Enterprise network security self-checking method and system

Abstract

The invention belongs to the technical field of network security, and discloses an enterprise network security self-checking method and system, and the method comprises the steps: collecting network flow data, equipment parameter data, user behavior data and security situation awareness data; preprocessing the collected network traffic data, equipment parameter data and user behavior data to obtain a network traffic feature data set, an equipment feature data set, a user behavior feature data set and a security situation awareness feature data set; fusing the network traffic feature data set, the equipment feature data set, the user behavior feature data set and the security situation awareness feature data set to obtain a comprehensive feature data set; training according to the comprehensive feature data set to obtain a network security prediction model, and predicting through the network security prediction model to obtain an enterprise network security state; the possibility of occurrence of network security events is reduced, response delay caused by human intervention is reduced through an automatic process, and the detection efficiency is greatly improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and more specifically, to a method and system for self-checking network security of an enterprise. Background Art

[0002] The patent application with the publication number CN117040763A discloses a simple network security detection method for consumer IoT products, which involves the field of simple network security detection technology and includes the following steps: identity authentication and access control: by reviewing the code, confirm whether the product has implemented the appropriate identity authentication and access control mechanism; in addition to being able to reduce the cost of outsourcing detection to a certain extent for the R&D and manufacturing companies of consumer IoT products, establish internal self-inspection capabilities, especially to meet the confidentiality requirements of more companies for their own products. More companies can use this solution to establish their own network security detection capabilities, quickly establish and improve the network security requirements of consumer IoT products in applications through a systematic, simple and efficient verification method, quickly form a complete network security product solution for consumer IoT products, and improve the internal network security development system of the company.

[0003] Currently, there are several major problems: In a complex network environment, the lack of cluster analysis may make it difficult to detect potential security risks, thereby increasing the possibility of attackers hiding in the network, causing enterprises to face greater security risks; existing technologies that do not dynamically adjust the number of clusters may not be able to adapt to changes in data characteristics and the number of data points, which will lead to distorted analysis results and fail to reflect the true network security status; Failure to automatically adjust the fuzzy factor according to the number of clusters and changes in data points may make it impossible to quickly adapt to changes in different network environments and attack modes, affecting the effectiveness of overall security protection; the lack of a strict membership judgment mechanism may lead to misclassification of data points, increase misjudgment of potential threats, and make security decisions based on inaccurate data, which may lead to major security incidents; the accuracy of clustering will be affected, making the analysis results unreliable and unable to provide strong support for the formulation of security policies; The lack of evaluation standards with quantitative indicators makes the judgment of network security status subjective and easily influenced by personal experience and prejudice, resulting in inaccurate security management; failure to increase the monitoring frequency of abnormal behavior will lead to delayed detection of potential threats, and failure to timely update log records, access control and security audit strategies will cause security protection measures to lag behind, making it impossible to flexibly respond to changes in the network environment and emerging security threats.

[0004] In view of this, the present invention proposes an enterprise network security self-check method and system to solve the above problems. Summary of the invention

[0005] In order to overcome the above-mentioned defects of the prior art and to achieve the above-mentioned purpose, the present invention provides the following technical solution: an enterprise network security self-checking method, comprising: S1. Collect network traffic data, device parameter data, user behavior data and security situation awareness data; S2. Preprocess the collected network traffic data, device parameter data, user behavior data, and security situation awareness data to obtain a network traffic feature data set, a device feature data set, a user behavior feature data set, and a security situation awareness feature data set; S3, integrating the network traffic feature data set, the device feature data set, the user behavior feature data set and the security situation awareness feature data set to obtain a comprehensive feature data set; training a network security prediction model based on the comprehensive feature data set, and predicting the network security status of the enterprise through the network security prediction model; S4. Compare the predicted enterprise network security status with a preset enterprise network security status threshold to determine whether the enterprise network security status is abnormal; S5. If the enterprise network security status is normal, the network security self-checking terminal generates status stability information and enters the continuous monitoring mode; if the enterprise network security status is abnormal, the network security self-checking terminal automatically collects abnormal network security status data and matches it with the security situation awareness feature data to determine whether the abnormal network security status data is consistent with the security situation awareness data; S6. If the abnormal network security status data is consistent with the security situation awareness data, the network security self-inspection terminal issues an early warning instruction corresponding to the security situation awareness data and generates a network security response strategy; if the abnormal network security status data is inconsistent with the security situation awareness data, the network security status severity level is evaluated through the abnormal status assessment model, and the network security response strategy is updated.

[0006] Furthermore, the network traffic data includes the enterprise's network protocol type, data packet size, number of data packets, traffic speed, traffic time and traffic path; the device parameter data includes the device startup time, the number of fault records and the status of the device's open network ports; the user behavior data includes the user's login time, the duration of each user login, the user's IP address, the number of files accessed within a period of w and the number of login failures; the security situation awareness data includes the number of network system vulnerabilities, the types of network system vulnerabilities, the malicious IP list, the number of malware executions and the internal abnormal data packet traffic.

[0007] Furthermore, the method of preprocessing the collected network traffic data, device parameter data, user behavior data, and security situation awareness data to obtain a network traffic feature data set, a device feature data set, a user behavior feature data set, and a security situation awareness feature data set includes: The outliers in network traffic data, device parameter data, user behavior data and security situation awareness data are identified and eliminated through the Laida criterion method, and the missing values ​​in network traffic data, device parameter data, user behavior data and security situation awareness data are filled through the forward filling method to obtain the processed network traffic feature data set, device feature data set, user behavior feature data set and security situation awareness feature data set; The processed network traffic feature data set, device feature data set, user behavior feature data set and security situation awareness feature data set are subjected to standard deviation normalization and converted into standard normal distribution, and finally the normalized network traffic feature data set, device feature data set, user behavior feature data set and security situation awareness feature data set are obtained.

[0008] Furthermore, the method of fusing the network traffic feature data set, the device feature data set, the user behavior feature data set and the security situation awareness feature data set to obtain a comprehensive feature data set includes: The network traffic feature dataset, device feature dataset, user behavior feature dataset and security situation awareness feature dataset are fused through a weighted model to form a comprehensive feature dataset. The network traffic feature dataset is recorded as , the device feature dataset is recorded as , the user behavior feature dataset is recorded as , the security situation awareness feature dataset is recorded as ; The weighted model is: ; in, is the weight coefficient of the network traffic feature dataset; is the weight coefficient of the device feature data set; is the weight coefficient of the user behavior feature dataset; is the weight coefficient of the security situation awareness feature dataset.

[0009] Furthermore, the training method of the network security prediction model includes: The data set is divided into a training set, a validation set and a test set to build a network security prediction model; the sample set is a subset of the data set, and each sample set includes a historical comprehensive feature data set and the corresponding enterprise network security status; the network security prediction model includes an input layer, a fully connected hidden layer and an output layer; The input layer of the model is used to input the historical comprehensive feature data set, and the output layer of the model is used to output the enterprise network security status; the output layer uses the Sigmoid activation function to generate classification probabilities; the network security prediction model is a fully connected neural network model; binary cross entropy is used as the loss function to measure the error of model prediction; Use the training set data to train the model and minimize the loss function through the Adam optimizer; use the validation set to evaluate the performance of the model and tune the model's hyperparameters until the model performance no longer improves significantly or reaches the preset stopping condition, thus obtaining a trained network security prediction model; input the current comprehensive data set into the trained network security prediction model to obtain the enterprise network security status.

[0010] Furthermore, the method of comparing the predicted enterprise network security status with a preset enterprise network security status threshold to determine whether the enterprise network security status is abnormal includes: If the predicted enterprise network security status is less than the preset enterprise network security status threshold, the enterprise network security status is determined to be normal; If the predicted enterprise network security status is greater than or equal to a preset enterprise network security status threshold, the enterprise network security status is determined to be abnormal.

[0011] Furthermore, if the enterprise network security status is abnormal, the network security self-checking terminal automatically collects abnormal network security status data and matches it with the security situation awareness feature data. The method for determining whether the abnormal network security status data is consistent with the security situation awareness data includes: The abnormal network security status data includes abnormal protocol type, abnormal traffic speed, duplicate data packets, packet loss rate, number of device crashes, abnormal login time and number of malware executions; S71, performing standard deviation normalization processing on the abnormal network security status data and the security situation awareness data to convert them into a standard normal distribution; clustering the abnormal network security status data and the security situation awareness data by using an improved fuzzy C-means clustering algorithm, and determining the range of the number of clusters by using a cluster selection formula; The cluster selection formula is: ; in, is the maximum number of clusters that can be selected; The total number of data points in the abnormal network security status data and security situation awareness data; The data feature types in abnormal network security status data and security situation awareness data; is a constant factor that controls the upper limit of the number of clusters; is the rounding function; S72, calculating the total square error under the determined number of clusters by using the aggregation metric calculation formula, and evaluating the aggregation metric of the clusters; The aggregation metric calculation formula is: ; in, is the total square error value under the determined number of clusters; is the number of clusters identified; is the cluster index, ranging from 1 to ; For clustering The set of data points in ; It is the first in the abnormal network security status data and security situation awareness data. data points; is the index of the data point; For clustering the center of For data points With cluster center The square of the Euclidean distance between them; The number of different clusters Corresponding The values ​​are plotted as a line graph, with the horizontal axis being the number of clusters , the vertical axis is Value; in the line chart, observe As the number of clusters increases, we look for the inflection point, i.e. The position where it begins to stabilize, the number of clusters corresponding to the inflection point As the final number of clusters; S73, dynamically adjusting the fuzzy factor required for clustering through a fuzzy factor adjustment formula, and automatically adjusting the degree of fuzziness according to changes in the number of clusters and the number of data points; the fuzzy factor adjustment formula is: ; in, is the fuzzy factor for controlling the fuzziness of membership; is the final number of clusters; is the number of data points that need to be clustered; S74. Calculate the data points in the abnormal network security status data and security situation awareness data through the membership calculation formula Clustering The membership degree of is: ; in, For data points Clustering The degree of membership; For data points To cluster center The Euclidean distance of For data points To Cluster Centers The Euclidean distance of The data points To cluster center The Euclidean distance The calculation formula is: ; in, For data points No. Features is the cluster center No. Features By calculating each , the membership of all data points in the abnormal network security status data and security situation awareness data are combined into a membership matrix , the size of the matrix is ,Right now: ; in, For data points Clustering The degree of membership; S75. Determine whether the membership of each data point to the cluster meets the clustering standard through the membership judgment formula, and update the membership matrix ; The membership judgment formula is: ; in, For clustering The number of data points in ; when ,Right now When , it is determined that the membership of each data point to the cluster meets the clustering standard; when ,Right now When , it is determined that the membership of each data point to the cluster does not meet the clustering standard; S76. According to the final membership matrix , determine the cluster type to which each data point belongs, and select the cluster with the largest membership as the classification of the data point; compare the clustering results of abnormal network security status data and security situation awareness data; If the clustering results of the abnormal network security status data and the security situation awareness data are the same, it is determined that the abnormal network security status data is consistent with the security situation awareness data; if the clustering results of the abnormal network security status data and the security situation awareness data are different, it is determined that the abnormal network security status data is inconsistent with the security situation awareness data.

[0012] Furthermore, if the abnormal network security state data is consistent with the security situation awareness data, the network security self-checking terminal issues a warning instruction corresponding to the security situation awareness data, and the method for generating a network security response strategy includes: According to the early warning instructions issued by the network security self-inspection terminal, corresponding protection measures are automatically implemented, and the corresponding protection measures include blocking suspicious IP access and adjusting firewall rules; abnormal network security status data and corresponding protection measures information are recorded and uploaded to the network security self-inspection terminal, and relevant staff are notified to cooperate with the network security self-inspection terminal to carry out continuous network security monitoring.

[0013] Furthermore, if the abnormal network security status data is inconsistent with the security situation awareness data, the method of evaluating the severity level of the network security status through the abnormal status evaluation model and updating the network security response strategy includes: The network security status severity level is evaluated by an abnormal status evaluation model, and the abnormal status evaluation model is: ; in, is the abnormal network security status assessment coefficient; For time Abnormal flow rate under For time The number of duplicate packets under is the packet loss rate; Abnormal login time; The number of device crashes; The time required to assess abnormal network security status; is the weight factor of abnormal traffic speed; is the weight factor for the number of duplicate packets; is the weight factor of packet loss rate; is the weight factor of abnormal login time; is the weight factor of the number of device crashes; The abnormal network security status assessment coefficient threshold is preset, and the abnormal network security status assessment coefficient threshold is further divided into a low-level abnormal network security status assessment coefficient threshold , Intermediate abnormal network security status assessment coefficient threshold and advanced abnormal network security status assessment coefficient threshold ; when When the network security status is judged as low, the log recording strategy is updated and the monitoring frequency of abnormal behavior is increased; when When the network security status is judged to be medium, the access control policy is updated to restrict the access rights of suspicious devices; when When the network security status is judged to be high severity, a comprehensive security audit is initiated to check all device parameters and network traffic; When the network security self-check terminal automatically controls and starts the network shutdown program.

[0014] An enterprise network security self-checking system, comprising: Data collection module, used to collect network traffic data, device parameter data, user behavior data and security situation awareness data; A data processing module is used to pre-process the collected network traffic data, device parameter data, user behavior data, and security situation awareness data to obtain a network traffic feature data set, a device feature data set, a user behavior feature data set, and a security situation awareness feature data set; The network security prediction module is used to integrate the network traffic feature data set, the device feature data set, the user behavior feature data set and the security situation awareness feature data set to obtain a comprehensive feature data set; the network security prediction model is obtained by training the comprehensive feature data set, and the network security status of the enterprise is predicted by the network security prediction model; A network security assessment module is used to compare the predicted enterprise network security status with a preset enterprise network security status threshold to determine whether the enterprise network security status is abnormal; The network security initial self-check module: if the enterprise network security status is normal, the network security self-check terminal generates status stability information and enters the continuous monitoring mode; if the enterprise network security status is abnormal, the network security self-check terminal automatically collects abnormal network security status data and matches it with the security situation awareness feature data to determine whether the abnormal network security status data is consistent with the security situation awareness data; The network security terminal self-inspection module, if the abnormal network security status data is consistent with the security situation awareness data, the network security self-inspection terminal will issue an early warning instruction corresponding to the security situation awareness data and generate a network security response strategy; if the abnormal network security status data is inconsistent with the security situation awareness data, the network security status severity level will be evaluated through the abnormal status assessment model, and the network security response strategy will be updated; each module is connected by wired and / or wireless means.

[0015] The technical effects and advantages of the enterprise network security self-checking method and system of the present invention are as follows: The present invention can effectively identify the consistency or inconsistency between abnormal network security status data and security situation awareness data by clustering the two; it is helpful to accurately judge potential security risks in a complex network environment; the number of clusters is dynamically adjusted according to data characteristics and the number of data points to ensure that cluster analysis can adapt to different network security status data and security situation awareness data, and ensure that each cluster can effectively represent the information in the data, avoiding information loss or noise interference caused by too many or too few clusters; Combined with the improved fuzzy C-means clustering algorithm, it can better handle fuzziness and uncertainty, improve the detection ability of abnormal states, and reduce the probability of false positives and false negatives; automatically adjust the fuzzy factor according to the changes in the number of clusters and data points, enhance the system's adaptability to different network environments and attack modes, and maintain efficient detection performance; through strict membership judgment, data points can be more accurately assigned to appropriate clusters to avoid misclassification, thereby improving the overall accuracy of clustering; The evaluation coefficient in the abnormal state evaluation model provides a quantitative indicator for the abnormal network security state, so that the network security state can be objectively evaluated through numerical values, which is convenient for management and analysis; increasing the monitoring frequency of abnormal behavior makes the detection of potential threats more timely and effective, and enhances the overall network security situation awareness capability; timely updating the logging strategy, access control strategy and security audit strategy according to the evaluation results can quickly respond to potential security threats and reduce the risk of loss. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A schematic diagram of a process flow of an enterprise network security self-checking method of the present invention; Figure 2 The present invention is a schematic diagram of the structure of an enterprise network security self-checking system. DETAILED DESCRIPTION

[0017] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0018] Example 1 See also Figure 1 and Figure 2 As shown, this embodiment provides an enterprise network security self-check method, including: S1. Collect network traffic data, device parameter data, user behavior data and security situation awareness data; S2. Preprocess the collected network traffic data, device parameter data, user behavior data, and security situation awareness data to obtain a network traffic feature data set, a device feature data set, a user behavior feature data set, and a security situation awareness feature data set; S3, integrating the network traffic feature data set, the device feature data set, the user behavior feature data set and the security situation awareness feature data set to obtain a comprehensive feature data set; training a network security prediction model based on the comprehensive feature data set, and predicting the network security status of the enterprise through the network security prediction model; S4. Compare the predicted enterprise network security status with a preset enterprise network security status threshold to determine whether the enterprise network security status is abnormal; S5. If the enterprise network security status is normal, the network security self-checking terminal generates status stability information and enters the continuous monitoring mode; if the enterprise network security status is abnormal, the network security self-checking terminal automatically collects abnormal network security status data and matches it with the security situation awareness feature data to determine whether the abnormal network security status data is consistent with the security situation awareness data; S6. If the abnormal network security status data is consistent with the security situation awareness data, the network security self-inspection terminal issues an early warning instruction corresponding to the security situation awareness data and generates a network security response strategy; if the abnormal network security status data is inconsistent with the security situation awareness data, the network security status severity level is evaluated through the abnormal status assessment model, and the network security response strategy is updated.

[0019] Network traffic data includes the enterprise's network protocol type, packet size, number of packets, traffic speed, traffic time and traffic path; device parameter data includes device startup time, number of fault records and status of device open network ports; user behavior data includes user login time, duration of each user login, user IP address, number of files accessed within w period and number of login failures; security situation awareness data includes number of network system vulnerabilities, types of network system vulnerabilities, malicious IP list, number of malware executions and internal abnormal packet traffic.

[0020] The enterprise's network protocol type and data packet size are obtained through the Wireshark tool; the number of data packets and flow rate are obtained through the SNMP network management protocol; the flow time is obtained through the NetFlow flow analysis tool; the flow path is obtained through the network detector; The device startup time is obtained through the operating system records; the number of fault records is obtained through the network monitoring tool Nagios; the status of the device's open network ports is obtained through the port scanning tool Nmap scanning; The user's login time is obtained through the operating system's security log; the duration of each user login is obtained through the operating system's audit log; the user's IP address is obtained through the Web server log; the number of files accessed within a period of time is obtained through the file system's access log; the number of login failures is obtained through the application's security log; The number of network system vulnerabilities is obtained through scanning with the vulnerability scanning tool OpenVAS; the types of network system vulnerabilities are obtained through analysis with vulnerability management tools; the malicious IP list is obtained through the third-party threat intelligence service AlienVault; the number of malware executions is obtained through SIEM system analysis log detection; and internal abnormal data packet traffic is obtained through the NetFlow traffic analysis tool.

[0021] The method of preprocessing the collected network traffic data, device parameter data, user behavior data and security situation awareness data to obtain a network traffic feature data set, a device feature data set, a user behavior feature data set and a security situation awareness feature data set includes: The outliers in network traffic data, device parameter data, user behavior data and security situation awareness data are identified and eliminated through the Laida criterion method, and the missing values ​​in network traffic data, device parameter data, user behavior data and security situation awareness data are filled through the forward filling method to obtain the processed network traffic feature data set, device feature data set, user behavior feature data set and security situation awareness feature data set; The processed network traffic feature data set, device feature data set, user behavior feature data set and security situation awareness feature data set are subjected to standard deviation normalization and converted into standard normal distribution, and finally the normalized network traffic feature data set, device feature data set, user behavior feature data set and security situation awareness feature data set are obtained.

[0022] The method of integrating the network traffic feature data set, the device feature data set, the user behavior feature data set and the security situation awareness feature data set to obtain a comprehensive feature data set includes: The network traffic feature dataset, device feature dataset, user behavior feature dataset and security situation awareness feature dataset are fused through a weighted model to form a comprehensive feature dataset. The network traffic feature dataset is recorded as , the device feature dataset is recorded as , the user behavior feature dataset is recorded as , the security situation awareness feature dataset is recorded as ; The weighted model is: ; in, is the weight coefficient of the network traffic feature dataset; is the weight coefficient of the device feature data set; is the weight coefficient of the user behavior feature dataset; is the weight coefficient of the security situation awareness feature dataset.

[0023] The training methods of cybersecurity prediction models include; The data set is divided into a training set, a validation set and a test set to build a network security prediction model; the sample set is a subset of the data set, and each sample set includes a historical comprehensive feature data set and the corresponding enterprise network security status; the network security prediction model includes an input layer, a fully connected hidden layer and an output layer; The input layer of the model is used to input the historical comprehensive feature data set, and the output layer of the model is used to output the enterprise network security status; the output layer uses the Sigmoid activation function to generate classification probabilities; the network security prediction model is a fully connected neural network model; Use binary cross entropy as the loss function to measure the error of model prediction; the binary cross entropy loss function is: ; in, is the number of data sets; For the The true label of each sample is either positive or negative. For the The predicted probability that a sample is classified as the positive class; Use the training set data to train the model and minimize the loss function through the Adam optimizer; use the validation set to evaluate the performance of the model and tune the model's hyperparameters until the model performance no longer improves significantly or reaches the preset stopping condition, thus obtaining a trained network security prediction model; input the current comprehensive data set into the trained network security prediction model to obtain the enterprise network security status.

[0024] The method of comparing the predicted enterprise network security status with the preset enterprise network security status threshold to determine whether the enterprise network security status is abnormal includes: If the predicted enterprise network security status is less than the preset enterprise network security status threshold, the enterprise network security status is determined to be normal; If the predicted enterprise network security status is greater than or equal to a preset enterprise network security status threshold, the enterprise network security status is determined to be abnormal.

[0025] If the enterprise network security status is abnormal, the network security self-check terminal automatically collects abnormal network security status data and matches it with the security situation awareness feature data. The method for determining whether the abnormal network security status data is consistent with the security situation awareness data includes: Abnormal network security status data includes abnormal protocol types, abnormal traffic speeds, duplicate data packets, packet loss rates, number of device crashes, abnormal login times, and number of malware executions; S71, performing standard deviation normalization processing on the abnormal network security status data and the security situation awareness data to convert them into a standard normal distribution; clustering the abnormal network security status data and the security situation awareness data by using an improved fuzzy C-means clustering algorithm, and determining the range of the number of clusters by using a cluster selection formula; The cluster selection formula is: ; in, is the maximum number of clusters that can be selected; The total number of data points in the abnormal network security status data and security situation awareness data; The data feature types in abnormal network security status data and security situation awareness data; is a constant factor that controls the upper limit of the number of clusters; is the rounding function; For example, the total number of data points in abnormal network security status data and security situation awareness data =100, data feature types in abnormal network security status data and security situation awareness data There are 16 types of constant factors that control the upper limit of the number of clusters If 2 is the maximum number of clusters that can be selected About 4.

[0026] S72, calculating the total square error under the determined number of clusters by using the aggregation metric calculation formula, and evaluating the aggregation metric of the clusters; The aggregate measure calculation formula is: ; in, is the total square error value under the determined number of clusters; is the number of clusters identified; is the cluster index, ranging from 1 to ; For clustering The set of data points in ; It is the first in the abnormal network security status data and security situation awareness data. data points; is the index of the data point; For clustering the center of For data points With cluster center The square of the Euclidean distance between them; The number of different clusters Corresponding The values ​​are plotted as a line graph, with the horizontal axis being the number of clusters , the vertical axis is Value; in the line chart, observe As the number of clusters increases, we look for the inflection point, i.e. The position where it begins to stabilize, the number of clusters corresponding to the inflection point As the final number of clusters; S73. Dynamically adjust the fuzzy factor required for clustering through a fuzzy factor adjustment formula, and automatically adjust the degree of fuzziness according to changes in the number of clusters and the number of data points; the fuzzy factor adjustment formula is: ; in, is the fuzzy factor for controlling the fuzziness of membership; is the final number of clusters; is the number of data points that need to be clustered; For example, the final number of clusters 8, the number of data points that need to be clustered is 120, then the fuzzy factor that controls the fuzziness of the membership About 2.44.

[0027] S74. Calculate the data points in the abnormal network security status data and security situation awareness data through the membership calculation formula Clustering The membership degree of ; the membership degree calculation formula is: ; in, For data points Clustering The degree of membership; For data points To cluster center The Euclidean distance of For data points To Cluster Centers The Euclidean distance of Data Points To cluster center The Euclidean distance The calculation formula is: ; in, For data points No. Features is the cluster center No. Features By calculating each , the membership of all data points in the abnormal network security status data and security situation awareness data are combined into a membership matrix , the size of the matrix is ,Right now: ; in, For data points Clustering The degree of membership; S75. Determine whether the membership of each data point to the cluster meets the clustering standard through the membership judgment formula, and update the membership matrix ; The membership judgment formula is: ; in, For clustering The number of data points in ; when ,Right now When , it is determined that the membership of each data point to the cluster meets the clustering standard; when ,Right now When , it is determined that the membership of each data point to the cluster does not meet the clustering standard; For example, clustering The number of data points in 30, the total number of data points in abnormal network security status data and security situation awareness data is 100, then when the data point Clustering Membership When it is greater than or equal to 0.3, Directly assign a value of 1 to determine that the membership of each data point to the cluster meets the clustering standard; when When it is less than 0.3, The value is assigned to 0, and it is determined that the membership of each data point to the cluster does not meet the clustering standard.

[0028] S76. According to the final membership matrix , determine the cluster type to which each data point belongs, and select the cluster with the largest membership as the classification of the data point; compare the clustering results of abnormal network security status data and security situation awareness data; If the clustering results of the abnormal network security status data and the security situation awareness data are the same, it is determined that the abnormal network security status data is consistent with the security situation awareness data; if the clustering results of the abnormal network security status data and the security situation awareness data are different, it is determined that the abnormal network security status data is inconsistent with the security situation awareness data.

[0029] If the abnormal network security status data is consistent with the security situation awareness data, the network security self-checking terminal issues an early warning instruction corresponding to the security situation awareness data, and the method for generating a network security response strategy includes: According to the early warning instructions issued by the network security self-inspection terminal, corresponding protection measures are automatically implemented, including blocking suspicious IP access and adjusting firewall rules; abnormal network security status data and corresponding protection measures information are recorded and uploaded to the network security self-inspection terminal, and relevant staff are notified to cooperate with the network security self-inspection terminal to carry out continuous network security monitoring.

[0030] If the abnormal network security status data is inconsistent with the security situation awareness data, the method of evaluating the severity level of the network security status through the abnormal status assessment model and updating the network security response strategy includes: The severity level of network security status is evaluated through the abnormal status evaluation model. The abnormal status evaluation model is: ; in, is the abnormal network security status assessment coefficient; For time Abnormal flow rate under For time The number of duplicate packets under is the packet loss rate; Abnormal login time; The number of device crashes; The time required to assess abnormal network security status; is the weight factor of abnormal traffic speed; is the weight factor for the number of duplicate packets; is the weight factor of packet loss rate; is the weight factor of abnormal login time; is the weight factor of the number of device crashes; The abnormal network security status assessment coefficient threshold is preset, and the abnormal network security status assessment coefficient threshold is further divided into a low-level abnormal network security status assessment coefficient threshold , Intermediate abnormal network security status assessment coefficient threshold and advanced abnormal network security status assessment coefficient threshold ; when When the network security status is judged as low, the log recording strategy is updated and the monitoring frequency of abnormal behavior is increased; when When the network security status is judged to be medium, the access control policy is updated to restrict the access rights of suspicious devices; when When the network security status is judged to be high severity, a comprehensive security audit is initiated to check all device parameters and network traffic; When the network security self-check terminal automatically controls and starts the network shutdown program.

[0031] The preset enterprise network security status threshold is set by the staff. The network security status of different enterprises is collected through the network security self-check terminal, and the average value of multiple enterprise network security statuses is taken as the preset enterprise network security status threshold; similarly, the abnormal network security status assessment coefficient threshold is set.

[0032] In this embodiment, by clustering abnormal network security status data and security situation awareness data, the consistency or inconsistency between the two can be effectively identified; it is helpful to accurately judge potential security risks in a complex network environment; the number of clusters is dynamically adjusted according to data characteristics and the number of data points to ensure that cluster analysis can adapt to different network security status data and security situation awareness data, and ensure that each cluster can effectively represent the information in the data, avoiding information loss or noise interference caused by too many or too few clusters; Combined with the improved fuzzy C-means clustering algorithm, it can better handle fuzziness and uncertainty, improve the detection ability of abnormal states, and reduce the probability of false positives and false negatives; automatically adjust the fuzzy factor according to the changes in the number of clusters and data points, enhance the system's adaptability to different network environments and attack modes, and maintain efficient detection performance; through strict membership judgment, data points can be more accurately assigned to appropriate clusters to avoid misclassification, thereby improving the overall accuracy of clustering; The evaluation coefficient in the abnormal state evaluation model provides a quantitative indicator for the abnormal network security state, so that the network security state can be objectively evaluated through numerical values, which is convenient for management and analysis; increasing the monitoring frequency of abnormal behavior makes the detection of potential threats more timely and effective, and enhances the overall network security situation awareness capability; timely updating the logging strategy, access control strategy and security audit strategy according to the evaluation results can quickly respond to potential security threats and reduce the risk of loss.

[0033] Example 2 See also Figure 2 As shown, the part not described in detail in this embodiment is described in Example 1, which provides an enterprise network security self-checking system, including: Data collection module, used to collect network traffic data, device parameter data, user behavior data and security situation awareness data; A data processing module is used to pre-process the collected network traffic data, device parameter data, user behavior data, and security situation awareness data to obtain a network traffic feature data set, a device feature data set, a user behavior feature data set, and a security situation awareness feature data set; The network security prediction module is used to integrate the network traffic feature data set, the device feature data set, the user behavior feature data set and the security situation awareness feature data set to obtain a comprehensive feature data set; the network security prediction model is obtained by training the comprehensive feature data set, and the network security status of the enterprise is predicted by the network security prediction model; A network security assessment module is used to compare the predicted enterprise network security status with a preset enterprise network security status threshold to determine whether the enterprise network security status is abnormal; The network security initial self-check module: if the enterprise network security status is normal, the network security self-check terminal generates status stability information and enters the continuous monitoring mode; if the enterprise network security status is abnormal, the network security self-check terminal automatically collects abnormal network security status data and matches it with the security situation awareness feature data to determine whether the abnormal network security status data is consistent with the security situation awareness data; The network security terminal self-inspection module, if the abnormal network security status data is consistent with the security situation awareness data, the network security self-inspection terminal will issue an early warning instruction corresponding to the security situation awareness data and generate a network security response strategy; if the abnormal network security status data is inconsistent with the security situation awareness data, the network security status severity level will be evaluated through the abnormal status assessment model, and the network security response strategy will be updated; each module is connected by wired and / or wireless means.

[0034] Since the electronic device introduced in this embodiment is an electronic device used to implement a method and system for self-checking enterprise network security in the embodiment of this application, based on the method and system for self-checking enterprise network security in the embodiment of this application, a person skilled in the art can understand the specific implementation of the electronic device of this embodiment and its various variations, so how the electronic device implements the method in the embodiment of this application is not described in detail here. As long as a person skilled in the art implements the electronic device used in the method and system for self-checking enterprise network security in the embodiment of this application, it belongs to the scope of protection of this application.

[0035] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters and thresholds in the formula are set by technicians in this field according to actual conditions.

[0036] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technical users in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A method for self-checking enterprise network security, characterized in that: include: S1. Collect network traffic data, device parameter data, user behavior data and security situation awareness data; S2. Preprocess the collected network traffic data, device parameter data, user behavior data, and security situation awareness data to obtain a network traffic feature data set, a device feature data set, a user behavior feature data set, and a security situation awareness feature data set; S3, integrating the network traffic feature data set, the device feature data set, the user behavior feature data set and the security situation awareness feature data set to obtain a comprehensive feature data set; A network security prediction model is obtained by training a comprehensive feature data set, and the network security status of the enterprise is predicted by the network security prediction model; S4. Compare the predicted enterprise network security status with a preset enterprise network security status threshold to determine whether the enterprise network security status is abnormal; S5. If the enterprise network security status is normal, the network security self-checking terminal generates status stability information and enters the continuous monitoring mode; if the enterprise network security status is abnormal, the network security self-checking terminal automatically collects abnormal network security status data and matches it with the security situation awareness feature data to determine whether the abnormal network security status data is consistent with the security situation awareness data; S6. If the abnormal network security status data is consistent with the security situation awareness data, the network security self-checking terminal issues an early warning instruction corresponding to the security situation awareness data and generates a network security response strategy; If the abnormal network security status data is inconsistent with the security situation awareness data, the network security status severity level is evaluated through the abnormal status assessment model, and the network security response strategy is updated.

2. The enterprise network security self-checking method according to claim 1, characterized in that: The network traffic data includes the enterprise's network protocol type, data packet size, number of data packets, traffic speed, traffic time and traffic path; the device parameter data includes the device startup time, the number of fault records and the status of the device's open network ports; the user behavior data includes the user's login time, the duration of each user login, the user's IP address, the number of files accessed within a period of w and the number of login failures; the security situation awareness data includes the number of network system vulnerabilities, the types of network system vulnerabilities, the malicious IP list, the number of malware executions and the internal abnormal data packet traffic.

3. The enterprise network security self-checking method according to claim 2, characterized in that: The method of preprocessing the collected network traffic data, device parameter data, user behavior data, and security situation awareness data to obtain a network traffic feature data set, a device feature data set, a user behavior feature data set, and a security situation awareness feature data set includes: The outliers in network traffic data, device parameter data, user behavior data and security situation awareness data are identified and eliminated through the Laida criterion method, and the missing values ​​in network traffic data, device parameter data, user behavior data and security situation awareness data are filled through the forward filling method to obtain the processed network traffic feature data set, device feature data set, user behavior feature data set and security situation awareness feature data set; The processed network traffic feature data set, device feature data set, user behavior feature data set and security situation awareness feature data set are subjected to standard deviation normalization and converted into standard normal distribution, and finally the normalized network traffic feature data set, device feature data set, user behavior feature data set and security situation awareness feature data set are obtained.

4. The enterprise network security self-checking method according to claim 3 is characterized in that: The method of fusing the network traffic feature data set, the device feature data set, the user behavior feature data set and the security situation awareness feature data set to obtain a comprehensive feature data set includes: The network traffic feature dataset, device feature dataset, user behavior feature dataset and security situation awareness feature dataset are fused through a weighted model to form a comprehensive feature dataset. The network traffic feature dataset is recorded as , the device feature dataset is recorded as , the user behavior feature dataset is recorded as , the security situation awareness feature dataset is recorded as ; The weighted model is: ； in, is the weight coefficient of the network traffic feature dataset; is the weight coefficient of the device feature data set; is the weight coefficient of the user behavior feature dataset; is the weight coefficient of the security situation awareness feature dataset.

5. The enterprise network security self-checking method according to claim 4, characterized in that: The training method of the network security prediction model includes: The data set is divided into a training set, a validation set and a test set to build a network security prediction model; the sample set is a subset of the data set, and each sample set includes a historical comprehensive feature data set and the corresponding enterprise network security status; the network security prediction model includes an input layer, a fully connected hidden layer and an output layer; The input layer of the model is used to input the historical comprehensive feature data set, and the output layer of the model is used to output the enterprise network security status; the output layer uses the Sigmoid activation function to generate classification probabilities; the network security prediction model is a fully connected neural network model; binary cross entropy is used as the loss function to measure the error of model prediction; Use the training set data to train the model and minimize the loss function through the Adam optimizer; use the validation set to evaluate the performance of the model and tune the model's hyperparameters until the model performance no longer improves significantly or reaches the preset stopping condition, thus obtaining a trained network security prediction model; input the current comprehensive data set into the trained network security prediction model to obtain the enterprise network security status.

6. The enterprise network security self-checking method according to claim 5, characterized in that: The method of comparing the predicted enterprise network security status with a preset enterprise network security status threshold to determine whether the enterprise network security status is abnormal includes: If the predicted enterprise network security status is less than the preset enterprise network security status threshold, the enterprise network security status is determined to be normal; If the predicted enterprise network security status is greater than or equal to a preset enterprise network security status threshold, the enterprise network security status is determined to be abnormal.

7. The enterprise network security self-checking method according to claim 6, characterized in that: If the network security status of the enterprise is abnormal, the network security self-checking terminal automatically collects abnormal network security status data and matches it with the security situation awareness feature data. The method for determining whether the abnormal network security status data is consistent with the security situation awareness data includes: The abnormal network security status data includes abnormal protocol type, abnormal traffic speed, duplicate data packets, packet loss rate, number of device crashes, abnormal login time and number of malware executions; S71, performing standard deviation normalization processing on the abnormal network security status data and the security situation awareness data to convert them into a standard normal distribution; clustering the abnormal network security status data and the security situation awareness data by using an improved fuzzy C-means clustering algorithm, and determining the range of the number of clusters by using a cluster selection formula; The cluster selection formula is: ； in, is the maximum number of clusters that can be selected; The total number of data points in the abnormal network security status data and security situation awareness data; The data feature types in abnormal network security status data and security situation awareness data; is a constant factor that controls the upper limit of the number of clusters; is the rounding function; S72, calculating the total square error under the determined number of clusters by using the aggregation metric calculation formula, and evaluating the aggregation metric of the clusters; The aggregation metric calculation formula is: ； in, is the total square error value under the determined number of clusters; is the number of clusters identified; is the cluster index, ranging from 1 to ; For clustering The set of data points in ; It is the first in the abnormal network security status data and security situation awareness data. data points; is the index of the data point; For clustering the center of For data points With cluster center The square of the Euclidean distance between them; The number of different clusters Corresponding The values ​​are plotted as a line graph, with the horizontal axis being the number of clusters , the vertical axis is Value; in the line chart, observe As the number of clusters increases, we look for the inflection point, i.e. The position where it begins to stabilize, the number of clusters corresponding to the inflection point As the final number of clusters; S73, dynamically adjusting the fuzzy factor required for clustering through a fuzzy factor adjustment formula, and automatically adjusting the degree of fuzziness according to changes in the number of clusters and the number of data points; the fuzzy factor adjustment formula is: ； in, is the fuzzy factor for controlling the fuzziness of membership; is the final number of clusters; is the number of data points that need to be clustered; S74. Calculate the data points in the abnormal network security status data and security situation awareness data through the membership calculation formula Clustering The membership degree of is: ； in, For data points Clustering The degree of membership; For data points To cluster center The Euclidean distance of For data points To Cluster Centers The Euclidean distance of The data points To cluster center The Euclidean distance The calculation formula is: ； in, For data points No. Features is the cluster center No. Features By calculating each , the membership of all data points in the abnormal network security status data and security situation awareness data are combined into a membership matrix , the size of the matrix is ,Right now: ； in, For data points Clustering The degree of membership; S75. Determine whether the membership of each data point to the cluster meets the clustering standard through the membership judgment formula, and update the membership matrix ; The membership judgment formula is: ； in, For clustering The number of data points in ; when ,Right now When , it is determined that the membership of each data point to the cluster meets the clustering standard; when ,Right now When , it is determined that the membership of each data point to the cluster does not meet the clustering standard; S76. According to the final membership matrix , determine the cluster type to which each data point belongs, and select the cluster with the largest membership as the classification of the data point; compare the clustering results of abnormal network security status data and security situation awareness data; If the clustering results of the abnormal network security status data and the security situation awareness data are the same, it is determined that the abnormal network security status data is consistent with the security situation awareness data; if the clustering results of the abnormal network security status data and the security situation awareness data are different, it is determined that the abnormal network security status data is inconsistent with the security situation awareness data.

8. The enterprise network security self-checking method according to claim 7, characterized in that: If the abnormal network security state data is consistent with the security situation awareness data, the network security self-checking terminal issues an early warning instruction corresponding to the security situation awareness data, and the method for generating a network security response strategy includes: According to the early warning instructions issued by the network security self-inspection terminal, corresponding protection measures are automatically implemented, and the corresponding protection measures include blocking suspicious IP access and adjusting firewall rules; abnormal network security status data and corresponding protection measures information are recorded and uploaded to the network security self-inspection terminal, and relevant staff are notified to cooperate with the network security self-inspection terminal to carry out continuous network security monitoring.

9. The enterprise network security self-checking method according to claim 8, characterized in that: If the abnormal network security status data is inconsistent with the security situation awareness data, the method of evaluating the severity level of the network security status through the abnormal status evaluation model and updating the network security response strategy includes: The network security status severity level is evaluated by an abnormal status evaluation model, and the abnormal status evaluation model is: ； in, is the abnormal network security status assessment coefficient; For time Abnormal flow rate under For time The number of duplicate packets under is the packet loss rate; Abnormal login time; The number of device crashes; The time required to assess abnormal network security status; is the weight factor of abnormal traffic speed; is the weight factor for the number of duplicate packets; is the weight factor of packet loss rate; is the weight factor of abnormal login time; is the weight factor of the number of device crashes; The abnormal network security status assessment coefficient threshold is preset, and the abnormal network security status assessment coefficient threshold is further divided into a low-level abnormal network security status assessment coefficient threshold , Intermediate abnormal network security status assessment coefficient threshold and advanced abnormal network security status assessment coefficient threshold ; when When the network security status is judged as low, the log recording strategy is updated and the monitoring frequency of abnormal behavior is increased; when When the network security status is judged to be medium, the access control policy is updated to restrict the access rights of suspicious devices; when When the network security status is judged to be high severity, a comprehensive security audit is initiated to check all device parameters and network traffic; When the network security self-check terminal automatically controls and starts the network shutdown program.

10. An enterprise network security self-checking system, used to implement the enterprise network security self-checking method according to any one of claims 1 to 9, characterized in that: include: Data collection module, used to collect network traffic data, device parameter data, user behavior data and security situation awareness data; A data processing module is used to pre-process the collected network traffic data, device parameter data, user behavior data, and security situation awareness data to obtain a network traffic feature data set, a device feature data set, a user behavior feature data set, and a security situation awareness feature data set; The network security prediction module is used to integrate the network traffic feature data set, the device feature data set, the user behavior feature data set and the security situation awareness feature data set to obtain a comprehensive feature data set; the network security prediction model is obtained by training the comprehensive feature data set, and the network security status of the enterprise is predicted by the network security prediction model; A network security assessment module is used to compare the predicted enterprise network security status with a preset enterprise network security status threshold to determine whether the enterprise network security status is abnormal; The network security initial self-check module: if the enterprise network security status is normal, the network security self-check terminal generates status stability information and enters the continuous monitoring mode; if the enterprise network security status is abnormal, the network security self-check terminal automatically collects abnormal network security status data and matches it with the security situation awareness feature data to determine whether the abnormal network security status data is consistent with the security situation awareness data; The network security terminal self-check module, if the abnormal network security status data is consistent with the security situation awareness data, the network security self-check terminal issues a warning instruction corresponding to the security situation awareness data and generates a network security response strategy; If the abnormal network security status data is inconsistent with the security situation awareness data, the network security status severity level is evaluated through the abnormal status assessment model, and the network security response strategy is updated; each module is connected by wired and / or wireless means.

Images