A network security analysis method and system based on digital twins

Abstract

The present invention relates to the field of network security technology, and in particular to a network security analysis method and system based on digital twins. The method comprises the following steps: performing network topology perception on a target network to obtain a network data transmission topology diagram; performing real-time traffic collection on the target network for the first time to obtain a first real-time traffic data set; constructing a digital twin model of the target network based on the first real-time traffic data set based on the network data transmission topology diagram to obtain a network digital twin model; performing real-time traffic collection on the target network for the second time to obtain a second real-time traffic data set; performing device system log collection on the target network to obtain a device system log set; performing data synchronization mapping on the second real-time traffic data set, the device system log set and the network digital twin model to obtain a real-time network digital twin model. The present invention significantly reduces network security risks.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security analysis method and system based on digital twins. Background Art

[0002] Existing network security protection measures often rely on static, rule-based defense systems, which often show slow response and insufficient detection capabilities when dealing with rapidly changing and highly complex network attack patterns. In addition, the decision-making process of network security protection often relies on manual analysis and experience judgment, which is not only inefficient but also prone to human errors. A major limitation of existing network security solutions is the lack of real-time and dynamic monitoring capabilities of the network environment. The dynamic changes in network topology and the continuous evolution of traffic patterns make it difficult for traditional static analysis methods to adapt. In addition, existing systems often have difficulty integrating and analyzing large amounts of data from different devices and components in the network, resulting in the inability to form a comprehensive understanding of the entire network environment. Another challenge is that existing network security systems often use isolated methods when processing and analyzing network logs, traffic data, and device status information, lacking effective data fusion and correlation analysis mechanisms. This results in limited accuracy and efficiency of security analysis, making it difficult to detect and respond to complex security threats in a timely manner. Summary of the invention

[0003] Based on this, it is necessary for the present invention to provide a network security analysis method and system based on digital twins to solve at least one of the above technical problems.

[0004] To achieve the above purpose, a network security analysis method based on digital twins includes the following steps:

[0005] Step S1: Perform network topology perception on the target network to obtain a network data transmission topology map; perform real-time traffic collection on the target network for the first time to obtain a first real-time traffic data set;

[0006] Step S2: constructing a digital twin model of the target network based on the first real-time traffic data set based on the network data transmission topology diagram to obtain a network digital twin model; collecting real-time traffic of the target network for a second time to obtain a second real-time traffic data set;

[0007] Step S3: collecting device system logs of the target network to obtain a device system log set; performing data synchronization mapping on the second real-time traffic data set, the device system log set and the network digital twin model to obtain a real-time network digital twin model;

[0008] Step S4: Perform network security analysis on the target network based on the real-time network digital twin model to obtain network security analysis results; adjust the security policy of the target network according to the network security analysis results.

[0009] The present invention can capture the dynamic changes of the network in real time, including changes in data transmission paths and traffic patterns, through network topology perception and real-time traffic collection. This makes network security monitoring no longer limited to periodic scanning or static rule checking, but can respond quickly to abnormal behaviors in the network. Through the construction of the digital twin model, an accurate virtual copy is provided for the network, which helps to simulate and predict network behavior more accurately. By comparing the first real-time traffic data set and the second real-time traffic data set, abnormal traffic can be more accurately identified, thereby improving the accuracy of security protection. By combining the device system log, real-time traffic data and the digital twin model, a comprehensive network status view is formed. This comprehensive data integration and analysis mechanism enables the present invention to monitor the entire network environment from a macro perspective and discover security threats that are ignored by isolated analysis methods. Through the automated data synchronization and mapping process, the present invention reduces the need for manual analysis and reduces errors and delays caused by human factors. At the same time, the application of the real-time network digital twin model improves the efficiency of security analysis, enabling the security team to respond to security incidents more quickly. Through network security analysis and security policy adjustment, the present solution can not only identify and respond to security threats, but also dynamically adjust security policies according to the analysis results to adapt to changes in the network environment. This adaptive security policy adjustment mechanism improves the network's defense capabilities against new attacks and unknown threats. Through real-time monitoring, accurate identification and rapid response, the present invention significantly reduces network security risks. It can help organizations detect and prevent potential attacks in a timely manner, and reduce the occurrence of security incidents such as data leakage and network interruption.

[0010] Preferably, the present invention also provides a network security analysis system based on digital twins, which is used to execute the network security analysis method based on digital twins as described above, and the network security analysis system based on digital twins includes:

[0011] The traffic collection module is used to perceive the network topology of the target network and obtain a network data transmission topology map; collect the real-time traffic of the target network for the first time and obtain a first real-time traffic data set;

[0012] A digital twin model construction module is used to construct a digital twin model of a target network based on a network data transmission topology diagram according to a first real-time traffic data set to obtain a network digital twin model; and collect real-time traffic of the target network for a second time to obtain a second real-time traffic data set;

[0013] A data synchronization module is used to collect device system logs of the target network to obtain a device system log set; perform data synchronization mapping on the second real-time traffic data set, the device system log set and the network digital twin model to obtain a real-time network digital twin model;

[0014] The network security analysis module is used to perform network security analysis on the target network based on the real-time network digital twin model to obtain network security analysis results; and adjust the security policy of the target network according to the network security analysis results.

[0015] Through the flow collection module, the system of the present invention can monitor the network data transmission topology map and flow data in real time, thereby providing accurate basic information for network security analysis. This real-time monitoring capability helps to timely discover abnormal behaviors and potential threats in the network. Through the digital twin model construction module, an accurate virtual copy of the target network can be created, including network topology and flow data. This digital twin model provides a reliable reference framework for network security analysis, making the analysis closer to the actual network environment. The data synchronization module forms a comprehensive network status view by integrating real-time flow data, device system logs and digital twin models. This data integration helps to improve the accuracy and depth of security analysis, making the analysis results more comprehensive and reliable. The network security analysis module reduces the need for manual intervention by automatically performing network security analysis tasks. This not only improves the analysis efficiency, but also reduces errors and delays caused by human factors. Through real-time monitoring and rapid analysis, the system can quickly identify security threats and respond. This rapid response mechanism helps to prevent attacks in a timely manner and reduce potential losses. The present invention can dynamically adjust security policies according to the results of network security analysis, so that network protection can adapt to the ever-changing network environment and threat situation. This adaptive capability significantly improves the defense capability of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Other features, objects and advantages of the present invention will become more apparent from the detailed description made with reference to the following drawings:

[0017] Figure 1 A schematic diagram of the steps of a digital twin-based network security analysis method according to an embodiment is shown.

[0018] Figure 2 A detailed flow chart of step S3 of an embodiment is shown.

[0019] Figure 3 A detailed flow chart of step S4 of an embodiment is shown. DETAILED DESCRIPTION

[0020] The technical method of the present invention is described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by technicians in this field without creative work are within the scope of protection of the present invention.

[0021] In addition, the accompanying drawings are only schematic illustrations of the present invention and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. The functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor methods and / or microcontroller methods.

[0022] It should be understood that, although the terms "first", "second", etc. may be used herein to describe various units, these units should not be limited by these terms. These terms are used only to distinguish one unit from another unit. For example, without departing from the scope of the exemplary embodiments, the first unit may be referred to as the second unit, and similarly the second unit may be referred to as the first unit. The term "and / or" used herein includes any and all combinations of one or more of the listed associated items.

[0023] To achieve this, please refer to Figures 1 to 3 , the present invention provides a network security analysis method based on digital twins, comprising the following steps:

[0024] Step S1: Perform network topology perception on the target network to obtain a network data transmission topology map; perform real-time traffic collection on the target network for the first time to obtain a first real-time traffic data set;

[0025] Step S2: constructing a digital twin model of the target network based on the first real-time traffic data set based on the network data transmission topology diagram to obtain a network digital twin model; collecting real-time traffic of the target network for a second time to obtain a second real-time traffic data set;

[0026] Step S3: collecting device system logs of the target network to obtain a device system log set; performing data synchronization mapping on the second real-time traffic data set, the device system log set and the network digital twin model to obtain a real-time network digital twin model;

[0027] Step S4: Perform network security analysis on the target network based on the real-time network digital twin model to obtain network security analysis results; adjust the security policy of the target network according to the network security analysis results.

[0028] In this embodiment, first, a network topology mapping tool, such as SolarWinds Network Topology Mapper, is used to perceive the network topology of the target network. By automatically discovering all devices and connections in the network, a network data transmission topology diagram is generated, which shows the communication path and connection relationship between devices in the network. Subsequently, a traffic monitoring tool, such as Wireshark, is deployed to collect the real-time traffic of the target network for the first time, collect all data packet information passing through the network device, and obtain the first real-time traffic data set. These data include information such as source and destination IP addresses, port numbers, and transmission protocols. Based on the network data transmission topology diagram and the first real-time traffic data set, a digital twin modeling software, such as BentleyMicroStation, is used to build a digital twin model of the target network. This model is a virtual copy of the network and can be used to simulate and analyze network behavior. Next, Wireshark is used again to collect the real-time traffic for the second time to obtain the second real-time traffic data set. This will provide the latest data on network traffic. At the same time, a log management tool, such as Splunk, is used to collect system logs of devices in the target network to obtain a device system log set. These logs include the operating status, error information, and configuration changes of the device. Then, the second real-time traffic data set and the device system log set are mapped to the network digital twin model for data synchronization. The model is updated in Bentley MicroStation to reflect the latest traffic and log data to obtain a real-time network digital twin model. Based on the real-time network digital twin model, network security analysis is performed using network security analysis tools, such as FireEye. The analysis tool will assess the vulnerability of the network, monitor abnormal behavior, and identify potential security threats to obtain network security analysis results. Finally, based on the results of the network security analysis, security policy management tools, such as Tenable.sc, are used to adjust the security policy of the target network. This includes but is not limited to updating access control rules, strengthening endpoint protection, enhancing encryption measures, or improving network monitoring strategies.

[0029] Preferably, step S1 comprises the following steps:

[0030] Step S11: collecting a physical topology diagram of the target network to obtain a network physical device topology diagram, wherein the network physical device topology diagram at least includes computers, routers, printers, servers, switches, hubs, and wireless access points;

[0031] Specifically, you can use network management software or command-line tools, such as SolarWinds Network TopologyMapper, to enter the IP address range or subnet of the target network. The tool will automatically scan the network and discover all online devices. The tool will identify various devices in the network, such as computers, routers, printers, servers, switches, hubs, and wireless access points. The identified online devices will be used to generate a visual topology map of the network's physical devices. This diagram is presented in a graphical interface, where each device is a node and the connecting lines represent physical or logical connections. The generated topology map needs to be reviewed to ensure that all devices are correctly identified and placed. If any errors or omissions are found, the topology map can be corrected by manual entry or adjustment.

[0032] Step S12: collecting hardware addresses and logical addresses of devices in the target network to obtain a device hardware address set and a device logical address set;

[0033] Specifically, you can choose a network scanning tool, such as Nmap, which can discover devices on the network and collect their hardware and logical addresses. Configure the scan parameters in Nmap and specify the IP address range or specific subnet to scan. At the same time, set the scan mode to collect the MAC address and IP address of the device. Start the scanning process. Nmap will send data packets to each device on the network and listen for responses. By analyzing the responses, Nmap can determine the MAC and IP addresses of the device. After the scan is completed, Nmap will provide a detailed report of all discovered devices, including the MAC address and IP address of each device. Organize the collected address information into device hardware address sets and device logical address sets. These sets can be in table form or records in a database.

[0034] Step S13: collecting routing tables of the target network to obtain a routing table set of the target network, wherein the routing table set of the target network includes a plurality of routing tables of the target network, and the routing table collection includes the routing table collection of the router and the routing table collection of the switch;

[0035] Specifically, you can use network management protocols such as SNMP (Simple Network Management Protocol) or directly access the device's CLI (Command Line Interface) to collect routing table information for all routers and switches in the target network. Make sure you have access to network devices (routers and switches) and prepare network management tools such as PRTG Network Monitor or SolarWinds Network Performance Monitor, which support the SNMP protocol. Enable SNMP on network devices and configure SNMP community strings in management tools to allow tools to access the device's routing table information. For routers, use SNMP to query routing-related objects in the router's MIB (Management Information Base), such as the IP routing table (ipRouteTable). For switches, if routing functions are supported (such as multilayer switches), also use SNMP to query the switch's routing table. The tool will automatically collect routing table information for each device, including the destination network, subnet mask, next hop address, egress interface, etc. The collected routing table information is organized into a target network routing table set, with one routing table for each device.

[0036] Step S14: marking device addresses on the network physical device topology map according to the device hardware address set and the device logical address set to obtain a marked network physical device topology map;

[0037] Specifically, you can select a tool that supports network topology drawing, such as Visio, SolarWinds, or CiscoNetwork Diagrammer. Import the network physical device topology diagram generated in step S11 into the drawing tool. For each device node, select the device in the graphical interface. Add the hardware address (MAC address) and logical address (IP address) in the properties or labels of the device node. Make sure that the annotations of each device are clearly visible and match the actual location and connection of the device. Export the annotated network physical device topology diagram to PDF or other formats and archive it.

[0038] Step S15: Draw a data transmission path for the marked network physical device topology map according to the target network routing table set to obtain a network data transmission topology map;

[0039] Specifically, data transmission paths can be drawn through network management and analysis tools. First, use a network analysis tool, such as SolarWinds Network Topology Mapper, to import the target network routing table set collected in step S13. Then, based on the information in the routing table, the tool will automatically draw the path through which the data flows on the network topology map. These paths will show how data packets are transmitted between network devices, including displaying the source node, destination node, and connection path between the data packets. After drawing, the generated network data transmission topology map needs to be reviewed to ensure the accuracy and completeness of the path. Finally, the network data transmission topology map that has been reviewed and found to be correct will be archived.

[0040] Step S16: collect the real-time traffic of the target network for the first time to obtain a first real-time traffic data set, wherein the first real-time traffic data set includes a plurality of first real-time traffic data, and the first real-time traffic data uniquely corresponds to the device in the target network.

[0041] Specifically, this can be achieved by deploying network traffic monitoring tools for real-time traffic collection, such as Wireshark or SolarWinds Network Analyzer. First, configure Wireshark to capture traffic at key switching points in the network, such as core routers or switches. Make sure the capture settings include all relevant network interfaces and protocol types. During the capture process, Wireshark will collect data packet information passing through network devices in real time, such as source IP, destination IP, port number, and amount of data transmitted. The collected data will be saved as the first real-time traffic data set, where each data record is associated with a specific device in the network.

[0042] The present invention significantly improves the accuracy and efficiency of network security analysis through key steps such as refined network topology identification, comprehensive device information collection, in-depth routing analysis, enhanced network visualization, accurate data transmission path mapping, and real-time traffic monitoring. These steps not only provide a solid foundation for building an accurate network model, but also can quickly locate problem devices, identify security threats at the routing level, provide an intuitive view of the network, track data flow, capture abnormal behavior, and formulate more targeted security policies. A detailed understanding of network topology and device information helps to optimize resource allocation and improve the overall performance and security of the network. When a security incident occurs, these detailed data are crucial for tracking the source of the attack and conducting security forensics, and also promote the efficiency and accuracy of automated security analysis tools.

[0043] Preferably, step S2 comprises the following steps:

[0044] Step S21: constructing a device component model for the target network to obtain a device component model library, wherein the device component model library includes a plurality of groups of device component models, wherein the group of device component models are hardware and software component models of different version numbers of the device;

[0045] Specifically, you can use computer-aided design (CAD) software or specialized network modeling tools to build device component models. First, collect the technical specifications and architecture information of all devices in the target network. Then, use CAD software such as AutoCAD or SolidWorks to create a basic model of each device. For each device, you need to create hardware and software component models with different version numbers. This includes detailed 3D modeling of the device's housing, interface, circuit board, etc. After the model is built, organize these models into a device component model library. The library will contain different version models of all devices in the network.

[0046] Step S22: collecting device version information of the target network to obtain a device version data set;

[0047] Specifically, network management tools and scripts can be used to achieve this. First, use network management tools, such as Nagios or Zabbix, to scan all devices in the network to collect basic information about the devices. Then, write a custom script, such as a Python script, to parse the data collected by the tool and extract the hardware and software version information of the device. The script can format the extracted version information into a device version data set, which should contain key information such as the device's identification information, hardware version number, and software version number.

[0048] Step S23: constructing a three-dimensional device model for the target network based on the device component model library and the device version data set to obtain a three-dimensional device model set;

[0049] Specifically, you can use computer-aided design (CAD) software, such as Autodesk AutoCAD or SiemensNX, to open the device component model library. Then, according to the device version data set, select the corresponding hardware and software component models. For each device in the network, according to its version information, integrate the corresponding component models to build a complete device 3D model. During the construction process, ensure that the size, interface location, and internal structure of the model match the actual device. After the construction is completed, integrate the 3D models of all devices into a device 3D model set.

[0050] Step S24: mapping the data transmission path of the device three-dimensional model set according to the network data transmission topology diagram to obtain a network data transmission three-dimensional model;

[0051] Specifically, you can use professional network modeling and simulation software, such as OPNET Modeler or Cisco PacketTracer, to import the network data transmission topology diagram and the device 3D model set. Then, according to the data transmission path information in the topology diagram, the 3D model of each device is path mapped in the simulation software. This includes drawing virtual data transmission lines between the 3D models to simulate the data flow in the actual network. During the mapping process, ensure that the data transmission path is consistent with the path in the topology diagram, and that the connection points of the path match the interface positions of the device. After the mapping is completed, the generated network data transmission 3D model is tested and verified to ensure the accuracy of the data flow and the reliability of the model. Finally, the network data transmission 3D model is obtained.

[0052] Step S25: Collect detailed specifications of each device in the target network to obtain a device-related parameter set, wherein the device-related parameter set at least includes device specification parameters, device operating system version, device firmware version, device application information, device network configuration file, device access control rules, device performance indicators, device security policies, and device communication protocols;

[0053] Specifically, detailed device specifications can be collected for each device in the target network through the network management system (NMS) and configuration management database (CMDB). First, use NMS tools such as Zabbix or Nagios to scan all devices in the network and collect basic information about the devices, such as IP address, MAC address, and device model. Then, use CMDB tools such as ServiceNow or BMC Remedy to record and organize this information. Next, more detailed specification parameters need to be extracted from the device's configuration file and operating system manually or using automated scripts, including operating system version, firmware version, installed applications, network configuration files, access control rules, performance indicators, security policies, and communication protocols. This data can be obtained through the device's API interface, SSH connection, or SNMP protocol. All the collected information will be integrated into a detailed set of device-related parameters.

[0054] Step S26: Associating device parameters with the three-dimensional model of network data transmission according to the device-related parameter set to obtain a network digital twin model;

[0055] Specifically, device parameter association can be performed through 3D modeling software and parameter management software. First, open the network data transmission 3D model. Then, use 3D modeling software such as Autodesk Revit or BentleyMicroStation to add parameters to the model of each device. These parameters can be imported from the device-related parameter set. For example, labels or annotations can be added to the 3D model of the device to display the operating system version, firmware version, and application information. In addition, color coding or different transparency can be used to represent the network configuration status, performance indicators, and security policies of the device. After completing the parameter association of all devices, the generated network digital twin model is tested and verified to ensure that all parameters are displayed and associated correctly. Finally, a network digital twin model is obtained.

[0056] Step S27: collect the real-time traffic of the target network for the second time to obtain a second real-time traffic data set, wherein the second real-time traffic data set includes a plurality of second real-time traffic data, and the second real-time traffic data uniquely corresponds to the device in the target network.

[0057] Specifically, you can determine the time point when the second traffic capture is required, and select monitoring points in the network, such as the SPAN port of a key switch or a router. Use tools such as Wireshark to set capture filters to ensure that only relevant traffic data is captured, such as traffic from a specific protocol or a specific device. Deploy capture devices in the network or start a remote capture session to ensure time synchronization of the capture devices. Start traffic capture at a preset time point, and Wireshark will capture all data packets passing through the network monitoring point and record information such as the source IP address, destination IP address, number of bytes transmitted, and protocol type. After the capture is completed, the collected data is sorted to generate a second real-time traffic data set. This data set should contain the unique identifier of each device and the corresponding traffic information.

[0058] The present invention significantly enhances the ability to identify network devices and their versions by constructing a detailed device component model library and a three-dimensional model, and improves the efficiency and intuitiveness of device management. By accurately mapping data flows and comprehensively collecting device parameters, a comprehensive network digital twin model can be constructed, providing a highly realistic virtual environment for in-depth security analysis. This not only optimizes the visualization of the network, making the relationship between the network structure and devices clearer, but also improves the depth of security analysis, helps to simulate attack paths and predict potential threats. The accurate network digital twin model promotes the precise implementation of security policies and ensures that security measures can be applied to key network parts in a targeted manner. Through the second real-time traffic collection, the real-time monitoring capability is enhanced, and the latest status of the network can be captured in time, providing support for rapid response. With the continuous changes in network equipment and configurations, the present invention ensures the continuous updating of the network digital twin model and improves the adaptability and overall security of the network.

[0059] Preferably, step S3 comprises the following steps:

[0060] Step S31: collecting device system logs of the target network to obtain a device system log set, wherein the device system log set includes a plurality of device system logs;

[0061] Specifically, you can use log management software and scripts to collect device system logs. First, determine the list of devices and log types that need to collect logs, such as system logs, error logs, and event logs generated by routers, switches, servers, etc. Then, use log management tools such as Splunk or ELK Stack (Elasticsearch, Logstash, Kibana) to configure log collection tasks. These tools can automatically collect log files from devices through SSH, SNMP, or other log transmission protocols. For each device, configure Logstash (if using ELK Stack) to connect to the device's log storage location and set filtering rules to identify and extract useful log information. After configuration, Logstash will regularly pull logs from the device and transfer them to Elasticsearch for index storage so that Kibana can be used for subsequent visual query and analysis. During the log collection process, ensure the integrity and accuracy of the logs, and perform preliminary parsing and formatting of the collected logs. After collection, integrate the log information into a device system log set.

[0062] Step S32: Time-aligning the device system log set and the second real-time traffic data set to obtain a synchronized device system log set and a synchronized second real-time traffic data set;

[0063] Specifically, data processing scripts and time synchronization tools can be used to time align the device system log set with the second real-time traffic data set. First, ensure that the device system log set and the second real-time traffic data set are sorted in chronological order. Then, use data processing tools, such as Python, to write a script to process the two data sets. The script will match the log and traffic data based on the timestamps. For example, for each line of system log, the script will search for traffic data at the same or similar time points and associate them. In the process of time alignment, it is necessary to handle time deviations and missing logs. To this end, a time window (such as ±1 minute) can be set, and the log and traffic data within this time window are considered to be matched. For missing logs or traffic data, default values ​​can be set in the script or interpolation methods can be used to estimate. After completing the time alignment, the synchronized device system log set and the synchronized second real-time traffic data set are integrated. The integrated data set will contain detailed log information and corresponding network traffic information for each event.

[0064] Step S33: Perform program running status statistics on each device system log to obtain a device running status summary table set;

[0065] Specifically, the collected system logs of each device can be analyzed through log analysis tools and custom scripts to count the running status of the program. First, use log analysis tools such as Graylog or Splunk to parse and index the device system log set. Then, write query statements or scripts to extract information about the program running status in the log, such as the number of program startups, the number of errors, the running time, etc. For example, in Splunk, you can use search queries such as search index=system_logs error_count>0|stats count by program to count the number of errors for each program. Through these queries, you can generate a report containing the program running status. Finally, integrate these reports into a set of device running status overview tables to provide a snapshot of the running status for each device.

[0066] Step S34: collecting performance indicators of each device in the target network to obtain a device performance indicator set;

[0067] Specifically, performance indicators of various devices in the target network can be collected by using network performance monitoring tools and device management software. For example, use Nagios or Zabbix to configure network devices to monitor and collect performance indicators such as CPU usage, memory usage, disk I / O, and network throughput. In Nagios, you can define monitoring services and use its plug-ins (such as check_cpu, check_memory, etc.) to collect performance data. Zabbix can do this through its built-in monitoring items and data collectors. Once configured, these tools will regularly collect performance data from the device and store the data in a database. This data is then extracted from the database and integrated into a set of device performance indicators to provide an overview of the performance of each device.

[0068] Step S35: Map the synchronized device system log set, the synchronized second real-time traffic data set, the device operation status overview table set and the device performance indicator set to the corresponding devices in the network digital twin model to obtain a real-time network digital twin model.

[0069] Specifically, you can open the network digital twin model. Then, use data visualization tools such as Tableau or Power BI to associate the set of device operating status overview tables and the set of device performance indicators with the devices in the model. For example, in Tableau, you can create a dashboard to display the performance indicators and operating status of each device. Next, associate the synchronized device system log set and the synchronized second real-time traffic data set with the devices in the model. This can be achieved by adding interactive charts or information labels to each device node in the model to display real-time traffic data and log information. Finally, integrate all this information into the network digital twin model to create a comprehensive network model that is updated in real time and contains device performance, status, and traffic information.

[0070] The present invention achieves data synchronization and time alignment by collecting device system logs and real-time traffic data, greatly enhancing the ability of log analysis and the accuracy of network activities. Through statistical analysis of logs and collection of performance indicators, comprehensive monitoring of equipment operation status is provided, which helps to timely discover performance bottlenecks and abnormal patterns. By integrating this data into the network digital twin model, a real-time updated network status view is constructed, which significantly improves the response speed of security incidents and the optimization of security policies. The present invention can also use real-time data for predictive analysis, identify potential threats in advance, and take preventive measures.

[0071] Preferably, step S4 comprises the following steps:

[0072] Step S41: performing traffic group matching on the first real-time traffic data set and the second real-time traffic data set according to the device ID in the target network to obtain a plurality of device traffic matching groups, wherein the device traffic matching groups include the first real-time traffic data of the device and the second real-time traffic data of the device, and the device traffic matching groups are the traffic passing through the same device in the same duration;

[0073] Specifically, data analysis software, such as Python with the Pandas library, can be used to perform traffic group matching. First, load the first real-time traffic data set and the second real-time traffic data set into the data analysis environment. Then, use the device ID as the key field to match the traffic records of the same device ID in each data set by performing an association operation. During the matching process, make sure that the traffic data within the same time range is compared. After the matching operation is completed, a series of device traffic matching groups will be obtained, each of which contains traffic data of the same device at two different time points.

[0074] Step S42: Calculate the flow difference between the first real-time flow data of the device and the second real-time flow data of the device to obtain the device flow difference;

[0075] Specifically, for each device traffic matching group, the difference in traffic values ​​between the first and second real-time traffic data sets can be calculated. This includes comparing the upload and download traffic data of the device and calculating their changes at two time points. Through the subtraction operation, the traffic difference of each device in the two real-time traffic data sets can be obtained.

[0076] Step S43: collecting device connection status of the target network to obtain a device connection status table, wherein the device connection status table includes a plurality of device connection status records, wherein the device connection status record includes device hardware address data and device network connection type, wherein the device network connection type is any one of an external connection device and a network isolation device;

[0077] Specifically, NMS, such as Zabbix or Nagios, can be used to monitor and record the connection status of network devices. First, configure the NMS tool to discover all devices in the network and identify the connection relationship between them. Then, through SNMP (Simple Network Management Protocol) or NetFlow protocol, collect the network interface information of the device, including interface status (such as enabled or disabled), interface type (such as Ethernet or wireless), and connected device hardware address. Next, classify the device connection status to distinguish whether the device is an external connection device (a device connected to the external network) or a network isolation device (a device connected only in the internal network). By analyzing the network configuration and routing information of the device, its connection type can be determined. Finally, the collected information of the device hardware address and the device network connection type is integrated into the device connection status table. This table will contain the hardware address of each device and the corresponding connection status record.

[0078] Step S44: extracting the device hardware address from the device flow difference to obtain the first device hardware address;

[0079] Specifically, the device hardware address may be directly extracted from the device traffic difference value, thereby obtaining the first device hardware address.

[0080] Import the data into analysis tools, such as Microsoft Excel or professional data analysis software Tableau. Then, based on preset conditions, such as when the flow difference exceeds a certain threshold, identify devices with abnormal flow.

[0081] Step S45: performing flow anomaly detection on the corresponding device according to the device flow difference, the device connection status table and the first device hardware address to obtain a device flow anomaly detection result;

[0082] Specifically, please refer to the sub-steps of step S45 for the detailed implementation process of this embodiment.

[0083] Step S46: Performing network security analysis on the target network based on the real-time network digital twin model according to the device traffic anomaly detection result to obtain a network security analysis result;

[0084] Specifically, please refer to the sub-steps of step S46 for the detailed implementation process of this embodiment.

[0085] Step S47: adjusting the security policy of the target network according to the network security analysis result.

[0086] Specifically, please refer to the sub-steps of step S47 for the detailed implementation process of this embodiment.

[0087] The present invention significantly improves the accuracy and efficiency of network traffic anomaly detection through precise traffic analysis and comprehensive connection status identification. The present invention can quickly identify abnormal traffic in the network by comparing traffic data at different time points, and effectively distinguish normal traffic from potential threats. Through real-time network security analysis and dynamic security policy adjustment mechanisms, it can respond to new security threats in a timely manner and adapt to the ever-changing network environment, thereby enhancing the network's adaptive defense capabilities. Rapid anomaly detection and policy adjustment processes improve response efficiency and reduce potential losses caused by security incidents. At the same time, accurate traffic analysis helps to optimize resource allocation and ensure that security resources are effectively utilized. In addition, the present invention also reduces the false alarm rate, improves the reliability of security analysis, and improves network transparency.

[0088] Preferably, step S45 includes the following steps:

[0089] Step S451: extracting the network connection type of the corresponding device according to the device connection status table and the hardware address of the first device to obtain the network connection type of the first device;

[0090] Specifically, a database management system or a data processing tool, such as Excel or Python's Pandas library, can be used. First, the device connection status table is imported into the database, or the table is loaded in the data processing tool. Next, the corresponding record is retrieved from the device connection status table using the hardware address of the first device as a keyword. By querying, the hardware address of each device and its network connection type can be obtained to determine whether the device is an external connection device or a network isolation device. Finally, the network connection type of the first device is obtained.

[0091] Step S452: If the network connection type of the first device is an external connection device, the device flow difference is compared with a preset first maximum flow threshold;

[0092] Specifically, if the network connection type of the first device is an external connection device, the device traffic difference is compared with a preset first maximum traffic threshold.

[0093] Step S453: if the device flow difference is greater than or equal to the preset first maximum flow threshold, the corresponding device is marked as a high flow abnormal device, and the device flow abnormality detection result is obtained;

[0094] Specifically, if the flow difference meets the condition, that is, is greater than or equal to the preset first maximum flow threshold, it will be marked as a "high flow abnormal device" in the result.

[0095] Step S454: if the device flow difference is less than the preset first maximum flow threshold, the corresponding device is marked as a normal flow device, and the device flow abnormality detection result is obtained;

[0096] Specifically, if the device flow difference is less than a preset first maximum flow threshold, these devices need to be marked as normal flow devices. To this end, data analysis software, such as Excel or Google Sheets, can be used to process and mark the data.

[0097] Step S455: If the network connection type of the first device is a network isolation device, the device flow difference is compared with a preset second maximum flow threshold;

[0098] Specifically, if the network connection type of the first device is a network isolation device, the device flow difference is compared with a preset second maximum flow threshold.

[0099] Step S456: If the device flow difference is greater than or equal to the preset second maximum flow threshold, the corresponding device is marked as a potential leakage device, and the device flow anomaly detection result is obtained;

[0100] Specifically, if the traffic difference of the network isolation devices is greater than or equal to the preset second maximum traffic threshold, these devices need to be marked as potential leaking devices. This can be done by using the data analysis software mentioned above.

[0101] Step S457: If the device flow difference is less than the preset second maximum flow threshold, the corresponding device is marked as an isolated safety device to obtain a device flow anomaly detection result, wherein the preset first maximum flow threshold is greater than the preset second maximum flow threshold.

[0102] Specifically, if the traffic difference of the network isolation devices is less than the preset second maximum traffic threshold, these devices are marked as isolated safety devices. This can be implemented by continuing to use the data analysis software.

[0103] The present invention significantly improves the efficiency and effectiveness of network security management by refining traffic anomaly detection, optimizing resource allocation, and improving the pertinence of security protection. By setting appropriate traffic thresholds for devices with different network connection types, it not only enhances the risk identification capability, but also improves the response efficiency, and quickly identifies and handles high-traffic anomalies and potential leaking devices. In addition, this strategy effectively reduces false positives and missed positives, and strengthens internal network security. The adaptability of the system is also improved, which can meet different network environments and security requirements, while promoting the implementation of automated security responses, providing comprehensive protection for network security.

[0104] Preferably, step S46 includes the following steps:

[0105] Step S461: According to the device traffic anomaly detection result, the corresponding device state is marked as the device traffic anomaly detection result in the real-time network digital twin model to obtain a marked real-time network digital twin model, wherein the device traffic anomaly detection result is any one of a high traffic anomaly device, a normal traffic device, a potential leakage device, and an isolated safety device;

[0106] Specifically, you can open the real-time network digital twin model and find the device corresponding to the device traffic anomaly detection result in the model. Then, according to the device traffic anomaly detection result, use the annotation function of the model editing tool to update the status of the device. For example, if the device is marked as a "high traffic anomaly device", change the color of the device to red in the digital twin model, or add a special icon as a warning. For "normal traffic devices", they can be marked green, while "potential leakage devices" and "isolated safety devices" can be marked with yellow and blue respectively. During the update process, ensure that the annotation of each device corresponds to its traffic anomaly detection result, and all changes are synchronized to the network digital twin model, and finally obtain the annotated real-time network digital twin model.

[0107] Step S462: extracting abnormal device data transmission paths from the target network based on the annotated real-time network digital twin model to obtain an abnormal device data transmission path set, wherein the abnormal device data transmission path set includes a plurality of abnormal device data transmission paths;

[0108] Specifically, you can open the annotated real-time network digital twin model and identify all devices that have been marked as abnormal. Then, use the path tracking function of a network analysis tool (such as OPNET Modeler or Cisco Packet Tracer) to track and record the path of data flow to other network nodes starting from these abnormal devices. During the tracing process, make sure to record all nodes and connections on the path, including switches, routers, and other intermediate devices. After the path extraction is completed, this information is integrated into a set of data transmission paths for abnormal devices. Each path set will contain a series of detailed information about the data flow, such as the source device, destination device, intermediate nodes passed through, and transmission protocols.

[0109] Step S463: performing transmission node statistics on each abnormal device data transmission path to obtain a transmission node number set, wherein the transmission node number set includes a number of transmission node numbers, and the transmission node number is the total number of transmission nodes in the abnormal device data transmission path;

[0110] Specifically, the abnormal device data transmission path set can be obtained from step S462, which contains detailed information of each path, such as the nodes and connections passed through. Then, use data processing tools such as Excel or Python to count the nodes in each path. In Excel, you can create a new worksheet, list all the paths, and use the counting function to count the number of nodes in each path. In Python, you can traverse the list of each path and use the built-in counting function to count the number of nodes. After the statistics are completed, the number of transmission nodes for each path is sorted into a set, that is, the transmission node number set.

[0111] Step S464: Calculate the abnormal device proportion for each abnormal device data transmission path to obtain an abnormal device proportion indicator set, wherein the abnormal device proportion indicator set includes a plurality of abnormal device proportion indicators;

[0112] Specifically, data analysis software, such as Tableau or R language, can be used to calculate the proportion of abnormal devices in each path. Get the set of transmission node numbers obtained in step S463 and the set of abnormal device data transmission paths in step S462. In Tableau, you can create a calculated field to calculate the ratio of the number of abnormal devices divided by the total number of nodes in the path. In R language, you can use data frame operations and ratio calculations to achieve this. After calculating the proportion of abnormal devices in each path, organize these proportions into a set of abnormal device proportion indicators.

[0113] Step S465: Based on the annotated real-time network digital twin model, a network security analysis is performed on the target network according to the transmission node number set and the abnormal device ratio indicator set to obtain a network security analysis result.

[0114] Specifically, please refer to the sub-steps of step S465 for the detailed implementation process of this embodiment.

[0115] The present invention significantly enhances the visualization and tracking capabilities of the network health status by marking the device status in the real-time network digital twin model, making the distribution of abnormal traffic and the potential threat propagation channels more clearly visible. Accurately identify the data transmission path of abnormal devices. At the same time, by counting the number of transmission nodes and calculating the proportion of abnormal devices, a detailed risk assessment can be performed, and the network security status can be comprehensively analyzed from both macro and micro levels. These measures optimize the formulation of security policies, improve the targeted response, quickly isolate and handle problem devices, reduce the impact of potential threats, and protect key assets. The annotated real-time network digital twin model promotes automated security operations, supports continuous security monitoring, and helps to detect new security threats in a timely manner.

[0116] Preferably, step S465 includes the following steps:

[0117] Step S4651: if the number of transmission nodes is greater than or equal to the preset critical number of nodes, then the corresponding abnormal device ratio index is compared with the preset first abnormal density threshold, otherwise the corresponding abnormal device ratio index is compared with the preset second abnormal density threshold, wherein the preset first abnormal density threshold is greater than the preset second abnormal density threshold;

[0118] Specifically, the number of transmission nodes of each abnormal device data transmission path can be determined. Then, two thresholds are set: a first abnormal density threshold and a second abnormal density threshold, wherein the first abnormal density threshold is greater than the second abnormal density threshold. In Excel, a table can be created to list the number of transmission nodes and abnormal device proportion index of each path. Next, for paths where the number of transmission nodes is greater than or equal to the critical number of nodes, the abnormal device proportion index is compared with the first abnormal density threshold; for paths where the number of transmission nodes is less than the critical number of nodes, it is compared with the second abnormal density threshold. In Excel, the "IF" function can be used to implement this logic: if the number of nodes is greater than or equal to the critical number of nodes, and the number of transmission nodes is greater than or equal to the preset critical number of nodes, the corresponding abnormal device proportion index is compared with the preset first abnormal density threshold, otherwise the corresponding abnormal device proportion index is compared with the preset second abnormal density threshold, wherein the preset first abnormal density threshold is greater than the preset second abnormal density threshold.

[0119] Step S4652: if the corresponding abnormal device ratio index is greater than or equal to the preset first abnormal density threshold or the corresponding abnormal device ratio index is greater than or equal to the preset second abnormal density threshold, then the corresponding data transmission path is marked as a high-risk path in the annotated real-time network digital twin model;

[0120] Specifically, if the corresponding abnormal device ratio index is greater than or equal to the preset first abnormal density threshold or the corresponding abnormal device ratio index is greater than or equal to the preset second abnormal density threshold, these paths are found in the real-time network digital twin model. Use the annotation function of the model editing tool, such as changing the path color, adding warning icons or special marks, to visually represent the high-risk status of these paths. For example, a rule can be set to mark any path with an abnormal device ratio greater than the first abnormal density threshold as red, regardless of the number of nodes, and add an exclamation mark icon next to the path. A similar marking strategy can also be adopted for paths with fewer nodes but still a high proportion of abnormal devices.

[0121] Step S4653: if the corresponding abnormal device ratio index is less than the preset first abnormal density threshold or the corresponding abnormal device ratio index is less than the preset second abnormal density threshold, then the corresponding data transmission path is marked as a low-risk path in the annotated real-time network digital twin model;

[0122] Specifically, if the corresponding abnormal device ratio index is less than the preset first abnormal density threshold or the corresponding abnormal device ratio index is less than the preset second abnormal density threshold, these paths are found in the real-time network digital twin model, and the annotation function of the model editing tool is used to update the status of these paths. For example, a rule can be set to change the color of these paths to green or blue, indicating low risk, or add a check icon to indicate safety.

[0123] Step S4654: Based on the annotated real-time network digital twin model, potential attack paths are deduced for high-risk paths to obtain a potential attack path set;

[0124] Specifically, all paths marked as high risk can be identified from the real-time network digital twin model. Then, using network simulation tools such as OPNET Modeler or Cisco Packet Tracer, the attack paths that attackers would exploit can be simulated. During the simulation process, different attack scenarios can be simulated, such as DDoS attacks, port scans, or phishing attacks, and the propagation paths of these attacks in the network can be observed. By analyzing the propagation mode and impact range of these simulated attacks, the most vulnerable links in the network can be identified and a set of potential attack paths can be generated.

[0125] Step S4655: construct a dynamic attack chain for the potential attack path set based on the annotated real-time network digital twin model to obtain a dynamic attack chain for the target network;

[0126] Specifically, a set of potential attack paths can be extracted from the real-time network digital twin model, which have been identified and marked in the previous steps. Then, security analysis tools such as Metasploit or security modeling tools such as Security Onion are used to simulate and build potential attack chains. During the construction process, various attack techniques and tactics are considered, such as exploiting vulnerabilities, spreading malware, or conducting phishing attacks. By simulating different attack scenarios, potential steps and paths taken by attackers can be identified and dynamic attack chains can be built. These attack chains show the paths and methods that attackers can potentially exploit, as well as potential targets and vulnerabilities.

[0127] Step S4656: Based on the annotated real-time network digital twin model, redundancy identification is performed on low-risk paths to obtain a redundant path safety assessment indicator set, wherein the redundant path safety assessment indicator set includes the number of redundant paths, path redundancy type, and path availability status;

[0128] Specifically, all paths marked as low risk can be identified from the real-time network digital twin model. Then, use network analysis tools, such as SolarWinds or Paessler PRTG, to analyze the redundancy of these paths. During the analysis, check the backup paths and redundant connections in the network to determine their existence and effectiveness. Next, evaluate the number, type (such as physical redundancy or logical redundancy), and availability of these redundant paths. For example, you can check whether the backup link is active or can be activated in a short time. Integrate this information into a set of redundant path safety assessment indicators.

[0129] Step S4657: Record the target network dynamic attack chain and redundant path security assessment indicator set as network security analysis results.

[0130] The present invention performs refined risk assessment by setting different abnormal density thresholds, and can carefully classify abnormal devices according to the number of transmission nodes, thereby optimizing resource allocation and ensuring that security resources are used preferentially in high-risk areas. By deducing potential attack paths and building dynamic attack chains, the ability to identify and prevent complex attack patterns is improved, while the redundancy identification of low-risk paths helps to improve the reliability and resilience of the network. Providing detailed network security analysis results, including dynamic attack chains and redundant path security assessment indicator sets, provides strong decision-making support, promotes the implementation of automated responses, and improves the effectiveness of security policies. The annotation of real-time network digital twin models supports continuous monitoring and improvement of network security status, and improves the overall level of network security protection.

[0131] Preferably, step S47 includes the following steps:

[0132] Step S471: determining the security policy that needs to be adjusted for the target network according to the network security analysis result, and obtaining the security policy that needs to be adjusted;

[0133] Specifically, a centralized security information and event management (SIEM) system, such as IBM QRadar or Splunk, can be used to manage network security analysis results. SIEM systems are able to integrate and analyze various security-related data points from the entire network. Abnormal device detection results, potential attack paths, and redundant path assessment reports will be evaluated to identify the shortcomings of the current security policy. For example, if abnormal traffic is detected in a specific area, it is necessary to increase the monitoring of the intrusion prevention system (IDS) in that area. Based on these analysis results, a list of security policies that need to be adjusted is prepared, clearly listing the specific network parts that need to be strengthened and the corresponding security measures.

[0134] Step S472: Optimizing the security policy to be adjusted according to the network security analysis result to obtain an optimized security policy;

[0135] Specifically, you can use specialized security policy management tools, such as Tenable.sc or Qualys PolicyCompliance. These tools can help identify weaknesses in policies and provide suggestions for improvement. Import the security policies that need to be adjusted and use the assessment function of the management tool to test the strength and effectiveness of these policies. Based on the feedback provided by the tool, formulate optimization measures, which include but are not limited to updating access control lists (ACLs), strengthening data encryption, modifying authentication mechanisms, or improving the default security configuration of network devices.

[0136] Step S473: adjusting the security policy of the target network according to the optimized security policy.

[0137] Specifically, network configuration tools, such as Cisco Prime or Juniper Networks, can be used to log in to network devices and apply new security policies. This includes updating ACLs on routers and switches, adjusting NAT rules, changing VPN configurations, or updating firewall rules. Before implementing new policies, technicians will conduct thorough testing to ensure that the changes will not affect the normal operation of the network. Once the testing is completed and the policy is in effect, the network will be protected according to the new security requirements. In addition, all related security documents will be updated to reflect these changes.

[0138] The present invention realizes the customization of security policies by analyzing the results of network security analysis to meet the needs of specific network environments, thereby enhancing the adaptability of the network to dynamic threats. This process improves the efficiency of policy updates through automation mechanisms, reduces human errors and delays, and strengthens the overall protection of the network, effectively reducing security risks. Timely security policy adjustments help mitigate the impact of potential threats and enhance defense against new attacks. In addition, continuous policy optimization supports the continuous improvement of network security situation and ensures long-term security protection.

[0139] Preferably, the present invention also provides a network security analysis system based on digital twins, which is used to execute the network security analysis method based on digital twins as described above, and the network security analysis system based on digital twins includes:

[0140] The traffic collection module is used to perceive the network topology of the target network and obtain a network data transmission topology map; collect the real-time traffic of the target network for the first time and obtain a first real-time traffic data set;

[0141] A digital twin model construction module is used to construct a digital twin model of a target network based on a network data transmission topology diagram according to a first real-time traffic data set to obtain a network digital twin model; and collect real-time traffic of the target network for a second time to obtain a second real-time traffic data set;

[0142] A data synchronization module is used to collect device system logs of the target network to obtain a device system log set; perform data synchronization mapping on the second real-time traffic data set, the device system log set and the network digital twin model to obtain a real-time network digital twin model;

[0143] The network security analysis module is used to perform network security analysis on the target network based on the real-time network digital twin model to obtain network security analysis results; and adjust the security policy of the target network according to the network security analysis results.

[0144] Therefore, the embodiments should be regarded as illustrative and non-restrictive from all points, and the scope of the present invention is limited by the appended claims rather than the above description, and it is therefore intended that all changes falling within the meaning and range of equivalent elements of the application documents are included in the present invention.

[0145] The above description is only a specific embodiment of the present invention, so that those skilled in the art can understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but should conform to the widest scope consistent with the principles and novel features invented herein.

Claims

1. A network security analysis method based on digital twins, characterized in that: The following steps are involved: Step S1: Perform network topology perception on the target network to obtain a network data transmission topology map; Performing a first real-time traffic collection on the target network to obtain a first real-time traffic data set; Step S2: constructing a digital twin model of the target network based on the first real-time traffic data set based on the network data transmission topology diagram to obtain a network digital twin model; collecting real-time traffic of the target network for a second time to obtain a second real-time traffic data set; Step S3: collecting device system logs of the target network to obtain a device system log set; performing data synchronization mapping on the second real-time traffic data set, the device system log set and the network digital twin model to obtain a real-time network digital twin model; Step S4: Perform network security analysis on the target network based on the real-time network digital twin model to obtain network security analysis results; Adjust the security policy of the target network according to the network security analysis results; wherein step S4 includes the following steps: Step S41: performing traffic group matching on the first real-time traffic data set and the second real-time traffic data set according to the device ID in the target network to obtain a plurality of device traffic matching groups, wherein the device traffic matching groups include the first real-time traffic data of the device and the second real-time traffic data of the device, and the device traffic matching groups are the traffic passing through the same device in the same duration; Step S42: Calculate the flow difference between the first real-time flow data of the device and the second real-time flow data of the device to obtain the device flow difference; Step S43: collecting device connection status of the target network to obtain a device connection status table, wherein the device connection status table includes a plurality of device connection status records, wherein the device connection status record includes device hardware address data and device network connection type, wherein the device network connection type is any one of an external connection device and a network isolation device; Step S44: extracting the device hardware address from the device flow difference to obtain the first device hardware address; Step S45: performing flow anomaly detection on the corresponding device according to the device flow difference, the device connection status table and the first device hardware address to obtain a device flow anomaly detection result; Step S46: Performing network security analysis on the target network based on the real-time network digital twin model according to the device traffic anomaly detection result to obtain a network security analysis result; Step S47: adjusting the security policy of the target network according to the network security analysis result.

2. The network security analysis method based on digital twins according to claim 1 is characterized in that: Step S1 includes the following steps: Step S11: collecting a physical topology diagram of the target network to obtain a network physical device topology diagram, wherein the network physical device topology diagram at least includes computers, routers, printers, servers, switches, hubs, and wireless access points; Step S12: collecting hardware addresses and logical addresses of devices in the target network to obtain a device hardware address set and a device logical address set; Step S13: collecting routing tables of the target network to obtain a routing table set of the target network, wherein the routing table set of the target network includes a plurality of routing tables of the target network, and the routing table collection includes the routing table collection of the router and the routing table collection of the switch; Step S14: marking device addresses on the network physical device topology map according to the device hardware address set and the device logical address set to obtain a marked network physical device topology map; Step S15: Draw a data transmission path for the marked network physical device topology map according to the target network routing table set to obtain a network data transmission topology map; Step S16: collect the real-time traffic of the target network for the first time to obtain a first real-time traffic data set, wherein the first real-time traffic data set includes a plurality of first real-time traffic data, and the first real-time traffic data uniquely corresponds to the device in the target network.

3. The network security analysis method based on digital twins according to claim 1 is characterized in that: Step S2 includes the following steps: Step S21: constructing a device component model for the target network to obtain a device component model library, wherein the device component model library includes a plurality of groups of device component models, wherein the group of device component models are hardware and software component models of different version numbers of the device; Step S22: collecting device version information of the target network to obtain a device version data set; Step S23: constructing a three-dimensional device model for the target network based on the device component model library and the device version data set to obtain a three-dimensional device model set; Step S24: mapping the data transmission path of the device three-dimensional model set according to the network data transmission topology diagram to obtain a network data transmission three-dimensional model; Step S25: Collect detailed specifications of each device in the target network to obtain a device-related parameter set, wherein the device-related parameter set at least includes device specification parameters, device operating system version, device firmware version, device application information, device network configuration file, device access control rules, device performance indicators, device security policies, and device communication protocols; Step S26: Associating device parameters with the three-dimensional model of network data transmission according to the device-related parameter set to obtain a network digital twin model; Step S27: collect the real-time traffic of the target network for the second time to obtain a second real-time traffic data set, wherein the second real-time traffic data set includes a plurality of second real-time traffic data, and the second real-time traffic data uniquely corresponds to the device in the target network.

4. The network security analysis method based on digital twins according to claim 1 is characterized in that: Step S3 includes the following steps: Step S31: collecting device system logs of the target network to obtain a device system log set, wherein the device system log set includes a plurality of device system logs; Step S32: Time-aligning the device system log set and the second real-time traffic data set to obtain a synchronized device system log set and a synchronized second real-time traffic data set; Step S33: Perform program running status statistics on each device system log to obtain a device running status summary table set; Step S34: collecting performance indicators of each device in the target network to obtain a device performance indicator set; Step S35: Map the synchronized device system log set, the synchronized second real-time traffic data set, the device operation status overview table set and the device performance indicator set to the corresponding devices in the network digital twin model to obtain a real-time network digital twin model.

5. The network security analysis method based on digital twins according to claim 1 is characterized in that: Step S45 includes the following steps: Step S451: extracting the network connection type of the corresponding device according to the device connection status table and the hardware address of the first device to obtain the network connection type of the first device; Step S452: If the network connection type of the first device is an external connection device, the device flow difference is compared with a preset first maximum flow threshold; Step S453: if the device flow difference is greater than or equal to the preset first maximum flow threshold, the corresponding device is marked as a high flow abnormal device, and the device flow abnormality detection result is obtained; Step S454: if the device flow difference is less than the preset first maximum flow threshold, the corresponding device is marked as a normal flow device, and the device flow abnormality detection result is obtained; Step S455: If the network connection type of the first device is a network isolation device, the device flow difference is compared with a preset second maximum flow threshold; Step S456: If the device flow difference is greater than or equal to the preset second maximum flow threshold, the corresponding device is marked as a potential leakage device, and the device flow anomaly detection result is obtained; Step S457: If the device flow difference is less than the preset second maximum flow threshold, the corresponding device is marked as an isolated safety device to obtain a device flow anomaly detection result, wherein the preset first maximum flow threshold is greater than the preset second maximum flow threshold.

6. The network security analysis method based on digital twins according to claim 1 is characterized in that: Step S46 includes the following steps: Step S461: According to the device traffic anomaly detection result, the corresponding device state is marked as the device traffic anomaly detection result in the real-time network digital twin model to obtain a marked real-time network digital twin model, wherein the device traffic anomaly detection result is any one of a high traffic anomaly device, a normal traffic device, a potential leakage device, and an isolated safety device; Step S462: extracting abnormal device data transmission paths from the target network based on the annotated real-time network digital twin model to obtain an abnormal device data transmission path set, wherein the abnormal device data transmission path set includes a plurality of abnormal device data transmission paths; Step S463: performing transmission node statistics on each abnormal device data transmission path to obtain a transmission node number set, wherein the transmission node number set includes a number of transmission node numbers, and the transmission node number is the total number of transmission nodes in the abnormal device data transmission path; Step S464: Calculate the abnormal device proportion for each abnormal device data transmission path to obtain an abnormal device proportion indicator set, wherein the abnormal device proportion indicator set includes a plurality of abnormal device proportion indicators; Step S465: Based on the annotated real-time network digital twin model, a network security analysis is performed on the target network according to the transmission node number set and the abnormal device ratio indicator set to obtain a network security analysis result.

7. The network security analysis method based on digital twins according to claim 6 is characterized in that: Step S465 includes the following steps: Step S4651: if the number of transmission nodes is greater than or equal to the preset critical number of nodes, then the corresponding abnormal device ratio index is compared with the preset first abnormal density threshold, otherwise the corresponding abnormal device ratio index is compared with the preset second abnormal density threshold, wherein the preset first abnormal density threshold is greater than the preset second abnormal density threshold; Step S4652: if the corresponding abnormal device ratio index is greater than or equal to the preset first abnormal density threshold or the corresponding abnormal device ratio index is greater than or equal to the preset second abnormal density threshold, then the corresponding data transmission path is marked as a high-risk path in the annotated real-time network digital twin model; Step S4653: if the corresponding abnormal device ratio index is less than the preset first abnormal density threshold or the corresponding abnormal device ratio index is less than the preset second abnormal density threshold, then the corresponding data transmission path is marked as a low-risk path in the annotated real-time network digital twin model; Step S4654: Based on the annotated real-time network digital twin model, potential attack paths are deduced for high-risk paths to obtain a potential attack path set; Step S4655: construct a dynamic attack chain for the potential attack path set based on the annotated real-time network digital twin model to obtain a dynamic attack chain for the target network; Step S4656: redundancy identification of low-risk paths is performed based on the annotated real-time network digital twin model to obtain a redundant path safety assessment indicator set, wherein the redundant path safety assessment indicator set includes the number of redundant paths, path redundancy type, and path availability status; Step S4657: Record the target network dynamic attack chain and redundant path security assessment indicator set as network security analysis results.

8. The network security analysis method based on digital twins according to claim 1 is characterized in that: Step S47 includes the following steps: Step S471: determining the security policy that needs to be adjusted for the target network according to the network security analysis result, and obtaining the security policy that needs to be adjusted; Step S472: Optimizing the security policy to be adjusted according to the network security analysis result to obtain an optimized security policy; Step S473: adjusting the security policy of the target network according to the optimized security policy.

9. A network security analysis system based on digital twins, characterized in that: For executing the digital twin-based network security analysis method as claimed in claim 1, the digital twin-based network security analysis system comprises: The traffic collection module is used to perceive the network topology of the target network and obtain a network data transmission topology map; collect the real-time traffic of the target network for the first time and obtain a first real-time traffic data set; A digital twin model construction module is used to construct a digital twin model of a target network based on a network data transmission topology diagram according to a first real-time traffic data set to obtain a network digital twin model; and collect real-time traffic of the target network for a second time to obtain a second real-time traffic data set; A data synchronization module is used to collect device system logs of the target network to obtain a device system log set; perform data synchronization mapping on the second real-time traffic data set, the device system log set and the network digital twin model to obtain a real-time network digital twin model; The network security analysis module is used to perform network security analysis on the target network based on the real-time network digital twin model to obtain network security analysis results; and adjust the security policy of the target network according to the network security analysis results.

Images