Network security management system based on big data

Abstract

The invention relates to a network security management system based on big data, and the system comprises the following modules: an identification module which is used for inputting an extracted feature vector into a preset identification algorithm for threat intelligence identification, and obtaining a threat intelligence identification result; the first analysis module is used for carrying out network attack behavior analysis on the network acquisition data based on the threat intelligence recognition result if the threat intelligence recognition result has a network abnormal behavior to obtain an attack scene; wherein the attack scene comprises an attack chain and an attack mode; the second analysis module is used for performing association analysis on the network acquisition data based on the attack scene to obtain a threat factor of network security; the management module is used for formulating a corresponding security management strategy based on the threat factor of the network security; the technical problem that a traditional security monitoring method cannot effectively capture latent abnormal behaviors in a network and is difficult to provide comprehensive and timely security threat early warning is solved.

Description

Technical Field

[0001] The present invention relates to the field of big data technology, and in particular to a network security management system based on big data. Background Art

[0002] At present, with the rapid development of information technology and the acceleration of digital transformation, network systems are facing increasing security challenges. The application of big data technology has significantly improved the ability to process and store information, but it has also brought about an increase in data complexity and network threats. In particular, with the popularization of emerging technologies such as the Internet of Things and cloud computing, the types of network attacks have become more diverse and complex, and traditional network security protection methods have gradually become incapable of dealing with these new threats. How to improve network security protection capabilities based on big data technology has become an urgent problem to be solved in the current network security field.

[0003] In existing network security management, data collection, threat identification and emergency response are usually relatively independent. This fragmented security management method leads to problems such as low detection accuracy, long response time and single decision-making strategy. As the concealment and complexity of attack methods continue to increase, traditional security monitoring methods cannot effectively capture abnormal behaviors lurking in the network and cannot provide comprehensive and timely security threat warnings. In addition, the diversity and dynamic changes of the network environment also make it difficult for traditional security management systems to adapt and make accurate security policy adjustments.

[0004] Therefore, studying a network security management system based on big data technology can effectively improve network security protection capabilities by comprehensively collecting, intelligently identifying, and deeply analyzing network behavior data, and formulating accurate security strategies in combination with correlation analysis methods. In this context, it is urgent to establish an integrated, intelligent, and dynamic network security management system to cope with the current complex and ever-changing network security threats and provide more accurate defense solutions. Summary of the invention

[0005] The main purpose of the present invention is to provide a network security management system based on big data, which solves the technical problem that traditional security monitoring methods cannot effectively capture abnormal behaviors lurking in the network and are difficult to provide comprehensive and timely security threat warnings.

[0006] To achieve the above objectives, the present invention provides a network security management system based on big data, comprising:

[0007] The acquisition module is used to collect data from network nodes to obtain network acquisition data, and to extract and construct features from the network acquisition data to obtain an extracted feature vector;

[0008] An identification module is used to input the extracted feature vector into a preset identification algorithm to perform threat intelligence identification and obtain a threat intelligence identification result;

[0009] A first analysis module is used to perform network attack behavior analysis on the network collection data based on the threat intelligence identification result to obtain an attack scenario if there is network abnormal behavior in the threat intelligence identification result; wherein the attack scenario includes an attack chain and an attack mode;

[0010] A second analysis module is used to perform correlation analysis on the network collected data based on the attack scenario to obtain threat factors for network security;

[0011] The management module is used to formulate corresponding security management strategies based on the threat factors of network security.

[0012] Further, data is collected from network nodes to obtain network collected data, and features are extracted and constructed from the network collected data to obtain extracted feature vectors, including:

[0013] A multi-dimensional collection module, used to collect multi-dimensional data from the network nodes to obtain multi-dimensional collection data; wherein the multi-dimensional data includes network traffic data, system log data, application log data and user behavior data;

[0014] A session reorganization module, used for performing session reorganization on the multi-dimensional collected data to obtain session reorganization data;

[0015] A cleaning module, used for cleaning the reorganized session data to obtain cleaned session data; wherein the cleaning includes removing duplicate data, filling missing values, and correcting abnormal values;

[0016] A feature extraction module, used to perform protocol analysis and behavior feature extraction on the cleaning session data to obtain behavior feature data;

[0017] A vector construction module, used to construct a feature vector based on the behavior feature data to obtain an initial feature vector; wherein the feature vector construction includes extracting statistical features, time series features and content features;

[0018] A dimension reduction processing module, used for performing dimension reduction processing on the initial feature vector to obtain a reduced dimension feature vector;

[0019] The feature selection module is used to perform feature selection on the dimension-reduced feature vector to obtain a selected feature vector, and use the selected feature vector as an extracted feature vector.

[0020] Furthermore, the extracted feature vector is input into a preset recognition algorithm for threat intelligence recognition to obtain a threat intelligence recognition result, including:

[0021] A normalization processing module, used to perform normalization processing on the extracted feature vector through a preset recognition algorithm to obtain a normalized vector;

[0022] An embedding module, used for performing high-dimensional feature embedding on the normalized vector to obtain an enhanced feature representation;

[0023] A weighing module, used for weighing the importance of the enhanced feature representation to obtain a weighted feature set;

[0024] A screening module, used for screening the weighted feature set by importance, so as to retain the features that contribute most to the identification of threat intelligence, and obtain an optimized feature subset;

[0025] An expansion module, used for performing feature expansion on the optimized feature subset to obtain an extended feature set;

[0026] A migration module, used for performing migration learning and domain adaptation on the extended feature set to obtain a migrated feature representation;

[0027] An anomaly detection module, used to perform an anomaly detection network analysis on the migrated feature representation to obtain preliminary threat intelligence;

[0028] An accelerated computing module, used to project the preliminary threat intelligence into the quantum computing space for accelerated computing through a preset quantum feature mapping algorithm to obtain quantum enhanced threat features;

[0029] The intelligence identification module is used to perform threat intelligence identification on the quantum enhanced threat characteristics to obtain threat intelligence identification results.

[0030] Furthermore, based on the threat intelligence identification result, the network collection data is subjected to network attack behavior analysis to obtain attack scenarios, including:

[0031] A semantic parsing module, used to perform multi-layer semantic parsing on the network collected data based on the threat intelligence identification result to obtain a semantic parsing vector;

[0032] A timing dependency modeling module, used to perform timing dependency modeling on the semantic parsing vector to obtain a timing dependency path;

[0033] A causal link reasoning module, used to perform causal link reasoning on the network collected data based on the temporal dependency path to obtain a causal link graph;

[0034] A joint analysis module, used to perform multimodal data fusion and joint analysis on the causal link graph through a preset multimodal Bayesian network algorithm to obtain a comprehensive attack graph;

[0035] A network construction module, used for dynamically constructing the network attack behavior based on the comprehensive attack graph to obtain a dynamic attack network;

[0036] A risk quantification calculation module, used to perform risk quantification calculation on the dynamic attack network to obtain a quantitative risk index;

[0037] The deduction and identification module is used to deduce and identify network attack paths based on quantitative risk indicators to obtain attack scenarios; wherein the network attack path includes a network attack chain and a network attack mode.

[0038] Furthermore, the network collected data is subjected to correlation analysis based on the attack scenario to obtain threat factors for network security, including:

[0039] A relationship deduction module, used to perform multi-dimensional relationship deduction on the network collected data based on the attack scenario to obtain a multi-dimensional relationship graph;

[0040] An association mining module is used to perform high-order association mining on the multidimensional relationship graph to obtain a high-order association matrix;

[0041] A causal modeling module, used to perform implicit causal modeling on the network attack behavior through a high-order correlation matrix to obtain a causal inference graph;

[0042] A semantic aggregation module, used for performing multi-level semantic aggregation on the causal inference graph to obtain an aggregated threat vector;

[0043] A topology risk assessment module, used to perform a topology risk assessment on the network attack path based on the aggregated threat vector to obtain a risk assessment matrix;

[0044] A threat evolution analysis module, used to perform a global threat evolution analysis on the attack scenario through the risk assessment matrix to obtain a threat evolution path diagram;

[0045] A feature mapping module, used for performing composite feature mapping on the threat evolution path diagram to obtain a threat factor feature diagram;

[0046] The factor screening module is used to perform adaptive factor screening on the threat evolution path diagram to obtain threat factors for network security.

[0047] Furthermore, the network attack behavior is implicitly causally modeled through a high-order correlation matrix to obtain a causal inference graph, including:

[0048] An abstract processing module is used to abstract the nonlinear high-dimensional latent variables in the network attack behavior through the high-order correlation matrix to obtain a dynamic Bayesian causal graph;

[0049] An implicit causal modeling module, used for performing implicit causal modeling based on the dynamic Bayesian causal graph to obtain an initial causal connectivity graph;

[0050] A decomposition module, used for performing spectral decomposition and conditional derivation on the initial causal connectivity graph to obtain a causal effect propagation path;

[0051] A reconstruction module, used for reconstructing an inverse probability weighted matrix based on information of the causal effect propagation path;

[0052] A recursive reasoning module, used for recursively reasoning the potential causal relationship of the network attack behavior based on the reconstructed inverse probability weighted matrix to obtain a topological causal matrix;

[0053] A dynamic tuning module, used for performing composite aggregation and dynamic tuning on the topological causal matrix to obtain a topological correlation orthogonal decomposition matrix;

[0054] The topological correlation module is used to perform dynamic Bayesian inference on the topological correlation orthogonal decomposition matrix through a preset attention causal network to obtain a causal inference graph.

[0055] Furthermore, a corresponding security management strategy is formulated based on the threat factors to network security, including:

[0056] An adaptive risk assessment module, used to perform adaptive risk assessment of the network environment based on the threat factors of the network security to obtain a dynamic risk score;

[0057] A vulnerability mapping module, used to perform hierarchical vulnerability mapping based on the dynamic risk score to obtain a vulnerability level distribution map;

[0058] A vector modeling module, used to perform attack vector modeling based on the vulnerability level distribution map to obtain an attack vector list;

[0059] A security management strategy construction module, used to construct a security management strategy based on the attack vector list to obtain a preliminary security management strategy;

[0060] A policy arrangement module, used for performing dynamic response policy arrangement based on the preliminary security management policy to obtain a dynamic security management policy set;

[0061] A security policy verification module, used to perform multi-factor security policy verification based on the dynamic security management policy set to obtain a policy verification report;

[0062] The cyclic policy enhancement module is used to perform cyclic policy enhancement on the security management policy through the policy verification report to formulate a corresponding security management policy.

[0063] The present invention also provides a network security management method based on big data, comprising the following steps:

[0064] Performing data collection on network nodes to obtain network collection data, and performing feature extraction and construction on the network collection data to obtain an extracted feature vector;

[0065] Inputting the extracted feature vector into a preset recognition algorithm to perform threat intelligence recognition to obtain a threat intelligence recognition result;

[0066] If the threat intelligence identification result shows abnormal network behavior, the network attack behavior analysis is performed on the network collection data based on the threat intelligence identification result to obtain an attack scenario; wherein the attack scenario includes an attack chain and an attack mode;

[0067] Performing correlation analysis on the network collected data based on the attack scenario to obtain threat factors for network security;

[0068] Based on the threat factors to network security, corresponding security management strategies are formulated.

[0069] The present invention also provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any one of the above methods when executing the computer program.

[0070] The present invention also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned methods are implemented.

[0071] The network security management system based on big data provided by the present invention comprises the following modules: an acquisition module, an identification module, a first analysis module, a second analysis module and a management module, wherein the acquisition module is used to collect data from network nodes to obtain network acquisition data, and to extract and construct features from the network acquisition data to obtain an extracted feature vector; the identification module is used to input the extracted feature vector into a preset identification algorithm to perform threat intelligence identification to obtain a threat intelligence identification result; the first analysis module is used to perform network attack behavior analysis on the network acquisition data based on the threat intelligence identification result to obtain an attack scenario if there is network abnormal behavior in the threat intelligence identification result; wherein the attack scenario includes an attack chain and an attack mode; the second analysis module is used to perform correlation analysis on the network acquisition data based on the attack scenario to obtain a threat factor for network security; the management module is used to formulate a corresponding security management strategy based on the threat factor for network security; through the above technical solution, the technical problem that the traditional security monitoring method cannot effectively capture the abnormal behavior lurking in the network and is difficult to provide a comprehensive and timely security threat warning is solved, and changes and potential threats in the network environment can be quickly captured. This real-time performance ensures that the system can obtain important security information at the first time, accurately filter out information related to potential threats from massive data, reduce false alarm rates, improve the efficiency of threat identification, and dynamically adjust and optimize management strategies based on real-time changing network security situations to ensure that defense measures are always kept in the best condition, thereby enhancing the flexibility and resilience of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] Figure 1 It is a schematic diagram of the steps of a network security management system based on big data in one embodiment of the present invention;

[0073] Figure 2 is a structural block diagram of a network security management method based on big data in one embodiment of the present invention;

[0074] Figure 3 It is a schematic block diagram of the structure of a computer device according to an embodiment of the present invention.

[0075] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0076] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0077] like Figure 1 As shown, Figure 1is a schematic diagram of a network security management system based on big data in one embodiment of the present invention;

[0078] In one embodiment of the present invention, a network security management system based on big data is provided, comprising:

[0079] The acquisition module is used to collect data from network nodes to obtain network acquisition data, and to extract and construct features from the network acquisition data to obtain extracted feature vectors.

[0080] Specifically, in the above-mentioned network security management system based on big data, the acquisition module is a key component of the system. Its main function is to collect data from network nodes, obtain network collection data, and further extract and construct features of these data, and finally generate extracted feature vectors. In order to achieve this process, first of all, the acquisition module needs to have the ability to monitor each node in the network environment, including real-time collection of data such as traffic, logs, access records, etc. Specifically, the acquisition module can capture various types of network activity data, such as the transmission of IP packets, the timestamp of user access, the source and destination of the request, etc., through sensors or agents deployed on different network nodes. After obtaining these raw network collection data, the acquisition module will perform preliminary cleaning and sorting of the data to remove noise data and irrelevant information. Next, the system will use a preset algorithm to extract features from the cleaned data. The purpose of this step is to convert complex and massive raw data into feature data that can be further processed by the system. Feature extraction usually includes operations such as grouping, statistics, and encoding of data to extract vectors that can represent network behavior characteristics. For example, when detecting network traffic anomalies, feature extraction may include key indicators such as the source IP address of the traffic, the destination IP address, the number of bytes transmitted, the size and frequency of the data packet, etc. The extracted feature data needs to be further constructed into a feature vector for use by subsequent identification and analysis modules. Feature vectors can be regarded as a condensed form of data, which represents multi-dimensional network behavior information in mathematical form, thereby simplifying the analysis and processing of complex data. For example, when facing a large-scale distributed denial of service (DDoS) attack, the acquisition module may extract specific patterns in the attack traffic, such as sudden traffic peaks, high-frequency IP requests, abnormal access paths, etc. These features will be constructed into feature vectors for threat identification by the identification module. In this way, the acquisition module can not only efficiently process the massive data in the network, but also convert these data into feature vectors with practical analysis value, providing a solid foundation for subsequent threat intelligence identification and network security management.

[0081] The identification module is used to input the extracted feature vector into a preset identification algorithm to perform threat intelligence identification and obtain a threat intelligence identification result.

[0082] Specifically, in the above-mentioned network security management system based on big data, the recognition module plays a key role. Its core function is to input the extracted feature vector generated by the acquisition module into the preset recognition algorithm to perform threat intelligence recognition, thereby obtaining the threat intelligence recognition result. Specifically, the recognition module first needs to be closely integrated with the acquisition module to receive the feature vector after feature extraction. These feature vectors represent abnormal behaviors or potential threat patterns that may exist in the network. Therefore, the task of the recognition module is to further analyze and judge these feature vectors using the preset algorithm. The preset recognition algorithm can include a variety of technical means, such as rule-based detection, machine learning algorithms or deep learning models, which can learn threat patterns from a large amount of historical data and establish corresponding models. In actual applications, the recognition module will select a suitable recognition algorithm according to different network security requirements. For example, when identifying phishing attacks, the algorithm may make judgments based on domain name features, access paths, user behaviors and other information in the feature vector, and identify those activities that are highly similar to known attack patterns. The recognition process usually includes model matching, feature similarity calculation and abnormal threshold judgment. Once the features related to threat intelligence are identified, the system will output the recognition results. This recognition result can not only be used to determine whether there is a security threat in the current network environment, but also provide basic data support for subsequent attack behavior analysis. For example, suppose the system detects that the same source IP frequently initiates a large number of invalid requests within a certain period of time. After extracting the feature vector, the recognition module can use the preset DDoS detection algorithm to determine whether these requests constitute potential attack behaviors. If the feature is highly consistent with the known DDoS attack pattern, the recognition module will output the recognition result, marking the behavior as a potential threat, thereby triggering further security protection measures. In this way, the recognition module can identify possible threat intelligence at an early stage and provide support for the system's timely response and protection.

[0083] The first analysis module is used to perform network attack behavior analysis on the network collected data based on the threat intelligence identification result to obtain an attack scenario if there is network abnormal behavior in the threat intelligence identification result; wherein the attack scenario includes an attack chain and an attack mode.

[0084] Specifically, in the above-mentioned network security management system based on big data, the first analysis module is one of the key steps. Its main task is to further analyze the network attack behavior of the network collection data based on the identification result when the network abnormal behavior is detected in the threat intelligence identification result, and finally generate the attack scenario. Specifically, when the identification module identifies the possible threat intelligence and identifies the abnormal behavior in the network, the first analysis module will be started. Its primary task is to combine these identification results to conduct an in-depth analysis of the collected network data to determine the specific attack means and paths behind the abnormal behavior. This analysis process usually requires comparing the identified feature vectors with the known attack pattern library to identify possible attack chains and attack patterns. In this process, the construction of the attack chain is a crucial step. The attack chain usually refers to a series of orderly actions taken by the attacker in the network, such as from the initial intrusion attempt to the final data theft or destruction. The first analysis module can gradually restore these steps through a comprehensive analysis of the network collection data, revealing the attacker's path and intention. In addition, the analysis module will also identify the attack pattern, which involves the classification and description of specific types of attacks. For example, by analyzing a certain specific packet feature or access pattern that appears repeatedly in the network, the module may identify that this is a sign of a SQL injection attack or the spread of a certain malware. For example, suppose the identification module detects that certain IP addresses have made abnormal accesses to multiple server ports in a short period of time. After receiving this identification result, the first analysis module will combine historical data and known attack chains to analyze whether these access behaviors belong to a known port scanning attack. By gradually analyzing the time series, source IP, target port and other features of these accesses, the module can determine that this is a network detection behavior, the purpose of which is to prepare for subsequent attacks. The attack scenario generated by this analysis not only includes the restoration of the attack chain, but also may reveal the attacker's specific goals and possible subsequent attack strategies. Through this systematic attack behavior analysis, the first analysis module can provide a more in-depth and accurate understanding of threats for network security management, thereby providing an important basis for the formulation of subsequent protective measures.

[0085] The second analysis module is used to perform correlation analysis on the network collected data based on the attack scenario to obtain threat factors for network security.

[0086] Specifically, in the above-mentioned network security management system based on big data, the role of the second analysis module is critical. It performs correlation analysis on the network collection data based on the attack scenario generated in the previous step, and finally obtains the threat factors of network security. Specifically, after the first analysis module conducts in-depth analysis on the threat intelligence identification results and constructs a complete attack scenario, the second analysis module begins to further analyze the data in these scenarios to reveal the threat factors hidden in the network. Threat factors usually refer to key elements that can trigger security incidents, such as specific IP addresses, malicious code fragments, abnormal traffic patterns or other factors that can pose a threat to network security. To achieve this goal, the second analysis module will comprehensively compare and associate various types of information in the attack scenario with the network collection data. At this time, the module will not only focus on explicit threats, but also identify potential security threats that have not yet fully manifested by analyzing the correlation between data. For example, some seemingly unrelated data items, such as network traffic fluctuations in a specific time period and the activity frequency of a certain IP address, may reveal the inherent connection between the two after correlation analysis, thereby identifying hidden threat factors. Through this correlation analysis, the second analysis module can integrate various abnormal data scattered in the network to form a complete set of threat factors, providing an important reference for the subsequent security management and protection strategy formulation. For example, suppose the first analysis module identifies abnormal activities involving multiple network nodes in a certain attack scenario. The second analysis module will further analyze the correlation of these nodes and may find that although these nodes are in different network areas, they have all been connected to a specific external server in a short period of time. Through further correlation analysis, the module may determine that this external server is actually a command and control center (C&C server) used to coordinate the malicious activities of these nodes. This discovery will be marked as a high risk as an important threat factor and incorporated into the system's security management strategy.

[0087] Therefore, through the correlation analysis of the second analysis module, the system can deeply explore the potential threats in the network collection data, so as to more accurately identify and respond to complex network security threats and improve the overall security protection level.

[0088] The management module is used to formulate corresponding security management strategies based on the threat factors of network security.

[0089] Specifically, in the above-mentioned network security management system based on big data, formulating corresponding security management strategies is one of the key steps. The core lies in how to formulate effective security management strategies based on the threat factors of network security obtained in the previous step, so as to improve the overall protection capability of the system. Specifically, after the second analysis module identifies the threat factors in the network through correlation analysis, the system needs to use these threat factors as the basis for formulating security management strategies. Threat factors are the specific manifestations of potential security risks in the network. Therefore, the formulation of strategies must be tailored to these risks to ensure that various possible attacks can be effectively responded to. When formulating security management strategies, the system first needs to conduct a detailed analysis and evaluation of the nature of threat factors, including their sources, possible impact ranges, and the probability of successful attacks. This information will help the system determine priorities and formulate emergency response measures for the most threatening factors. For example, if a threat factor is identified as being related to a known ransomware attack, the security management strategy may immediately include isolating the network traffic related to the factor, performing a comprehensive scan and cleanup of the affected system, and strengthening real-time monitoring of similar attack patterns. In addition, security management strategies also need to be forward-looking, not only to address current threats, but also to prevent potential risks. To this end, the system may develop a series of security control measures for the identified threat factors, such as updating firewall rules, strengthening access control policies, adding multi-factor authentication, and conducting regular security audits and penetration tests. The development and implementation of these measures are intended to reduce the security incidents that threat factors may cause in the future. For example, suppose the system identifies a threat factor as a surge in abnormal traffic from a certain geographical area during a specific time period. This behavior may point to a harbinger of a distributed denial of service (DDoS) attack. To deal with such threats, the system may develop strategies, including dynamically adjusting traffic thresholds, enabling DDoS protection systems, and automatically triggering early warning mechanisms when abnormal traffic reaches a certain level, notifying the security team to take further action. Through this security management strategy development based on threat factors, the system can not only effectively respond to current security threats, but also improve the overall network security protection capabilities through continuous strategy optimization, ensuring that a high level of protection is always maintained in the face of complex and changing network security environments.

[0090] In a specific embodiment, data is collected from network nodes to obtain network collected data, and features are extracted and constructed from the network collected data to obtain extracted feature vectors, including:

[0091] A multi-dimensional collection module, used to collect multi-dimensional data from the network nodes to obtain multi-dimensional collection data; wherein the multi-dimensional data includes network traffic data, system log data, application log data and user behavior data;

[0092] A session reorganization module, used for performing session reorganization on the multi-dimensional collected data to obtain session reorganization data;

[0093] A cleaning module, used for cleaning the reorganized session data to obtain cleaned session data; wherein the cleaning includes removing duplicate data, filling missing values, and correcting abnormal values;

[0094] A feature extraction module, used to perform protocol analysis and behavior feature extraction on the cleaning session data to obtain behavior feature data;

[0095] A vector construction module, used to construct a feature vector based on the behavior feature data to obtain an initial feature vector; wherein the feature vector construction includes extracting statistical features, time series features and content features;

[0096] A dimension reduction processing module, used for performing dimension reduction processing on the initial feature vector to obtain a reduced dimension feature vector;

[0097] The feature selection module is used to perform feature selection on the dimension-reduced feature vector to obtain a selected feature vector, and use the selected feature vector as an extracted feature vector.

[0098] Specifically, in the above-mentioned network security management system based on big data, the process of data collection, feature extraction and construction of extracted feature vectors for network nodes is the basis for the entire system to identify and respond to network threats. This process mainly includes the collaborative work of multiple modules, namely, multi-dimensional collection module, session reorganization module, cleaning module, feature extraction module, vector construction module, dimensionality reduction processing module and feature selection module. Each module plays a specific role in it, and together completes the in-depth analysis and processing of network data. First, the multi-dimensional collection module is used to collect multi-dimensional data from network nodes to obtain multi-dimensional collection data. These data cover multiple dimensions, including network traffic data, system log data, application log data and user behavior data. Network traffic data refers to data transmission information between network nodes, system log data is a record generated by the operating system, application log data includes the operation records of various applications, and user behavior data reflects the user's operation and interaction behavior in the system. By collecting these dimensional data, the system can fully understand the operation status and activity of network nodes, laying the foundation for subsequent analysis. Next, the session reorganization module will perform session reorganization on the multi-dimensional collection data to obtain session reorganization data. Session reassembly refers to the process of reassembling scattered data from the same session to restore a complete communication chain or interaction process. This process is crucial for analyzing specific attack behaviors or abnormal activities, because many complex network attacks are executed in a distributed manner through multiple sessions. Through session reassembly, the system can more accurately identify the correlation between data and reveal potential attack paths. After completing session reassembly, the cleaning module will clean the session reassembly data to obtain cleaned session data. The cleaning process includes removing duplicate data, filling missing values, and correcting outliers. Removing duplicate data is to eliminate redundant information caused by repetition in network transmission or log records, filling missing values ​​is to fill in the blank parts of the collected data through reasonable inference or external data sources, and correcting outliers is to adjust or mark those data that are beyond the reasonable range to ensure the accuracy and consistency of the data. Through data cleaning, the system can obtain purer and more reliable session data, preparing for the next step of feature extraction. After that, the feature extraction module performs protocol parsing and behavioral feature extraction on the cleaned session data to obtain behavioral feature data. Protocol parsing refers to decoding and analyzing network protocol data packets to extract useful information, such as IP addresses, port numbers, data transmission protocols, etc. Behavioral feature extraction is to extract features that can characterize network activities or user behaviors from these parsed data. These features may include data packet size, transmission frequency, session duration, etc. Through feature extraction, the system can generate a series of behavioral feature data that can reflect the characteristics of network activities and provide materials for constructing feature vectors.After obtaining the behavioral feature data, the vector construction module constructs a feature vector based on this data to obtain an initial feature vector. A feature vector is a mathematical representation of network activity that can convert complex behavioral features into a numerical format that can be used for calculation and analysis. The feature vector construction process includes extracting statistical features, time series features, and content features. Statistical features refer to features obtained by statistical analysis of the quantity and distribution of data, such as the average size or standard deviation of a data packet; time series features analyze the pattern of data changes over time, such as the time interval or peak period of data transmission; content features analyze the content of the data itself, such as the specific content of a data packet or the specific pattern of a load. By extracting these features, the system can generate an initial feature vector that covers many aspects of network activity. However, the initial feature vector often contains a large number of dimensions and redundant information, which may lead to increased computational complexity and overfitting of the model. Therefore, the dimensionality reduction processing module is used to perform dimensionality reduction processing on the initial feature vector to obtain a reduced dimensionality feature vector. The purpose of dimensionality reduction processing is to reduce the dimension of the feature vector through mathematical methods while trying to keep the main information of the data intact. Commonly used dimensionality reduction techniques include principal component analysis (PCA) and linear discriminant analysis (LDA), which can find the features with the largest amount of information in the feature vector and remove those redundant features that have little impact on the results, thereby simplifying the data structure and improving the analysis efficiency. Finally, the feature selection module performs feature selection on the reduced feature vector to obtain the selected feature vector and use it as the final extracted feature vector. Feature selection refers to further screening out the most representative and distinguishing features based on certain predefined standards or algorithms on the basis of dimensionality reduction processing. Commonly used feature selection methods include filtering, packaging, and embedding, which can sort features according to their importance and select those features that contribute most to the classification or prediction results, thereby optimizing the performance of the model. For example, in a network intrusion detection system, through the multi-dimensional acquisition module, the system collects a large amount of network traffic data and log information. After session reorganization and cleaning, some specific behavioral features are extracted, such as abnormal login attempts, unauthorized file access, etc. After vector construction and dimensionality reduction, these features finally generate a feature vector containing key behavioral features, which is input into a preset classifier to determine whether there is intrusion in the current network. If certain features, such as a large number of failed login attempts in a short period of time, are identified as highly correlated with known attack patterns, the system will mark them as potential security threats and trigger corresponding protective measures. Through the collaborative work of these modules, the system can effectively extract representative feature vectors from massive network data, providing a solid data foundation for subsequent threat detection and security management strategy formulation.

[0099] In a specific embodiment, the extracted feature vector is input into a preset recognition algorithm for threat intelligence recognition to obtain a threat intelligence recognition result, including:

[0100] A normalization processing module, used to perform normalization processing on the extracted feature vector through a preset recognition algorithm to obtain a normalized vector;

[0101] An embedding module, used for performing high-dimensional feature embedding on the normalized vector to obtain an enhanced feature representation;

[0102] A weighing module, used for weighing the importance of the enhanced feature representation to obtain a weighted feature set;

[0103] A screening module, used for screening the weighted feature set by importance, so as to retain the features that contribute most to the identification of threat intelligence, and obtain an optimized feature subset;

[0104] An expansion module, used for performing feature expansion on the optimized feature subset to obtain an extended feature set;

[0105] A migration module, used for performing migration learning and domain adaptation on the extended feature set to obtain a migrated feature representation;

[0106] An anomaly detection module, used to perform an anomaly detection network analysis on the migrated feature representation to obtain preliminary threat intelligence;

[0107] An accelerated computing module, used to project the preliminary threat intelligence into the quantum computing space for accelerated computing through a preset quantum feature mapping algorithm to obtain quantum enhanced threat features;

[0108] The intelligence identification module is used to perform threat intelligence identification on the quantum enhanced threat characteristics to obtain threat intelligence identification results.

[0109] Specifically, in the above network security management system, extracting feature vectors and inputting them into the preset recognition algorithm for threat intelligence recognition is one of the core steps, which involves the close cooperation of multiple modules, and each module plays a vital role in the process of realizing threat intelligence recognition. First, the normalization processing module normalizes the extracted feature vectors through the preset recognition algorithm to obtain normalized vectors. The purpose of normalization is to adjust the feature data of different scales to the same range, thereby eliminating the influence of the difference in the size of the feature value on the subsequent analysis. Through normalization, the system can more effectively compare and analyze the relative importance of different features, ensuring that the algorithm is consistent when processing feature vectors. Next, the embedding module embeds the normalized vector into high-dimensional features to obtain enhanced feature representation. High-dimensional feature embedding is a method of converting low-dimensional features into high-dimensional space representations, which can capture more complex relationships and dependencies between features. Through the embedding operation, the system can enhance the expressive power of feature vectors, thereby better characterizing potential threat behaviors. For example, in network traffic analysis, the embedding module can expand the original simple traffic features to higher dimensions, capture the subtle differences between different traffic patterns, and lay the foundation for subsequent threat identification. After completing the high-dimensional embedding, the weighing module weighs the importance of the enhanced feature representation to obtain a weighted feature set. Importance weighing refers to assigning different weights to different features according to their contribution to threat intelligence identification. The weighing module determines which features have a greater influence in the identification process by analyzing the correlation between features and threat behaviors, and then assigns higher weights to these features. In this way, the system can highlight the most representative features, making the subsequent identification algorithm more targeted and efficient. Next, the screening module performs importance screening on the weighted feature set to retain the features that contribute most to threat intelligence identification and obtain an optimized feature subset. The task of the screening module is to further streamline the feature set and remove those features that contribute less to threat identification or may introduce noise, thereby improving the accuracy and stability of the model. In this process, the screening module may use methods such as recursive feature elimination or feature selection based on information gain to ensure that the retained features have the greatest contribution to the final threat intelligence identification results. Subsequently, the expansion module performs feature expansion on the optimized feature subset to obtain an extended feature set. Feature expansion refers to generating new features through combination or conversion based on existing features to further enrich the feature space and enhance the model's expressiveness. For example, by cross-combining different features or generating new features through nonlinear transformation, the system can capture more complex feature patterns and thus more comprehensively characterize potential threat intelligence. After the extended feature set is generated, the migration module performs transfer learning and domain adaptation on it to obtain the migrated feature representation.Transfer learning is a method of leveraging the knowledge of a trained model in a new domain. By mapping the extended feature set to a new domain, the transfer module can apply the knowledge previously learned in other similar tasks to the current threat identification task to improve the identification effect. Domain adaptation refers to adjusting the model in the new domain so that it can better adapt to the distribution characteristics of the current data, so that it can still maintain efficient recognition capabilities in the new environment. Next, the anomaly detection module performs anomaly detection network analysis on the migrated feature representation to obtain preliminary threat intelligence. Anomaly detection network analysis is a method of identifying potential threats by detecting abnormal patterns in data. By analyzing the migrated feature representation, the system can find data that deviates from normal behavior patterns, thereby preliminarily identifying possible security threats. For network security systems, this detection can help identify new attacks or abnormal activities that are not covered by preset rules or models. After obtaining preliminary threat intelligence, the accelerated computing module projects the preliminary threat intelligence into the quantum computing space for accelerated computing through a preset quantum feature mapping algorithm to obtain quantum enhanced threat features. Quantum feature mapping is a method of rapid data processing using quantum computing technology. By projecting preliminary threat intelligence into quantum computing space, the system can use the parallel processing capabilities of quantum computing to greatly improve computing efficiency, thereby obtaining more accurate threat intelligence features in a shorter time. Finally, the intelligence recognition module performs threat intelligence recognition on the quantum enhanced threat features to obtain the final threat intelligence recognition results. The task of the intelligence recognition module is to combine the enhanced features generated by all the above steps, analyze them using the preset recognition algorithm, and finally identify the specific threat type and risk level. For example, if the system detects that certain features are highly consistent with the known DDoS attack mode, the intelligence recognition module identifies them as possible DDoS attack threats and outputs the corresponding recognition results. Through this process, the system can accurately identify potential threats in the network and provide timely warnings and protection measures, thereby improving the security of the entire network. In summary, through the coordinated work of normalization, embedding, weighing, screening, expansion, migration, anomaly detection, accelerated computing and final intelligence recognition, the system can start from the original feature vector, gradually refine and enhance the threat intelligence features, and finally achieve efficient identification of network threats. During this process, each module plays an indispensable role, jointly ensuring that the system can promptly detect and respond to various potential security threats when facing a complex and changing network environment.

[0110] In a specific embodiment, based on the threat intelligence identification result, the network collection data is subjected to network attack behavior analysis to obtain an attack scenario, including:

[0111] A semantic parsing module, used to perform multi-layer semantic parsing on the network collected data based on the threat intelligence identification result to obtain a semantic parsing vector;

[0112] A timing dependency modeling module, used to perform timing dependency modeling on the semantic parsing vector to obtain a timing dependency path;

[0113] A causal link reasoning module, used to perform causal link reasoning on the network collected data based on the temporal dependency path to obtain a causal link graph;

[0114] A joint analysis module, used to perform multimodal data fusion and joint analysis on the causal link graph through a preset multimodal Bayesian network algorithm to obtain a comprehensive attack graph;

[0115] A network construction module, used for dynamically constructing the network attack behavior based on the comprehensive attack graph to obtain a dynamic attack network;

[0116] A risk quantification calculation module, used to perform risk quantification calculation on the dynamic attack network to obtain a quantitative risk index;

[0117] The deduction and identification module is used to deduce and identify network attack paths based on quantitative risk indicators to obtain attack scenarios; wherein the network attack path includes a network attack chain and a network attack mode.

[0118] Specifically, in the above network security management system, the network attack behavior analysis of network collection data based on the threat intelligence identification results is a complex and multi-step process, which covers a series of modular operations from data parsing to attack scenario generation. These modules include semantic parsing module, temporal dependency modeling module, causal link reasoning module, joint analysis module, network construction module, risk quantification calculation module and deduction and identification module, each of which plays a key role in the analysis of network attack behavior. First, the semantic parsing module performs multi-layer semantic parsing on the network collection data based on the threat intelligence identification results to obtain a semantic parsing vector. Multi-layer semantic parsing is a method for deeply mining data semantic information. By parsing different levels and dimensions of network data, more contextual information can be extracted to help identify potential threat behaviors. For example, when the system detects that a certain IP address has abnormal behavior, the semantic parsing module can further parse the communication mode of the IP address, the type of resources accessed, and the interaction with other nodes to generate a detailed semantic parsing vector. These parsing vectors provide a rich information basis for subsequent temporal dependency modeling. Next, the temporal dependency modeling module performs temporal dependency modeling on the semantic parsing vector to obtain a temporal dependency path. Temporal dependency modeling is a key step in analyzing the changes of network behavior over time. By capturing the temporal relationship between data, the dynamic characteristics of attack behavior can be revealed. Through this modeling, the system can construct a time series of attack behavior and identify the attacker's behavior pattern and its development trend. For example, the system may find that a series of network requests occur in sequence within a specific time. These requests may constitute a continuous scanning activity, indicating potential attack behavior. After obtaining the temporal dependency path, the causal link reasoning module performs causal link reasoning on the network collection data based on the temporal dependency path to obtain a causal link graph. Causal link reasoning is a method to identify attack paths by analyzing the causal relationship between events. By studying the causal relationship between different events, the system can draw the attacker's action route and identify the root cause of the attack and its propagation path. For example, if a series of abnormal login attempts are highly correlated with a subsequent data leakage event, the causal link reasoning module can infer that there is a causal relationship between these events, and then identify potential attack links. Then, the joint analysis module performs multimodal data fusion and joint analysis on the causal link graph through a preset multimodal Bayesian network algorithm to obtain a comprehensive attack map. The multimodal Bayesian network algorithm is an algorithm that combines different types of data for analysis. By combining multiple data sources, such as network traffic logs, system logs, user behavior data, etc., the system can build a more comprehensive attack map. This joint analysis can help identify more complex attack patterns and reveal the multi-dimensional behavioral characteristics of attackers.For example, the system may combine network traffic data and user behavior data to find that a user has abnormal traffic characteristics before accessing sensitive resources, which may indicate that the user's account has been hijacked by an attacker. After the comprehensive attack graph is generated, the network construction module dynamically constructs the network attack behavior based on the comprehensive attack graph to obtain a dynamic attack network. Dynamic network construction is to reflect the evolution of attack behavior in real time by mapping the attack behavior to a dynamically changing network structure. In this way, the system can more intuitively display the attacker's action path and attack chain in the network. For example, in a dynamic attack network, the system can see the process of the attacker starting from an initial infected node and gradually expanding to other nodes, which provides an important basis for the formulation of defense strategies. Next, the risk quantification calculation module performs risk quantification calculation on the dynamic attack network to obtain quantitative risk indicators. Risk quantification calculation is a method of quantitatively evaluating the potential impact of attack behavior. By evaluating the possibility of attack success and its potential harm to the system, the system can generate quantitative risk indicators that can help security teams prioritize high-risk threats. For example, if an attack path points to a critical server and the possibility of attack success is high, the system may mark the path as high risk and recommend immediate defense measures. Finally, the deduction and identification module deduces and identifies network attack paths based on quantitative risk indicators to obtain attack scenarios. Network attack path deduction is a method of predicting potential threats by simulating different paths that attackers may take. By combining the previously generated quantitative risk indicators, the system can deduce the attacker's possible next move and identify possible attack scenarios. These attack scenarios include network attack chains and network attack patterns. Through these scenarios, the system can warn of potential attacks in advance and help the security team prepare for defense in advance. For example, in a simulation scenario, the system may deduce that the attacker may further obtain the administrator privileges of the system through the compromised user account. This deduction result can help the security team take corresponding protective measures. In general, through semantic parsing, temporal dependency modeling, causal link reasoning, multimodal data fusion, dynamic network construction, risk quantification calculation, and attack path deduction, these modules work together, and the system can extract rich information from network acquisition data, analyze the characteristics and paths of attack behaviors, and finally generate detailed attack scenarios. This series of steps not only provides a comprehensive perspective for threat detection, but also provides strong support for the formulation of attack defense strategies, enabling the network security management system to maintain efficient threat perception and response capabilities when facing complex and changing attack situations.

[0119] In a specific embodiment, the network collected data is subjected to correlation analysis based on the attack scenario to obtain threat factors for network security, including:

[0120] A relationship deduction module, used to perform multi-dimensional relationship deduction on the network collected data based on the attack scenario to obtain a multi-dimensional relationship graph;

[0121] An association mining module is used to perform high-order association mining on the multidimensional relationship graph to obtain a high-order association matrix;

[0122] A causal modeling module, used to perform implicit causal modeling on the network attack behavior through a high-order correlation matrix to obtain a causal inference graph;

[0123] A semantic aggregation module, used for performing multi-level semantic aggregation on the causal inference graph to obtain an aggregated threat vector;

[0124] A topology risk assessment module, used to perform a topology risk assessment on the network attack path based on the aggregated threat vector to obtain a risk assessment matrix;

[0125] A threat evolution analysis module, used to perform a global threat evolution analysis on the attack scenario through the risk assessment matrix to obtain a threat evolution path diagram;

[0126] A feature mapping module, used for performing composite feature mapping on the threat evolution path diagram to obtain a threat factor feature diagram;

[0127] The factor screening module is used to perform adaptive factor screening on the threat evolution path diagram to obtain threat factors for network security.

[0128] Specifically, in the network security management system, the association analysis of network collected data based on the attack scenario to obtain the threat factors of network security is a delicate and complex process, involving multi-level relationship deduction, association mining, causal modeling, semantic aggregation, topological risk assessment, threat evolution analysis, feature mapping and factor screening. Each step is to dig and analyze the network attack behavior layer by layer, and finally form a clear threat factor feature map, which provides strong support for network security management. First, the relationship deduction module performs multi-dimensional relationship deduction on the network collected data based on the attack scenario to obtain a multi-dimensional relationship graph. Multi-dimensional relationship deduction includes analyzing various entities and their relationships in the network data to construct a multi-dimensional relationship graph reflecting various possible interactions between these entities. For example, in an attack scenario, the system may analyze the interaction between multiple entities such as user accounts, network devices, and access resources, and extract the relationship between these entities to form a multi-dimensional relationship graph. This graph not only reflects the direct interaction relationship, but also reveals the potential indirect relationship, which provides a basis for subsequent association mining. After obtaining the multi-dimensional relationship graph, the association mining module will perform high-order association mining on it to obtain a high-order association matrix. High-order association mining refers to identifying potential high-level association patterns in the network by analyzing complex associations between multiple dimensions. These patterns may be hidden tracks of attackers as they move through the network, or hidden connections between multiple seemingly independent events. Through this mining, the system can construct a high-order association matrix that reflects multi-level and complex associations. For example, an attack scenario may involve multiple failed login attempts and a subsequent successful data theft. The system can discover the potential connections between these events through high-order association mining, thereby identifying the key nodes in the attack chain. Next, the causal modeling module performs implicit causal modeling on the network attack behavior based on the high-order association matrix to obtain a causal inference graph. Implicit causal modeling is a method of inferring potential causal relationships by analyzing associated data. Through this modeling, the system can reveal the causal chain behind the attack behavior and better understand the attacker's action logic. For example, if the high-order association matrix shows that a certain abnormal network traffic is always related to a specific system crash event, implicit causal modeling may infer that this abnormal traffic is one of the causes of the system crash, thereby constructing a causal inference graph. After the causal inference graph is generated, the semantic aggregation module performs multi-level semantic aggregation on it to obtain an aggregated threat vector. Multi-level semantic aggregation involves integrating semantic information at different levels to generate an aggregated threat vector that reflects the overall attack situation. For example, the system may integrate information at different levels, such as user behavior, attack path, and device status, and aggregate it into a comprehensive threat vector. This threat vector not only reflects the surface characteristics of the attack behavior, but also reveals deeper semantic associations, allowing the system to more accurately identify potential threats.Subsequently, the topology risk assessment module performs a topology risk assessment on the network attack path based on the aggregated threat vectors, thereby obtaining a risk assessment matrix. Topology risk assessment is a method of assessing potential risks by analyzing the network structure and its changes during the attack process. Through this assessment, the system can identify weak links and high-risk areas in the network, thereby providing a basis for security defense. For example, if a critical server is accessed multiple times in the attack path and each time is accompanied by abnormal traffic, the system may mark the server as a high-risk node through topology risk assessment and recommend additional protective measures. Next, the threat evolution analysis module performs a global threat evolution analysis on the attack scenario through the risk assessment matrix to obtain a threat evolution path map. Global threat evolution analysis is a method of predicting possible future threat paths by comprehensively considering the entire attack process and its potential development trends. Through this analysis, the system can reveal the attacker's possible next move and the direction in which the attack may evolve. For example, if the system detects that the attacker is gradually gaining administrator privileges on the system, the global threat evolution analysis may infer that the attacker will try to further expand the scope of the attack next, thereby generating a threat evolution path map. After the threat evolution path graph is generated, the feature mapping module will perform composite feature mapping on it to obtain a threat factor feature graph. Composite feature mapping includes extracting and mapping the key features in the threat evolution path into a comprehensive feature graph. This feature graph reflects the key threat factors in the entire attack process and provides a basis for subsequent factor screening. For example, the system may map the features of each step of the attacker's actions, tools used, resources accessed, etc. into the feature graph, thereby providing a comprehensive reference for security analysis. Finally, the factor screening module performs adaptive factor screening on the threat evolution path graph to obtain network security threat factors. Adaptive factor screening is a method of screening out the most threatening factors by analyzing the key nodes and behaviors in the threat evolution path. These factors are often the key factors that lead to security incidents. By identifying and analyzing these factors, the system can provide more accurate security protection. For example, the system may identify a specific network port or a specific malware as a key threat factor that causes the system to be attacked through adaptive factor screening, and thus recommends focusing on monitoring and protecting these factors. In general, through relationship deduction, high-order association mining, implicit causal modeling, multi-level semantic aggregation, topological risk assessment, global threat evolution analysis, composite feature mapping, and adaptive factor screening, this series of steps work together to enable the system to extract key threat factors from network collection data, providing accurate risk assessment and protection strategies for network security. This process not only reveals the behavior patterns of attackers, but also provides security teams with actionable intelligence to help them better respond to ever-changing network threats.

[0129] In a specific embodiment, the network attack behavior is implicitly causally modeled through a high-order correlation matrix to obtain a causal inference graph, including:

[0130] An abstract processing module is used to abstract the nonlinear high-dimensional latent variables in the network attack behavior through the high-order correlation matrix to obtain a dynamic Bayesian causal graph;

[0131] An implicit causal modeling module, used for performing implicit causal modeling based on the dynamic Bayesian causal graph to obtain an initial causal connectivity graph;

[0132] A decomposition module, used for performing spectral decomposition and conditional derivation on the initial causal connectivity graph to obtain a causal effect propagation path;

[0133] A reconstruction module, used for reconstructing an inverse probability weighted matrix based on information of the causal effect propagation path;

[0134] A recursive reasoning module, used for recursively reasoning the potential causal relationship of the network attack behavior based on the reconstructed inverse probability weighted matrix to obtain a topological causal matrix;

[0135] A dynamic tuning module, used for performing composite aggregation and dynamic tuning on the topological causal matrix to obtain a topological correlation orthogonal decomposition matrix;

[0136] The topological correlation module is used to perform dynamic Bayesian inference on the topological correlation orthogonal decomposition matrix through a preset attention causal network to obtain a causal inference graph.

[0137] Specifically, in network security analysis, implicit causal modeling of network attack behavior through high-order correlation matrix is ​​a complex and delicate process, and its ultimate goal is to obtain a causal inference graph that can reflect the potential causal relationship behind network attack behavior. This process involves the collaborative work of multiple modules, and each module plays a vital role in analysis and inference. First, the abstraction processing module abstracts the nonlinear high-dimensional latent variables in network attack behavior through high-order correlation matrix to obtain a dynamic Bayesian causal graph. Here, nonlinear high-dimensional latent variables refer to those complex relationships in attack behavior that are hidden and difficult to directly observe. These variables are often the driving factors behind the attacker's behavior. Through abstraction processing, the system can transform these complex latent variables into a simpler dynamic Bayesian causal graph, which can more clearly show the causal relationship of the attack behavior. For example, in a network attack scenario, there may be complex nonlinear relationships between multiple seemingly independent attack steps. The system can reveal these hidden connections through abstraction processing and represent them in the dynamic Bayesian causal graph. Next, the implicit causal modeling module performs implicit causal modeling based on the dynamic Bayesian causal graph to obtain the initial causal connectivity map. At this stage, the system establishes preliminary causal connectivity between attack behaviors by analyzing the nodes and edges in the dynamic Bayesian causal graph. This initial causal connectivity graph can be understood as a rough attack causal chain, where each node represents a potential attack behavior and each edge represents the causal relationship between these behaviors. For example, in a network attack, an abnormal traffic surge may be related to a subsequent server crash. The implicit causal modeling module connects these events to form an initial causal connectivity graph. After obtaining the initial causal connectivity graph, the decomposition module performs spectral decomposition and conditional deduction on it to obtain the causal effect propagation path. Spectral decomposition is a mathematical method that allows the system to better understand the internal structure of complex causal relationships by decomposing them into several simpler components. Conditional deduction, on the other hand, further refines the causal relationship by analyzing the performance of these components under different conditions, thereby obtaining a more accurate causal effect propagation path. For example, in the above example of server crash, the system may identify multiple possible causal paths through spectral decomposition, and then determine which path is most likely to be the actual causal chain through conditional deduction. As the causal effect propagation paths are formed, the reconstruction module reconstructs the inverse probability weighted matrix based on the information of these paths. The inverse probability weighted matrix is ​​a tool for correcting and adjusting causal inference. The reconstruction module can improve the accuracy and reliability of causal inference by mapping the information in the causal effect propagation paths into the inverse probability weighted matrix.For example, the system may find that certain attack behaviors have different influences in different attack paths. The reconstruction module will use this information to reconstruct the inverse probability weighted matrix to more accurately reflect the actual causal relationship of these behaviors. After the inverse probability weighted matrix is ​​reconstructed, the recursive reasoning module recursively infers the potential causal relationship of network attack behaviors based on the matrix to obtain the topological causal matrix. Recursive reasoning is a process of repeated analysis and inference. By continuously adjusting and optimizing the inference process, the system can gradually reveal the deep causal relationship behind the attack behavior. The topological causal matrix is ​​the final result of this process. It not only shows the direct causal relationship between attack behaviors, but also reveals the topological structure of these relationships in the entire network. For example, the recursive reasoning module may identify that certain attack behaviors are jointly triggered by multiple preceding behaviors. This complex causal relationship is clearly represented in the topological causal matrix. After the topological causal matrix is ​​generated, the dynamic tuning module performs compound aggregation and dynamic tuning on it, and finally obtains the topological correlation orthogonal decomposition matrix. Compound aggregation is to integrate multiple causal relationships together to form a more comprehensive causal structure, while dynamic tuning is to ensure the accuracy of the inference results by adjusting and optimizing the causal relationship in real time. The final generated topological correlation orthogonal decomposition matrix can more accurately reflect the complex causal relationship between attack behaviors, providing a solid foundation for further analysis and inference. Finally, the topological correlation module performs dynamic Bayesian inference on the topological correlation orthogonal decomposition matrix through the preset attention causal network to obtain a causal inference graph. The attention causal network is an inference tool based on neural networks. By introducing the attention mechanism, the system can better focus on the key parts of the causal relationship, thereby improving the accuracy of inference. The final generated causal inference graph not only shows the causal chain between attack behaviors, but also reveals the strength and importance of these causal relationships. For example, in a complex network attack scenario, the causal inference graph may highlight a key node that plays a vital role in the attack chain, prompting the security team to focus on its protection. In general, through the comprehensive application of abstract processing, high-order association mining, implicit causal modeling, spectral decomposition, information reconstruction, recursive reasoning, dynamic tuning, and attention causal networks, the system can extract deep causal relationships from network attack behaviors and finally generate a clear causal inference graph. This causal inference graph not only provides a powerful tool for network security analysis, but also helps security teams better understand and respond to complex network attacks.

[0138] In a specific embodiment, formulating a corresponding security management strategy based on the threat factors to network security includes:

[0139] An adaptive risk assessment module, used to perform adaptive risk assessment of the network environment based on the threat factors of the network security to obtain a dynamic risk score;

[0140] A vulnerability mapping module, used to perform hierarchical vulnerability mapping based on the dynamic risk score to obtain a vulnerability level distribution map;

[0141] A vector modeling module, used to perform attack vector modeling based on the vulnerability level distribution map to obtain an attack vector list;

[0142] A security management strategy construction module, used to construct a security management strategy based on the attack vector list to obtain a preliminary security management strategy;

[0143] A policy arrangement module, used for performing dynamic response policy arrangement based on the preliminary security management policy to obtain a dynamic security management policy set;

[0144] A security policy verification module, used to perform multi-factor security policy verification based on the dynamic security management policy set to obtain a policy verification report;

[0145] The cyclic policy enhancement module is used to perform cyclic policy enhancement on the security management policy through the policy verification report to formulate a corresponding security management policy.

[0146] Specifically, in the field of network security, formulating effective security management strategies for the ever-changing threat factors is the key to protecting the network environment from attacks. Through a series of steps such as adaptive risk assessment, vulnerability mapping, attack vector modeling, policy construction and orchestration, security policy verification, and cyclic policy enhancement, network security management strategies can be systematically formulated and optimized to ensure their dynamic adaptability and effectiveness. First, the adaptive risk assessment module evaluates the threat factors of network security and conducts adaptive risk assessment of the network environment to obtain a dynamic risk score. Threat factors refer to various factors that may affect network security, including external attack behaviors and internal system vulnerabilities. Through adaptive risk assessment, the system can monitor and analyze the changes of these threat factors in real time and calculate a dynamic risk score based on their potential impact on the network environment. For example, in an enterprise network that is highly dependent on Internet connections, if a large amount of abnormal traffic is detected, this situation may indicate a potential distributed denial of service (DDoS) attack threat, and the system will assign a higher risk score to the network based on the severity of such threat factors. Next, the vulnerability mapping module performs hierarchical vulnerability mapping based on the dynamic risk score to obtain a vulnerability level distribution map. Vulnerability mapping is the systematic marking and classification of weaknesses in a network system, and the classification is based on the severity of their impact and the likelihood of their occurrence. The vulnerability level distribution map is a visual result of this process, showing the vulnerabilities and distribution of different parts of the system. Through this diagram, the security management team can clearly see which parts have the highest security risks and take targeted measures. For example, in a certain enterprise network, if the security vulnerabilities of multiple key servers are concentrated on a specific software version, the vulnerability levels of these servers will be marked as high-risk areas in the distribution map. After the vulnerability level is determined, the vector modeling module analyzes the vulnerability level distribution map, models the attack vector, and obtains a list of attack vectors. An attack vector refers to the way or method that an attacker may use the system vulnerability to attack. By analyzing the vulnerability distribution map, the system can infer possible attack paths and generate an attack vector list, listing potential attack methods and their possible targets. For example, a remote code execution vulnerability in a system may become the primary vector for an attacker to invade the network. This vulnerability will be included in the attack vector list and analyzed together with other possible attack paths. Based on the list of attack vectors, the security management strategy building module begins to formulate preliminary security management strategies. In this step, the system combines the possibility and potential impact of each attack vector with the existing protection measures to build a preliminary protection strategy. These strategies will cover everything from the deployment of defense measures to response plans for emergencies, ensuring that they can respond quickly and effectively when faced with actual threats.For example, in the scenario of preventing DDoS attacks, the system may recommend deploying advanced firewalls or traffic filters and setting specific traffic monitoring and automatic response rules. However, only preliminary security management policies are not enough to cope with dynamically changing threats. Therefore, the policy orchestration module further performs dynamic response policy orchestration on these preliminary policies to obtain a dynamic security management policy set. Policy orchestration is to organically combine different protection measures and response plans to form a dynamic policy set that can adapt to changes in threats. Through policy orchestration, the system can automatically adjust the protection policy based on real-time monitoring data to cope with changing attack methods. For example, when facing complex attacks with multiple attack vectors, the system can dynamically adjust the policy based on the current attack situation and give priority to the most urgent threats. After the policy orchestration is completed, the security policy verification module performs multi-factor security policy verification based on the dynamic security management policy set to obtain a policy verification report. Security policy verification is to verify the effectiveness and feasibility of the policy in actual operation by simulating different attack scenarios. The system will evaluate the performance of the policy from multiple perspectives (such as time, resource utilization, and attack success rate) and generate a detailed policy verification report. For example, by simulating a load test of a DDoS attack, it is verified whether the deployed traffic filter can effectively block attack traffic during peak hours and ensure that normal user access is not affected. Finally, based on the policy verification report, the cyclic policy enhancement module performs cyclic policy enhancement on the security management policy to formulate a more complete security management policy. Cyclic policy enhancement refers to the process of implementing the policy, through continuous verification, feedback and optimization, to gradually improve the effectiveness and adaptability of the security management policy. Through this process, the system can continuously improve the existing policy, timely correct possible loopholes or deficiencies, and ensure that the network environment is always in the best protection state. For example, after multiple rounds of verification, the system may find that some protection measures are not as effective as expected. At this time, the cyclic policy enhancement module will recommend adjusting or replacing these measures to better deal with actual threats. In general, through the steps of adaptive risk assessment, vulnerability mapping, attack vector modeling, policy construction and orchestration, security policy verification, and cyclic policy enhancement, the system can formulate a complete set of security management policies that can dynamically adapt to changes in threats in the network environment and continuously improve its protection effect. Ultimately, this comprehensive security management solution will provide strong protection for network security.

[0147] The above describes the network security system method based on big data in the embodiment of the present invention. The following describes the network security management method based on big data in the embodiment of the present invention. Figure 2 In one embodiment of the present invention, a network security management method based on big data includes:

[0148] Performing data collection on network nodes to obtain network collection data, and performing feature extraction and construction on the network collection data to obtain an extracted feature vector;

[0149] Inputting the extracted feature vector into a preset recognition algorithm to perform threat intelligence recognition to obtain a threat intelligence recognition result;

[0150] If the threat intelligence identification result shows abnormal network behavior, the network attack behavior analysis is performed on the network collection data based on the threat intelligence identification result to obtain an attack scenario; wherein the attack scenario includes an attack chain and an attack mode;

[0151] Performing correlation analysis on the network collected data based on the attack scenario to obtain threat factors for network security;

[0152] Based on the threat factors to network security, corresponding security management strategies are formulated.

[0153] In this embodiment, for the specific implementation of each module in the above method embodiment, please refer to the above method embodiment, which will not be repeated here.

[0154] Reference Figure 3 The present invention also provides a computer device in an embodiment, wherein the internal structure of the computer device can be as follows: Figure 3 As shown. The computer device includes a processor, a memory, a display screen, an input device, a network interface and a database connected through a system bus. Among them, the processor designed by the computer is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store the corresponding data in this embodiment. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, the above method is implemented.

[0155] Those skilled in the art will understand that Figure 3 The structure shown in the figure is merely a block diagram of a portion of the structure related to the solution of the present invention, and does not constitute a limitation on the computer device to which the solution of the present invention is applied.

[0156] An embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the above method is implemented. It can be understood that the computer-readable storage medium in this embodiment can be a volatile readable storage medium or a non-volatile readable storage medium.

[0157] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media provided by the present invention and used in the embodiments can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double-speed data rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM.

[0158] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, device, article or method including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, device, article or method. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the presence of other identical elements in the process, device, article or method including the element.

[0159] The above description is only a preferred embodiment of the present invention, and does not limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made by using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A network security management system based on big data, characterized in that: include: The acquisition module is used to collect data from network nodes to obtain network acquisition data, and to extract and construct features from the network acquisition data to obtain an extracted feature vector; An identification module is used to input the extracted feature vector into a preset identification algorithm to perform threat intelligence identification and obtain a threat intelligence identification result; A first analysis module is used to perform network attack behavior analysis on the network collection data based on the threat intelligence identification result to obtain an attack scenario if there is network abnormal behavior in the threat intelligence identification result; wherein the attack scenario includes an attack chain and an attack mode; A second analysis module is used to perform correlation analysis on the network collected data based on the attack scenario to obtain threat factors for network security; The management module is used to formulate corresponding security management strategies based on the threat factors of network security.

2. The network security management system based on big data according to claim 1 is characterized in that: Data is collected from network nodes to obtain network collected data, and features are extracted and constructed from the network collected data to obtain extracted feature vectors, including: A multi-dimensional collection module, used to collect multi-dimensional data from the network nodes to obtain multi-dimensional collection data; wherein the multi-dimensional data includes network traffic data, system log data, application log data and user behavior data; A session reorganization module, used for performing session reorganization on the multi-dimensional collected data to obtain session reorganization data; A cleaning module, used for cleaning the reorganized session data to obtain cleaned session data; wherein the cleaning includes removing duplicate data, filling missing values, and correcting abnormal values; A feature extraction module, used to perform protocol analysis and behavior feature extraction on the cleaning session data to obtain behavior feature data; A vector construction module, used to construct a feature vector based on the behavior feature data to obtain an initial feature vector; wherein the feature vector construction includes extracting statistical features, time series features and content features; A dimension reduction processing module, used for performing dimension reduction processing on the initial feature vector to obtain a reduced dimension feature vector; The feature selection module is used to perform feature selection on the dimension-reduced feature vector to obtain a selected feature vector, and use the selected feature vector as an extracted feature vector.

3. The network security management system based on big data according to claim 1 is characterized in that: The extracted feature vector is input into a preset recognition algorithm to perform threat intelligence recognition, and a threat intelligence recognition result is obtained, including: A normalization processing module, used to perform normalization processing on the extracted feature vector through a preset recognition algorithm to obtain a normalized vector; An embedding module, used for performing high-dimensional feature embedding on the normalized vector to obtain an enhanced feature representation; A weighing module, used for weighing the importance of the enhanced feature representation to obtain a weighted feature set; A screening module, used for screening the weighted feature set by importance, so as to retain the features that contribute most to the identification of threat intelligence, and obtain an optimized feature subset; An expansion module, used for performing feature expansion on the optimized feature subset to obtain an extended feature set; A migration module, used for performing migration learning and domain adaptation on the extended feature set to obtain a migrated feature representation; An anomaly detection module, used to perform an anomaly detection network analysis on the migrated feature representation to obtain preliminary threat intelligence; An accelerated computing module, used to project the preliminary threat intelligence into the quantum computing space for accelerated computing through a preset quantum feature mapping algorithm to obtain quantum enhanced threat features; The intelligence identification module is used to perform threat intelligence identification on the quantum enhanced threat characteristics to obtain threat intelligence identification results.

4. The network security management system based on big data according to claim 1 is characterized in that: Based on the threat intelligence identification result, the network collected data is subjected to network attack behavior analysis to obtain attack scenarios, including: A semantic parsing module, used to perform multi-layer semantic parsing on the network collected data based on the threat intelligence identification result to obtain a semantic parsing vector; A timing dependency modeling module, used to perform timing dependency modeling on the semantic parsing vector to obtain a timing dependency path; A causal link reasoning module, used to perform causal link reasoning on the network collected data based on the temporal dependency path to obtain a causal link graph; A joint analysis module, used to perform multimodal data fusion and joint analysis on the causal link graph through a preset multimodal Bayesian network algorithm to obtain a comprehensive attack graph; A network construction module, used for dynamically constructing the network attack behavior based on the comprehensive attack graph to obtain a dynamic attack network; A risk quantification calculation module, used to perform risk quantification calculation on the dynamic attack network to obtain a quantitative risk index; The deduction and identification module is used to deduce and identify network attack paths based on quantitative risk indicators to obtain attack scenarios; wherein the network attack path includes a network attack chain and a network attack mode.

5. The network security management system based on big data according to claim 4 is characterized in that: Based on the attack scenario, the network collected data is subjected to correlation analysis to obtain threat factors for network security, including: A relationship deduction module, used to perform multi-dimensional relationship deduction on the network collected data based on the attack scenario to obtain a multi-dimensional relationship graph; An association mining module is used to perform high-order association mining on the multidimensional relationship graph to obtain a high-order association matrix; A causal modeling module, used to perform implicit causal modeling on the network attack behavior through a high-order correlation matrix to obtain a causal inference graph; A semantic aggregation module, used for performing multi-level semantic aggregation on the causal inference graph to obtain an aggregated threat vector; A topology risk assessment module, used to perform a topology risk assessment on the network attack path based on the aggregated threat vector to obtain a risk assessment matrix; A threat evolution analysis module, used to perform a global threat evolution analysis on the attack scenario through the risk assessment matrix to obtain a threat evolution path diagram; A feature mapping module, used for performing composite feature mapping on the threat evolution path diagram to obtain a threat factor feature diagram; The factor screening module is used to perform adaptive factor screening on the threat evolution path diagram to obtain threat factors for network security.

6. The network security management system based on big data according to claim 5 is characterized in that: The network attack behavior is implicitly causally modeled through a high-order correlation matrix to obtain a causal inference graph, including: An abstract processing module is used to abstract the nonlinear high-dimensional latent variables in the network attack behavior through the high-order correlation matrix to obtain a dynamic Bayesian causal graph; An implicit causal modeling module, used for performing implicit causal modeling based on the dynamic Bayesian causal graph to obtain an initial causal connectivity graph; A decomposition module, used for performing spectral decomposition and conditional derivation on the initial causal connectivity graph to obtain a causal effect propagation path; A reconstruction module, used for reconstructing an inverse probability weighted matrix based on information of the causal effect propagation path; A recursive reasoning module, used for recursively reasoning the potential causal relationship of the network attack behavior based on the reconstructed inverse probability weighted matrix to obtain a topological causal matrix; A dynamic tuning module, used for performing composite aggregation and dynamic tuning on the topological causal matrix to obtain a topological correlation orthogonal decomposition matrix; The topological correlation module is used to perform dynamic Bayesian inference on the topological correlation orthogonal decomposition matrix through a preset attention causal network to obtain a causal inference graph.

7. The network security management system based on big data according to claim 1 is characterized in that: Formulate corresponding security management strategies based on the network security threat factors, including: An adaptive risk assessment module, used to perform adaptive risk assessment of the network environment based on the threat factors of the network security to obtain a dynamic risk score; A vulnerability mapping module, used to perform hierarchical vulnerability mapping based on the dynamic risk score to obtain a vulnerability level distribution map; A vector modeling module, used to perform attack vector modeling based on the vulnerability level distribution map to obtain an attack vector list; A security management strategy construction module, used to construct a security management strategy based on the attack vector list to obtain a preliminary security management strategy; A policy arrangement module, used for performing dynamic response policy arrangement based on the preliminary security management policy to obtain a dynamic security management policy set; A security policy verification module, used to perform multi-factor security policy verification based on the dynamic security management policy set to obtain a policy verification report; The cyclic policy enhancement module is used to perform cyclic policy enhancement on the security management policy through the policy verification report to formulate a corresponding security management policy.

8. A network security management method based on big data, characterized in that: The following steps are involved: Performing data collection on network nodes to obtain network collection data, and performing feature extraction and construction on the network collection data to obtain an extracted feature vector; Inputting the extracted feature vector into a preset recognition algorithm to perform threat intelligence recognition to obtain a threat intelligence recognition result; If the threat intelligence identification result shows abnormal network behavior, the network attack behavior analysis is performed on the network collection data based on the threat intelligence identification result to obtain an attack scenario; wherein the attack scenario includes an attack chain and an attack mode; Performing correlation analysis on the network collected data based on the attack scenario to obtain threat factors for network security; Based on the threat factors to network security, corresponding security management strategies are formulated.

9. A computer device comprising a memory and a processor, wherein a computer program is stored in the memory, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images