Internet space security testing method and system based on network equipment micro data

Abstract

The present invention discloses an Internet space security testing method and system based on network device micro data, which solves the shortcomings of existing methods in terms of lack of attention to micro data of a single network device and security protection of associated devices. The method includes obtaining micro data of network devices including physical properties, connection characteristics, communication behaviors and historical usage patterns, and modeling them as tensors, determining the acquisition frequency through sampling boundaries; collecting behavioral feature data according to the acquisition frequency, and extracting and marking abnormal communication features through anomaly detection methods; calculating risk scores based on abnormal communication features, generating risk level labels, and performing real-time early warning and in-depth analysis on high-risk devices; and calculating threat perception indexes for associated devices, prioritizing and allocating protection resources to ensure that potential threats are fully protected. The present invention can achieve accurate risk assessment and dynamic protection, and improve Internet space security.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an Internet space security testing method and system based on network device micro data. Background Art

[0002] With the rapid development of the Internet, network equipment is increasingly used in various information systems, and the complexity and diversity of Internet space security threats are also increasing. Current Internet space security testing methods are usually based on big data technology, which identifies potential threats by collecting and analyzing massive network data. These traditional methods mainly rely on macro data analysis, such as large-scale data mining of the entire network's traffic, user behavior, and attack patterns to detect network anomalies. However, this macro data analysis method has limitations in refined detection, especially when facing the micro-behavioral characteristics of individual network devices, and cannot provide detailed risk assessment and real-time security protection.

[0003] Although existing Internet space security testing methods can discover certain potential threats through big data analysis, they often lack attention to the "micro data" of a single network device. In addition, existing Internet space security testing methods often only provide early warning and protection for network devices with abnormal behavior characteristics, while ignoring the risks of network devices associated with them. In the Internet space, if a network device is attacked by a network attack or data is contaminated, its associated network devices may also have potential network security threats. How to effectively protect its associated devices with potential network security threats is also a problem that needs to be solved urgently. Summary of the invention

[0004] In order to solve the above technical problems, a method and system for Internet space security testing based on micro data of network devices are provided. This technical solution solves the problem that although the existing Internet space security testing methods proposed in the above background technology can discover certain potential threats through big data analysis, they often lack attention to the "micro data" of a single network device and cannot provide detailed risk assessment and real-time security protection. The existing Internet space security testing methods often only provide early warning and protection for network devices with abnormal behavior characteristics, but ignore the risks of the network devices associated with them, and cannot effectively protect the associated devices with potential network security threats.

[0005] In order to achieve the above purpose, the technical solution adopted by the present invention is:

[0006] The Internet space security testing method based on network equipment micro data includes:

[0007] Acquire network device micro data, the micro data including physical attribute information, connection characteristic information, communication behavior data and historical usage patterns of the network device;

[0008] The network device micro data is modeled as a tensor, and the acquisition frequency is determined according to the theoretical sampling bound of tensor filling;

[0009] Collecting network device behavior feature data according to the collection frequency, wherein the network device behavior feature data includes communication protocol features, traffic features, access frequency, time features, data transmission direction, and session features;

[0010] Based on the behavior feature data of network devices, abnormal communication features are extracted and marked through communication traffic anomaly detection methods;

[0011] Based on abnormal communication characteristics, a security risk assessment model is used to calculate the risk score of network devices and generate corresponding risk level labels;

[0012] According to the risk level label, it can provide real-time warning for high-risk network devices and automatically trigger in-depth security analysis;

[0013] Extract the communication link event log information of high-risk network devices, perform behavioral correlation analysis on the communication links of high-risk network devices, and mark potential threat identifiers;

[0014] Based on the potential threat identification, a threat perception index is generated for the potential security threats of network devices associated with high-risk network devices;

[0015] According to the threat perception index, network devices associated with high-risk network devices are prioritized and corresponding security protection resources and protection strategies are allocated;

[0016] Based on the network equipment and communication links in the Internet space, establish a full-link Internet space topology map;

[0017] Based on the Internet space topology map, the Internet space security index is calculated according to the risk scores of high-risk network devices and the threat perception index of their associated devices;

[0018] Evaluate and optimize the security status of network equipment and communication links in the Internet space based on the Internet Space Security Index:

[0019] The calculation formula of threat perception index is:

[0020]

[0021] In the formula, is the threat perception index, is the total number of threat indicators, For the The weight of the threat indicator, For the The quantitative value of the threat indicator, is the base of natural logarithms, is the time decay factor.

[0022] Preferably, the network device micro data is modeled as a tensor, and the acquisition frequency is determined according to a theoretical sampling boundary filled with the tensor, specifically including:

[0023] Based on the four dimensions of physical attribute information, connection characteristic information, communication behavior data and historical usage patterns of network equipment micro data, a multi-dimensional tensor structure is formed;

[0024] Perform preprocessing operations such as normalization, missing value filling and noise filtering on network equipment micro data;

[0025] The preprocessed data is decomposed using tensor decomposition method to extract the main features and construct a low-rank tensor model;

[0026] Based on the low-rank tensor model, a sampling bound formula in tensor filling theory is applied to calculate the minimum sampling frequency;

[0027] According to the minimum sampling frequency, a data collection strategy is obtained, and the collection frequency is acquired according to the data collection strategy.

[0028] Preferably, collecting network device behavior feature data according to the collection frequency specifically includes:

[0029] Acquire the actual operating environment and security requirement information of the network device, and define the upper and lower limits of the collection frequency in combination with the collection frequency;

[0030] Set different collection modes for different network devices according to the collection frequency and the upper and lower limits of the collection frequency, including time interval collection and event-triggered collection;

[0031] Deploy corresponding collection modules for network devices according to the collection method;

[0032] The collection module collects network device behavior feature data.

[0033] Preferably, the extracting and marking abnormal communication features by a communication traffic anomaly detection method based on the network device behavior feature data specifically includes:

[0034] Performing preprocessing operations of data cleaning and data standardization on the network device behavior feature data;

[0035] Extract key features from the pre-processed network device behavior feature data, including traffic size, packet frequency, session duration, protocol type, and source and destination IP distribution;

[0036] Use feature selection algorithm to select the most discriminative features for anomaly detection and reduce the dimension;

[0037] Obtain historical normal communication data, and set initial thresholds of key features using statistical analysis methods based on the historical normal communication data;

[0038] Based on the set initial threshold, each key feature is detected to determine whether it exceeds the normal range. If it exceeds the normal range, it is marked as an abnormal communication feature;

[0039] If abnormal communication features are detected, they will be marked and detailed information on their occurrence time, number of occurrences, degree of abnormality, involved IP addresses, communication protocols and associated network devices will be recorded.

[0040] Preferably, the risk score of the network device is calculated based on the abnormal communication characteristics using a security risk assessment model, and a corresponding risk level label is generated, specifically including:

[0041] Obtaining category attributes of abnormal communication features, and assigning weights to abnormal communication features of different categories according to the category attributes of the abnormal communication features, where the category attributes include static abnormal communication features and dynamic abnormal communication features;

[0042] Multiply the weight of each abnormal communication feature by its corresponding tag, where the tag includes the degree of abnormality and the number of occurrences;

[0043] Calculate the comprehensive risk score of network devices through the security risk assessment model;

[0044] The calculation formula for the comprehensive risk score of network equipment is:

[0045]

[0046] In the formula, Provide a comprehensive risk score for network devices. is the total number of static abnormal communication features, is the total number of dynamic abnormal communication features, For the The weight of static abnormal communication features, For the The abnormal degree of the static abnormal communication characteristics, For the The weight of the dynamic abnormal communication features, For the The abnormal degree of dynamic abnormal communication characteristics, For the The time when the dynamic abnormal communication characteristics occur, is the base of natural logarithms, is the time decay factor;

[0047] Standardizing the comprehensive risk score and mapping the score range to a predetermined standard interval, wherein the standard interval is 0-100;

[0048] According to the standardized risk scores, risk levels are set, including low risk, medium risk and high risk;

[0049] Map the risk scores of network devices to corresponding risk levels and generate clear risk level labels.

[0050] Preferably, the method of providing a real-time warning for high-risk network devices based on risk level labels and automatically triggering in-depth security analysis specifically includes:

[0051] Obtain the risk level label of the network device. If the risk level label of the network device reaches or exceeds the high risk level, generate warning information, which includes the physical attribute information of the network device, the risk score, the category attribute of the abnormal communication feature, the occurrence time and the number of occurrences of the abnormal communication feature, and output the warning information for display;

[0052] Obtain historical log data, traffic data, and configuration data of network devices, conduct in-depth security analysis of network devices based on early warning information, and determine whether it is normal behavior through machine learning algorithms;

[0053] If the warning information is consistent with the normal historical log data, traffic data and configuration data of the network device, the warning for the network device is cancelled, and the cause of the warning and the analysis result are recorded;

[0054] If the warning information does not conform to the normal historical log data, traffic data and configuration data of the network equipment, the detected abnormal communication characteristics are traced to determine the abnormal source, attack path and attack method, and identify the attack mode;

[0055] Based on the described attack patterns, develop protection strategies, including isolating infected devices, blocking suspicious traffic, and updating security policies.

[0056] Preferably, extracting the communication link event log information of the high-risk network device, performing behavior correlation analysis on the communication link of the high-risk network device, and marking the potential threat identifier specifically includes:

[0057] Obtain communication link event log information of network devices associated with high-risk network devices;

[0058] The event log information includes data exchange log, access control log, operation log and communication log;

[0059] Compare the actual operation behaviors of network devices associated with high-risk network devices with normal event log information to detect whether there are abnormal behaviors that deviate from the normal pattern;

[0060] If abnormal behavior is detected, detecting whether there is abnormal communication feature based on the abnormal behavior;

[0061] If there are abnormal communication features, the warning information will be output and displayed;

[0062] If the warning information does not conform to the normal historical log data, traffic data and configuration data of the network device, the detected abnormal communication characteristics are traced to determine the abnormal source, attack path and attack method, and identify the attack mode;

[0063] Develop protection strategies based on the described attack patterns, including isolating infected devices, blocking suspicious traffic, and updating security policies;

[0064] Identify specific threat patterns based on early warning information;

[0065] Obtain category attributes of threat patterns, including malware propagation, data leakage, traffic attack, and data pollution, and mark them as potential threat identifiers.

[0066] Preferably, generating a threat perception index for a potential security threat of a network device associated with a high-risk network device based on the potential threat identification specifically includes:

[0067] Based on potential threat identification, obtain threat indicators, including threat probability, threat impact scope, threat duration, threat traffic size, threat intelligence and vulnerability status;

[0068] Quantify the value of each threat indicator and assign weights to the threat indicators according to the category attributes of the threat pattern;

[0069] The threat perception index is calculated based on the numerical value of the quantified threat indicator and the threat indicator weight;

[0070] Prioritize network devices associated with high-risk network devices based on the threat perception index;

[0071] Based on the priority sorting results, security protection resources, including human resources, technical resources, and financial resources, are allocated to high-priority network devices to strengthen their network monitoring and implement stricter access control;

[0072] Assign corresponding protection strategies to high-priority network devices based on the category attributes of threat patterns and potential threat identification, including updating firewall rules, configuring intrusion detection systems, and implementing network segmentation and isolation strategies.

[0073] Preferably, the calculating of the Internet space security index and the evaluation and optimization of the security status of network devices and communication links in the Internet space according to the Internet space security index specifically include:

[0074] Based on the network equipment and communication links in the Internet space, establish a full-link Internet space topology map;

[0075] Based on the Internet space topology map, the Internet space security index is calculated according to the risk scores of high-risk network devices and the threat perception index of their associated devices;

[0076] The nodes in the Internet space topology map are defined as all network devices in the Internet space, and the edges are defined as the communication links between the nodes. The graph structure of the Internet space topology map is:

[0077]

[0078] In the formula, is a node set, representing all network devices, is a set of edges, representing the communication links between devices;

[0079] According to the risk score and risk level label of network devices, obtain a collection of network devices with high risk levels;

[0080] Obtain a set of high-priority network devices based on the threat perception index and priority sorting results;

[0081] Based on the Internet space topology graph, the risk index of a single communication link is calculated. For each edge in the topology graph, , where For high-risk network devices, For the high-priority network devices associated with it, the risk index calculation formula for a single communication link is:

[0082]

[0083] In the formula, For the The risk index of the communication links, For high risk devices The comprehensive risk score of The high priority network device associated with it Threat perception index;

[0084] Accumulate the risk index of all links and remove duplicate values;

[0085] For all links in the topology of The Internet space link risk index is obtained by accumulation, where the accumulation calculation formula is:

[0086]

[0087] In the formula, is the Internet space link risk index, is the total number of links in the topology graph;

[0088] The same network devices may exist in different links. During the accumulation process, the risk index of the communication link may be counted repeatedly. Use the deduplication algorithm to obtain the deduplicated link set and adjust the accumulation calculation formula:

[0089]

[0090] In the formula, is the set of links after deduplication;

[0091] Based on the Internet space link risk index, the Internet space security index is calculated, and the Internet space link risk index is standardized to the range of 0-100. The calculation formula is:

[0092]

[0093] In the formula, is the overall Internet space security index, The maximum risk sum is pre-set based on network size and security requirements;

[0094] set up If the security threshold is exceeded, the corresponding optimization measures will be taken, including: hardware upgrades, patch updates and configuration optimization for high-risk devices, security audits and reinforcement of related devices, lowering their threat perception index, isolating high-risk links, limiting their impact on other network parts, strengthening traffic monitoring of high-risk links, and implementing strict traffic filtering and access control strategies.

[0095] Furthermore, an Internet space security testing system based on network device micro data is proposed, which is used to implement any of the above security testing methods, including:

[0096] A data acquisition module, the data acquisition module is used to acquire micro data of network devices, including physical attribute information, connection characteristic information, communication behavior data and historical usage patterns;

[0097] A tensor modeling module, which is used to model the acquired network device micro data into a multi-dimensional tensor structure, calculate the minimum acquisition frequency through tensor filling theory and sampling bounds, and generate a data acquisition strategy;

[0098] A data collection module, which dynamically collects behavioral characteristic data of network devices according to data collection strategies and collection frequencies, and supports multiple collection methods, including time interval collection and event-triggered collection;

[0099] Anomaly detection module, which extracts and marks abnormal communication features based on network device behavior feature data, including features extraction, threshold setting, anomaly detection and marking, etc., records detailed information of detected abnormal behaviors, and uses a security risk assessment model to calculate the risk score of the network device, standardizes the risk score, and generates a corresponding risk level label;

[0100] Real-time warning and in-depth analysis module, which issues real-time warnings to high-risk network devices based on risk level labels, automatically triggers in-depth security analysis, determines whether the behavior is abnormal through machine learning algorithms, and performs source tracing analysis on abnormal behavior;

[0101] A correlation analysis module, which is used to extract full-link event log information of high-risk network devices, perform behavioral correlation analysis on their operation links, and identify potential threat identifiers, including detecting abnormal behaviors and their related communication characteristics;

[0102] A threat perception module, which calculates a threat perception index based on potential threat identification, including threat indicator quantification, weight allocation, and index calculation to reflect the degree of potential threats, prioritizes high-risk network devices and their associated devices according to the threat perception index, and allocates corresponding security protection resources and protection strategies according to the priority;

[0103] The log management and visualization module is used to manage the operation records and analysis results of each module of the system and provide a visual display interface.

[0104] Compared with the prior art, the present invention has the following beneficial effects:

[0105] The Internet space security testing method and system based on the micro data of network equipment proposed in this scheme can achieve more accurate risk identification and assessment by modeling and analyzing the micro data of network equipment. The analysis method based on micro data makes up for the shortcomings of traditional big data analysis in detecting security risks faced by individual network devices in the Internet space. It can dynamically adjust the collection frequency and efficiently extract abnormal features through anomaly detection methods, thereby realizing real-time early warning and in-depth analysis of high-risk equipment.

[0106] In addition, this solution will also conduct security checks on associated devices of high-risk devices, prioritize them and allocate resources by calculating the threat perception index, and ensure that associated devices with potential security threats can also be protected in a timely manner through priority response and dynamic adjustment of protection strategies. BRIEF DESCRIPTION OF THE DRAWINGS

[0107] Figure 1 This is a flow chart of the Internet space security testing method based on network device micro data proposed by the present invention;

[0108] Figure 2 A flow chart for obtaining acquisition frequency in the present invention;

[0109] Figure 3 This is a flow chart of detecting abnormal communication features in the present invention;

[0110] Figure 4 A flow chart for calculating risk scores in the present invention;

[0111] Figure 5 This is a flowchart of early warning information analysis in the present invention;

[0112] Figure 6 A flowchart for marking threat identification in the present invention;

[0113] Figure 7 This is a flow chart for calculating the Internet space security index in the present invention;

[0114] Figure 8 This is a structural block diagram of the Internet space security testing system based on network equipment micro data proposed by the present invention. DETAILED DESCRIPTION

[0115] The following description is used to disclose the present invention so that those skilled in the art can implement the present invention. The preferred embodiments described below are only examples, and those skilled in the art may think of other obvious variations.

[0116] Reference Figure 1 - Figure 7 As shown, the Internet space security testing method based on network equipment micro data includes:

[0117] Acquire network device micro data, the micro data including physical attribute information, connection characteristic information, communication behavior data and historical usage patterns of the network device;

[0118] The network device micro data is modeled as a tensor, and the acquisition frequency is determined according to the theoretical sampling bound of tensor filling;

[0119] Collecting network device behavior feature data according to the collection frequency, wherein the network device behavior feature data includes communication protocol features, traffic features, access frequency, time features, data transmission direction, and session features;

[0120] Based on the behavior feature data of network devices, abnormal communication features are extracted and marked through communication traffic anomaly detection methods;

[0121] Based on abnormal communication characteristics, a security risk assessment model is used to calculate the risk score of network devices and generate corresponding risk level labels;

[0122] According to the risk level label, it can provide real-time warning for high-risk network devices and automatically trigger in-depth security analysis;

[0123] Extract the communication link event log information of high-risk network devices, perform behavioral correlation analysis on the communication links of high-risk network devices, and mark potential threat identifiers;

[0124] Based on the potential threat identification, a threat perception index is generated for the potential security threats of network devices associated with high-risk network devices;

[0125] According to the threat perception index, network devices associated with high-risk network devices are prioritized and corresponding security protection resources and protection strategies are allocated;

[0126] Based on the network equipment and communication links in the Internet space, establish a full-link Internet space topology map;

[0127] Based on the Internet space topology map, the Internet space security index is calculated according to the risk scores of high-risk network devices and the threat perception index of their associated devices;

[0128] Evaluate and optimize the security status of network equipment and communication links in the Internet space based on the Internet Space Security Index:

[0129] The calculation formula of threat perception index is:

[0130]

[0131] In the formula, is the threat perception index, is the total number of threat indicators, For the The weight of the threat indicator, For the The quantitative value of the threat indicator, is the base of natural logarithms, is the time decay factor.

[0132] Furthermore, the micro data of network devices is modeled as a tensor, and the acquisition frequency is determined according to the theoretical sampling bounds of tensor filling, including:

[0133] Based on the four dimensions of physical attribute information, connection characteristic information, communication behavior data and historical usage patterns of network equipment micro data, a multi-dimensional tensor structure is formed;

[0134] Perform preprocessing operations such as normalization, missing value filling and noise filtering on network equipment micro data;

[0135] The preprocessed data is decomposed using tensor decomposition method to extract the main features and construct a low-rank tensor model;

[0136] Based on the low-rank tensor model, a sampling bound formula in tensor filling theory is applied to calculate the minimum sampling frequency;

[0137] According to the minimum sampling frequency, a data collection strategy is obtained, and the collection frequency is acquired according to the data collection strategy.

[0138] Specifically, based on the four core dimensions of network devices, including physical attribute information, connection characteristic information, communication behavior data and historical usage patterns, the micro data is organized to form a multidimensional tensor structure to describe the complex characteristics of the device in a high-dimensional space. The micro data of network devices is normalized to ensure the consistency of dimensions between different characteristics. Missing values ​​are filled to reduce the errors caused by incomplete data. The filling method can use average values, interpolation or prediction models, etc., perform noise filtering, remove abnormal data points or error data to ensure data quality and model accuracy. Tensor decomposition methods such as high-order singular value decomposition (HOSVD) are used to decompose the preprocessed multidimensional tensor, extract the main features in the data, and construct a low-rank tensor model, thereby reducing the tensor dimension and simplifying the computational complexity while ensuring information integrity. Based on the constructed low-rank tensor model, the sampling bound formula in the tensor filling theory is applied to calculate the minimum sampling frequency of the tensor. The sampling bound formula determines the minimum frequency of data collection based on the rate of change of data features and the dimensional relationship of the low-rank model, ensuring the optimal data collection efficiency without losing key information.

[0139] Furthermore, according to the collection frequency, the network device behavior characteristic data is collected, including:

[0140] Acquire the actual operating environment and security requirement information of the network device, and define the upper and lower limits of the collection frequency in combination with the collection frequency;

[0141] Set different collection modes for different network devices according to the collection frequency and the upper and lower limits of the collection frequency, including time interval collection and event-triggered collection;

[0142] Deploy corresponding collection modules for network devices according to the collection method;

[0143] The collection module collects network device behavior feature data.

[0144] Specifically, obtain the working environment information of network equipment, including equipment type, network location, and load conditions, evaluate its role and importance in the network, obtain the security requirement information of the equipment, including data sensitivity, equipment importance, etc., and determine the monitoring priority. For example, critical network equipment or high-risk equipment usually requires a higher acquisition frequency. According to the theoretical sampling boundary of tensor modeling and the stability of the equipment, determine the minimum acquisition frequency required for collecting data. The lower limit acquisition frequency of low-risk or stable equipment will be lower to save resources. Combined with data sensitivity and equipment importance, set a higher acquisition frequency upper limit for important or high-risk equipment to achieve intensive collection of critical data. The high upper limit frequency ensures a quick response when an incident occurs. While setting upper and lower limits, A dynamic adjustment mechanism is introduced to optimize the upper and lower limits of the collection frequency in a timely manner according to the real-time monitoring results and environmental changes to adapt to the current network needs. There are two collection methods: time interval collection, which uses fixed time interval collection for low-risk devices and most network devices. The lower limit of the collection frequency is usually used to collect behavioral feature data at a regular interval. This method is suitable for devices with relatively stable status to ensure regular updating of basic data for important network devices; event-triggered collection is set. When specific events are detected, such as abnormal traffic, sudden increase in access frequency, abnormal changes in connection status, etc., temporary collection is triggered, the collection frequency is increased to the upper limit, and the regular collection frequency is restored after the event ends. This method ensures that the device is monitored more frequently under abnormal conditions.

[0145] Furthermore, based on the network device behavior feature data, the abnormal communication features are extracted and marked by the communication traffic anomaly detection method, specifically including:

[0146] Performing preprocessing operations of data cleaning and data standardization on the network device behavior feature data;

[0147] Extract key features from the pre-processed network device behavior feature data, including traffic size, packet frequency, session duration, protocol type, and source and destination IP distribution;

[0148] Use feature selection algorithm to select the most discriminative features for anomaly detection and reduce the dimension;

[0149] Obtain historical normal communication data, and set initial thresholds of key features using statistical analysis methods based on the historical normal communication data;

[0150] Based on the set initial threshold, each key feature is detected to determine whether it exceeds the normal range. If it exceeds the normal range, it is marked as an abnormal communication feature;

[0151] If abnormal communication features are detected, they will be marked and detailed information on their occurrence time, number of occurrences, degree of abnormality, involved IP addresses, communication protocols and associated network devices will be recorded.

[0152] Specifically, historical normal communication data is obtained to establish a baseline for normal communication behavior. Based on historical data, initial thresholds are set for each key feature using statistical analysis methods such as mean analysis. The initial thresholds reflect the reasonable range of normal communication characteristics and provide standards for subsequent anomaly detection. Based on the set initial thresholds, real-time or batch network device behavior feature data are detected. If a feature value exceeds the set threshold range, it is considered to be abnormal behavior and is marked as an abnormal communication feature.

[0153] Furthermore, based on the abnormal communication characteristics, the security risk assessment model is used to calculate the risk score of the network device and generate the corresponding risk level label, including:

[0154] Obtaining category attributes of abnormal communication features, and assigning weights to abnormal communication features of different categories according to the category attributes of the abnormal communication features, where the category attributes include static abnormal communication features and dynamic abnormal communication features;

[0155] Multiply the weight of each abnormal communication feature by its corresponding tag, where the tag includes the degree of abnormality and the number of occurrences;

[0156] Calculate the comprehensive risk score of network devices through the security risk assessment model;

[0157] The calculation formula for the comprehensive risk score of network equipment is:

[0158]

[0159] In the formula, Provide a comprehensive risk score for network devices. is the total number of static abnormal communication features, is the total number of dynamic abnormal communication features, For the The weight of static abnormal communication features, For the The abnormal degree of the static abnormal communication characteristics, For the The weight of the dynamic abnormal communication features, For the The abnormal degree of dynamic abnormal communication characteristics, For the The time when the dynamic abnormal communication characteristics occur, is the base of natural logarithms, is the time decay factor;

[0160] Standardizing the comprehensive risk score and mapping the score range to a predetermined standard interval, wherein the standard interval is 0-100;

[0161] According to the standardized risk scores, risk levels are set, including low risk, medium risk and high risk;

[0162] Map the risk scores of network devices to corresponding risk levels and generate clear risk level labels.

[0163] Specifically, the category attributes are extracted from the abnormal communication features, and the abnormal communication features are divided into two categories: static abnormal communication features and dynamic abnormal communication features. Static abnormal communication features refer to anomalies related to the inherent properties of the device or historical behavior patterns, while dynamic abnormal communication features are related to recent activities and real-time communication behaviors. The time decay factor is obtained. , which is used to reflect the weakening impact of abnormal events over time. Combined with the time decay factor, a higher weight is given to dynamic abnormal communication features to reflect their greater impact on current risks. The risk scores of network devices are mapped to corresponding risk levels to generate clear risk level labels. For example, risk scores in the range of 0-40 are defined as low risk, risk scores in the range of 40-70 are defined as medium risk, and risk scores in the range of 70-100 are defined as high risk.

[0164] Furthermore, according to the risk level label, real-time warnings are issued for high-risk network devices, and in-depth security analysis is automatically triggered, including:

[0165] Obtain the risk level label of the network device. If the risk level label of the network device reaches or exceeds the high risk level, generate warning information, which includes the physical attribute information of the network device, the risk score, the category attribute of the abnormal communication feature, the occurrence time and the number of occurrences of the abnormal communication feature, and output the warning information for display;

[0166] Obtain historical log data, traffic data, and configuration data of network devices, conduct in-depth security analysis of network devices based on early warning information, and determine whether it is normal behavior through machine learning algorithms;

[0167] If the warning information is consistent with the normal historical log data, traffic data and configuration data of the network device, the warning for the network device is cancelled, and the cause of the warning and the analysis result are recorded;

[0168] If the warning information does not conform to the normal historical log data, traffic data and configuration data of the network equipment, the detected abnormal communication characteristics are traced to determine the abnormal source, attack path and attack method, and identify the attack mode;

[0169] Based on the described attack patterns, develop protection strategies, including isolating infected devices, blocking suspicious traffic, and updating security policies.

[0170] Specifically, after the warning is generated, the historical log data, traffic data and configuration data of the device are automatically retrieved from the log management module of the network device to ensure the comprehensiveness of the analysis process. Machine learning algorithms such as classification algorithms are used to compare the current abnormal behavior with historical data to determine whether the behavior conforms to the normal mode. If the warning information matches the historical normal behavior data of the device, the current behavior is considered to be a normal fluctuation of the network device, and the warning is canceled. The reason for canceling the warning and the results of the in-depth security analysis are recorded for subsequent review. If the warning information does not match the historical normal behavior data of the device, the current behavior is considered to be a network attack, and the detected abnormal communication characteristics are traced to determine the source of the abnormality, the attack path and the attack method, and the attack mode is identified. According to the identified attack mode, targeted protection strategies are generated, such as isolating the detected infected or abnormal devices from the network to prevent further spread of threats. According to the source and purpose of the abnormal communication characteristics, firewall or intrusion prevention system rules are set to block suspicious inbound and outbound traffic. According to the detected attack characteristics, the existing security policies and rule bases are updated to improve the accuracy of subsequent detection and the strength of protection.

[0171] Furthermore, the communication link event log information of high-risk network devices is extracted, the communication links of high-risk network devices are analyzed for behavioral correlation, and potential threat identifiers are marked, including:

[0172] Obtain communication link event log information of network devices associated with high-risk network devices;

[0173] The event log information includes data exchange log, access control log, operation log and communication log;

[0174] Compare the actual operation behaviors of network devices associated with high-risk network devices with normal event log information to detect whether there are abnormal behaviors that deviate from the normal pattern;

[0175] If abnormal behavior is detected, detecting whether there is abnormal communication feature based on the abnormal behavior;

[0176] If there are abnormal communication features, the warning information will be output and displayed;

[0177] If the warning information does not conform to the normal historical log data, traffic data and configuration data of the network device, the detected abnormal communication characteristics are traced to determine the abnormal source, attack path and attack method, and identify the attack mode;

[0178] Develop protection strategies based on the described attack patterns, including isolating infected devices, blocking suspicious traffic, and updating security policies;

[0179] Identify specific threat patterns based on early warning information;

[0180] Obtain category attributes of threat patterns, including malware propagation, data leakage, traffic attack, and data pollution, and mark them as potential threat identifiers.

[0181] Specifically, in the Internet space, all network devices are interconnected. If one of the network devices is attacked by a network attack or data is contaminated, then its associated devices are likely to be attacked or contaminated as well. Therefore, it is necessary to detect its associated devices to determine whether there is a potential threat. Event log information is extracted from all network devices associated with high-risk network devices, including data exchange logs, access control logs, operation logs, and communication logs. Based on historical event log information, a normal operation behavior pattern library of associated network devices is established, and the actual operation behavior of the associated network devices is compared with the normal behavior pattern library to identify abnormal behaviors that deviate from the normal pattern. If an operation behavior that deviates from the normal pattern is detected, the abnormal communication characteristics of the behavior are further analyzed. If abnormal communication characteristics exist, an early warning message is generated. If the early warning message shows that the device has significant abnormalities, the abnormal communication characteristics are traced and analyzed to determine the source of the abnormality, attack path and attack method, and a corresponding protection strategy is formulated. If the early warning message shows that the device does not have significant abnormalities, even if the detection is consistent with the historical normal pattern, the early warning mark is not cancelled to ensure continuous monitoring so that a quick response can be made when risks arise.

[0182] Furthermore, based on the potential threat identification, a threat perception index is generated for the potential security threats of network devices associated with the high-risk network devices, specifically including:

[0183] Based on potential threat identification, obtain threat indicators, including threat probability, threat impact scope, threat duration, threat traffic size, threat intelligence and vulnerability status;

[0184] Quantify the value of each threat indicator and assign weights to the threat indicators according to the category attributes of the threat pattern;

[0185] The threat perception index is calculated based on the numerical value of the quantified threat indicator and the threat indicator weight;

[0186] The calculation formula of threat perception index is:

[0187]

[0188] In the formula, is the threat perception index, is the total number of threat indicators, For the The weight of the threat indicator, For the The quantitative value of the threat indicator, is the base of natural logarithms, is the time decay factor;

[0189] The calculated threat perception index Performing standardization processing to map the index range to a predetermined score range, wherein the standard score range is 0-100;

[0190] Prioritize network devices associated with high-risk network devices based on the threat perception index;

[0191] Based on the priority sorting results, security protection resources, including human resources, technical resources, and financial resources, are allocated to high-priority network devices to strengthen their network monitoring and implement stricter access control;

[0192] Assign corresponding protection strategies to high-priority network devices based on the category attributes of threat patterns and potential threat identification, including updating firewall rules, configuring intrusion detection systems, and implementing network segmentation and isolation strategies.

[0193] Furthermore, the Internet space security index is calculated, and the security status of network equipment and communication links in the Internet space is evaluated and optimized according to the Internet space security index, including:

[0194] Based on the network equipment and communication links in the Internet space, establish a full-link Internet space topology map;

[0195] Based on the Internet space topology map, the Internet space security index is calculated according to the risk scores of high-risk network devices and the threat perception index of their associated devices;

[0196] The nodes in the Internet space topology map are defined as all network devices in the Internet space, and the edges are defined as the communication links between the nodes. The graph structure of the Internet space topology map is:

[0197]

[0198] In the formula, is a node set, representing all network devices, is a set of edges, representing the communication links between devices;

[0199] According to the risk score and risk level label of network devices, obtain a collection of network devices with high risk levels;

[0200] Obtain a set of high-priority network devices based on the threat perception index and priority sorting results;

[0201] Based on the Internet space topology graph, the risk index of a single communication link is calculated. For each edge in the topology graph, , where For high-risk network devices, For the high-priority network devices associated with it, the risk index calculation formula for a single communication link is:

[0202]

[0203] In the formula, For the The risk index of the communication links, For high risk devices The comprehensive risk score of The high priority network device associated with it Threat perception index;

[0204] Accumulate the risk index of all links and remove duplicate values;

[0205] For all links in the topology of The Internet space link risk index is obtained by accumulation, where the accumulation calculation formula is:

[0206]

[0207] In the formula, is the Internet space link risk index, is the total number of links in the topology graph;

[0208] The same network devices may exist in different links. During the accumulation process, the risk index of the communication link may be counted repeatedly. Use the deduplication algorithm to obtain the deduplicated link set and adjust the accumulation calculation formula:

[0209]

[0210] In the formula, is the set of links after deduplication;

[0211] Based on the Internet space link risk index, the Internet space security index is calculated, and the Internet space link risk index is standardized to the range of 0-100. The calculation formula is:

[0212]

[0213] In the formula, is the overall Internet space security index, The maximum risk sum is pre-set based on network size and security requirements;

[0214] set up If the security threshold is exceeded, the corresponding optimization measures will be taken, including: hardware upgrades, patch updates and configuration optimization for high-risk devices, security audits and reinforcement of related devices, lowering their threat perception index, isolating high-risk links, limiting their impact on other network parts, strengthening traffic monitoring of high-risk links, and implementing strict traffic filtering and access control strategies.

[0215] Specifically, the Internet Space Security Index It is a comprehensive security quantitative indicator used to evaluate the security status of the entire Internet space. By establishing an Internet space topology map, identifying the risk status of network devices and their links, and combining the risk scores of high-risk devices and the threat perception index of associated devices, an index is finally obtained to quantify the overall security of the Internet space. The range is usually from 0 to 100, with higher values ​​indicating higher overall risk and worse security.

[0216] Further, see Figure 8 As shown, an Internet space security testing system based on network device micro data is proposed, which is used to implement any of the security testing methods as described above, including:

[0217] A data acquisition module, the data acquisition module is used to acquire micro data of network devices, including physical attribute information, connection characteristic information, communication behavior data and historical usage patterns;

[0218] A tensor modeling module, which is used to model the acquired network device micro data into a multi-dimensional tensor structure, calculate the minimum acquisition frequency through tensor filling theory and sampling bounds, and generate a data acquisition strategy;

[0219] A data collection module, which dynamically collects behavioral characteristic data of network devices according to data collection strategies and collection frequencies, and supports multiple collection methods, including time interval collection and event-triggered collection;

[0220] Anomaly detection module, which extracts and marks abnormal communication features based on network device behavior feature data, including features extraction, threshold setting, anomaly detection and marking, etc., records detailed information of detected abnormal behaviors, and uses a security risk assessment model to calculate the risk score of the network device, standardizes the risk score, and generates a corresponding risk level label;

[0221] Real-time warning and in-depth analysis module, which issues real-time warnings to high-risk network devices based on risk level labels, automatically triggers in-depth security analysis, determines whether the behavior is abnormal through machine learning algorithms, and performs source tracing analysis on abnormal behavior;

[0222] A correlation analysis module, which is used to extract full-link event log information of high-risk network devices, perform behavioral correlation analysis on their operation links, and identify potential threat identifiers, including detecting abnormal behaviors and their related communication characteristics;

[0223] A threat perception module, which calculates a threat perception index based on potential threat identification, including threat indicator quantification, weight allocation, and index calculation to reflect the degree of potential threats, prioritizes high-risk network devices and their associated devices according to the threat perception index, and allocates corresponding security protection resources and protection strategies according to the priority;

[0224] The log management and visualization module is used to manage the operation records and analysis results of each module of the system and provide a visual display interface.

[0225] To sum up, the advantages of the present invention are: by modeling and analyzing the micro data of network devices, more accurate risk identification and assessment can be achieved. The analysis method based on micro data makes up for the shortcomings of traditional big data analysis in detecting security risks faced by individual network devices in the Internet space. It can dynamically adjust the collection frequency and efficiently extract abnormal features through anomaly detection methods, thereby realizing real-time early warning and in-depth analysis of high-risk equipment.

[0226] Security inspections are carried out on the associated devices of high-risk devices. The threat perception index is calculated by analyzing the operation links and communication behaviors of the associated devices, and they are prioritized and resourced. This comprehensively improves the coverage of security inspections. Through priority response and dynamic adjustment of protection strategies, it ensures that associated devices with potential security threats can also be protected in a timely manner, effectively improving the security protection level of the overall network and strengthening the comprehensive security capabilities of the Internet space.

[0227] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The above embodiments and descriptions only describe the principles of the present invention. The present invention may be subject to various changes and improvements without departing from the spirit and scope of the present invention. These changes and improvements fall within the scope of the present invention. The scope of protection claimed by the present invention is defined by the attached claims and their equivalents.

Claims

1. An Internet space security testing method based on network device micro data, characterized in that: include: Acquire network device micro data, the micro data including physical attribute information, connection characteristic information, communication behavior data and historical usage patterns of the network device; The network device micro data is modeled as a tensor, and the acquisition frequency is determined according to the theoretical sampling bound of tensor filling; Collecting network device behavior feature data according to the collection frequency, wherein the network device behavior feature data includes communication protocol features, traffic features, access frequency, time features, data transmission direction, and session features; Based on the behavior feature data of network devices, abnormal communication features are extracted and marked through communication traffic anomaly detection methods; Based on abnormal communication characteristics, a security risk assessment model is used to calculate the risk score of network devices and generate corresponding risk level labels; According to the risk level label, it can provide real-time warning for high-risk network devices and automatically trigger in-depth security analysis; Extract the communication link event log information of high-risk network devices, perform behavioral correlation analysis on the communication links of high-risk network devices, and mark potential threat identifiers; Based on the potential threat identification, a threat perception index is generated for the potential security threats of network devices associated with high-risk network devices; According to the threat perception index, network devices associated with high-risk network devices are prioritized and corresponding security protection resources and protection strategies are allocated; Based on the network equipment and communication links in the Internet space, establish a full-link Internet space topology map; Based on the Internet space topology map, the Internet space security index is calculated according to the risk scores of high-risk network devices and the threat perception index of their associated devices; Evaluate and optimize the security status of network equipment and communication links in the Internet space based on the Internet Space Security Index: The calculation formula of threat perception index is: In the formula, is the threat perception index, is the total number of threat indicators, For the The weight of the threat indicator, For the The quantitative value of the threat indicator, is the base of natural logarithms, is the time decay factor.

2. The Internet space security testing method based on network device micro data according to claim 1 is characterized in that: The network device micro data is modeled as a tensor, and the acquisition frequency is determined according to the theoretical sampling bounds of tensor filling, specifically including: Based on the four dimensions of physical attribute information, connection characteristic information, communication behavior data and historical usage patterns of network equipment micro data, a multi-dimensional tensor structure is formed; Perform preprocessing operations such as normalization, missing value filling and noise filtering on network equipment micro data; The preprocessed data is decomposed using tensor decomposition method to extract the main features and construct a low-rank tensor model; Based on the low-rank tensor model, a sampling bound formula in tensor filling theory is applied to calculate the minimum sampling frequency; According to the minimum sampling frequency, a data collection strategy is obtained, and the collection frequency is acquired according to the data collection strategy.

3. The Internet space security testing method based on network device micro data according to claim 1 is characterized in that: The collecting of network device behavior characteristic data according to the collection frequency specifically includes: Acquire the actual operating environment and security requirement information of the network device, and define the upper and lower limits of the collection frequency in combination with the collection frequency; Set different collection modes for different network devices according to the collection frequency and the upper and lower limits of the collection frequency, including time interval collection and event-triggered collection; Deploy corresponding collection modules for network devices according to the collection method; The collection module collects network device behavior feature data.

4. The Internet space security testing method based on network device micro data according to claim 1 is characterized in that: The method of extracting and marking abnormal communication features based on the network device behavior feature data by using a communication traffic anomaly detection method specifically includes: Performing preprocessing operations of data cleaning and data standardization on the network device behavior feature data; Extract key features from the pre-processed network device behavior feature data, including traffic size, packet frequency, session duration, protocol type, and source and destination IP distribution; Use feature selection algorithm to select the most discriminative features for anomaly detection and reduce the dimension; Obtain historical normal communication data, and set initial thresholds of key features using statistical analysis methods based on the historical normal communication data; Based on the set initial threshold, each key feature is detected to determine whether it exceeds the normal range. If it exceeds the normal range, it is marked as an abnormal communication feature; If abnormal communication features are detected, they will be marked and detailed information on their occurrence time, number of occurrences, degree of abnormality, involved IP addresses, communication protocols and associated network devices will be recorded.

5. The Internet space security testing method based on network device micro data according to claim 1 is characterized in that: Based on the abnormal communication characteristics, the risk score of the network device is calculated using the security risk assessment model, and the corresponding risk level label is generated, which specifically includes: Obtaining category attributes of abnormal communication features, and assigning weights to abnormal communication features of different categories according to the category attributes of the abnormal communication features, where the category attributes include static abnormal communication features and dynamic abnormal communication features; Multiply the weight of each abnormal communication feature by its corresponding tag, where the tag includes the degree of abnormality and the number of occurrences; Calculate the comprehensive risk score of network devices through the security risk assessment model; The calculation formula for the comprehensive risk score of network equipment is: In the formula, Provide a comprehensive risk score for network devices. is the total number of static abnormal communication features, is the total number of dynamic abnormal communication features, For the The weight of static abnormal communication features, For the The abnormal degree of the static abnormal communication characteristics, For the The weight of the dynamic abnormal communication features, For the The abnormal degree of dynamic abnormal communication characteristics, For the The time when the dynamic abnormal communication characteristics occur, is the base of natural logarithms, is the time decay factor; Standardizing the comprehensive risk score and mapping the score range to a predetermined standard interval, wherein the standard interval is 0-100; According to the standardized risk scores, risk levels are set, including low risk, medium risk and high risk; Map the risk scores of network devices to corresponding risk levels and generate clear risk level labels.

6. The Internet space security testing method based on network device micro data according to claim 1 is characterized in that: According to the risk level label, high-risk network devices are given real-time warnings and deep security analysis is automatically triggered, including: Obtain the risk level label of the network device. If the risk level label of the network device reaches or exceeds the high risk level, generate warning information, which includes the physical attribute information of the network device, the risk score, the category attribute of the abnormal communication feature, the occurrence time and the number of occurrences of the abnormal communication feature, and output the warning information for display; Obtain historical log data, traffic data, and configuration data of network devices, conduct in-depth security analysis of network devices based on early warning information, and determine whether it is normal behavior through machine learning algorithms; If the warning information is consistent with the normal historical log data, traffic data and configuration data of the network device, the warning for the network device is cancelled, and the cause of the warning and the analysis result are recorded; If the warning information does not conform to the normal historical log data, traffic data and configuration data of the network equipment, the detected abnormal communication characteristics are traced to determine the abnormal source, attack path and attack method, and identify the attack mode; Based on the described attack patterns, develop protection strategies, including isolating infected devices, blocking suspicious traffic, and updating security policies.

7. The Internet space security testing method based on network device micro data according to claim 1 is characterized in that: The extracting of communication link event log information of high-risk network devices, performing behavior correlation analysis on the communication links of high-risk network devices, and marking potential threat identifiers specifically include: Obtain communication link event log information of network devices associated with high-risk network devices; The event log information includes data exchange log, access control log, operation log and communication log; Compare the actual operation behaviors of network devices associated with high-risk network devices with normal event log information to detect whether there are abnormal behaviors that deviate from the normal pattern; If abnormal behavior is detected, detecting whether there is abnormal communication feature based on the abnormal behavior; If there are abnormal communication features, the warning information will be output and displayed; If the warning information does not conform to the normal historical log data, traffic data and configuration data of the network device, the detected abnormal communication characteristics are traced to determine the abnormal source, attack path and attack method, and identify the attack mode; Develop protection strategies based on the described attack patterns, including isolating infected devices, blocking suspicious traffic, and updating security policies; Identify specific threat patterns based on early warning information; Obtain category attributes of threat patterns, including malware propagation, data leakage, traffic attack, and data pollution, and mark them as potential threat identifiers.

8. The Internet space security testing method based on network device micro data according to claim 1 is characterized in that: Generating a threat perception index for a potential security threat of a network device associated with a high-risk network device based on the potential threat identification specifically includes: Based on potential threat identification, obtain threat indicators, including threat probability, threat impact scope, threat duration, threat traffic size, threat intelligence and vulnerability status; Quantify the value of each threat indicator and assign weights to the threat indicators according to the category attributes of the threat pattern; The threat perception index is calculated based on the numerical value of the quantified threat indicator and the threat indicator weight; Prioritize network devices associated with high-risk network devices based on the threat perception index; Based on the priority sorting results, security protection resources, including human resources, technical resources, and financial resources, are allocated to high-priority network devices to strengthen their network monitoring and implement stricter access control; Assign corresponding protection strategies to high-priority network devices based on the category attributes of threat patterns and potential threat identification, including updating firewall rules, configuring intrusion detection systems, and implementing network segmentation and isolation strategies.

9. The Internet space security testing method based on network device micro data according to claim 1 is characterized in that: The calculation of the Internet space security index, and the evaluation and optimization of the security status of network equipment and communication links in the Internet space according to the Internet space security index, specifically include: Based on the network equipment and communication links in the Internet space, establish a full-link Internet space topology map; Based on the Internet space topology map, the Internet space security index is calculated according to the risk scores of high-risk network devices and the threat perception index of their associated devices; The nodes in the Internet space topology map are defined as all network devices in the Internet space, and the edges are defined as the communication links between the nodes. The graph structure of the Internet space topology map is: In the formula, is a node set, representing all network devices, is a set of edges, representing the communication links between devices; According to the risk score and risk level label of network devices, obtain a collection of network devices with high risk levels; Obtain a set of high-priority network devices based on the threat perception index and priority sorting results; Based on the Internet space topology graph, the risk index of a single communication link is calculated. For each edge in the topology graph, , where For high-risk network devices, For the high-priority network devices associated with it, the risk index calculation formula for a single communication link is: In the formula, For the The risk index of the communication links, For high risk devices The comprehensive risk score of The high priority network device associated with it Threat perception index; Accumulate the risk index of all links and remove duplicate values; For all links in the topology of The Internet space link risk index is obtained by accumulation, where the accumulation calculation formula is: In the formula, is the Internet space link risk index, is the total number of links in the topology graph; The same network devices may exist in different links. During the accumulation process, the risk index of the communication link may be counted repeatedly. Use the deduplication algorithm to obtain the deduplicated link set and adjust the accumulation calculation formula: In the formula, is the set of links after deduplication; Based on the Internet space link risk index, the Internet space security index is calculated, and the Internet space link risk index is standardized to the range of 0-100. The calculation formula is: In the formula, is the overall Internet space security index, The maximum risk sum is pre-set based on network size and security requirements; set up If the security threshold is exceeded, the corresponding optimization measures will be taken, including: hardware upgrades, patch updates and configuration optimization for high-risk devices, security audits and reinforcement of related devices, lowering their threat perception index, isolating high-risk links, limiting their impact on other network parts, strengthening traffic monitoring of high-risk links, and implementing strict traffic filtering and access control strategies.

10. An Internet space security testing system based on network device micro data, used to implement the security testing method according to any one of claims 1 to 9, characterized in that: include: A data acquisition module, the data acquisition module is used to acquire micro data of network devices, including physical attribute information, connection characteristic information, communication behavior data and historical usage patterns; A tensor modeling module, which is used to model the acquired network device micro data into a multi-dimensional tensor structure, calculate the minimum acquisition frequency through tensor filling theory and sampling bounds, and generate a data acquisition strategy; A data collection module, which dynamically collects behavioral characteristic data of network devices according to data collection strategies and collection frequencies, and supports multiple collection methods, including time interval collection and event-triggered collection; Anomaly detection module, which extracts and marks abnormal communication features based on network device behavior feature data, including features extraction, threshold setting, anomaly detection and marking, etc., records detailed information of detected abnormal behaviors, and uses a security risk assessment model to calculate the risk score of the network device, standardizes the risk score, and generates a corresponding risk level label; Real-time warning and in-depth analysis module, which issues real-time warnings to high-risk network devices based on risk level labels, automatically triggers in-depth security analysis, determines whether the behavior is abnormal through machine learning algorithms, and performs source tracing analysis on abnormal behavior; A correlation analysis module, which is used to extract full-link event log information of high-risk network devices, perform behavioral correlation analysis on their operation links, and identify potential threat identifiers, including detecting abnormal behaviors and their related communication characteristics; A threat perception module, which calculates a threat perception index based on potential threat identification, including threat indicator quantification, weight allocation, and index calculation to reflect the degree of potential threats, prioritizes high-risk network devices and their associated devices according to the threat perception index, and allocates corresponding security protection resources and protection strategies according to the priority; The log management and visualization module is used to manage the operation records and analysis results of each module of the system and provide a visual display interface.

Images