A network security dynamic assessment method and system based on cloud-edge collaboration

Abstract

The present invention discloses a network security dynamic assessment method and system based on cloud-edge collaboration, and relates to the field of network security technology. The assessment method improves the efficiency and real-time performance of data processing by deploying an edge computing platform on each terminal device on the edge side of the data; performs network attack tests on different network links to obtain relevant detection data as data support for identifying real network attacks and their attack event types; calculates the defense performance parameters of the network link based on the attack event type and the collected operating parameter indicators, and calculates the security risk assessment coefficient and takes corresponding security measures by comprehensively considering multiple indicators such as the network attack event type, defense performance parameters, event response capability index and vulnerability risk parameters of the network link. The method realizes a comprehensive and dynamic security assessment of the network link to ensure the overall security and stability of the network.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and specifically to a network security dynamic assessment method and system based on cloud-edge collaboration. Background Art

[0002] With the development of Internet technology, the network has greatly improved the communication efficiency and production efficiency of all walks of life. As a result, network security involves various aspects such as security, personal privacy, and financial security. The normal and safe operation of the network system has also been paid attention to by all walks of life.

[0003] The traditional network security management system collects audit logs, intrusion audit logs and industrial control firewall security logs, collects a large number of network security logs, and after certain analysis, identifies the highly feasible security logs as security incidents. This method is used to evaluate network security, but this method cannot identify the network security status and the type of network attack events, and cannot make a good assessment of the specific overall network operating environment, which reduces network security to a certain extent.

[0004] In order to solve this problem, we propose a network security dynamic assessment method and system based on cloud-edge collaboration. Summary of the invention

[0005] In view of the shortcomings of the prior art, the present invention provides a network security dynamic assessment method and system based on cloud-edge collaboration, which can effectively solve the problems in the background technology.

[0006] To achieve the above object, the technical solution adopted by the present invention is:

[0007] A network security dynamic assessment method based on cloud-edge collaboration, the method comprising the following steps:

[0008] A central cloud management platform is deployed in the data center of the entire network. The central cloud management platform is equipped with a network security status database, which is used to store historical data sets and feature data sets. An edge computing platform is deployed on each end device at the edge of the data in the entire network.

[0009] Deploy intelligent agents to all devices in the entire network that require network security assessment;

[0010] The intelligent agent intervenes in the network link to be evaluated on the terminal device and obtains its access and control permissions;

[0011] Conduct network attack tests in the network link to be evaluated, select the network attack event type for the network attack test, and conduct simulated network attacks;

[0012] Obtaining the operating parameter indicators of the network link before and after the network attack, calculating the correlation between the network attack event type and the operating parameter indicators, and screening the operating parameter indicators to obtain the key attack event indicators of the network attack event type;

[0013] Obtain relevant test data in the network attack test, package it into a comparison parameter package and upload it to the feature database, match the real-time operating parameter indicators of the network link with the comparison parameter package in the feature database to identify network attacks and their network attack event type information;

[0014] Based on the type of network attack event, the maximum value allowed by the key attack event indicator in the network link is obtained. Based on the operating parameter indicators before and after the network attack, the performance parameters of the network link in the network attack are calculated.

[0015] The edge computing platform collects event response parameters and vulnerability information data sets of network links in network attacks, and evaluates the event response capabilities and vulnerability risk parameters of network links when they are attacked by network attacks;

[0016] Analyze the security risk assessment coefficient of the network link in a network attack environment based on the network attack event type, defense performance parameters, event response capability index and vulnerability risk parameters of the network link;

[0017] Set an assessment coefficient threshold, and determine whether it is necessary to intervene in the security risk of the network link based on the security risk assessment coefficient;

[0018] If yes, a network link adjustment command is generated and submitted to the corresponding end device; if no, the network link continues to be monitored.

[0019] Preferably, performing a network attack test in the network link to be evaluated, selecting a network attack event type for the network attack test, and performing a simulated network attack specifically includes:

[0020] Deploy intelligent agents to all devices in the entire network that require network security assessment;

[0021] Obtaining terminal device parameter information, wherein the terminal device parameter information includes device name, IP address and operating system;

[0022] Based on the terminal device parameter information, the network link information to be evaluated is obtained, and the intelligent agent intervenes in the network link to be evaluated to obtain its access and control permissions;

[0023] Based on the business requirements and importance of the target network link, design a network attack simulation plan, which includes the type of network attack event, test time period, number of tests, and test cycle of each test;

[0024] According to the network attack simulation plan, use the simulated attack automation tool to perform network attack tests on the network links to be evaluated.

[0025] Preferably, the obtaining of operating parameter indicators of the network link before and after the network attack, calculating the correlation between the network attack event type and the operating parameter indicators, and screening the operating parameter indicators to obtain key attack event indicators of the network attack event type specifically includes:

[0026] The time point of the network attack simulation program implementation is recorded as T0, the period before T0 is recorded as the first detection period, and the data of the network under normal operation is collected; the period after T0 is recorded as the second detection period, and the data of the network under attack is collected, and the first detection period and the second detection period have the same duration;

[0027] Setting a sampling frequency, collecting a plurality of operating parameter indicators in the first detection cycle and the second detection cycle based on the sampling frequency, and obtaining an operating parameter indicator data set of the plurality of operating parameter indicators in the first detection cycle and the second detection cycle;

[0028] The operating parameter indicators include throughput, packet loss rate, connection establishment success rate, connection request speed, number of unfinished connections, ICMP request processing speed, ICMP response time, TCP SYN queue length and SYN Cookie activation status;

[0029] The operating parameter indicator data set collected during the second detection cycle is standardized, and the missing values ​​in the data set are filled using the interpolation method;

[0030] Based on the operating parameter index data set collected in the second detection cycle, the calculation is performed in the The correlation between any two operating parameter indicators when a network attack event type is detected;

[0031] Based on the correlation, a correlation matrix is ​​constructed. According to the correlation matrix, several operating parameter indicators are selected as the Key attack event indicators under the types of network attack events;

[0032] Record at least one type of network attack event in this network attack test;

[0033] The correlation calculation formula is:

[0034] In the formula, For operating parameter indicators and operating parameter indicators The correlation degree, and They are respectively the operating parameter indicators and operating parameter indicators In the The observations in the subsample, and They are respectively the operating parameter indicators and operating parameter indicators The average value of , , is the number of sampling times in the second detection cycle;

[0035] in, The value range is from -1 to 1. Indicates a strong positive correlation, Indicates a strong negative correlation. Indicates no correlation.

[0036] Preferably, the obtaining of relevant test data in the network attack test, packaging the data into a comparison parameter package and uploading the package to the feature database, matching the real-time operation parameter index of the network link with the comparison parameter package in the feature database, for identifying the network attack and its network attack event type information, specifically includes:

[0037] Obtain and organize relevant test data in network attack tests;

[0038] The relevant test data includes network configuration information, test time information, attack event type information and corresponding operation parameter indicators;

[0039] Package the relevant tests into a comparison parameter package, upload the comparison parameter package to the feature database for subsequent network attack detection and analysis;

[0040] Continuously monitor and analyze the real-time operating parameter indicators of network links in non-testing state;

[0041] The operating parameter indicators monitored in real time are matched with the comparison parameter packages in the feature database to identify real network attacks and their types of network attack events.

[0042] Preferably, based on the network attack event type, obtaining the maximum value allowed by the key attack event indicator in the network link, and based on the operating parameter indicators before and after the network attack, calculating the resistance performance parameters of the network link in the network attack, specifically includes:

[0043] The operating parameter indicator data sets collected in the first detection cycle and the second detection cycle are standardized, and the missing values ​​in the data sets are filled by interpolation method;

[0044] Based on the operating parameter indicator data set of the first detection cycle, extract The average value of each key attack event indicator under the network attack event type is taken as the baseline value;

[0045] Based on the operating parameter indicator data set of the second detection cycle, extract The average value of each key attack event indicator under the network attack event type is taken as the actual value;

[0046] Obtain the maximum allowable value of each key attack event indicator, and calculate the average transmission performance utilization of the network link under normal network conditions based on the baseline value of the key attack event indicator;

[0047] Compare the actual values ​​of key attack event indicators with the baseline values ​​to determine the changes in key attack event indicators before and after detection;

[0048] Based on the changes in the indicators of each key attack event, it is calculated that the network link is in the The degree of change of key attack event indicators under the type of network attack event;

[0049] Based on the change degree of key attack event indicators and the average utilization rate of transmission performance, the The defense performance parameters of network links under various types of network attack events;

[0050] The calculation formula of the average utilization rate of the transmission performance is as follows:

[0051] In the formula, It indicates the average utilization rate of transmission performance of key attack event indicators under normal network conditions. Indicates the number of key attack event indicators, Indicates Baseline values ​​of key attack event indicators, Indicates The maximum allowed value of a key attack event indicator, Indicates The average utilization rate of key attack event indicators, Indicates The weight coefficient of the average utilization rate of key attack event indicators and ;

[0052] The calculation formula for the change degree of the key attack event indicators is:

[0053] In the formula, Indicates that key attack event indicators are The degree of change of parameter indicators before and after the types of network attack events, Indicates the number of key attack event indicators, Indicates Baseline values ​​of key attack event indicators, Indicates The actual values ​​of the key attack event indicators, Indicates The weight coefficient of the change degree of key attack event indicators, and ;

[0054] The calculation formula of the resistance performance parameter is:

[0055] In the formula, Indicated in The network link defense performance parameters under the types of network attack events, , are weight coefficients respectively.

[0056] Preferably, the edge computing platform collects event response parameters and vulnerability information data sets of network links in network attacks, and evaluates event response capabilities and vulnerability risk parameters of network links when they are attacked by network attacks, specifically including:

[0057] Collect event response parameters of network links in network attacks and evaluate the event response capabilities of network links when attacked;

[0058] The event response parameters include response success rate, response time, detection time, recovery time and total downtime;

[0059] Obtain the ratio of the number of successful network restorations to the total number of attack events after a network attack, recorded as the response success rate;

[0060] Obtain the time interval from the start of the network attack to the start of the emergency response, which is recorded as the response time;

[0061] Get the time interval from the beginning of the network attack to the detection, which is recorded as the detection time;

[0062] The time interval from the start of the emergency response to the restoration of normal network operation is obtained, which is recorded as the recovery time;

[0063] Obtain the total time from the start of the network attack to the restoration of network operation parameter indicators to normal, which is recorded as the total downtime;

[0064] The collected data is standardized and calculated The event response capability index of the network link under various types of attacks;

[0065] Use vulnerability scanning tools and security auditing tools to perform vulnerability scanning and security auditing on network links after network attacks to generate vulnerability information data sets;

[0066] The vulnerability information data set includes the vulnerability type, vulnerability impact scope, vulnerability severity and vulnerability repair difficulty of each vulnerability;

[0067] According to the specific situation of each vulnerability, assign parameters to the vulnerability impact range, vulnerability severity and vulnerability repair difficulty of each vulnerability and calculate the vulnerability risk parameters;

[0068] The calculation formula of the incident response capability index is:

[0069] in, For the The response capability index of various types of attack incidents, For the The total number of attack events of the type For the Type of attack incidents Response time, For the Type of attack incidents Detection time, For the Type of attack incidents Recovery time, For the Type of attack incidents Total downtime, For the The response success rate of each type of attack event, , , , , They are the weight coefficients of recovery time, response success rate, response time, detection time and total downtime respectively.

[0070] Preferably, the network attack event type, resistance performance parameter, event response capability index and vulnerability risk parameter of the network link are used to analyze the security risk assessment coefficient of the network link under the network attack environment, specifically including:

[0071] Constructing a network security assessment model;

[0072] Obtain the network attack event type, defense performance parameters, event response capability index and vulnerability risk parameters in the network link;

[0073] Input the above-mentioned defense performance parameters, incident response capability index and vulnerability risk parameters into the network security assessment model to obtain the security risk assessment coefficient;

[0074] The calculation formula of the safety risk assessment coefficient is:

[0075] In the formula, Indicates The vulnerability risk parameters of network links under different types of attack events. Indicates The response capability index of the network link under different types of attack events. Indicates The network link's defense performance parameters under various types of attack events.

[0076] Preferably, the setting of the assessment coefficient threshold, based on the security risk assessment coefficient, determines whether it is necessary to intervene in the security risk of the network link, specifically includes:

[0077] Based on the security risk assessment coefficient, set the assessment coefficient threshold;

[0078] Set the low risk threshold to 5, the medium risk threshold to 10, and the high risk threshold to 15;

[0079] When the security risk assessment coefficient is less than 5, it is recorded as low security risk and the network link continues to be monitored;

[0080] When the security risk assessment coefficient is greater than 5 and less than 10, it is recorded as a medium security risk and a preliminary investigation and optimization of the network link is conducted;

[0081] When the security risk assessment coefficient is greater than 10 and less than 15, it is recorded as a high security risk and emergency measures are taken for the network link;

[0082] When the security risk assessment coefficient is greater than 15, it is recorded as an extremely high security risk and immediate action is taken on the network link;

[0083] When the network link is of medium security risk, high security risk, or extremely high security risk, identify the end device associated with the network link, use the administrator account and password for identity authentication, and manage and control the end device.

[0084] Furthermore, the present invention also proposes a network security dynamic assessment system based on cloud-edge collaboration, which is used to implement any of the above-mentioned assessment methods, including:

[0085] The central cloud management platform module is used to store historical data sets and feature data sets as the basis for subsequent network attack testing and security assessment;

[0086] The edge computing platform module obtains access and control permissions on the end device through an intelligent agent, performs simulated network attacks based on preset network attack events, and monitors the operating parameter indicators of the network link before and after the network attack; is used to perform correlation calculations on the operating parameter indicators to obtain the defense performance parameters of the network link; is used to evaluate the event response capability of the network link when it is attacked; and is used for the vulnerability risk parameters of the network link when it is attacked;

[0087] The data processing and analysis module is used to organize and analyze relevant test data in network attack tests, package the test data into comparison parameter packages, and upload them to the feature database;

[0088] Real-time monitoring and matching module, which is used to continuously monitor the real-time operating parameter indicators of network links and match them with the comparison parameter packages in the feature database to identify network attacks and their types of attack events;

[0089] Wherein, the central cloud management platform module includes a security risk assessment model building unit and a security intervention decision unit;

[0090] The security risk assessment model building unit is used to build a network security assessment model and calculate the security risk assessment coefficient by integrating the network attack event type, defense performance parameters, event response capability index and vulnerability risk parameters;

[0091] The security intervention decision unit is used to evaluate the security risk assessment coefficient, decide whether it is necessary to intervene in the security risk of the network link, and take corresponding measures.

[0092] Preferably, the edge computing platform module specifically includes:

[0093] An intelligent agent deployment unit, used to deploy intelligent agents on various end devices that require network security assessment;

[0094] An access and control authority acquisition unit, used to obtain access and control authority on a terminal device to perform network attack testing;

[0095] A network attack test unit, used to select appropriate simulated attack tools based on preset network attack event types;

[0096] An operation parameter indicator monitoring unit is used to monitor the operation parameter indicators of the network link before and after the network attack;

[0097] A key attack event calculation unit, used to calculate the correlation between the network attack event type and the operation parameter index, and calculate the key attack event index;

[0098] A defense performance parameter calculation unit is used to obtain changes in key attack event indicators and average transmission performance utilization, and calculate defense performance parameters of network links;

[0099] An event response capability evaluation unit, used to obtain event response parameters and evaluate the event response capability of a network link when it is attacked;

[0100] The vulnerability risk assessment unit is used to evaluate the network link using vulnerability scanning tools and security auditing tools, generate vulnerability information data sets, and calculate the vulnerability risk parameters of the network link.

[0101] Compared with the prior art, the present invention provides a network security dynamic assessment method and system based on cloud-edge collaboration, which has the following beneficial effects:

[0102] This network security assessment method realizes cloud-edge collaboration through the effective collaboration between the central cloud management platform and the edge computing platform, improves the efficiency and real-time performance of data processing, reduces the burden on the central server, and ensures the continuous and stable operation of the network to a certain extent;

[0103] Through the intelligent agent, network attack tests are conducted to comprehensively evaluate the performance of network links under different types of attack events, obtain relevant test data in network attack tests and upload them to the feature database, and match the operating parameter indicators monitored in real time with the comparison parameter packages in the feature database to provide data support for identifying real network attacks and their types of network attack events, thereby improving the defense capability and security of network links;

[0104] This method integrates multiple indicators such as network attack event types, defense performance parameters, event response capability index and vulnerability risk parameters of network links, calculates the security risk assessment coefficient and takes corresponding security measures. This method realizes a comprehensive and dynamic security assessment of network links to ensure the overall security and stability of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0105] Figure 1 A flowchart of a network security dynamic assessment method based on cloud-edge collaboration provided by the present invention;

[0106] Figure 2 A flow chart for obtaining the resistance performance parameters provided by the present invention;

[0107] Figure 3 This is a framework diagram of a network security dynamic assessment system based on cloud-edge collaboration in the present invention. DETAILED DESCRIPTION

[0108] In order to make the technical means, creative features, objectives and effects of the present invention easy to understand, the present invention will be further described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0109] In order to address the shortcomings of the existing technology, such as Figure 1 As shown, the present invention provides a network security dynamic assessment method and system based on cloud-edge collaboration, the method comprising the following steps:

[0110] A central cloud management platform is deployed in the data center of the entire network. The central cloud management platform is equipped with a network security status database, which is used to store historical data sets and feature data sets. An edge computing platform is deployed on each end device at the edge of the data in the entire network.

[0111] Deploy intelligent agents to all devices in the entire network that require network security assessment;

[0112] The intelligent agent intervenes in the network link to be evaluated on the terminal device and obtains its access and control permissions;

[0113] Conduct network attack tests in the network link to be evaluated, select the network attack event type for the network attack test, and conduct simulated network attacks;

[0114] Obtaining the operating parameter indicators of the network link before and after the network attack, calculating the correlation between the network attack event type and the operating parameter indicators, and screening the operating parameter indicators to obtain the key attack event indicators of the network attack event type;

[0115] Obtain relevant test data in the network attack test, package it into a comparison parameter package and upload it to the feature database, match the real-time operating parameter indicators of the network link with the comparison parameter package in the feature database to identify network attacks and their network attack event type information;

[0116] Based on the type of network attack event, the maximum value allowed by the key attack event indicator in the network link is obtained. Based on the operating parameter indicators before and after the network attack, the performance parameters of the network link in the network attack are calculated.

[0117] The edge computing platform collects event response parameters and vulnerability information data sets of network links in network attacks, and evaluates the event response capabilities and vulnerability risk parameters of network links when they are attacked by network attacks;

[0118] Analyze the security risk assessment coefficient of the network link in a network attack environment based on the network attack event type, defense performance parameters, event response capability index and vulnerability risk parameters of the network link;

[0119] Set an assessment coefficient threshold, and determine whether it is necessary to intervene in the security risk of the network link based on the security risk assessment coefficient;

[0120] If yes, a network link adjustment command is generated and submitted to the corresponding end device; if no, the network link continues to be monitored.

[0121] Specifically, a network attack test is performed in the network link to be evaluated, the network attack event type of the network attack test is selected, and a simulated network attack is performed, specifically including:

[0122] Deploy intelligent agents to all devices in the entire network that require network security assessment;

[0123] Obtain terminal device parameter information, including device name, IP address and operating system;

[0124] Based on the terminal device parameter information, the network link information to be evaluated is obtained, and the intelligent agent intervenes in the network link to be evaluated to obtain its access and control permissions;

[0125] Design a network attack simulation plan based on the business needs and importance of the target network link. The network attack simulation plan includes the type of network attack event, test time period, number of tests, and the test cycle of each test;

[0126] According to the network attack simulation plan, use the simulated attack automation tool to perform network attack tests on the network links to be evaluated.

[0127] Specifically, the operating parameter indicators of the network link before and after the network attack are obtained, the correlation between the network attack event type and the operating parameter indicators is calculated, and the operating parameter indicators are screened to obtain the key attack event indicators of the network attack event type, specifically including:

[0128] The time point of the network attack simulation program implementation is recorded as T0, the period before T0 is recorded as the first detection period, and the data of the network under normal operation is collected; the period after T0 is recorded as the second detection period, and the data of the network under attack is collected, and the first detection period and the second detection period have the same duration;

[0129] Setting a sampling frequency, collecting a plurality of operating parameter indicators in the first detection cycle and the second detection cycle based on the sampling frequency, and obtaining an operating parameter indicator data set of the plurality of operating parameter indicators in the first detection cycle and the second detection cycle;

[0130] Operation parameter indicators include throughput, packet loss rate, connection establishment success rate, connection request speed, number of unfinished connections, ICMP request processing speed, ICMP response time, TCP SYN queue length, and SYN Cookie activation status;

[0131] The operating parameter indicator data set collected during the second detection cycle is standardized, and the missing values ​​in the data set are filled using the interpolation method;

[0132] Based on the operating parameter index data set collected in the second detection cycle, the calculation is performed in the The correlation between any two operating parameter indicators when a network attack event type is detected;

[0133] Based on the correlation, a correlation matrix is ​​constructed. According to the correlation matrix, several operating parameter indicators are selected as the Key attack event indicators under the types of network attack events;

[0134] Record at least one type of network attack event in this network attack test, including but not limited to DDoS attack, SYN Flood attack, ICMP Flood attack, ARP spoofing, SQL injection, XSS attack, and buffer overflow;

[0135] Record the attack event types of network attack tests and associate them with the collected operating parameter indicators as data support for subsequent identification of real network attacks and their attack event types;

[0136] The correlation calculation formula is:

[0137] In the formula, For operating parameter indicators and operating parameter indicators The correlation degree, and They are respectively the operating parameter indicators and operating parameter indicators In the The observations in the subsample, is the number of sampling times in the second detection cycle, and They are respectively the operating parameter indicators and operating parameter indicators The average value of , ;

[0138] in, The value range is from -1 to 1. Indicates a strong positive correlation, Indicates a strong negative correlation. Indicates no correlation.

[0139] Specifically, relevant test data in the network attack test is obtained, packaged into a comparison parameter package and uploaded to the feature database, and the real-time operation parameter indicators of the network link are matched with the comparison parameter package in the feature database to identify network attacks and network attack event type information, including:

[0140] Obtain and organize relevant test data in network attack tests;

[0141] Relevant test data includes network configuration information, test time information, attack event type information and corresponding operating parameter indicators;

[0142] Package the relevant tests into a comparison parameter package, upload the comparison parameter package to the feature database for subsequent network attack detection and analysis;

[0143] Continuously monitor and analyze the real-time operating parameter indicators of network links in non-testing state;

[0144] Match the real-time monitored operating parameter indicators with the comparison parameter packages in the feature database to identify real network attacks and their types;

[0145] It should be noted that this method uses pre-recorded attack event types and their corresponding operating parameter indicators as a benchmark. When similar parameter changes occur in the actual network, the system can quickly identify potential network attacks and their corresponding attack event types. This correlation analysis based on historical data can improve the accuracy and reliability of attack identification.

[0146] Specifically, Figure 2 As shown in the figure, based on the network attack event type, the maximum value allowed by the key attack event indicator in the network link is obtained, and based on the operating parameter indicators before and after the network attack, the defense performance parameters of the network link in the network attack are calculated, including:

[0147] The operating parameter indicator data sets collected in the first detection cycle and the second detection cycle are standardized, and the missing values ​​in the data sets are filled by interpolation method;

[0148] Based on the operating parameter indicator data set of the first detection cycle, extract The average value of each key attack event indicator under the network attack event type is taken as the baseline value;

[0149] Based on the operating parameter indicator data set of the second detection cycle, extract The average value of each key attack event indicator under the network attack event type is taken as the actual value;

[0150] Obtain the maximum allowable value of each key attack event indicator, and calculate the average transmission performance utilization of the network link under normal network conditions based on the baseline value of the key attack event indicator;

[0151] Compare the actual values ​​of key attack event indicators with the baseline values ​​to determine the changes in key attack event indicators before and after detection;

[0152] Based on the changes in the indicators of each key attack event, it is calculated that the network link is in the The degree of change of key attack event indicators under the type of network attack event;

[0153] Based on the change degree of key attack event indicators and the average utilization rate of transmission performance, the The defense performance parameters of network links under various types of network attack events;

[0154] The calculation formula for the average utilization of transmission performance is as follows:

[0155] In the formula, It indicates the average utilization rate of transmission performance of key attack event indicators under normal network conditions. Indicates the number of key attack event indicators, Indicates Baseline values ​​of key attack event indicators, Indicates The maximum allowed value of a key attack event indicator, Indicates The average utilization rate of key attack event indicators, Indicates The weight coefficient of the average utilization rate of key attack event indicators and ;

[0156] The calculation formula for the change degree of key attack event indicators is:

[0157] In the formula, Indicates that key attack event indicators are The degree of change of parameter indicators before and after the types of network attack events, Indicates the number of key attack event indicators, Indicates Baseline values ​​of key attack event indicators, Indicates The actual values ​​of the key attack event indicators, Indicates The weight coefficient of the change degree of key attack event indicators, and ;

[0158] The calculation formula for the resistance performance parameter is:

[0159] In the formula, Indicated in The network link defense performance parameters under the types of network attack events, , are weight coefficients respectively;

[0160] Specifically, the edge computing platform collects event response parameters and vulnerability information data sets of network links in network attacks, and evaluates the event response capabilities and vulnerability risk parameters of network links when they are attacked by network attacks, including:

[0161] Collect event response parameters of network links in network attacks and evaluate the event response capabilities of network links when attacked;

[0162] Incident response parameters include response success rate, response time, detection time, recovery time, and total downtime;

[0163] Obtain the ratio of the number of successful network restorations to the total number of attack events after a network attack, recorded as the response success rate;

[0164] Obtain the time interval from the start of the network attack to the start of the emergency response, which is recorded as the response time;

[0165] Get the time interval from the beginning of the network attack to the detection, which is recorded as the detection time;

[0166] The time interval from the start of the emergency response to the restoration of normal network operation is obtained, which is recorded as the recovery time;

[0167] Obtain the total time from the start of the network attack to the restoration of network operation parameter indicators to normal, which is recorded as the total downtime;

[0168] The collected data is standardized and calculated The event response capability index of the network link under various types of attacks;

[0169] Use vulnerability scanning tools and security auditing tools to perform vulnerability scanning and security auditing on network links after network attacks to generate vulnerability information data sets;

[0170] The vulnerability information dataset includes the vulnerability type, vulnerability impact scope, vulnerability severity, and vulnerability repair difficulty of each vulnerability;

[0171] According to the specific situation of each vulnerability, assign parameters to the vulnerability impact range, vulnerability severity and vulnerability repair difficulty of each vulnerability and calculate the vulnerability risk parameters;

[0172] The calculation formula of the incident response capability index is:

[0173] in, For the The response capability index of various types of attack incidents, For the The total number of attack events of the type For the Type of attack incidents Response time, For the Type of attack incidents Detection time, For the Type of attack incidents Recovery time, For the Type of attack incidents Total downtime, For the The response success rate of each type of attack event, , , , , They are the weight coefficients of recovery time, response success rate, response time, detection time and total downtime;

[0174] It should be noted that the vulnerability risk parameter is calculated as follows:

[0175] The reciprocal of the vulnerability repair difficulty value, the vulnerability severity value, and the vulnerability impact range value of each vulnerability are multiplied to obtain the risk score of each vulnerability;

[0176] According to the vulnerability type, obtain vulnerability impact preference indicators;

[0177] Compare the vulnerability impact preference index and the key attack event index to obtain the key feature index, which represents the overlap between the vulnerability impact preference index and the key attack event index.

[0178] The ratio of the key feature index to the vulnerability impact preference index is used as the impact coefficient of the vulnerability type;

[0179] According to the vulnerability type and impact coefficient of each vulnerability, the risk score of each vulnerability is weighted to obtain the vulnerability risk parameter of the network link;

[0180] The calculation formula of vulnerability risk parameter is:

[0181] In the formula, Indicates the number of vulnerabilities, Indicates The weight of the vulnerability type corresponding to each vulnerability, Indicates Assign vulnerability severity values ​​to each vulnerability. Indicates the impact coefficient of the vulnerability type, Indicates Assign the vulnerability impact range of each vulnerability. Indicates Assign a vulnerability repair difficulty value to each vulnerability.

[0182] Specifically, based on the network attack event type, defense performance parameters, event response capability index and vulnerability risk parameters of the network link, the security risk assessment coefficient of the network link under the network attack environment is analyzed, including:

[0183] Constructing a network security assessment model;

[0184] Obtain the network attack event type, defense performance parameters, event response capability index and vulnerability risk parameters in the network link;

[0185] Input the above-mentioned defense performance parameters, incident response capability index and vulnerability risk parameters into the network security assessment model to obtain the security risk assessment coefficient;

[0186] The calculation formula of the safety risk assessment coefficient is:

[0187] In the formula, Indicates The vulnerability risk parameters of network links under different types of attack events. Indicates The response capability index of the network link under different types of attack events. Indicates The network link's defense performance parameters under various types of attack events.

[0188] Specifically, an assessment coefficient threshold is set, and based on the security risk assessment coefficient, it is determined whether it is necessary to intervene in the security risk of the network link, specifically including:

[0189] Based on the security risk assessment coefficient, set the assessment coefficient threshold;

[0190] Set the low risk threshold to 5, the medium risk threshold to 10, and the high risk threshold to 15;

[0191] When the security risk assessment coefficient is less than 5, it is recorded as low security risk and the network link continues to be monitored;

[0192] When the security risk assessment coefficient is greater than 5 and less than 10, it is recorded as a medium security risk and a preliminary investigation and optimization of the network link is conducted;

[0193] When the security risk assessment coefficient is greater than 10 and less than 15, it is recorded as a high security risk and emergency measures are taken for the network link;

[0194] When the security risk assessment coefficient is greater than 15, it is recorded as an extremely high security risk and immediate action is taken on the network link;

[0195] When the network link is of medium security risk, high security risk or extremely high security risk, identify the end device associated with the network link, use the administrator account and password for identity authentication, generate a network link adjustment command based on the security risk assessment coefficient of the network link and the type of attack event, and submit it to the corresponding end device to manage and control the end device;

[0196] It should be noted that this method achieves quantitative assessment of security risks by setting clear assessment coefficient thresholds, ensuring the objectivity and accuracy of the assessment; different management measures are taken according to the security risk level, achieving rational allocation and efficient utilization of resources, and ensuring timely response and processing of risks of different levels; the security risk assessment coefficient and the type of attack event generate adjustment commands for the network link, and submit them to the corresponding terminal device, achieving precise control of specific terminal devices, so as to effectively respond to the security threats of network attacks.

[0197] Further, such as Figure 3 As shown, the present invention also proposes a network security dynamic assessment system based on cloud-edge collaboration, which is used to implement any of the above-mentioned assessment methods, including:

[0198] The central cloud management platform module is used to store historical data sets and feature data sets as the basis for subsequent network attack testing and security assessment;

[0199] The edge computing platform module obtains access and control permissions on the end device through an intelligent agent, performs simulated network attacks based on preset network attack events, and monitors the operating parameter indicators of the network link before and after the network attack; is used to perform correlation calculations on the operating parameter indicators to obtain the defense performance parameters of the network link; is used to evaluate the event response capability of the network link when it is attacked; and is used for the vulnerability risk parameters of the network link when it is attacked;

[0200] The data processing and analysis module is used to organize and analyze relevant test data in network attack tests, package the test data into comparison parameter packages, and upload them to the feature database;

[0201] Real-time monitoring and matching module, which is used to continuously monitor the real-time operating parameter indicators of network links and match them with the comparison parameter packages in the feature database to identify network attacks and their types of attack events;

[0202] Among them, the central cloud management platform module includes a security risk assessment model building unit and a security intervention decision-making unit;

[0203] The security risk assessment model building unit is used to comprehensively consider the network attack event type, defense performance parameters, event response capability index and vulnerability risk parameters, build a network security assessment model and calculate the security risk assessment coefficient;

[0204] The security intervention decision unit is used to evaluate the security risk assessment coefficient, decide whether it is necessary to intervene in the security risk of the network link, and take corresponding measures.

[0205] Specifically, the edge computing platform module includes:

[0206] An intelligent agent deployment unit, used to deploy intelligent agents on various end devices that require network security assessment;

[0207] An access and control authority acquisition unit, used to obtain access and control authority on a terminal device to perform network attack testing;

[0208] A network attack test unit, used to select appropriate simulated attack tools based on preset network attack event types;

[0209] An operation parameter indicator monitoring unit is used to monitor the operation parameter indicators of the network link before and after the network attack;

[0210] A key attack event calculation unit, used to calculate the correlation between the network attack event type and the operation parameter index, and calculate the key attack event index;

[0211] A defense performance parameter calculation unit is used to obtain the changes in key attack event indicators and the average utilization rate of transmission performance, and calculate the defense performance parameters of the network link;

[0212] An event response capability evaluation unit, used to obtain event response parameters and evaluate the event response capability of a network link when it is attacked;

[0213] The vulnerability risk assessment unit is used to evaluate the network link using vulnerability scanning tools and security auditing tools, generate vulnerability information data sets, and calculate the vulnerability risk parameters of the network link.

[0214] In summary, the advantages of the present invention are: by deploying an edge computing platform on each end device on the data edge side, the efficiency and real-time performance of data processing are improved; by performing network attack tests on different network links, relevant detection data are obtained as data support for identifying real network attacks and their attack event types; the defense performance parameters of the network link are calculated based on the attack event type and the collected operating parameter indicators, and the network attack event type, defense performance parameters, event response capability index and vulnerability risk parameters of the network link are integrated to calculate the security risk assessment coefficient and take corresponding security measures. This method realizes a comprehensive and dynamic security assessment of the network link to ensure the overall security and stability of the network.

[0215] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It should be understood by those skilled in the art that the present invention is not limited by the above embodiments, and the above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, and these changes and improvements all fall within the scope of the present invention to be protected.

Claims

1. A network security dynamic assessment method based on cloud-edge collaboration, characterized in that: The method comprises the following steps: A central cloud management platform is deployed in the data center of the entire network. The central cloud management platform is equipped with a network security status database, which is used to store historical data sets and feature data sets. An edge computing platform is deployed on each end device at the edge of the data in the entire network. Deploy intelligent agents to all devices in the entire network that require network security assessment; The intelligent agent intervenes in the network link to be evaluated on the terminal device and obtains its access and control permissions; Conduct network attack tests in the network link to be evaluated, select the network attack event type for the network attack test, and conduct simulated network attacks; Obtaining the operating parameter indicators of the network link before and after the network attack, calculating the correlation between the network attack event type and the operating parameter indicators, and screening the operating parameter indicators to obtain the key attack event indicators of the network attack event type; Obtain relevant test data in the network attack test, package it into a comparison parameter package and upload it to the feature database, match the real-time operating parameter indicators of the network link with the comparison parameter package in the feature database to identify network attacks and their network attack event type information; Based on the type of network attack event, the maximum value allowed by the key attack event indicator in the network link is obtained. Based on the operating parameter indicators before and after the network attack, the performance parameters of the network link in the network attack are calculated. The edge computing platform collects event response parameters and vulnerability information data sets of network links in network attacks, and evaluates the event response capabilities and vulnerability risk parameters of network links when they are attacked by network attacks; Analyze the security risk assessment coefficient of the network link in a network attack environment based on the network attack event type, defense performance parameters, event response capability index and vulnerability risk parameters of the network link; Set an assessment coefficient threshold, and determine whether it is necessary to intervene in the security risk of the network link based on the security risk assessment coefficient; If yes, a network link adjustment command is generated and submitted to the corresponding end device; if no, the network link continues to be monitored.

2. According to claim 1, a network security dynamic assessment method based on cloud-edge collaboration is characterized in that: The network attack test is performed in the network link to be evaluated, the network attack event type of the network attack test is selected, and the simulated network attack is performed, specifically including: Deploy intelligent agents to all devices in the entire network that require network security assessment; Obtaining terminal device parameter information, wherein the terminal device parameter information includes device name, IP address and operating system; Based on the terminal device parameter information, the network link information to be evaluated is obtained, and the intelligent agent intervenes in the network link to be evaluated to obtain its access and control permissions; Based on the business requirements and importance of the target network link, design a network attack simulation plan, which includes the type of network attack event, test time period, number of tests, and test cycle of each test; According to the network attack simulation plan, use the simulated attack automation tool to perform network attack tests on the network links to be evaluated.

3. According to claim 2, a network security dynamic assessment method based on cloud-edge collaboration is characterized in that: The obtaining of the operating parameter index of the network link before and after the network attack, calculating the correlation between the network attack event type and the operating parameter index, and screening the operating parameter index to obtain the key attack event index of the network attack event type, specifically includes: The time point of the network attack simulation program implementation is recorded as T0, the period before T0 is recorded as the first detection period, and the data of the network under normal operation is collected; the period after T0 is recorded as the second detection period, and the data of the network under attack is collected, and the first detection period and the second detection period have the same duration; Setting a sampling frequency, collecting a plurality of operating parameter indicators in the first detection cycle and the second detection cycle based on the sampling frequency, and obtaining an operating parameter indicator data set of the plurality of operating parameter indicators in the first detection cycle and the second detection cycle; The operating parameter indicators include throughput, packet loss rate, connection establishment success rate, connection request speed, number of unfinished connections, ICMP request processing speed, ICMP response time, TCP SYN queue length and SYN Cookie activation status; The operating parameter indicator data set collected during the second detection cycle is standardized, and the missing values ​​in the data set are filled using the interpolation method; Based on the operating parameter index data set collected in the second detection cycle, the calculation is performed in the The correlation between any two operating parameter indicators when a network attack event type is detected; Based on the correlation, a correlation matrix is ​​constructed. According to the correlation matrix, several operating parameter indicators are selected as the Key attack event indicators under the types of network attack events; Record at least one type of network attack event in this network attack test; The correlation calculation formula is: In the formula, For operating parameter indicators and operating parameter indicators The correlation degree, and They are respectively the operating parameter indicators and operating parameter indicators In the The observations in the subsample, and They are respectively the operating parameter indicators and operating parameter indicators The average value of is the number of sampling times in the second detection cycle; in, The value range is from -1 to 1. Indicates a strong positive correlation, Indicates a strong negative correlation. Indicates no correlation.

4. According to claim 3, a network security dynamic assessment method based on cloud-edge collaboration is characterized in that: The relevant test data in the network attack test is obtained, packaged into a comparison parameter package and uploaded to the feature database, and the real-time operation parameter index of the network link is matched with the comparison parameter package in the feature database to identify the network attack and its network attack event type information, specifically including: Obtain and organize relevant test data in network attack tests; The relevant test data includes network configuration information, test time information, attack event type information and corresponding operation parameter indicators; Package the relevant tests into a comparison parameter package, upload the comparison parameter package to the feature database for subsequent network attack detection and analysis; Continuously monitor and analyze the real-time operating parameter indicators of network links in non-testing state; The operating parameter indicators monitored in real time are matched with the comparison parameter packages in the feature database to identify real network attacks and their types of network attack events.

5. According to claim 4, a network security dynamic assessment method based on cloud-edge collaboration is characterized in that: The method of obtaining the maximum value allowed by the key attack event indicator in the network link based on the network attack event type and calculating the resistance performance parameter of the network link in the network attack based on the operation parameter indicators before and after the network attack specifically includes: The operating parameter indicator data sets collected in the first detection cycle and the second detection cycle are standardized, and the missing values ​​in the data sets are filled by interpolation method; Based on the operating parameter indicator data set of the first detection cycle, extract The average value of each key attack event indicator under the network attack event type is taken as the baseline value; Based on the operating parameter indicator data set of the second detection cycle, extract The average value of each key attack event indicator under the network attack event type is taken as the actual value; Obtain the maximum allowable value of each key attack event indicator, and calculate the average transmission performance utilization of the network link under normal network conditions based on the baseline value of the key attack event indicator; Compare the actual values ​​of key attack event indicators with the baseline values ​​to determine the changes in key attack event indicators before and after detection; Based on the changes in the indicators of each key attack event, it is calculated that the network link is in the The degree of change of key attack event indicators under the type of network attack event; Based on the change degree of key attack event indicators and the average utilization rate of transmission performance, the The defense performance parameters of network links under various types of network attack events; The calculation formula of the average utilization rate of the transmission performance is as follows: In the formula, It indicates the average utilization rate of transmission performance of key attack event indicators under normal network conditions. Indicates the number of key attack event indicators, Indicates Baseline values ​​of key attack event indicators, Indicates The maximum allowed value of a key attack event indicator, Indicates The average utilization rate of key attack event indicators, Indicates The weight coefficient of the average utilization rate of key attack event indicators and ; The calculation formula for the change degree of the key attack event indicators is: In the formula, Indicates that key attack event indicators are The degree of change of parameter indicators before and after the types of network attack events, Indicates the number of key attack event indicators, Indicates Baseline values ​​of key attack event indicators, Indicates The actual values ​​of the key attack event indicators, Indicates The weight coefficient of the change degree of key attack event indicators, and ; The calculation formula of the resistance performance parameter is: In the formula, Indicated in The network link defense performance parameters under the types of network attack events, , are weight coefficients respectively.

6. A network security dynamic assessment method based on cloud-edge collaboration according to claim 5, characterized in that: The edge computing platform collects event response parameters and vulnerability information data sets of network links in network attacks, and evaluates the event response capabilities and vulnerability risk parameters of network links when they are attacked by network attacks, including: Collect event response parameters of network links in network attacks and evaluate the event response capabilities of network links when attacked; The event response parameters include response success rate, response time, detection time, recovery time and total downtime; Obtain the ratio of the number of successful network restorations to the total number of attack events after a network attack, recorded as the response success rate; Obtain the time interval from the start of the network attack to the start of the emergency response, which is recorded as the response time; Get the time interval from the beginning of the network attack to the detection, which is recorded as the detection time; The time interval from the start of the emergency response to the restoration of normal network operation is obtained, which is recorded as the recovery time; Obtain the total time from the start of the network attack to the restoration of network operation parameter indicators to normal, which is recorded as the total downtime; The collected data is standardized and calculated The event response capability index of the network link under various types of attacks; Use vulnerability scanning tools and security auditing tools to perform vulnerability scanning and security auditing on network links after network attacks to generate vulnerability information data sets; The vulnerability information data set includes the vulnerability type, vulnerability impact scope, vulnerability severity and vulnerability repair difficulty of each vulnerability; According to the specific situation of each vulnerability, assign parameters to the vulnerability impact range, vulnerability severity and vulnerability repair difficulty of each vulnerability and calculate the vulnerability risk parameters; The calculation formula of the incident response capability index is: in, For the The response capability index of various types of attack incidents, For the The total number of attack events of the type For the Type of attack incidents Response time, For the Type of attack incidents Detection time, For the Type of attack incidents Recovery time, For the Type of attack incidents Total downtime, For the The response success rate of each type of attack event, , , , , They are the weight coefficients of recovery time, response success rate, response time, detection time and total downtime respectively.

7. A network security dynamic assessment method based on cloud-edge collaboration according to claim 6, characterized in that: The network attack event type, defense performance parameter, event response capability index and vulnerability risk parameter of the network link are used to analyze the security risk assessment coefficient of the network link under the network attack environment, specifically including: Constructing a network security assessment model; Obtain the network attack event type, defense performance parameters, event response capability index and vulnerability risk parameters in the network link; Input the above-mentioned defense performance parameters, incident response capability index and vulnerability risk parameters into the network security assessment model to obtain the security risk assessment coefficient; The calculation formula of the safety risk assessment coefficient is: In the formula, Indicates The vulnerability risk parameters of network links under different types of attack events. Indicates The response capability index of the network link under different types of attack events. Indicates The network link's defense performance parameters under various types of attack events.

8. A network security dynamic assessment method based on cloud-edge collaboration according to claim 7, characterized in that: The setting of the assessment coefficient threshold determines whether it is necessary to intervene in the security risk of the network link based on the security risk assessment coefficient, specifically including: Based on the security risk assessment coefficient, set the assessment coefficient threshold; Set the low risk threshold to 5, the medium risk threshold to 10, and the high risk threshold to 15; When the security risk assessment coefficient is less than 5, it is recorded as low security risk and the network link continues to be monitored; When the security risk assessment coefficient is greater than 5 and less than 10, it is recorded as a medium security risk and a preliminary investigation and optimization of the network link is conducted; When the security risk assessment coefficient is greater than 10 and less than 15, it is recorded as a high security risk and emergency measures are taken for the network link; When the security risk assessment coefficient is greater than 15, it is recorded as an extremely high security risk and immediate action is taken on the network link; When the network link is of medium security risk, high security risk, or extremely high security risk, identify the end device associated with the network link, use the administrator account and password for identity authentication, and manage and control the end device.

9. A network security dynamic assessment system based on cloud-edge collaboration, used to implement the assessment method according to any one of claims 1 to 8, characterized in that: include: The central cloud management platform module is used to store historical data sets and feature data sets as the basis for subsequent network attack testing and security assessment; The edge computing platform module obtains access and control permissions on the end device through intelligent agents, performs simulated network attacks based on preset network attack events, and monitors the operating parameter indicators of the network link before and after the network attack; Used to calculate the correlation of operating parameter indicators and obtain the defense performance parameters of network links; used to evaluate the event response capability of network links when attacked; Used for vulnerability risk parameters of network links when attacked; The data processing and analysis module is used to organize and analyze relevant test data in network attack tests, package the test data into comparison parameter packages, and upload them to the feature database; Real-time monitoring and matching module, which is used to continuously monitor the real-time operating parameter indicators of network links and match them with the comparison parameter packages in the feature database to identify network attacks and their types of attack events; Wherein, the central cloud management platform module includes a security risk assessment model building unit and a security intervention decision unit; The security risk assessment model building unit is used to build a network security assessment model and calculate the security risk assessment coefficient by integrating the network attack event type, defense performance parameters, event response capability index and vulnerability risk parameters; The security intervention decision unit is used to evaluate the security risk assessment coefficient, decide whether it is necessary to intervene in the security risk of the network link, and take corresponding measures.

10. A network security dynamic assessment system based on cloud-edge collaboration according to claim 9, characterized in that: The edge computing platform module specifically includes: An intelligent agent deployment unit, used to deploy intelligent agents on various end devices that require network security assessment; An access and control authority acquisition unit, used to obtain access and control authority on a terminal device to perform network attack testing; A network attack test unit, used to select appropriate simulated attack tools based on preset network attack event types; An operation parameter indicator monitoring unit is used to monitor the operation parameter indicators of the network link before and after the network attack; A key attack event calculation unit, used to calculate the correlation between the network attack event type and the operation parameter index, and calculate the key attack event index; A defense performance parameter calculation unit is used to obtain changes in key attack event indicators and average transmission performance utilization, and calculate defense performance parameters of network links; An event response capability evaluation unit, used to obtain event response parameters and evaluate the event response capability of a network link when it is attacked; The vulnerability risk assessment unit is used to evaluate the network link using vulnerability scanning tools and security auditing tools, generate vulnerability information data sets, and calculate the vulnerability risk parameters of the network link.

Images