Network security protection system based on GIS

Abstract

The invention relates to the technical field of network security, in particular to a GIS (Geographic Information System)-based network security protection system, which comprises a dynamic topology adjustment module, an intelligent threat identification module, a network security evaluation module, a global topology optimization module and an automatic recovery and redundancy design module, the global topology optimization module and the dynamic topology adjustment module are combined, long-term optimization of the whole network is realized on the global level, and the system can comprehensively evaluate each node and dynamically calculate the connection weight in combination with the multi-dimensional characteristics such as the traffic load, the security score and the geographic position of the node, so that the reliability of the network is improved. When a node fault or abnormity is detected, a redundant path can be automatically selected according to historical data and a geographic position, and the method is subjected to topology recovery, so that high-priority nodes can obtain better connection resources, and low-priority nodes can automatically allocate the redundant path, and network performance optimization and load balance are ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and more specifically, to a network security protection system based on GIS. Background Art

[0002] Traditional network security solutions mostly rely on static network structures and passive protection mechanisms, which are unable to cope with the ever-changing threat environment in modern networks. In particular, the widespread use of geographic information systems (GIS) has complicated the spatial distribution of network devices and data, further exacerbating the difficulty of network security management.

[0003] For example, patent CN116996320A is a GIS-based local device network security monitoring system. The system collects the geographic location information of local devices through GIS technology, and combines multi-dimensional data such as operating system version, network status, and data transmission information to monitor the network security status of local devices.

[0004] The existing GIS-based system mainly relies on the static network structure of the equipment and preset rules to monitor network security, lacks a flexible response mechanism for dynamic topology, and cannot adjust the network topology according to real-time data when the load or risk of the network node changes. This may cause some key nodes to become weak links in attacks due to overload, thus affecting the security of the entire network.

[0005] Both the above-mentioned public systems and other existing technologies are mainly aimed at the security assessment of single devices or local devices, and pay less attention to the optimization of the overall network topology. For large-scale and complex network environments, how to adjust and optimize the global network topology based on the geographical distribution of network devices, real-time traffic, and threat sources is still a technical gap. Summary of the invention

[0006] In view of the shortcomings of the prior art, the purpose of the present invention is to provide a GIS-based dynamic topology adjustment network security protection system that solves the limitations of the static topology structure in the traditional system, can improve the intelligence level and global optimization capability of the network security system, and provide a security protection solution for the distributed network environment.

[0007] To achieve the above object, the present invention provides the following technical solutions:

[0008] A network security protection system based on GIS, including

[0009] Dynamic topology adjustment module, which dynamically adjusts the network topology according to the real-time status, traffic load, geographic location and risk assessment of the nodes, ensuring that the connection priority of the nodes in the network can be optimized in real time according to load changes and threat conditions;

[0010] Intelligent threat identification module, based on historical threat data and current traffic anomaly detection, generates real-time threat scores by combining risk assessment with geographic location, and provides intelligent identification and protection strategies for network security threats;

[0011] The network security assessment module collects device characterization data, including operating system information, network traffic, security indicators, etc., and combines the stored security standard data to conduct real-time network security assessment and generate a security assessment report;

[0012] The global topology optimization module optimizes the overall network topology structure. By combining multiple dimensions such as node traffic load, security, and geographical distance, it dynamically adjusts the connection weights between different nodes to optimize the performance of the entire network.

[0013] The automated recovery and redundancy design module automatically performs topology recovery and redundant path selection based on historical data and geographic location to ensure business continuity when a network node failure or anomaly is detected.

[0014] The present invention is further configured as follows: the dynamic topology adjustment module includes

[0015] The connection priority calculation unit dynamically adjusts the connection between nodes through a preset weight coefficient based on the node's traffic load, geographical risk, and security. The specific formula is:

[0016]

[0017] in, Representation Node To Node Connection priority of Indicates the real-time traffic load of the node; Indicates the maximum traffic load that can be handled in the network; The risk level of the node;

[0018] It indicates the maximum security score achieved in the network; Security scores between nodes; Weight coefficient, used to adjust the impact of each factor;

[0019] The optimization strategy execution unit executes the preset optimization strategies including load balancing, traffic redirection and delay minimization according to the output of the connection priority calculation unit;

[0020] The adaptive weight adjustment unit dynamically adjusts the weight parameters in the calculation formula based on the current state of the network to ensure the system's adaptability under different network conditions.

[0021] The present invention is further configured as follows: the intelligent threat identification module includes

[0022] The historical threat time decay unit calculates the impact of historical threats on the current threat score based on the time decay coefficient of historical events. The specific formula is:

[0023]

[0024] in, For the cumulative impact of historical threats, For the The impact of historical threat events, is the time decay factor, is the time since the threat event occurred, is the attenuation coefficient, The weight of each historical event;

[0025] A real-time anomaly detection unit is used to monitor abnormal patterns in real-time traffic data and dynamically adjust the threat score based on risk factors of geographic location.

[0026] The present invention is further configured as follows: the network security assessment module includes

[0027] Data collection unit, which obtains the device's operating system version, network status, and traffic load in real time;

[0028] The security standard matching unit is used to match the collected device information with the stored security standard data to identify possible network security vulnerabilities or abnormal behaviors.

[0029] The present invention is further configured as follows: the global topology optimization module includes

[0030] Traffic analysis unit, which is used to monitor and analyze the traffic load across the entire network, identify possible traffic bottlenecks and overloaded nodes, and provide a basis for topology adjustment based on these analysis results;

[0031] The geographic location optimization unit optimizes network connections based on the geographic distance between nodes through GIS data, reduces cross-regional delays, and improves network transmission efficiency;

[0032] The connection priority adjustment unit is used to dynamically calculate the connection weights between nodes based on the node's traffic load, security score and geographical distance, ensuring efficient and low-latency connections between high-priority nodes. At the same time, according to the actual network conditions, it provides flexible redundant path allocation and dynamic adjustment for low-priority nodes to ensure network fault tolerance and business continuity.

[0033] The global optimization computing unit dynamically adjusts the network topology based on a multi-objective optimization algorithm, combining the traffic, security score, and geographic location of the nodes to maximize the overall performance of the network.

[0034] The present invention is further configured as follows: the automatic recovery and redundancy design module includes

[0035] Fault detection unit, which monitors the operating status of network nodes in real time, identifies node failures, connection interruptions or performance anomalies, and triggers corresponding recovery operations;

[0036] The redundant path calculation unit automatically generates alternative topological paths based on historical data and geographic location information, which is triggered when a node fails;

[0037] A recovery execution unit, which is used to automatically adjust the network topology based on the fault detection and redundant path calculation results, reroute the traffic to the available path, and restore the network connection of the affected nodes;

[0038] The redundant resource management unit is used to monitor and manage redundant resources, ensure that the redundant paths of key nodes in the network are always efficient and reliable, and automatically allocate and adjust the priority of redundant resources.

[0039] The present invention is further configured as follows: the connection priority adjustment unit includes a traffic load unit, a security assessment unit, a geographic location optimization unit, a node health status monitoring unit and a network delay monitoring unit, and the specific formula is as follows:

[0040]

[0041] in, Representation Node and nodes Connection priority between For Node In time Traffic load; Indicates the maximum traffic load in the network; Representation Node and nodes Safety scores between Indicates the maximum security score in the network; Representation Node and nodes The geographical distance between Represents the minimum geographical distance between all nodes in the network; Representation Node health status; Indicates the maximum value of the node health status; Representation Node and nodes The network delay between They are the weight coefficients for traffic load, security, geographical distance, health status, and delay respectively;

[0042] The present invention is further configured as follows: the intelligent threat identification module also includes

[0043] Threat tracing unit, which tracks and locates the threat source, combines with Geographic Information System (GIS), identifies the source of the attack, and generates a detailed tracing report;

[0044] The attack path prediction unit analyzes current and historical attack behaviors, combines network topology, and uses prediction models to predict the attacker's next move or the path of attack spread.

[0045] Adaptive response unit, which dynamically adjusts network security protection strategies based on historical threat scores and real-time threat scores, including flow restriction, node isolation or enhanced encryption to respond to different threat levels;

[0046] Risk trend analysis unit, which is based on historical data, geographic location, current network environment and known threat intelligence. This unit can analyze long-term threat trends and predict potential security risks;

[0047] The present invention is further configured as follows: the network security assessment module further includes

[0048] The risk assessment unit performs further risk analysis based on the vulnerabilities or abnormal behaviors detected by the security standard matching unit, and generates a risk assessment score based on the criticality of the device, the severity of the vulnerability, and the current security status of the network;

[0049] The abnormal behavior analysis unit analyzes the behavior patterns of devices through historical data, identifies and detects abnormal behaviors, and detects unreasonable behaviors or activities in combination with the regular network usage patterns of the devices, and further identifies potential network threats.

[0050] The present invention is further configured as follows: the prediction model is specifically:

[0051]

[0052] in, Representation Node In time The state vector at the moment; GRU stands for gated recurrent unit; Representation Node and nodes Attention weights between nodes, using Graph Attention Network (GAT) to dynamically adjust the weights between nodes; represents the time-dependent weight matrix; Representation Node In time Traffic load; node and nodes Safety scores between Representation Node and nodes The geographical distance between them is in inverse proportion ( ) reflects the impact of geographical distance on priority; Represents the weight coefficient, which controls the influence of traffic load, security score and geographical distance in node status update respectively.

[0053] Compared with the shortcomings of the prior art, the beneficial effects of the present invention are:

[0054] This application achieves long-term optimization of the entire network at the global level by combining the global topology optimization module with the dynamic topology adjustment module. Combined with multi-dimensional characteristics such as node traffic load, security score and geographical location, the system can comprehensively evaluate each node and dynamically calculate the connection weight. When a node failure or anomaly is detected, it can automatically select redundant paths and perform topology recovery based on historical data and geographical location. This method ensures that high-priority nodes can obtain better connection resources, and low-priority nodes will automatically allocate redundant paths to ensure network performance optimization and load balancing.

[0055] Through intelligent threat identification, attack path prediction, topology optimization and automatic recovery, the efficiency of network protection has been greatly improved. By reducing human intervention, the complexity of operation and maintenance has been reduced, ensuring that the system can make intelligent protection decisions in the shortest time, thus improving the overall security of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 It is a module block diagram of the present invention;

[0057] Figure 2 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0058] Reference Figure 1 to Figure 2 The embodiments of the present invention are further described.

[0059] This embodiment specifically includes: a dynamic topology adjustment module, an intelligent threat identification module, a network security assessment module, a global topology optimization module, and an automatic recovery and redundancy design module.

[0060] The dynamic topology adjustment module dynamically adjusts the network topology according to the real-time status, traffic load, geographic location and risk assessment of the nodes, ensuring that the connection priority of the nodes in the network can be optimized in real time according to load changes and threat conditions.

[0061] The dynamic topology adjustment module specifically includes:

[0062] Connection priority calculation unit: Based on the traffic load, geographical risk, and security of the node, the connection between nodes is dynamically adjusted through the preset weight coefficient. The specific formula is:

[0063]

[0064] in, Representation Node To Node Connection priority of Indicates the real-time traffic load of the node; Indicates the maximum traffic load that can be handled in the network; The risk level of the node;

[0065] It indicates the maximum security score achieved in the network; Security scores between nodes; Weight coefficient, used to adjust the impact of each factor;

[0066] Optimization strategy execution unit: Executes preset optimization strategies, including load balancing, traffic redirection, and delay minimization, based on the output of the connection priority calculation unit.

[0067] Adaptive weight adjustment unit: Dynamically adjust the calculation formula based on the current state of the network The weight parameters ensure the system's adaptability under different network conditions.

[0068] The intelligent threat identification module generates real-time threat scores based on historical threat data and current traffic anomaly detection, combined with geographic location risk assessment, and provides intelligent identification and protection strategies for network security threats.

[0069] The intelligent threat identification module specifically includes:

[0070] Historical threat time decay unit: It calculates the impact of historical threats on the current threat score based on the time decay coefficient of historical events.

[0071] The specific formula is as follows:

[0072]

[0073] in, is the weight of each historical event, is the attenuation coefficient, is the time difference between events. The impact of each historical event.

[0074] Real-time anomaly detection unit: By monitoring abnormal behaviors in network traffic and combining geographic location risk factors, the threat score is adjusted. This module can analyze the current network status through abnormal traffic detection and adjust the protection strategy in real time.

[0075] Threat tracing unit: By tracking and locating the threat source, combined with the Geographic Information System (GIS), it identifies the source of the attack and generates a detailed tracing report.

[0076] Attack path prediction unit: By analyzing current and historical attack behaviors and combining network topology, the attacker's next move or the attack spread path is predicted through a prediction model.

[0077] The prediction model is as follows:

[0078]

[0079] in, Representation Node In time The state vector at the moment, the node features updated after passing through the GRU unit;

[0080] GRU stands for gated recurrent unit. Through this mechanism, the system can capture the changes in node status over time, especially the dynamic changes in response to network attacks;

[0081] Representation Node and nodes Attention weights between nodes: Use the Graph Attention Network (GAT) to dynamically adjust the weights between nodes. The weights are dynamically generated based on the relationship between nodes and their importance, ensuring that the model can capture key nodes.

[0082] Represents the time-related weight matrix, which represents the influence weight of the features between nodes as they change over time;

[0083] Representation Node In time The traffic load is normalized by subtracting the difference between the current node load and the maximum load to measure the impact of node load on connection priority;

[0084] node and nodes The security score between nodes reflects the security of the connection. The higher the score, the more secure the connection. Through normalization, the security differences between nodes are reflected;

[0085] Representation Node and nodes The geographical distance between them is in inverse proportion ( ) reflects the impact of geographical distance on priority. The shorter the distance, the higher the priority.

[0086] Represents the weight coefficients, which respectively control the impact of traffic load, security score, and geographical distance in node status update, ensuring the appropriate adjustment of each factor in different scenarios.

[0087] Adaptive response unit: This unit dynamically adjusts network security protection strategies based on historical threat scores and real-time threat scores, including traffic restriction, node isolation or enhanced encryption, to respond to different threat levels.

[0088] Reflection in the formula: By adding traffic load , Safety score and geographical distance The dynamic adjustment of Perform dynamic weighting.

[0089] Risk Trend Analysis Unit: Based on historical data, geographic location, current network environment and known threat intelligence, this unit can analyze long-term threat trends and predict potential security risks.

[0090] The network security assessment module is used to collect device operating system information, network status, and traffic load, and combines the stored security standard data to perform real-time network security assessment and generate a security assessment report.

[0091] The cybersecurity assessment modules include:

[0092] Data collection unit: obtain the device's operating system version, network status, and traffic load in real time;

[0093] The security standard matching unit is used to match the collected device information with the stored security standard data to identify possible network security vulnerabilities or abnormal behaviors.

[0094] Risk assessment unit: Based on the vulnerabilities or abnormal behaviors detected by the security standard matching unit, further risk analysis is performed, and a risk assessment score is generated based on the criticality of the device, the severity of the vulnerability, and the current security status of the network;

[0095] Abnormal behavior analysis unit: Analyzes the behavior patterns of devices through historical data, identifies and detects abnormal behaviors, and combines the regular network usage patterns of devices to detect unreasonable behaviors or activities, and further identify potential network threats.

[0096] The global topology optimization module optimizes the overall topology of the entire network. By combining multiple dimensions such as node traffic load, security, and geographical distance, it dynamically adjusts the connection weights between different nodes to optimize the performance of the entire network.

[0097] The global topology optimization module specifically includes:

[0098] Traffic analysis unit: used to monitor and analyze the traffic load across the entire network, identify possible traffic bottlenecks and overloaded nodes, and provide a basis for topology adjustment based on these analysis results;

[0099] Geographic location optimization unit: Based on the geographic distance between nodes, it optimizes network connections through GIS data, reduces cross-regional delays, and improves network transmission efficiency;

[0100] Connection priority adjustment unit: It is used to dynamically calculate the connection weights between nodes based on the traffic load, security score and geographical distance of the nodes, ensuring efficient and low-latency connections between high-priority nodes. At the same time, it provides flexible redundant path allocation and dynamic adjustment for low-priority nodes according to actual network conditions to ensure network fault tolerance and business continuity.

[0101] Connection priority adjustment unit: includes traffic load unit, security assessment unit, geographic location optimization unit, node health status monitoring unit and network delay monitoring unit. The specific formula is as follows:

[0102]

[0103] in, Representation Node and nodes The higher the value of the connection priority, the higher the priority of the connection.

[0104] For Node In time Traffic load indicates the network traffic currently processed by the node. The higher the traffic load, the lower the priority to prevent network congestion.

[0105] It represents the maximum traffic load in the network and serves as a normalized reference point to ensure that traffic load comparisons of all nodes are based on the same standard;

[0106] Representation Node and nodes The security score between them is based on the encryption level of the communication, historical vulnerability information and security protocol. The higher the security, the higher the connection priority.

[0107] Represents the maximum security score in the network, serving as a standardized reference point for security scores;

[0108] Representation Node and nodes The shorter the geographical distance, the higher the priority, which reduces network transmission delay;

[0109] Represents the minimum geographical distance between all nodes in the network, serving as a reference point for normalization;

[0110] Representation Node The health status of the node reflects the stability, failure rate and current hardware / software status of the node. The worse the health status, the lower the priority, so as to reduce the impact of node failure on the overall network;

[0111] Indicates the maximum value of the node health status, which is used to normalize the node health status score;

[0112] Representation Node and nodes The lower the network delay, the higher the priority, ensuring efficient data transmission;

[0113] They are the weight coefficients for traffic load, security, geographical distance, health status, and latency, which are used to adjust the impact of each factor on connection priority.

[0114] Global optimization computing unit: Based on a multi-objective optimization algorithm (genetic algorithm), it dynamically adjusts the network topology structure based on the node's traffic, security score and geographical location to maximize the overall performance of the network, while optimizing multiple key performance indicators, including network traffic load balancing, latency minimization, redundancy improvement and security enhancement.

[0115] When a network node failure or anomaly is detected, the automated recovery and redundancy design module automatically performs topology recovery and redundant path selection based on historical data and geographic location to ensure business continuity.

[0116] The automatic recovery and redundancy design module specifically includes:

[0117] Fault detection unit: used to monitor the operating status of network nodes in real time, identify node failures, connection interruptions or performance anomalies, and trigger corresponding recovery operations.

[0118] Redundant path calculation unit: Automatically generates alternative topology paths based on historical data and geographic location information, which is triggered when a node fails.

[0119] Recovery execution unit: used to automatically adjust the network topology based on the fault detection and redundant path calculation results, reroute the traffic to the available path, and restore the network connection of the affected nodes.

[0120] Redundant resource management unit: used to monitor and manage redundant resources, ensure that the redundant paths of key nodes in the network are always efficient and reliable, and automatically allocate and adjust the priority of redundant resources.

[0121] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Common changes and substitutions made by those skilled in the art within the scope of the technical solution of the present invention should be included in the protection scope of the present invention.

Claims

1. A GIS-based network security protection system, characterized by: include: Dynamic topology adjustment module, which dynamically adjusts the network topology according to the real-time status, traffic load, geographic location and risk assessment of the nodes, ensuring that the connection priority of the nodes in the network can be optimized in real time according to load changes and threat conditions; Intelligent threat identification module, based on historical threat data and current traffic anomaly detection, generates real-time threat scores by combining risk assessment with geographic location, and provides intelligent identification and protection strategies for network security threats; The network security assessment module collects device characterization data, including operating system information, network traffic, security indicators, etc., and combines the stored security standard data to conduct real-time network security assessment and generate a security assessment report; The global topology optimization module optimizes the overall network topology structure. By combining multiple dimensions such as node traffic load, security, and geographical distance, it dynamically adjusts the connection weights between different nodes to optimize the performance of the entire network. The automated recovery and redundancy design module automatically performs topology recovery and redundant path selection based on historical data and geographic location to ensure business continuity when a network node failure or anomaly is detected.

2. According to claim 1, a GIS-based network security protection system is characterized by: The dynamic topology adjustment module includes: The connection priority calculation unit dynamically adjusts the connection between nodes through a preset weight coefficient based on the node's traffic load, geographical risk, and security. The specific formula is: in, Representation Node To Node Connection priority: Indicates the real-time traffic load of the node; Indicates the maximum traffic load that can be handled in the network; The risk level of the node; It indicates the maximum security score achieved in the network; Security scores between nodes; Weight coefficient, used to adjust the impact of each factor; The optimization strategy execution unit executes the preset optimization strategies including load balancing, traffic redirection and delay minimization according to the output of the connection priority calculation unit; The adaptive weight adjustment unit dynamically adjusts the weight parameters in the calculation formula based on the current state of the network to ensure the system's adaptability under different network conditions.

3. According to claim 2, a GIS-based network security protection system is characterized by: The intelligent threat identification module includes: The historical threat time decay unit calculates the impact of historical threats on the current threat score based on the time decay coefficient of historical events. The specific formula is: in, For the cumulative impact of historical threats, For the The impact of historical threat events, is the time decay factor, is the time since the threat event occurred, is the attenuation coefficient, The weight of each historical event; A real-time anomaly detection unit is used to monitor abnormal patterns in real-time traffic data and dynamically adjust the threat score based on risk factors of geographic location.

4. According to claim 3, a GIS-based network security protection system is characterized by: The network security assessment module includes: Data collection unit, which obtains the device's operating system version, network status, and traffic load in real time; The security standard matching unit is used to match the collected device information with the stored security standard data to identify possible network security vulnerabilities or abnormal behaviors.

5. According to claim 4, a GIS-based network security protection system is characterized by: The global topology optimization module includes: Traffic analysis unit, which is used to monitor and analyze the traffic load across the entire network, identify possible traffic bottlenecks and overloaded nodes, and provide a basis for topology adjustment based on these analysis results; The geographic location optimization unit optimizes network connections based on the geographic distance between nodes through GIS data, reduces cross-regional delays, and improves network transmission efficiency; The connection priority adjustment unit is used to dynamically calculate the connection weights between nodes based on the traffic load, security score and geographical distance of the nodes, ensuring efficient and low-latency connections between high-priority nodes. At the same time, according to the actual network conditions, it provides flexible redundant path allocation and dynamic adjustment for low-priority nodes to ensure network fault tolerance and business continuity. The global optimization computing unit, based on a multi-objective optimization algorithm, combines the traffic, security score and geographical location of the nodes to dynamically adjust the network topology to maximize the overall performance of the network.

6. According to claim 5, a GIS-based network security protection system is characterized by: The automatic recovery and redundancy design module includes: Fault detection unit, which monitors the operating status of network nodes in real time, identifies node failures, connection interruptions or performance anomalies, and triggers corresponding recovery operations; The redundant path calculation unit automatically generates alternative topological paths based on historical data and geographic location information, which is triggered when a node fails; A recovery execution unit, which is used to automatically adjust the network topology based on the fault detection and redundant path calculation results, reroute the traffic to the available path, and restore the network connection of the affected nodes; The redundant resource management unit is used to monitor and manage redundant resources, ensure that the redundant paths of key nodes in the network are always efficient and reliable, and automatically allocate and adjust the priority of redundant resources.

7. The GIS-based network security protection system according to claim 6 is characterized by: The connection priority adjustment unit includes a traffic load unit, a security assessment unit, a geographic location optimization unit, a node health status monitoring unit and a network delay monitoring unit. The specific formula is as follows: in, Representation Node and nodes Connection priority between For Node In time Traffic load; Indicates the maximum traffic load in the network; Representation Node and nodes Safety scores between Indicates the maximum security score in the network; Representation Node and nodes The geographical distance between Represents the minimum geographical distance between all nodes in the network; Representation Node health status; Indicates the maximum value of the node health status; Representation Node and nodes The network delay between They are the weight coefficients for traffic load, security, geographical distance, health status and delay respectively.

8. According to claim 3, a GIS-based network security protection system is characterized by: The intelligent threat identification module also includes: Threat tracing unit, which tracks and locates the threat source, combines with Geographic Information System (GIS), identifies the source of the attack, and generates a detailed tracing report; The attack path prediction unit analyzes current and historical attack behaviors, combines network topology, and uses prediction models to predict the attacker's next move or the path of attack spread. Adaptive response unit, which dynamically adjusts network security protection strategies based on historical threat scores and real-time threat scores, including flow restriction, node isolation or enhanced encryption to respond to different threat levels; Risk trend analysis unit, which is based on historical data, geographic location, current network environment and known threat intelligence. This unit can analyze long-term threat trends and predict potential security risks.

9. The GIS-based network security protection system according to claim 4, characterized in that: The network security assessment module also includes: The risk assessment unit performs further risk analysis based on the vulnerabilities or abnormal behaviors detected by the security standard matching unit, and generates a risk assessment score based on the criticality of the device, the severity of the vulnerability, and the current security status of the network; The abnormal behavior analysis unit analyzes the behavior patterns of devices through historical data, identifies and detects abnormal behaviors, and detects unreasonable behaviors or activities in combination with the regular network usage patterns of the devices, and further identifies potential network threats.

10. The GIS-based network security protection system according to claim 8, characterized in that: The prediction model is specifically: in, Representation Node In time The state vector at the moment; GRU stands for gated recurrent unit; Representation Node and nodes Attention weights between nodes, using Graph Attention Network (GAT) to dynamically adjust the weights between nodes; represents the time-dependent weight matrix; Representation Node In time Traffic load; node and nodes Safety scores between Representation Node and nodes The geographical distance between them is inversely proportional ( ) reflects the impact of geographical distance on priority; Represents the weight coefficient, which controls the influence of traffic load, security score and geographical distance in node status update respectively.

Images