A network security optimization analysis system based on deep learning

Abstract

The present invention belongs to the field of network security and relates to data analysis technology. It is used to solve the problem that the existing network security optimization analysis system cannot accurately locate hidden dangers in the network in combination with the size of network risks and risk change trends. Specifically, it is a network security optimization analysis system based on deep learning, including a host status evaluation module, a network security joint analysis module, a network security optimization analysis module and a database. The network security joint analysis module includes a network security risk calculation unit and a network security risk trend evaluation unit; the host status evaluation module, the network security joint analysis module, the network security optimization analysis module and the database are communicatively connected in sequence; the host status evaluation module is used to evaluate the status of the host in the network, the network security joint analysis module is used to analyze the network security in combination with the risk size and change trend, and the network security optimization analysis module is used to optimize the network security, thereby improving the accuracy of the network security optimization analysis.

Description

Technical Field

[0001] The present invention belongs to the field of network security and relates to data analysis technology, specifically a network security optimization analysis system based on deep learning. Background Art

[0002] With the rapid development of information technology, the use of the Internet for information dissemination, resource sharing, and long-distance rapid communication has greatly improved people's quality of life; however, the existence of network system vulnerabilities has caused instability in network operation on the one hand, and the possibility of attacks on the other hand, bringing great network security risks.

[0003] The existing network security optimization and analysis system is unable to quantify the risks of hosts in the network and analyze the risk change trend at the same time, nor can it optimize the entire network security based on the size of network security risks and risk change trends, making it difficult to accurately and effectively locate network vulnerabilities and hidden dangers.

[0004] In view of the above technical problems, this application proposes a solution. Summary of the invention

[0005] The purpose of the present invention is to provide a network security optimization analysis system based on deep learning, which is used to solve the problem that the existing network security optimization analysis system cannot accurately and effectively locate the hidden dangers and loopholes in the entire network in combination with the size of network security risks and risk change trends;

[0006] The technical problem to be solved by the present invention is: how to provide a network security optimization and analysis system based on deep learning that can accurately and effectively locate hidden dangers and loopholes in the entire network based on the size of network security risks and risk change trends.

[0007] The purpose of the present invention can be achieved through the following technical solutions:

[0008] A network security optimization and analysis system based on deep learning, comprising a host state evaluation module, a network security joint analysis module, a network security optimization analysis module and a database, wherein the network security joint analysis module comprises a network security risk calculation unit and a network security risk trend evaluation unit; the host state evaluation module, the network security joint analysis module, the network security optimization analysis module and the database are sequentially connected in communication;

[0009] The host status evaluation module is used to evaluate the status of the host in the network: mark the communication device connected to the computer network as the host, generate a monitoring cycle of fixed duration, obtain the host status coefficient ZT according to the frequency timing, and mark the host status as abnormal state, general state or normal state according to the host status coefficient ZT;

[0010] The network security risk calculation unit is used to calculate the size of the network security risk: statistically calculate the occurrence probabilities P1, P2 and P3 of the host in the normal state, general state and abnormal state during the monitoring period, and perform numerical calculation to obtain the network security risk value WF of the network;

[0011] The network security risk trend assessment unit is used to assess the changing trend of network security risks: mark the end time of each monitoring cycle as the initial time T0 of the network security risk trend assessment, obtain the initial vector A and the state change matrix S of the host at the initial time T0, perform matrix transformation to obtain the host state vector B, and calculate the element values ​​of the host state vector B to obtain the risk change trend FB;

[0012] The network security joint analysis module is used to conduct a comprehensive analysis of network security in combination with the size and change trend of network risks: judging whether the network security is qualified and whether there is a risk based on the comparison results of the network security risk value WF and the risk change trend FB with the preset thresholds;

[0013] The network security optimization and analysis module is used to optimize and analyze network security after receiving a qualified risk signal or an unqualified signal: according to the judgment result of the network security joint analysis module, the host is divided into a standard host and an observation host, the characteristic vectors of the standard host and the observation host are obtained and the overlap is calculated to determine whether the observation host is a dangerous host, and optimization measures are taken for the dangerous host.

[0014] Furthermore, the process of obtaining the host state coefficient ZT includes: generating a monitoring cycle with a fixed duration of L1 seconds, the total number of collections in one monitoring cycle is recorded as n, and the host's system permission request number QQ, network delay YC, network traffic rate LL and number of applications CX are obtained at a frequency of (L1 / n) times / second, and the host state coefficient ZT is obtained by numerical calculation.

[0015] Furthermore, the host status marking process includes: comparing the host status coefficient ZT with the preset host status high value ZTmax and the host status low value ZTmin: if the host status coefficient ZT is greater than or equal to the host status high value ZTmax, the host status is marked as an abnormal state; if the host status coefficient ZT is less than the host status high value ZTmax and greater than or equal to the host status low value ZTmin, the host status is marked as a general state; if the host status coefficient ZT is less than the host status low value ZTmin, the host status is marked as a normal state.

[0016] Furthermore, the process of obtaining the network security risk value WF includes: performing numerical calculations on the occurrence probabilities P1, P2 and P3 of the host in the normal state, general state and abnormal state during the monitoring period to obtain the host risk performance value ZF of the host during the monitoring period, summing up and averaging the host risk performance values ​​ZF of all hosts in the network to obtain the network security risk value WF of the network during the monitoring period, and sending the network security risk value WF to the joint analysis module.

[0017] Furthermore, the acquisition process of the host state vector B includes: marking the end time of each monitoring cycle as the initial time T0 of the network security risk trend assessment, marking the normal state of the host as 1, the general state as 2, and the abnormal state as 3, then the state of the host at the initial time T0 is marked as the initial vector A = [P1, P2, P3] T ; Get the state change matrix of the host Element P 12 is the probability of the host changing from a normal state to a general state during the monitoring period, and so on; the initial vector A and the state change matrix S are matrix-operated to obtain the host state vector B after n state changes after the initial time T0, and B = [P1n, P2n, P3n] T , where P1n, P2n and P3n represent the probability prediction values ​​of the host's normal state, general state and abnormal state at the end of the next monitoring cycle, respectively.

[0018] Furthermore, the process of obtaining the risk change trend FB includes: numerically calculating the probability prediction values ​​P1n, P2n and P3n to obtain the host risk prediction value ZC of the host in the next monitoring cycle, summing up and averaging the host risk prediction values ​​ZC of all hosts in the network to obtain the network security risk prediction value WC of the network in the next monitoring cycle; numerically calculating the network security risk value WF of the monitoring cycle and the network security risk prediction value WC of the next monitoring cycle to obtain the risk change trend FB of the network, and sending the risk change trend FB to the joint analysis module.

[0019] Furthermore, the process of judging network security includes: obtaining the network security risk threshold WAmax and the risk change threshold FBmax through the storage module, and comparing them with the network security risk value WA and the risk change trend FB respectively: if the network security risk value WA is less than or equal to the network security risk threshold WAmax and the risk change trend FB is less than or equal to the risk change threshold FBmax, then the network is judged to be qualified and the risk is decreasing, and no processing is required; if the network security risk value WA is less than or equal to the network security risk threshold WAmax and the risk change trend FB is greater than or equal to the risk change threshold FBmax, then the network is judged to be qualified but the risk is increasing, and a qualified and risky signal is generated and sent to the network security optimization and analysis module; if the network security risk value WA is greater than or equal to the network security risk threshold WAmax, then the network is judged to be unqualified, and an unqualified signal is generated and sent to the network security optimization and analysis module.

[0020] Furthermore, the process of acquiring the characteristic vector includes: if the network security optimization and analysis module receives a qualified risk signal, it is determined that the host risk prediction value ZC of the host in the network does not meet the requirements, and all the hosts in the network are sorted in order from small to large according to the numerical value of the host risk prediction value ZC, and the first object after the sorting is marked as a standard host, and the next L2 objects are marked as observation hosts, and L2 is a quantitative constant; the state change matrix of the standard host is flattened into a vector and marked as a characteristic vector X, and the state change matrix of the observation host is flattened into a vector and marked as a characteristic vector Y; if the network security optimization and analysis module receives an unqualified signal, it is determined that the host risk performance value ZF of the host in the network does not meet the requirements, and all the hosts in the network are sorted in order from small to large according to the host risk performance value ZF, and the first object after the sorting is marked as a standard host, and the next L3 objects are marked as observation hosts, and L3 is a quantitative constant; the initial vector A of the standard host is marked as the characteristic vector X, and the initial vector A of the observation host is marked as the characteristic vector Y

[0021] Furthermore, the judgment process of the dangerous host includes: performing numerical calculation on the characteristic vector X and the characteristic vector Y to obtain the correlation coefficient XG, and comparing the correlation coefficient XG with the preset correlation coefficient threshold value XGmax: if XG is greater than XGmax, it is judged that the overlap degree of the characteristic vector X and the characteristic vector Y meets the requirements and no processing is required; if XG is less than or equal to XGmax, it is judged that the overlap degree of the characteristic vector X and the characteristic value vector Y does not meet the requirements, and the observed host corresponding to the characteristic vector Y is marked as a dangerous host in the network, a dangerous host signal is generated and sent to the terminal of the administrator, and optimization measures are taken for the dangerous host.

[0022] The present invention has the following beneficial effects:

[0023] 1. The host status evaluation module collects host data at a regular frequency within the monitoring period and calculates the host status coefficient, so that the real-time status of the host can be evaluated according to the host status coefficient, ensuring a quick response to the host status in the network;

[0024] 2. The network security risk calculation unit calculates the host risk performance value according to the host status during the monitoring period, so as to comprehensively evaluate the network risk size according to the risk performance values ​​of all hosts in the network;

[0025] 3. The network security risk trend assessment unit performs numerical calculations on the initial vector and state change matrix of the host in the network to obtain the host state vector, so as to predict the risk change trend of the host and the entire network based on the host state vector;

[0026] 4. Through the network security optimization analysis module, a comprehensive analysis of network security is conducted in combination with the size of network risks and changing trends. The hosts are divided into standard hosts and observation hosts, and the overlap of the feature vectors of the two is further compared to identify dangerous hosts that affect network security, thereby improving the accuracy of network security optimization analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0028] Figure 1 is the overall system block diagram of the present invention;

[0029] Figure 2 This is a block diagram of the network security joint analysis module of the present invention. DETAILED DESCRIPTION

[0030] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0031] like Figure 1-2As shown, a network security optimization and analysis system based on deep learning includes a host status assessment module, a network security joint analysis module, a network security optimization analysis module and a database. The network security joint analysis module includes a network security risk calculation unit and a network security risk trend assessment unit; the host status assessment module, the network security joint analysis module, the network security optimization analysis module and the database are communicatively connected in sequence.

[0032] The host status evaluation module is used to evaluate the status of the host in the network: the communication device connected to the computer network is marked as the host, and a monitoring cycle with a fixed duration of L1 seconds is generated. The total number of acquisitions in one monitoring cycle is recorded as n, and the number of system permission requests QQ, network delay YC, network traffic rate LL and number of applications CX of the host are obtained at a frequency of (L1 / n) times / second, and the collected data is transmitted to the database as training data for storage; among them, the number of system permission requests QQ, network delay YC, and network traffic rate LL can be collected and obtained through the log files of the operating system, and the number of applications CX can be collected and obtained through the processes in the task manager;

[0033] By formula Numerical calculation is performed to obtain the host state coefficient ZT, where y1, y2 and y3 are all proportional coefficients, and y1>y2>y3;

[0034] Compare the host status coefficient ZT with the preset host status high value ZTmax and host status low value ZTmin:

[0035] If the host status coefficient ZT is greater than or equal to the host status high value ZTmax, the host status is marked as abnormal;

[0036] If the host status coefficient ZT is less than the host status high value ZTmax and greater than or equal to the host status low value ZTmin, the host status is marked as a general status;

[0037] If the host status coefficient ZT is less than the host status low value ZTmin, the host status is marked as normal; by collecting the host data at a frequency during the monitoring period and calculating the host status coefficient, the real-time status of the host can be evaluated according to the host status coefficient, ensuring a rapid response to the host status in the network.

[0038] The network security risk calculation unit is used to calculate the size of network security risk: at the end of the monitoring period, the probability of occurrence of the host in the normal state, general state and abnormal state during the monitoring period is statistically calculated by the database P1, P2 and P3; the host risk performance value ZF of the host during the monitoring period is obtained by numerical calculation through the formula ZF=k1*P1+k2*P2+k3*P3, wherein k1, k2 and k3 are risk values ​​of the host in different states, and k3>k2>k1. It should be noted that the risk value is a constant obtained by continuous optimization of the deep learning model based on a large amount of training data; the host risk performance value ZF of all hosts in the network is summed and averaged to obtain the network security risk value WF of the network during the monitoring period, and the network security risk value WF is sent to the joint analysis module; the network security risk value WF is a value reflecting the level of network security risk. The larger the value of the network security risk value WF, the higher the corresponding network security risk; by calculating the host risk performance value according to the state of the host during the monitoring period, the network risk size can be comprehensively evaluated according to the risk performance values ​​of all hosts in the network.

[0039] The network security risk trend assessment unit is used to assess the changing trend of network security risks: the end time of each monitoring cycle is marked as the initial time T0 of the network security risk trend assessment, the normal state of the host is marked as 1, the general state is marked as 2, and the abnormal state is marked as 3, then the state of the host at the initial time T0 is marked as the initial vector A = [P1, P2, P3] T ; Get the state change matrix of the host For example, P 12 is the probability of the host changing from the normal state to the general state during the monitoring period. The acquisition process is as follows: the number of times the host changes from the normal state to the general state during the monitoring period is recorded as C 12 , the total number of host state changes during the monitoring period is the total number of acquisitions n minus 1, then P 12 =C 12 / (n-1); through the formula Perform matrix operation on the initial vector A and the state change matrix S to obtain the host state vector B after n state changes after the initial time T0, and B = [P1n, P2n, P3n] T , where P1n, P2n and P3n represent the probability prediction values ​​of the host normal state, general state and abnormal state at the end of the next monitoring period respectively;

[0040] Substitute the probability prediction values ​​P1n, P2n and P3n into the formula ZF=k1*P1+k2*P2+k3*P3 for numerical calculation to obtain the host risk prediction value ZC of the host in the next monitoring cycle. Sum and average the host risk prediction values ​​ZC of all hosts in the network to obtain the network security risk prediction value WC of the network in the next monitoring cycle.

[0041] The network security risk value WF of the monitoring period and the network security risk prediction value WC of the next monitoring period are numerically calculated by the formula FB=(WC-WF) / WF to obtain the risk change trend FB of the network, and the risk change trend FB is sent to the joint analysis module; the risk change trend FB is a numerical value that reflects the trend of network security risk changes. The larger the value of the risk change trend FB, the greater the trend of the corresponding network security risk becoming higher; the host state vector is obtained by numerically calculating the initial vector and the state change matrix of the host in the network, so that the risk change trend of the host and the entire network can be predicted based on the host state vector.

[0042] The network security joint analysis module is used to conduct a comprehensive analysis of network security based on the size and change trend of network risks: the network security risk threshold WAmax and the risk change threshold FBmax are obtained through the storage module, and compared with the network security risk value WA and the risk change trend FB respectively:

[0043] If the network security risk value WA is less than or equal to the network security risk threshold WAmax and the risk change trend FB is less than or equal to the risk change threshold FBmax, the network security is judged to be qualified and the risk is decreasing, and no action is required;

[0044] If the network security risk value WA is less than or equal to the network security risk threshold WAmax and the risk change trend FB is greater than or equal to the risk change threshold FBmax, it is judged that the network security is qualified but the risk is increasing, and a qualified and risky signal is generated and sent to the network security optimization analysis module;

[0045] If the network security risk value WA is greater than or equal to the network security risk threshold WAmax, the network security is judged to be unqualified, and an unqualified signal is generated and sent to the network security optimization analysis module.

[0046] The network security optimization and analysis module is used to optimize and analyze network security after receiving qualified risk signals or unqualified signals:

[0047] If the network security optimization and analysis module receives a qualified risk signal, it is determined that the host risk prediction value ZC of the host in the network does not meet the requirements, and all hosts in the network are sorted in ascending order according to the values ​​of the host risk prediction value ZC. The first object after the sorting is marked as a standard host, and the next L2 objects are marked as observation hosts, where L2 is a quantity constant; the state change matrix of the standard host is flattened into a vector and marked as a feature vector X, and the state change matrix of the observation host is flattened into a vector and marked as a feature vector Y;

[0048] If the network security optimization and analysis module receives an unqualified signal, it is determined that the host risk performance value ZF of the host in the network does not meet the requirements, and all hosts in the network are sorted in order from small to large according to the host risk performance value ZF. The first object after the sorting is marked as a standard host, and the next L3 objects are marked as observation hosts, where L3 is a quantity constant; the initial vector A of the standard host is marked as a feature vector X, and the initial vector A of the observation host is marked as a feature vector Y;

[0049] By formula The correlation coefficient XG between the eigenvector X and the eigenvector Y is obtained by numerical calculation, where X and Y are the element values ​​in the eigenvectors X and Y respectively, E(X) and E(Y) are the means of the elements in the eigenvectors X and Y respectively, and σ X σ Y is the product of the standard deviation of the elements in the feature vector X and Y; the correlation coefficient XG is compared with the preset correlation coefficient threshold XGmax:

[0050] If XG is greater than XGmax, it is judged that the coincidence degree of the eigenvector X and the eigenvector Y meets the requirement and no processing is required;

[0051] If XG is less than or equal to XGmax, it is determined that the overlap between the eigenvector X and the eigenvalue vector Y does not meet the requirements, the observed host corresponding to the eigenvector Y is marked as a dangerous host in the network, a dangerous host signal is generated and sent to the administrator's terminal, and optimization measures are taken for the dangerous host; illustratively, the optimization measures include configuring firewall rules, updating the virus library of the antivirus software, scanning the network system and applications for vulnerabilities, and reviewing whether the permissions of the application match business requirements; by combining the size of the network risk and the change trend to conduct a comprehensive analysis of network security, the hosts are divided into standard hosts and observation hosts, and the overlap of the eigenvectors of the two is further compared to find out the dangerous hosts that affect network security, thereby improving the accuracy of network security optimization analysis.

[0052] A network security optimization and analysis system based on deep learning, when working, marks a communication device connected to a computer network as a host, generates a monitoring cycle of fixed duration, obtains a host state coefficient ZT according to a frequency timing, and marks the host state as an abnormal state, a general state or a normal state according to the host state coefficient ZT; statistically calculates the probability of the host being in a normal state, a general state and an abnormal state during the monitoring cycle, and numerically calculates the network security risk value WF of the network; marks the end time of each monitoring cycle as the initial time T0 of the network security risk trend assessment, obtains the initial vector A and the state change matrix S of the host at the initial time T0, performs matrix calculation to obtain the host state vector B, and calculates the element value of the host state vector B to obtain the risk change trend FB; judges whether the network security is qualified and whether there is a risk by combining the network security risk value WF and the risk change trend FB, and divides the host into a standard host and an observation host, obtains the characteristic vectors of the standard host and the observation host, calculates the overlap degree, judges whether the observation host is a dangerous host, and takes optimization measures for the dangerous host.

[0053] The above contents are merely examples and explanations of the structure of the present invention. The technicians in this technical field may make various modifications or additions to the specific embodiments described or replace them in a similar manner. As long as they do not deviate from the structure of the invention or exceed the scope defined by the claims, they should all fall within the protection scope of the present invention.

[0054] The above formulas are obtained by collecting a large amount of data for software simulation and selecting a formula close to the actual value. The coefficients in the formula are set by technicians in this field according to actual conditions; such as: formula ZF = k1*P1+k2*P2+k3*P3; technicians in this field collect multiple groups of sample data and set corresponding host risk performance values ​​for each group of sample data; substitute the set host risk performance value and the collected sample data into the formula, any three formulas constitute a three-variable linear equation group, screen the calculated coefficients and take the average, and obtain the values ​​of k1, k2 and k3 as 1.53, 2.25 and 2.89 respectively;

[0055] The size of the coefficient is to quantify each parameter to obtain a specific value for subsequent comparison. The size of the coefficient depends on the amount of sample data and the initial setting of the corresponding host risk performance value for each set of sample data by technical personnel in this field; as long as it does not affect the proportional relationship between the parameter and the quantified value, such as the host risk performance value is proportional to the probability that the host is in a normal state.

[0056] In the description of this specification, the description with reference to the terms "one embodiment", "example", "specific example", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0057] The preferred embodiments of the present invention disclosed above are only used to help explain the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to only specific implementation methods. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A network security optimization analysis system based on deep learning, characterized in that: It includes a host status assessment module, a database, a network security joint analysis module and a network security optimization analysis module which are connected in sequence, and the network security joint analysis module includes a network security risk calculation unit and a network security risk trend assessment unit; The host status evaluation module marks the communication device connected to the computer network as a host, generates a monitoring cycle of a fixed duration, obtains the host status coefficient ZT according to the frequency timing, and marks the host status as an abnormal state, a general state, or a normal state according to the host status coefficient ZT; The network security risk calculation unit calculates the probability of occurrence of the host in the normal state, general state and abnormal state respectively, P1, P2 and P3 during the monitoring period, and obtains the network security risk value WF of the network according to P1, P2 and P3; The network security risk trend assessment unit marks the end time of each monitoring cycle as the initial time T0 of the network security risk trend assessment, performs matrix operations on the initial vector A and the state change matrix S corresponding to the state of the host at the initial time T0, obtains the host state vector B of the host at the end time of the next monitoring cycle, and obtains the risk change trend FB of the network based on B and WF; The network security joint analysis module determines whether the network security is qualified and whether there is risk based on the comparison results of the network security risk value WF and the network security risk threshold WAmax and the comparison results of the risk change trend FB and the risk change threshold FBmax; The network security optimization and analysis module, after receiving the judgment result of network security as qualified risk signal or unqualified signal, divides the host into standard host and observation host, obtains the characteristic vectors x and y of the standard host and the observation host respectively, determines whether the observation host is a dangerous host according to the overlap of x and y, and takes optimization measures for the dangerous host.

2. According to the deep learning-based network security optimization analysis system of claim 1, it is characterized in that: The process of obtaining the host state coefficient ZT includes: generating a monitoring cycle with a fixed duration of L1 seconds, the total number of collections in one monitoring cycle is recorded as n, and the host's system permission request number QQ, network delay YC, network traffic rate LL and number of applications CX are obtained at a frequency of (L1 / n) times / second, and the host state coefficient ZT is obtained by numerical calculation based on the host's system permission request number QQ, network delay YC, network traffic rate LL and number of applications CX.

3. A network security optimization analysis system based on deep learning according to claim 2, characterized in that: The host status marking process includes: comparing the host status coefficient ZT with the preset host status high value ZTmax and the host status low value ZTmin: if the host status coefficient ZT is greater than or equal to the host status high value ZTmax, the host status is marked as an abnormal state; if the host status coefficient ZT is less than the host status high value ZTmax and greater than or equal to the host status low value ZTmin, the host status is marked as a general state; if the host status coefficient ZT is less than the host status low value ZTmin, the host status is marked as a normal state.

4. A network security optimization analysis system based on deep learning according to claim 3, characterized in that: The process of obtaining the network security risk value WF includes: numerically calculating the occurrence probabilities P1, P2 and P3 of the host in the normal state, general state and abnormal state during the monitoring period to obtain the host risk performance value ZF of the host during the monitoring period, and summing and averaging the host risk performance values ​​ZF of all hosts in the network to obtain the network security risk value WF of the network during the monitoring period.

5. A network security optimization analysis system based on deep learning according to claim 4, characterized in that: The acquisition process of the host state vector B includes: marking the end time of each monitoring cycle as the initial time T0 of the network security risk trend assessment, marking the normal state of the host as 1, the general state as 2, and the abnormal state as 3, then the state of the host at the initial time T0 is marked as the initial vector A=[P1, P2, P3] T ; Get the state change matrix of the host , element P ij is the probability of the host changing from state i to state j during the monitoring period, where i, j = 1, 2, 3; matrix operation is performed on the initial vector A and the state change matrix S to obtain the host state vector B after the host undergoes n state changes after the initial time T0, and B = [P1n, P2n, P3n] T , where P1n, P2n and P3n represent the probability prediction values ​​of the host's normal state, general state and abnormal state at the end of the next monitoring cycle, respectively.

6. A network security optimization analysis system based on deep learning according to claim 5, characterized in that: The process of obtaining the risk change trend FB includes: numerically calculating the probability prediction values ​​P1n, P2n and P3n to obtain the host risk prediction value ZC of the host in the next monitoring cycle, summing up and averaging the host risk prediction values ​​ZC of all hosts in the network to obtain the network security risk prediction value WC of the network in the next monitoring cycle; numerically calculating the network security risk value WF of the monitoring cycle and the network security risk prediction value WC of the next monitoring cycle to obtain the risk change trend FB of the network.

7. A network security optimization analysis system based on deep learning according to claim 6, characterized in that: The process of judging network security includes: obtaining the network security risk threshold WAmax and the risk change threshold FBmax through the storage module, and comparing them with the network security risk value WF and the risk change trend FB respectively: if the network security risk value WF is less than or equal to the network security risk threshold WAmax and the risk change trend FB is less than or equal to the risk change threshold FBmax, then the network is judged to be qualified and the risk is decreasing, and no processing is required; if the network security risk value WF is less than or equal to the network security risk threshold WAmax and the risk change trend FB is greater than the risk change threshold FBmax, then the network is judged to be qualified but the risk is increasing, and a qualified and risky signal is generated and sent to the network security optimization and analysis module; if the network security risk value WF is greater than the network security risk threshold WAmax, then the network is judged to be unqualified, and an unqualified signal is generated and sent to the network security optimization and analysis module.

8. A network security optimization analysis system based on deep learning according to claim 7, characterized in that: The process of acquiring the characteristic vector includes: if the network security optimization and analysis module receives a qualified risk signal, it is judged that the host risk prediction value ZC of the host in the network does not meet the requirements, all the hosts in the network are sorted in the order of the host risk prediction value ZC from small to large, the first object after the sorting is marked as a standard host, and the next L2 objects are marked as observation hosts, and L2 is a quantity constant; the state change matrix of the standard host is flattened into a vector and marked as a characteristic vector X, and the state change matrix of the observation host is flattened into a vector and marked as a characteristic vector Y; if the network security optimization and analysis module receives an unqualified signal, it is judged that the host risk performance value ZF of the host in the network does not meet the requirements, all the hosts in the network are sorted in the order of the host risk performance value ZF from small to large, the first object after the sorting is marked as a standard host, and the next L3 objects are marked as observation hosts, and L3 is a quantity constant; the initial vector A of the standard host is marked as a characteristic vector X, and the initial vector A of the observation host is marked as a characteristic vector Y.

9. A network security optimization analysis system based on deep learning according to claim 8, characterized in that: The judgment process of the dangerous host includes: performing numerical calculation on the characteristic vector X and the characteristic vector Y to obtain the correlation coefficient XG, and comparing the correlation coefficient XG with the preset correlation coefficient threshold value XGmax: if XG is greater than XGmax, it is judged that the coincidence degree of the characteristic vector X and the characteristic vector Y meets the requirements and no processing is required; if XG is less than or equal to XGmax, it is judged that the coincidence degree of the characteristic vector X and the characteristic value vector Y does not meet the requirements, and the observed host corresponding to the characteristic vector Y is marked as a dangerous host in the network, a dangerous host signal is generated and sent to the terminal of the administrator, and optimization measures are taken for the dangerous host.

Images