A network security alarm system and method based on big data

Abstract

The present invention relates to the field of security alarms, and discloses a network security alarm system and method based on big data. A network data acquisition module collects network traffic and security data from network devices and system logs, stores the data obtained by the network data acquisition module in a database, then calls the data in the database and performs security analysis according to preset alarm rules, calculates a security alarm index, and then compares the security alarm index with a security threshold interval preset by the system. If the security alarm index is within the security threshold interval, the current network is judged to be secure, otherwise it is judged that the current network has security risks, and then generates alarm information based on the result that the network security analysis module judges that the current network has security risks, and sends the alarm information to a system background. Finally, after arranging in descending order according to the security alarm index, an arrangement order of the alarm information is generated, and the arrangement order is used as a response priority.

Description

Technical Field

[0001] The present invention relates to the field of security alarms, and in particular to a network security alarm system and method based on big data. Background Art

[0002] With the rapid development of information technology, network security issues have become increasingly prominent and have become a major challenge facing society, enterprises and even individuals. Faced with increasingly complex network forms and traditional security protection methods can no longer meet the needs.

[0003] For example, the current network security alarm system often generates false alarms because normal traffic is similar to attack traffic, wasting the security team's time and energy to analyze irrelevant alarms, resulting in a high probability of false alarms. At the same time, the time from detecting a threat to the system issuing an alarm and responding is too long, giving attackers enough time to infiltrate the network or cause damage, resulting in a slow response speed. Therefore, how to achieve a balance between false alarms and response speed is the key to improving network security. Summary of the invention

[0004] The purpose of the present invention is to provide a network security alarm system and method based on big data to solve the above technical problems.

[0005] The purpose of the present invention can be achieved by the following technical solutions:

[0006] A network security alarm system based on big data, comprising:

[0007] Network data collection module, used to collect network traffic and security data from network devices and system logs;

[0008] A data storage module, used to store the data obtained by the network data collection module into a database;

[0009] The data processing module is used to call the data in the database and perform security analysis according to the preset alarm rules to calculate the security alarm index;

[0010] The network security analysis module is used to compare the security alarm index with the security threshold interval preset by the system. If the security alarm index is within the security threshold interval, the current network is judged to be secure; otherwise, the current network is judged to have security risks;

[0011] The alarm module generates alarm information based on the result of the network security analysis module judging that there are security risks in the current network, and sends the alarm information to the system background;

[0012] The response module is used to generate an arrangement order of alarm information after arranging them in descending order according to the security alarm index, and use the arrangement order as the response priority.

[0013] As a further technical solution, the process of performing security analysis according to the preset alarm rules is as follows:

[0014] Establish a traffic baseline per unit time based on historically acquired network traffic data ;

[0015] Real-time network traffic data With flow baseline Make a comparison;

[0016] If the formula The calculated network traffic risk coefficient , then the network traffic is judged to be at risk, otherwise it is judged to be network secure; among them, is the preset network traffic risk threshold. , is the preset weight coefficient, , They are ~ The maximum and minimum network traffic during the period. For the current moment, is the starting moment of a unit of time;

[0017] Security data includes log information, vulnerability information and historical alarm information. Log information, vulnerability information and historical alarm information are input into the pre-trained neural network model to output the safety factor. ,like , then it is judged that there is a risk in network protection, otherwise it is judged that network protection is safe;

[0018] like and If both are not satisfied, , Substitute the following formula: Calculate the security alarm index ;

[0019] in, , is the preset scale factor, , They are the mean network traffic and the mean safety factor respectively.

[0020] As a further technical solution, the working process of the network security analysis module is:

[0021] The safety alarm index will be calculated The preset safety threshold For comparison:

[0022] like , then judge the current network security;

[0023] like , then it is judged that there is a security risk in the current network.

[0024] As a further technical solution, the working process of the alarm module is:

[0025] When it is determined that there is a risk in network traffic, a first-level alarm signal is issued;

[0026] When it is judged that there is a risk in network protection, a secondary alarm signal is issued;

[0027] When it is determined that there is a security risk in the current network, a third-level alarm signal is issued;

[0028] Among them, the first-level alarm signal is less than the second-level alarm signal and less than the third-level alarm signal.

[0029] As a further technical solution, the process of generating the order of alarm information is as follows:

[0030] For the first-level alarm signal, the priority coefficient is obtained according to the network traffic risk coefficient and the traffic distribution of the port, and the arrangement order of the first-level alarm signal is generated according to the priority coefficient;

[0031] For the secondary alarm signals, the arrangement order of the secondary alarm signals is generated after arranging them in descending order according to the safety factor;

[0032] For the three-level alarm signals, the arrangement order of the three-level alarm signals is generated after arranging them in descending order according to the safety alarm index.

[0033] As a further technical solution, the process of obtaining the priority coefficient is:

[0034] According to historical data, the traffic of each port of the network is compared with the preset traffic range. Ports that exceed the preset traffic range are marked as red ports, ports that fall within the preset traffic range are marked as yellow ports, and the remaining ports are marked as green ports;

[0035] Get the generation time of each first-level alarm signal, with the generation time as the end time point, and the preset interval time Collect data n times in a row and get the red port each time Green Port the number of

[0036] The first i The priority coefficient of the first level alarm signal ;

[0037] According to the priority factor After sorting in descending order, the arrangement order of the first-level alarm signal is generated.

[0038] Said in, For the i The network traffic risk coefficient of the first-level alarm signal is , is the preset weight coefficient, , are the means of the red port and the green port respectively.

[0039] A network security alarm method based on big data includes the following steps:

[0040] S1. Collect network traffic and security data from network devices and system logs, and store the obtained data in a database;

[0041] S2. Call the data in the database and perform security analysis according to the preset alarm rules to calculate the security alarm index;

[0042] S3, comparing the security alarm index with the security threshold interval preset by the system. If the security alarm index is within the security threshold interval, the current network is judged to be secure; otherwise, the current network is judged to have security risks;

[0043] S4. Generate alarm information based on the result that the network security analysis module determines that there is a security risk in the current network, and send the alarm information to the system background;

[0044] S5. After arranging the alarm information in descending order according to the security alarm index, an arrangement order of the alarm information is generated, and the arrangement order is used as the response priority.

[0045] Beneficial effects of the present invention:

[0046] The present invention realizes the purpose of real-time security monitoring of network traffic and security data through the cooperation of data processing modules and network security analysis modules, and can make security predictions based on the trends of network traffic and security data within a cycle, so that the alarm information provided by the alarm module is more accurate to reduce false alarms, while taking into account the alarm response problem while improving the alarm accuracy. Therefore, the arrangement order of the alarm information is used as the response priority to achieve a relatively fast response under limited management resources, so as to reduce the risk of too long time between the issuance of an alarm and the response. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The present invention will be further described below in conjunction with the accompanying drawings.

[0048] Figure 1is a system structure diagram of the present invention;

[0049] Figure 2 It is a diagram of the method steps of the present invention. DETAILED DESCRIPTION

[0050] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0051] See also Figure 1-Figure 2 As shown, the present invention is a network security alarm system based on big data, comprising:

[0052] Network data collection module, used to collect network traffic and security data from network devices and system logs;

[0053] A data storage module, used to store the data obtained by the network data collection module into a database;

[0054] The data processing module is used to call the data in the database and perform security analysis according to the preset alarm rules to calculate the security alarm index;

[0055] The network security analysis module is used to compare the security alarm index with the security threshold interval preset by the system. If the security alarm index is within the security threshold interval, the current network is judged to be secure; otherwise, the current network is judged to have security risks;

[0056] The alarm module generates alarm information based on the result of the network security analysis module judging that there are security risks in the current network, and sends the alarm information to the system background;

[0057] The response module is used to generate an arrangement order of alarm information after arranging them in descending order according to the security alarm index, and use the arrangement order as the response priority.

[0058] In this implementation, the data processing module and the network security analysis module cooperate to achieve the purpose of real-time security monitoring of network traffic and security data, and can make security predictions based on the trends of network traffic and security data within a cycle, so that the alarm information provided by the alarm module is more accurate to reduce false alarms. At the same time, the alarm response problem is taken into account while improving the alarm accuracy. Therefore, the arrangement order of the alarm information is used as the response priority to achieve a relatively fast response under limited management resources, so as to reduce the risk of too long time between the issuance of an alarm and the response.

[0059] The process of security analysis according to the preset alarm rules is as follows:

[0060] Establish a traffic baseline per unit time based on historically acquired network traffic data ;

[0061] Real-time network traffic data With flow baseline Make a comparison;

[0062] If the formula The calculated network traffic risk coefficient , then the network traffic is judged to be at risk, otherwise it is judged to be network secure; among them, is the preset network traffic risk threshold. , is the preset weight coefficient, , They are ~ The maximum and minimum network traffic during the period. For the current moment, is the starting moment of a unit of time;

[0063] Security data includes log information, vulnerability information and historical alarm information. Log information, vulnerability information and historical alarm information are input into the pre-trained neural network model to output the safety factor. ,like , then it is judged that there is a risk in network protection, otherwise it is judged that network protection is safe;

[0064] like and If both are not satisfied, , Substitute the following formula: Calculate the security alarm index ;

[0065] in, , is the preset scale factor, , They are the mean network traffic and the mean safety factor respectively.

[0066] In this embodiment, a specific security analysis method is provided. When working, a flow baseline within a unit time is established by monitoring the historical network flow data for a long time. , and then the real-time network traffic data With flow baseline By comparing, we can judge the potential network traffic trend. Deviation from flow baseline The greater the degree, the higher the abnormal rate of network traffic, so it is necessary to issue a security alarm for network traffic in a timely manner; establish a correlation model through the above content ,pass For reaction Deviation from flow baseline degree, The larger the The bigger, the higher the risk, through It reflects the ratio of the maximum value to the minimum value of network traffic in the current period. Obviously, if the ratio is larger, it means that the network traffic exceeds the limit by a larger margin. The higher the impact, the more accurate the security of network traffic can be evaluated through the above technical solutions;

[0067] At the same time, in order to accurately evaluate the overall network security, a correlation model of the security alarm index is established by combining the security factor and the network traffic risk factor. , obviously The larger the value, the greater the risk of network traffic. The larger the value, the greater the risk of network protection. Therefore, combining the above two aspects to obtain an overall network security assessment will lay the foundation for subsequent timely response.

[0068] The working process of the network security analysis module is as follows:

[0069] The safety alarm index will be calculated The preset safety threshold For comparison:

[0070] like , then judge the current network security;

[0071] like , then it is judged that there is a security risk in the current network.

[0072] The working process of the alarm module is:

[0073] When it is determined that there is a risk in network traffic, a first-level alarm signal is issued;

[0074] When it is judged that there is a risk in network protection, a secondary alarm signal is issued;

[0075] When it is determined that there is a security risk in the current network, a third-level alarm signal is issued;

[0076] Among them, the first-level alarm signal is less than the second-level alarm signal and less than the third-level alarm signal.

[0077] Through the above technical solution, according to the safety alarm index The preset safety threshold The comparison result is used to determine whether the current network is safe. If there is a security risk, an alarm will be issued through the alarm module, and it will serve as the highest level alarm signal. When the aforementioned part is running, if it is determined that there is a risk in the network traffic, a first-level alarm signal will be issued. When it is determined that there is a risk in network protection, a second-level alarm signal will be issued. The network traffic risk is less harmful than the network protection risk.

[0078] The process of generating the alarm information arrangement order is:

[0079] For the first-level alarm signal, the priority coefficient is obtained according to the network traffic risk coefficient and the traffic distribution of the port, and the arrangement order of the first-level alarm signal is generated according to the priority coefficient;

[0080] For the secondary alarm signals, the arrangement order of the secondary alarm signals is generated after arranging them in descending order according to the safety factor;

[0081] For the three-level alarm signals, the arrangement order of the three-level alarm signals is generated after arranging them in descending order according to the safety alarm index.

[0082] The process of obtaining the priority coefficient is as follows:

[0083] According to historical data, the traffic of each port of the network is compared with the preset traffic range. Ports that exceed the preset traffic range are marked as red ports, ports that fall within the preset traffic range are marked as yellow ports, and the remaining ports are marked as green ports;

[0084] Get the generation time of each first-level alarm signal, with the generation time as the end time point, and the preset interval time Collect data n times in a row and get the red port each time Green Port the number of

[0085] The first i The priority coefficient of the first level alarm signal ; ;in, For the i The network traffic risk coefficient of the first-level alarm signal is , is the preset weight coefficient, , They are the mean number of red ports and green ports respectively;

[0086] According to the priority factor After sorting in descending order, the arrangement order of the first-level alarm signal is generated.

[0087] In this embodiment, a specific method for generating an arrangement order of alarm information is provided. Specifically, for the second-level and third-level alarm signals, the arrangement order can be generated after they are arranged in descending order according to the safety factor and the safety alarm index respectively. For the first-level alarm signal, since the level is low and the possibility of occurrence is also high, it is necessary to determine whether the network traffic risk is caused by abnormal port traffic. Therefore, an analysis model is established by using the network traffic risk coefficient and the changes in the number of red ports and green ports each time;

[0088]

[0089] Calculate the priority coefficient of the first-level alarm signal , It indicates the difference between the number of green ports and the average number of green ports during the sampling period. Obviously, the larger it is, the greater the fluctuation of the number of green ports. It indicates the difference between the number of red ports and the average red ports during the sampling period. Obviously, the larger it is, the greater the volatility of the number of red ports. Therefore, when both are large, it means that the traffic of the port has changed abnormally, which points out the direction for subsequent investigation, so that the priority of the first-level alarm signal can be obtained.

[0090] A network security alarm method based on big data includes the following steps:

[0091] S1. Collect network traffic and security data from network devices and system logs, and store the obtained data in a database;

[0092] S2. Call the data in the database and perform security analysis according to the preset alarm rules to calculate the security alarm index;

[0093] S3, comparing the security alarm index with the security threshold interval preset by the system. If the security alarm index is within the security threshold interval, the current network is judged to be secure; otherwise, the current network is judged to have security risks;

[0094] S4. Generate alarm information based on the result that the network security analysis module determines that there is a security risk in the current network, and send the alarm information to the system background;

[0095] S5. After arranging the alarm information in descending order according to the security alarm index, an arrangement order of the alarm information is generated, and the arrangement order is used as the response priority.

[0096] It should be noted that the calculation formulas and various parameters involved in the calculations in the present invention have been dimensionally processed in advance, and the calculations involved in the formulas are purely numerical calculations. The process of dimensionless processing is well known in the industry and will not be described here.

[0097] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.

Claims

1. A network security alarm system based on big data, characterized in that: include: Network data collection module, used to collect network traffic and security data from network devices and system logs; A data storage module, used to store the data obtained by the network data collection module into a database; The data processing module is used to call the data in the database and perform security analysis according to the preset alarm rules to calculate the security alarm index; The network security analysis module is used to compare the security alarm index with the security threshold interval preset by the system. If the security alarm index is within the security threshold interval, the current network is judged to be secure; otherwise, the current network is judged to have security risks; The alarm module generates alarm information based on the result of the network security analysis module judging that there are security risks in the current network, and sends the alarm information to the system background; A response module is used to generate an arrangement order of alarm information after arranging them in descending order according to the security alarm index, and use the arrangement order as the response priority; The process of security analysis according to the preset alarm rules is as follows: Establish a traffic baseline per unit time based on historically acquired network traffic data ; Real-time network traffic data With flow baseline For comparison; if the formula The calculated network traffic risk coefficient , then the network traffic is judged to be at risk, otherwise it is judged to be network secure; among them, is the preset network traffic risk threshold. , is the preset weight coefficient, , They are ~ The maximum and minimum network traffic during the period. For the current moment, is the starting moment of a unit of time; Security data includes log information, vulnerability information and historical alarm information. Log information, vulnerability information and historical alarm information are input into the pre-trained neural network model to output the safety factor. ,like , then it is judged that there is a risk in network protection, otherwise it is judged that network protection is safe; like and If both are not satisfied, , Substitute the following formula: Calculate the security alarm index ; in, , is the preset scale factor, , They are the mean network traffic and the mean safety factor respectively.

2. The network security alarm system based on big data according to claim 1 is characterized in that: The working process of the network security analysis module is as follows: The safety alarm index will be calculated The preset safety threshold For comparison: like , then judge the current network security; like , then it is determined that there is a security risk in the current network.

3. The network security alarm system based on big data according to claim 2 is characterized in that: The working process of the alarm module is: When it is determined that there is a risk in network traffic, a first-level alarm signal is issued; When it is judged that there is a risk in network protection, a secondary alarm signal is issued; When it is determined that there is a security risk in the current network, a third-level alarm signal is issued; Among them, the first-level alarm signal is less than the second-level alarm signal and less than the third-level alarm signal.

4. The network security alarm system based on big data according to claim 3 is characterized in that: The process of generating the alarm information arrangement order is: For the first-level alarm signal, the priority coefficient is obtained according to the network traffic risk coefficient and the traffic distribution of the port, and the arrangement order of the first-level alarm signal is generated according to the priority coefficient; For the secondary alarm signals, the arrangement order of the secondary alarm signals is generated after arranging them in descending order according to the safety factor; For the three-level alarm signals, the arrangement order of the three-level alarm signals is generated after arranging them in descending order according to the safety alarm index.

5. The network security alarm system based on big data according to claim 4 is characterized in that: The process of obtaining the priority coefficient is as follows: According to historical data, the traffic of each port of the network is compared with the preset traffic range. Ports that exceed the preset traffic range are marked as red ports, ports that fall within the preset traffic range are marked as yellow ports, and the remaining ports are marked as green ports; Get the generation time of each first-level alarm signal, with the generation time as the end time point, and the preset interval time Collect data n times in a row and get the red port each time Green Port the number of The first i The priority coefficient of the first level alarm signal ; According to the priority factor After sorting in descending order, the arrangement order of the first-level alarm signal is generated.

6. The network security alarm system based on big data according to claim 5 is characterized in that: Said in, For the i The network traffic risk coefficient of the first-level alarm signal is , is the preset weight coefficient, , are the means of the red port and the green port respectively.

7. A network security alarm method based on big data, the method is applicable to the network security alarm system based on big data according to any one of claims 1 to 6, characterized in that: The steps include: S1. Collect network traffic and security data from network devices and system logs, and store the obtained data in a database; S2. Call the data in the database and perform security analysis according to the preset alarm rules to calculate the security alarm index; S3, comparing the security alarm index with the security threshold interval preset by the system. If the security alarm index is within the security threshold interval, the current network is judged to be secure; otherwise, the current network is judged to have security risks; S4. Generate alarm information based on the result that the network security analysis module determines that there is a security risk in the current network, and send the alarm information to the system background; S5. After arranging the alarm information in descending order according to the security alarm index, an arrangement order of the alarm information is generated, and the arrangement order is used as the response priority.

Images