Network security model comprehensive evaluation system and evaluation method thereof

Abstract

The invention discloses a network security model comprehensive evaluation system and an evaluation method thereof, and particularly relates to the technical field of network security. The method comprises the following steps: obtaining an intelligence response delay coefficient, a data processing difference coefficient and a signal unavailable coefficient in each subinterval to obtain an adaptive coefficient of the subinterval; establishing an adaptive coefficient set according to the adaptive coefficients in all the subintervals, screening out all abnormal coefficients in the adaptive coefficient set, establishing an abnormal set for all the abnormal coefficients, calculating a standard deviation in the abnormal set, and comparing the standard deviation with a preset standard deviation value to obtain an abnormal coefficient set; and the self-adaptive capability of the network security model comprehensive evaluation system is judged according to the comparison result, so that an alarm can be given in time to remind a worker that the network security model comprehensive evaluation system has vulnerabilities on the evaluation result of the network security model, and measures need to be taken in time, so that the accuracy of the evaluation result of the network security model is relatively high.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security model comprehensive evaluation system and an evaluation method thereof. Background Art

[0002] The Cybersecurity Model Comprehensive Assessment System is a tool for comprehensive assessment and analysis of cybersecurity models. It integrates multiple assessment methods and technologies to conduct in-depth inspections of various aspects of the cybersecurity model, including but not limited to vulnerability detection, threat assessment, attack path analysis, risk management, and security protection effect assessment, thereby helping security experts and network administrators better understand and improve the defense capabilities and robustness of their cybersecurity models.

[0003] Since the network environment may change dynamically, in order to ensure the accuracy of the network security model evaluation by the network security model comprehensive evaluation system, the network security model comprehensive evaluation system is required to have a certain degree of adaptive ability, and be able to self-adjust and learn according to environmental changes, so as to maintain high performance; however, in the above technology, if the network security model comprehensive evaluation system cannot timely self-adjust and learn according to environmental changes, and this situation is not perceived in time, it may cause loopholes in the evaluation results of the network security model, resulting in low accuracy of the evaluation results of the network security model.

[0004] The network security model comprehensive evaluation system in the related technology is unable to evaluate its own adaptive capabilities, which leads to loopholes in its evaluation results of the network security model. Therefore, how to provide an evaluation method that can effectively evaluate the adaptive capabilities of the network security model evaluation system has become a technical problem that urgently needs to be solved. Summary of the invention

[0005] The purpose of the present invention is to provide a network security model comprehensive evaluation system and an evaluation method thereof, so as to solve the problem in the prior art that there is a lack of evaluation of the adaptive capability of the network security model comprehensive evaluation system.

[0006] In order to achieve the above-mentioned purpose, according to the first aspect of the present invention, there is provided an evaluation method for a network security model comprehensive evaluation system, the evaluation method for the network security model comprehensive evaluation system comprising the following steps: obtaining the replacement time of the environment in which the network security model is located; obtaining the time interval between the replacement time and the current time as the target time interval; dividing the target time interval to obtain a plurality of sub-intervals; obtaining the intelligence response delay coefficient, data processing difference coefficient and signal unavailability coefficient of each sub-interval; weighted summing the intelligence response delay coefficient, data processing difference coefficient and signal unavailability coefficient of each sub-interval to calculate the adaptive coefficient of each sub-interval; establishing an adaptive coefficient set, the adaptive coefficient set including the adaptive coefficients of all sub-intervals; screening abnormal coefficients in the adaptive coefficient set; establishing an abnormal set with the screened multiple abnormal coefficients; calculating the standard deviation of the multiple abnormal coefficients in the abnormal set, comparing the calculated standard deviation with the preset standard deviation value, and issuing an alarm signal according to the comparison result.

[0007] In this way, the evaluation method of the network security model comprehensive evaluation system provided by the present invention can evaluate the adaptability of the network security model comprehensive evaluation system, and can promptly issue an alarm to remind the staff that there are loopholes in the evaluation results of the network security model by the network security model comprehensive evaluation system, and timely measures need to be taken to make the evaluation results of the network security model more accurate.

[0008] Furthermore, the method for obtaining the intelligence response delay coefficient in each sub-interval specifically includes: obtaining each update time W of the threat intelligence in each sub-interval 更 y and the corresponding response time W 响 y ; Wherein, y represents a number, y=1, 2, 3, 4, ..., m, m is the number of numbers and is a positive integer;

[0009] The intelligence response delay coefficient is calculated using the following formula:

[0010]

[0011] Where RF is the intelligence response delay coefficient.

[0012] Furthermore, the method for obtaining the data processing difference coefficient in each sub-interval specifically includes:

[0013] The data processing coefficient of variation was calculated using the following formula:

[0014] Dax=a1×YD+a2×Wn;

[0015] Wherein, Dax is the data processing difference coefficient, a1 is the preset weight coefficient of the data detection missing coefficient, a2 is the preset weight coefficient of the data processing time error coefficient; YD is the data detection missing coefficient, Wn is the data processing time error coefficient;

[0016] Among them, YD is calculated using the following formula:

[0017]

[0018] In the formula, S 实 l S is the number of data corresponding to the network security model detected. 预 l is the number of data corresponding to the preset network security model that needs to be detected; l represents the number of moments, which refers to multiple moments in each sub-interval; l = 1, 2, 3, 4, ..., h, where h is a positive integer;

[0019] Among them, Wn is calculated using the following formula:

[0020] Wn=ln(j / c+1)

[0021] The specific value of c is obtained by the following method:

[0022] Get the number of data corresponding to the network security model processed by the system at different times in each sub-interval and mark it as Q 实 f , f represents the number of data corresponding to the network security model processed by the system, f = 1, 2, 3, 4, ..., c, c is the total number of data corresponding to the network security model processed by the system at different times in each sub-interval, and c is a positive integer;

[0023] The following method is used to obtain the specific value of j:

[0024] Q 实 f Within the range of the amount of data that can be effectively processed by the preset data system [D 少 , D 多 ] are re-labeled as E a , a represents Q 实 f Within the range of the amount of data that can be effectively processed by the preset data system [D 少 , D 多 ], a=1, 2, 3, 4, ..., j, j is Q 实 f Within the range of the amount of data that can be effectively processed by the preset data system [D 少 , D 多], j is a positive integer; D 少 The minimum amount of data that can be effectively processed by the preset data system, D 多 The maximum amount of data that can be efficiently processed by a given data system.

[0025] Furthermore, the method for obtaining the signal unavailable coefficient in each sub-interval specifically includes:

[0026] The signal unavailability coefficient is calculated using the following formula:

[0027] Bvy=b1×WD+b2×Uj;

[0028] Wherein, Bvy is the signal unavailable coefficient, b1 represents the preset weight coefficient of the network line number instability coefficient, b2 represents the preset weight coefficient of the network line number failure coefficient; WD represents the network line number instability coefficient, and Uj represents the network line number failure coefficient;

[0029] Among them, WD is calculated using the following formula:

[0030]

[0031] In the formula, is the average value of the actual network signal at different times within T time, and the expression obtained is: Get the actual network signal of the system at different times during operation in each sub-interval, and mark the actual network signal as X 实 p , p represents the number of the actual network signal when the system is running, p = 1, 2, 3, 4, ..., g, g is the sequence number of the actual network signal, and g is a positive integer;

[0032] Among them, Uj is calculated using the following formula:

[0033] Uj=A / g

[0034] The specific value of A is obtained by the following method:

[0035] The actual network signal of the system at different times in each sub-interval is less than the preset minimum threshold value Fd of the effective network signal, and is re-marked as S v , v represents the number of times the actual network signal is less than the preset minimum threshold value Fd of the effective network signal, a=1, 2, 3, 4, ..., A, A is the total number of times the actual network signal is less than the preset minimum threshold value Fd of the effective network signal, A is a positive integer; g is the sequence number of the actual network signal.

[0036] Furthermore, the method of calculating the adaptive coefficient of each sub-interval by weighted summing the intelligence response delay coefficient, the data processing difference coefficient and the signal unavailable coefficient of each sub-interval specifically includes the following steps:

[0037] The adaptive coefficient of each sub-interval is calculated using the following formula:

[0038]

[0039] Wherein, YgHt is the adaptive coefficient, RF is the intelligence response delay coefficient, Dax is the data processing difference coefficient, Bvy is the signal unavailable coefficient, α is the preset proportional coefficient of the intelligence response delay coefficient, β is the preset proportional coefficient of the data processing difference coefficient, γ is the preset proportional coefficient of the signal unavailable coefficient, and α, β, and γ are all greater than 0.

[0040] Furthermore, the method for screening abnormal coefficients in the adaptive coefficient set specifically includes: when the adaptive coefficient is not less than a preset adaptive coefficient reference threshold, marking the adaptive coefficient as an abnormal coefficient; when the adaptive coefficient is less than the preset adaptive coefficient reference threshold, marking the adaptive coefficient as a normal coefficient.

[0041] Furthermore, the calculated standard deviation is compared with the preset standard deviation value, and the method of issuing an alarm signal according to the comparison result specifically includes: when the calculated standard deviation is not less than the preset standard deviation value, issuing an alarm signal; when the calculated standard deviation is less than the preset standard deviation value, no alarm signal is issued.

[0042] According to the second aspect of the present invention, a network security model comprehensive evaluation system is also provided, and the network security model comprehensive evaluation system includes: a time division module: obtaining the time interval from the change time to the current time of the environment in which the network security model is located, obtaining the target time interval, and dividing the target time interval according to the preset window to obtain multiple sub-intervals; wherein the preset window is set according to the actual situation; an intelligence response delay module: obtaining the time data and response time data of the system in each sub-interval for real-time updating of threat intelligence, and obtaining the intelligence response delay coefficient in each sub-interval according to the time data and response time data for updating threat intelligence; a data processing difference module: obtaining the quantity information of the system real-time detection data in each sub-interval, and obtaining the intelligence response delay coefficient in each sub-interval according to the detection data The data processing difference coefficient in each sub-interval is obtained based on the quantity information; the signal unavailable module: obtains the network signal data of the system in each sub-interval during operation, and obtains the signal unavailable coefficient in each sub-interval based on the network signal data; the adaptive module: obtains the adaptive coefficient in each sub-interval based on the intelligence response delay coefficient, the data processing difference coefficient and the signal unavailable coefficient in each sub-interval; the alarm module: establishes an adaptive coefficient set based on the adaptive coefficients in all sub-intervals, filters out all the abnormal coefficients in the adaptive coefficient set, and establishes an abnormal set for all the abnormal coefficients, calculates the standard deviation of multiple abnormal coefficients in the abnormal set, and compares the calculated standard deviation with the preset standard deviation value, and issues an alarm signal based on the comparison result.

[0043] In this way, the network security model comprehensive evaluation system provided by the present invention can evaluate its own adaptive capabilities and can issue alarms in a timely manner to remind staff that there are loopholes in the evaluation results of the network security model by the network security model comprehensive evaluation system, and that timely measures need to be taken to make the evaluation results of the network security model more accurate.

[0044] Based on the implementations provided in the above aspects, this application can also be further combined to provide more implementations. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0046] Figure 1 A flowchart of an evaluation method of a network security model comprehensive evaluation system provided by an optional embodiment of the present invention;

[0047] Figure 2A framework diagram of a network security model comprehensive evaluation system provided in an optional embodiment of the present invention. DETAILED DESCRIPTION

[0048] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only embodiments of a part of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention. Unless otherwise specified, the technical means used in the embodiments are conventional means well known to those skilled in the art.

[0049] The embodiment of the present invention provides a network security model comprehensive evaluation method. Figure 1 , Figure 1 A flowchart of a network security model comprehensive evaluation method provided by an embodiment of the present invention. The method comprises the following steps:

[0050] Obtaining a time interval from when the environment in which the network security model is located is changed to the current moment, obtaining a target time interval, and dividing the target time interval according to a preset window to obtain a plurality of sub-intervals;

[0051] Obtain the time data and response time data of the system updating threat intelligence in real time in each sub-interval, and obtain the intelligence response delay coefficient based on the time data and response time data of updating threat intelligence;

[0052] Obtaining the quantity information of the real-time detection data of the system in each sub-interval, and obtaining the data processing difference coefficient according to the quantity information of the detection data;

[0053] Obtain network signal data of the system in each sub-interval during operation, and obtain a signal unavailability coefficient based on the network signal data;

[0054] The adaptive coefficient of each sub-interval is obtained according to the intelligence response delay coefficient, the data processing difference coefficient and the signal unavailable coefficient in each sub-interval;

[0055] An adaptive coefficient set is established based on the adaptive coefficients in all sub-intervals, and all abnormal coefficients in the adaptive coefficient set are screened out, and an abnormal set is established for all abnormal coefficients, and the standard deviation in the abnormal set is calculated, and the calculated standard deviation is compared with the preset standard deviation value, and an alarm signal is issued based on the comparison result.

[0056] It should be noted that the preset window is set by professional personnel based on actual conditions and is not specifically limited.

[0057] A network security model comprehensive evaluation method provided by an embodiment of the present invention obtains the adaptive coefficient of each sub-interval by acquiring the intelligence response delay coefficient, the data processing difference coefficient and the signal unavailable coefficient in the sub-interval, establishes an adaptive coefficient set according to the adaptive coefficients in all sub-intervals, and screens out all the abnormal coefficients in the adaptive coefficient set, establishes an abnormal set for all the abnormal coefficients, calculates the standard deviation in the abnormal set, and compares the standard deviation with a preset standard deviation value, and judges the adaptive ability of the network security model comprehensive evaluation system according to the comparison result, so that an alarm can be issued in time to remind the staff that there are loopholes in the evaluation results of the network security model by the network security model comprehensive evaluation system, which may cause the evaluation results of the network security model to be less accurate, and it is necessary to take timely measures to make the evaluation results of the network security model more accurate.

[0058] In one embodiment, obtaining the time data and response time data of the system updating threat intelligence in real time in each sub-interval, and obtaining the intelligence response delay coefficient according to the time data and response time data of updating threat intelligence includes:

[0059] Get each update time of threat intelligence and the corresponding response time in each sub-interval, and mark each update time of threat intelligence and the corresponding response time respectively. 更 y and Q 响 y , y represents the number of each update time of threat intelligence and the corresponding number of response times, y = 1, 2, 3, 4, ..., m, m is the number of numbers and is a positive integer;

[0060] Q 更 y and Q 响 y After processing, the intelligence response delay coefficient is obtained. The specific calculation expression is: Where RF is the intelligence response delay coefficient.

[0061] In one implementation, through the above method, the calculated intelligence response delay coefficient is more accurate and can better reflect whether the network security model comprehensive evaluation system can timely adjust and learn itself according to environmental changes.

[0062] It should be noted that the preset expected maximum delay time is set by professionals according to actual conditions, and will not be described in detail.

[0063] It should be noted that each update time of threat intelligence and the corresponding response time can be collected through the monitoring system in the device corresponding to the network security model, or in other ways, which will not be elaborated or limited in detail.

[0064] It should be noted that the intelligence response delay coefficient refers to the delay between each update time of the threat intelligence detected and the corresponding response time during the operation of the network security model comprehensive evaluation system. If the delay between each update time of the threat intelligence detected and the corresponding response time during the operation of the network security model comprehensive evaluation system is greater, it means that there is a problem with the network security model comprehensive evaluation system, and it cannot adjust and learn itself according to environmental changes in a timely manner. This may lead to loopholes in the evaluation results of the network security model, resulting in low accuracy of the evaluation results of the network security model. The reasons are:

[0065] Delayed introduction of new threat information: When the intelligence response delay coefficient is large, the system cannot introduce the latest threat intelligence in a timely manner. This means that there is a significant time difference between threat intelligence updates and system responses, resulting in the system failing to adjust and protect based on the latest threat information.

[0066] Outdated defense mechanisms: Due to the inability to update defense strategies in a timely manner, the system is still using outdated information and rules, which reduces its protection capabilities and is unable to respond to new threats.

[0067] Threat detection delay: A high intelligence response delay factor means that the information update in the threat detection process lags behind, making the system unable to identify emerging threats in a timely manner.

[0068] Increased risk of threat proliferation: When threats cannot be identified and responded to in a timely manner, attackers have more time to operate within the system, expanding the scope of impact and the degree of damage.

[0069] Delayed automated response: Automated defense systems rely on fast and accurate intelligence updates and responses. If the intelligence response is delayed too much, the automated response will become ineffective or inefficient.

[0070] Security incidents are not handled in a timely manner: Delayed response time leads to delays in the handling of security incidents, making it impossible to isolate and resolve security issues in the first place.

[0071] Delayed assessment results: Due to delays in intelligence updates and responses, the data and information used by the system when conducting security assessments are no longer accurate and comprehensive, resulting in delayed and inaccurate assessment results.

[0072] Increased false negatives and false positives: Outdated threat intelligence may cause the system to fail to correctly identify the current threat scenario, increasing the probability of false negatives (unidentified real threats) and false positives (false threat alerts).

[0073] Therefore, a large intelligence response delay coefficient means that the system is slow to respond to new threats and cannot update and adjust defense strategies in a timely manner, resulting in the network security model comprehensive evaluation system being unable to adjust and learn according to environmental changes in a timely manner, resulting in inaccurate evaluation results and loopholes.

[0074] In one embodiment, obtaining the system real-time detection data quantity information in each sub-interval, and obtaining the data processing difference coefficient according to the detection data quantity information includes:

[0075] The data processing variance coefficient includes the data detection missing coefficient and the data processing time error coefficient;

[0076] Obtain the number of data corresponding to the network security model detected by the system at different times in each sub-interval and the number of data corresponding to the preset network security model that needs to be detected, and mark the number of data corresponding to the detected network security model and the number of data corresponding to the preset network security model that needs to be detected as S respectively. 实 l and S 预 l , l represents the number of moments, l = 1, 2, 3, 4, ..., h, h is a positive integer;

[0077] According to S 实 l and S 预 l To the data detection missing coefficient YD, the calculation formula is:

[0078] Get the number of data corresponding to the network security model processed by the system at different times in each sub-interval and mark it as Q 实 f , f represents the number of data corresponding to the network security model processed by the system, f = 1, 2, 3, 4, ..., c, c is the total number of data corresponding to the network security model processed by the system at different times in each sub-interval, and c is a positive integer;

[0079] Q 实 f Within the range of the amount of data that can be effectively processed by the preset data system [D 少 , D 多 ] are re-marked as E a , a represents Q 实 f Within the range of the amount of data that can be effectively processed by the preset data system [D 少 , D 多 ], a=1, 2, 3, 4, ..., j, j is Q 实f Within the range of the amount of data that can be effectively processed by the preset data system [D 少 , D 多 ], j is a positive integer; D 少 The minimum amount of data that can be effectively processed by the preset data system, D 多 The maximum amount of data that can be efficiently processed by a given data system.

[0080] Calculate the data processing time error coefficient Nj, the calculation formula is: Wn = ln (j / c + 1);

[0081] Calculate the data processing difference coefficient, the calculation formula is: Dax = a1 × YD + a2 × Wn; where Dax is the data processing difference coefficient, and a1 and a2 represent the preset weight coefficients of the data detection omission coefficient and the data processing time error coefficient.

[0082] It should be noted that the number of data corresponding to the network security model detected by the system at different times in each sub-interval and the number of data corresponding to the network security model processed by the system can be obtained through the monitoring system inside the system, or in other ways, which will not be described or limited in detail. In addition, the preset number of data corresponding to the network security model that needs to be detected and the range of the preset number of data that the system can effectively process are determined by professionals based on actual conditions and are not specifically limited.

[0083] It should be noted that the data processing variance coefficient refers to the degree of data omissions and invalidity of processed data detected by the network security model comprehensive evaluation system during operation. The greater the degree of data omissions and invalidity of processed data detected by the network security model comprehensive evaluation system during operation, the greater the degree of data omissions and invalidity of processed data, indicating that the network security model comprehensive evaluation system has problems and cannot adjust and learn itself in time according to environmental changes. This may lead to loopholes in the evaluation results of the network security model, resulting in low accuracy of the evaluation results of the network security model. The reasons are:

[0084] Data omissions: When the data processing variance coefficient is large, data omissions may occur during the data collection and processing process. This means that the system cannot obtain comprehensive network security information, resulting in incomplete basic data for evaluation.

[0085] Missing important data: Missing key security incidents or threat intelligence data will make it impossible for the system to fully understand the current security situation and affect the formulation and adjustment of defense strategies.

[0086] Poor data quality: A high coefficient of variation also indicates that there is a large amount of invalid or low-quality data in the data processed by the system. This data may be redundant, inaccurate or irrelevant, affecting the system's analysis and decision-making capabilities.

[0087] Incorrect analysis results: The presence of invalid data can cause the system to produce misleading results during analysis and evaluation, increasing the likelihood of false positives and negatives.

[0088] Lack of dynamic adaptability: The system relies on accurate and comprehensive data to make real-time adjustments and learning. A large coefficient of variance in data processing indicates that the system has problems in data collection and processing and cannot adjust and learn in time according to environmental changes.

[0089] Delayed policy updates: Due to incomplete and invalid data, it is difficult for the system to update and optimize policies based on the latest threat intelligence and security incidents, reducing its ability to respond to new threats.

[0090] Therefore, a larger data processing variance coefficient means that the system has problems with data omissions and invalid data processing, resulting in the network security model comprehensive evaluation system being unable to adjust and learn itself in a timely manner according to environmental changes, which directly affects the accuracy and reliability of the evaluation results.

[0091] In one embodiment, obtaining network signal data of the system during operation in each sub-interval, and obtaining a signal unavailable coefficient according to the network signal data includes:

[0092] The signal unavailable coefficient includes the network signal unstable coefficient and the network signal failure coefficient. The method for obtaining the network signal unstable coefficient is as follows:

[0093] Get the actual network signal of the system at different times during operation in each sub-interval, and mark the actual network signal as X 实 p , p represents the number of the actual network signal when the system is running, p = 1, 2, 3, 4, ..., g, g is the sequence number of the actual network signal, and g is a positive integer;

[0094] Calculate the actual network signal X at different times in each subinterval 实 p The standard deviation of is taken as the network signal instability coefficient WD, and the calculation formula is:

[0095]

[0096] in, is the average value of the actual network signal at different times within T time, and the expression obtained is:

[0097] The actual network signal of the system at different times in each sub-interval is less than the preset minimum threshold value Fd of the effective network signal, and is re-marked as S v , v represents the number of times when the actual network signal is less than the preset minimum threshold value Fd of the effective network signal, v=1, 2, 3, 4, ..., A, A is the total number of times when the actual network signal is less than the preset minimum threshold value Fd of the effective network signal, and A is a positive integer.

[0098] Calculate the network signal failure coefficient Uj, the calculation formula is: Uj = A / g;

[0099] The signal unavailability coefficient is calculated using the following formula: Bvy=b1×WD+b2×Uj; wherein Bvy is the signal unavailability coefficient, and b1 and b2 represent the preset weight coefficients of the network line number instability coefficient and the network line number failure coefficient.

[0100] It should be noted that the actual network signal when the system is running can be acquired in real time according to the monitoring system in the network security model comprehensive evaluation system. In addition, the preset minimum threshold value of the effective network signal is the lowest network signal value under effective conditions when the network security model comprehensive evaluation system is running, which is determined by professionals based on actual conditions and is not specifically limited.

[0101] It should be noted that the signal unavailability coefficient refers to the degree of instability of the actual network signal when the system is running and the degree to which it is less than the minimum effective network signal threshold; if the actual network signal is more unstable and less than the minimum effective network signal threshold when the system is running, it means that there is a problem with the network security model comprehensive evaluation system, and it cannot adjust and learn itself in time according to environmental changes; it may cause loopholes in the evaluation results of the network security model, resulting in low accuracy of the evaluation results of the network security model. The reasons are:

[0102] Unable to obtain comprehensive data: Unstable network signals lead to interruptions in data transmission. The system is unable to continuously and stably obtain necessary security data, resulting in incomplete basic data for evaluation.

[0103] Loss of critical data: Situations below the minimum valid network signal threshold increase the risk of loss of critical security data, making it impossible for the system to fully understand the current security situation.

[0104] Delayed and erroneous responses: Signal unavailability prevents the system from responding promptly after detecting a threat. Delayed or erroneous responses may cause the threat to spread and increase losses.

[0105] Automated defense is limited: The automated defense system relies on stable network signals to execute defense strategies. If the signal is unavailable, the automated defense strategy cannot be executed normally, reducing the system's defense effectiveness.

[0106] Unreliable data foundation: Data transmission problems caused by signal unavailability make the basic data of the system incomplete and inaccurate when conducting security assessments, resulting in deviations in the assessment results.

[0107] Unable to update and learn in time: Adaptive systems need to continuously receive and process the latest data to learn and optimize. The unavailable signal makes it impossible for the system to obtain new data in time and adjust itself according to environmental changes, which affects the learning effect.

[0108] Therefore, a higher signal unavailability coefficient indicates that the system faces problems of unstable and insufficient signals during data transmission and processing, resulting in the inability of the network security model comprehensive evaluation system to adjust and learn itself in a timely manner according to environmental changes, which directly affects the system's response speed, data integrity and the accuracy of the evaluation results.

[0109] In one embodiment, obtaining the adaptive coefficient of each sub-interval according to the intelligence response delay coefficient, the data processing difference coefficient and the signal unavailable coefficient in each sub-interval includes:

[0110] The adaptive coefficient of each sub-interval is obtained by weighted summing the intelligence response delay coefficient, data processing difference coefficient and signal unavailable coefficient in each sub-interval, including:

[0111]

[0112] Where YgHT is the adaptive coefficient, RF, Dax and Bvy are the intelligence response delay coefficient, data processing difference coefficient and signal unavailability coefficient respectively, α, β and γ are the preset proportional coefficients of the intelligence response delay coefficient, data processing difference coefficient and signal unavailability coefficient respectively, and α, β and γ are all greater than 0.

[0113] In one embodiment, an adaptive coefficient set is established based on the adaptive coefficients in all sub-intervals, and all abnormal coefficients in the adaptive coefficient set are screened out, including:

[0114] An adaptive coefficient set is established according to the adaptive coefficients in all subintervals, and all abnormal coefficients in the adaptive coefficient set are screened out;

[0115] When the adaptive coefficient is not less than the preset adaptive coefficient reference threshold, it means that the adaptive ability of the network security model comprehensive evaluation system is smaller at this time, and the adaptive coefficient is marked as an abnormal coefficient;

[0116] When the adaptive coefficient is less than the preset adaptive coefficient reference threshold, it means that the adaptive ability of the network security model comprehensive evaluation system is greater at this time, and the adaptive coefficient is marked as a normal coefficient.

[0117] In one implementation, the above-mentioned preset adaptive coefficient reference threshold is set by professionals according to actual conditions, and the details are not repeated here.

[0118] In one embodiment, all abnormal coefficients are used to establish an abnormal set, and the standard deviation in the abnormal set is calculated, and the calculated standard deviation is compared with a preset standard deviation value, and an alarm signal is issued according to the comparison result, including:

[0119] All abnormal coefficients are used to establish an abnormal set, and the standard deviation in the abnormal set is calculated. The standard deviation is compared with the preset standard deviation value, and whether there is a problem with the system operation is determined based on the comparison result;

[0120] A number of abnormal coefficients are used to establish a data set and calibrated as N, then N = {OF d}, where d = {1, 2, 3…u}, u is a positive integer;

[0121] And calculate the standard deviation of several abnormal coefficients in the data set, and calibrate the standard deviation of several abnormal coefficients in the data set as xstg, and compare the calculated standard deviation xstg with the preset standard deviation value xstjk;

[0122] If the calculated standard deviation xstg is not less than the preset standard deviation value xstjk, an alarm signal is issued;

[0123] If the calculated standard deviation xstg is less than the preset standard deviation value xstjk, no alarm signal is issued.

[0124] The calculation formula of standard deviation xstg is as follows:

[0125]

[0126] Among them, the value of the preset standard deviation value xstjk is set according to the actual situation.

[0127] Optionally, the preset standard deviation value xstjk is set to 0.5-1.5.

[0128] Preferably, the preset standard deviation value xstjk is set to 1.0.

[0129] When an alarm signal is issued, it means that the network security model comprehensive evaluation system cannot adjust and learn itself in time according to environmental changes, which may cause loopholes in the evaluation results of the network security model, resulting in low accuracy of the evaluation results of the network security model. Therefore, an alarm can be issued in time to remind staff to take measures for the network security model comprehensive evaluation system in time, so that the network security model comprehensive evaluation system can evaluate the network security model with high accuracy.

[0130] In the application, the moment when the environment changes refers to when the environment outside the security network model changes. When the environment in which the default security network model is located changes, the system can perceive it; the current moment refers to the moment when the environment in which the security network model is located changes to the moment when the security network model is currently running.

[0131] Based on the same inventive concept, an embodiment of the present invention also provides a network security model comprehensive evaluation system.

[0132] See also Figure 2 , Figure 2 A framework diagram of a network security model comprehensive evaluation system provided by an embodiment of the present invention, the network security model comprehensive evaluation system includes:

[0133] Time division module: obtains the time interval from when the environment in which the network security model is located is changed to the current moment, obtains the target time interval, and divides the target time interval according to the preset window to obtain several sub-intervals;

[0134] Intelligence response delay module: obtains the time data and response time data of the system updating threat intelligence in real time in each sub-interval, and obtains the intelligence response delay coefficient based on the time data and response time data of updating threat intelligence;

[0135] Data processing difference module: obtains the real-time detection data quantity information of the system in each sub-interval, and obtains the data processing difference coefficient according to the detection data quantity information;

[0136] Signal unavailable module: obtains the network signal data of the system in each sub-interval during operation, and obtains the signal unavailable coefficient based on the network signal data;

[0137] Adaptive module: obtains the adaptive coefficient of each sub-interval according to the intelligence response delay coefficient, data processing difference coefficient and signal unavailable coefficient in each sub-interval;

[0138] Alarm module: Establish an adaptive coefficient set based on the adaptive coefficients in all sub-intervals, and filter out all abnormal coefficients in the adaptive coefficient set, and establish an abnormal set for all abnormal coefficients, and calculate the standard deviation in the abnormal set, and compare the calculated standard deviation with the preset standard deviation value, and issue an alarm signal based on the comparison result.

[0139] Beneficial effects of the present invention:

[0140] The present invention proposes an evaluation method for a network security model comprehensive evaluation system and a network security model comprehensive evaluation system. The adaptive coefficient of the sub-interval is obtained by acquiring the intelligence response delay coefficient, the data processing difference coefficient and the signal unavailable coefficient in each sub-interval. An adaptive coefficient set is established according to the adaptive coefficients in all sub-intervals, and all abnormal coefficients in the adaptive coefficient set are screened out, and an abnormal set is established for all abnormal coefficients. The standard deviation in the abnormal set is calculated, and the standard deviation is compared with a preset standard deviation value. The adaptive ability of the network security model comprehensive evaluation system is judged according to the comparison result. In this way, an alarm can be issued in time to remind the staff that there are loopholes in the evaluation results of the network security model by the network security model comprehensive evaluation system, which may cause the evaluation results of the network security model to be less accurate, and timely measures need to be taken to make the evaluation results of the network security model more accurate.

[0141] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.

Claims

1. An evaluation method for a network security model comprehensive evaluation system, characterized in that: The evaluation method of the network security model comprehensive evaluation system comprises the following steps: Obtain the change time of the environment in which the network security model is located; Obtaining a time interval between the replacement time and the current time as a target time interval; Dividing the target time interval to obtain multiple sub-intervals; Obtain the intelligence response delay coefficient, data processing difference coefficient and signal unavailability coefficient of each sub-interval; The intelligence response delay coefficient, data processing difference coefficient and signal unavailable coefficient of each sub-interval are weighted and summed to calculate the adaptive coefficient of each sub-interval; Establishing an adaptive coefficient set, wherein the adaptive coefficient set includes adaptive coefficients of all subintervals; Screening abnormal coefficients in the adaptive coefficient set; The multiple abnormal coefficients obtained by screening are used to establish an abnormal set; The standard deviation of the multiple abnormal coefficients in the abnormal set is calculated, the calculated standard deviation is compared with a preset standard deviation value, and an alarm signal is issued according to the comparison result.

2. The evaluation method of the network security model comprehensive evaluation system according to claim 1 is characterized in that: The method for obtaining the intelligence response delay coefficient in each sub-interval specifically includes: Get the update time Q of threat intelligence in each sub-interval 更 y and the corresponding response time Q 响 y ; Wherein, y represents a number, y=1, 2, 3, 4, ..., m, m is the number of numbers and is a positive integer; The intelligence response delay coefficient is calculated using the following formula: Where RF is the intelligence response delay coefficient.

3. The evaluation method of the network security model comprehensive evaluation system according to claim 1 is characterized in that: The method for obtaining the data processing difference coefficient in each sub-interval specifically includes: The data processing coefficient of variation was calculated using the following formula: Dax=a1×YD+a2×Wn; Wherein, Dax is the data processing difference coefficient, a1 is the preset weight coefficient of the data detection missing coefficient, a2 is the preset weight coefficient of the data processing time error coefficient; YD is the data detection missing coefficient, Wn is the data processing time error coefficient; Among them, YD is calculated using the following formula: In the formula, S 实 l S is the number of data corresponding to the network security model detected. 预 l is the number of data corresponding to the preset network security model that needs to be detected; l represents the number of moments, l=1, 2, 3, 4, ..., h, h is a positive integer; Among them, Wn is calculated using the following formula: Wn=ln(j / c+1) The specific value of c is obtained by the following method: Get the number of data corresponding to the network security model processed by the system at different times in each sub-interval and mark it as Q 实 f , f represents the number of data corresponding to the network security model processed by the system, f = 1, 2, 3, 4, ..., c, c is the total number of data corresponding to the network security model processed by the system at different times in each sub-interval, and c is a positive integer; The following method is used to obtain the specific value of j: Q 实 f Within the range of the amount of data that can be effectively processed by the preset data system [D 少 , D 多 ] are re-labeled as E a , a represents Q 实 f Within the range of the amount of data that can be effectively processed by the preset data system [D 少 , D 多 ], a=1, 2, 3, 4, ..., j, j is Q 实 f Within the range of the amount of data that can be effectively processed by the preset data system [D 少 , D 多 ], j is a positive integer; D 少 The minimum amount of data that can be effectively processed by the preset data system, D 多 The maximum amount of data that can be efficiently processed by a given data system.

4. The evaluation method of the network security model comprehensive evaluation system according to claim 1 is characterized in that: The method for obtaining the signal unavailable coefficient in each sub-interval specifically includes: The signal unavailability coefficient is calculated using the following formula: Bvy=b1×WD+b2×Uj; Wherein, Bvy is the signal unavailable coefficient, b1 represents the preset weight coefficient of the network line number instability coefficient, b2 represents the preset weight coefficient of the network line number failure coefficient; WD represents the network line number instability coefficient, and Uj represents the network line number failure coefficient; Among them, WD is calculated using the following formula: In the formula, is the average value of the actual network signal at different times within T time, and the expression obtained is: Get the actual network signal of the system at different times during operation in each sub-interval, and mark the actual network signal as X 实 p , p represents the number of the actual network signal when the system is running, p = 1, 2, 3, 4, ..., g, g is the sequence number of the actual network signal, and g is a positive integer; Among them, Uj is calculated using the following formula: Uj=A / g The specific value of A is obtained by the following method: The actual network signal of the system at different times in each sub-interval is less than the preset minimum threshold value Fd of the effective network signal, and is re-marked as S v , v represents the number of times the actual network signal is less than the preset minimum threshold value Fd of the effective network signal, a=1, 2, 3, 4, ..., A, A is the total number of times the actual network signal is less than the preset minimum threshold value Fd of the effective network signal, A is a positive integer; g is the sequence number of the actual network signal.

5. The evaluation method of the network security model comprehensive evaluation system according to claim 1 is characterized in that: The method of calculating the adaptive coefficient of each sub-interval by weighted summing the intelligence response delay coefficient, the data processing difference coefficient and the signal unavailable coefficient of each sub-interval specifically comprises the following steps: The adaptive coefficient of each sub-interval is calculated using the following formula: Wherein, YgHt is the adaptive coefficient, RF is the intelligence response delay coefficient, Dax is the data processing difference coefficient, Bvy is the signal unavailable coefficient, α is the preset proportional coefficient of the intelligence response delay coefficient, β is the preset proportional coefficient of the data processing difference coefficient, γ is the preset proportional coefficient of the signal unavailable coefficient, and α, β, and γ are all greater than 0.

6. The evaluation method of the network security model comprehensive evaluation system according to claim 1 is characterized in that: The method for screening abnormal coefficients in the adaptive coefficient set specifically includes: When the adaptive coefficient is not less than a preset adaptive coefficient reference threshold, the adaptive coefficient is marked as an abnormal coefficient; When the adaptive coefficient is less than a preset adaptive coefficient reference threshold, the adaptive coefficient is marked as a normal coefficient.

7. The evaluation method of the network security model comprehensive evaluation system according to claim 1 is characterized in that: The method of comparing the calculated standard deviation with the preset standard deviation value and issuing an alarm signal according to the comparison result specifically includes: When the calculated standard deviation is not less than the preset standard deviation value, an alarm signal is issued; When the calculated standard deviation is less than the preset standard deviation value, no alarm signal is issued.

8. A network security model comprehensive evaluation system, characterized in that: The network security model comprehensive evaluation system includes: Time division module: obtains the time interval from the change time to the current time of the environment where the network security model is located, obtains the target time interval, and divides the target time interval according to the preset window to obtain multiple sub-intervals; Intelligence response delay module: obtains the time data and response time data of the system updating threat intelligence in real time in each sub-interval, and obtains the intelligence response delay coefficient in each sub-interval based on the time data and response time data of updating threat intelligence; Data processing difference module: obtains the real-time detection data quantity information of the system in each sub-interval, and obtains the data processing difference coefficient in each sub-interval according to the detection data quantity information; Signal unavailable module: obtains the network signal data of the system in each sub-interval during operation, and obtains the signal unavailable coefficient in each sub-interval based on the network signal data; Adaptive module: obtains the adaptive coefficient in each sub-interval according to the intelligence response delay coefficient, data processing difference coefficient and signal unavailable coefficient in each sub-interval; Alarm module: establish an adaptive coefficient set based on the adaptive coefficients in all sub-intervals, filter out all abnormal coefficients in the adaptive coefficient set, and establish an abnormal set for all abnormal coefficients, calculate the standard deviation of multiple abnormal coefficients in the abnormal set, and compare the calculated standard deviation with the preset standard deviation value, and issue an alarm signal based on the comparison result.

Images