers based on the behavior authentication result; The comprehensive safety impact score is updated by the additional outliers.

8. A network security processing system based on a dynamic network, characterized in that: For implementing the network security processing method based on a dynamic network according to any one of claims 1 to 7, the system comprises: A configuration management module, which is used to perform configuration management of network terminals in the intranet, including management of real IP addresses, external network access IP addresses and virtual addresses of dynamic conversion units; A monitoring module, the monitoring module is used to perform terminal monitoring of network terminals based on the configuration management result and establish a monitoring data set, the monitoring data set includes a device data set and a user data set; An update module, the update module is used to establish a drive network, the drive network includes a time drive subnetwork, an event drive subnetwork and a load drive subnetwork, input the monitoring data set and time information into the drive network to perform drive evaluation, call the virtual address based on the drive evaluation result, and perform dynamic IP update of the network terminal; A first calculation module, the first calculation module is used to calculate the node security impact score of each monitoring point through the monitoring data set to generate a node security impact score calculation result; A second calculation module, the second calculation module is used to perform abnormal event correlation evaluation on all monitoring points, perform impact calculation on the node safety impact score calculation result based on the correlation evaluation result, and generate a comprehensive safety impact score; A processing module is used to perform network security processing according to the comprehensive security impact score and the dynamic IP update result.

Images