Network security defense mechanism evaluation method, system, equipment and medium

Abstract

The invention discloses a network security defense mechanism evaluation method, system and device and a medium, and the method comprises the steps: analyzing various defense mechanisms in a current network system, and extracting the feature information of the defense mechanism of the current network system; and inputting the feature information of the defense mechanism of the current network system into the trained defense mechanism scoring model to obtain an evaluation result of the defense mechanism of the current network system, and the method, the system, the equipment and the medium can fully consider the synergistic effect among multiple layers of defense mechanisms to evaluate the network security defense mechanism.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer network and information security, and relates to a network security defense mechanism evaluation method, system, equipment and medium. Background Art

[0002] In the context of today's digital transformation, enterprise network security defense mechanisms are facing increasingly complex challenges. With the continuous evolution of network attack technology, the diversity and complexity of network attack methods have increased significantly. Attackers use zero-day vulnerabilities, advanced persistent threats (APT), DDoS and other methods to attack network systems. Although traditional defense methods such as firewalls, intrusion detection systems (IDS), access control lists (ACLs), etc. are still widely used, their defense effects are limited when facing these advanced threats.

[0003] Existing network security assessment methods usually analyze a single defense mechanism, lack a global perspective, and cannot fully consider the synergy between multiple layers of defense mechanisms. Especially in complex enterprise network environments, defense mechanisms are often distributed at different levels, making it impossible to fully evaluate the effectiveness of each defense mechanism. Summary of the invention

[0004] The purpose of the present invention is to overcome the shortcomings of the above-mentioned prior art and provide a network security defense mechanism evaluation method, system, device and medium. The method, system, device and medium can fully consider the synergy between multiple layers of defense mechanisms to evaluate the network security defense mechanism.

[0005] In order to achieve the above object, the present invention adopts the following technical scheme:

[0006] In one aspect of the present invention, the network security defense mechanism evaluation method of the present invention comprises:

[0007] Analyze various defense mechanisms in the current network system and extract characteristic information of the defense mechanisms of the current network system;

[0008] The characteristic information of the defense mechanism of the current network system is input into the trained defense mechanism scoring model to obtain an evaluation result of the defense mechanism of the current network system.

[0009] The network security defense mechanism evaluation method of the present invention is further improved in that:

[0010] Furthermore, various defense mechanisms in the current network system include but are not limited to: firewall, IDS, ACL, and endpoint security policy.

[0011] Furthermore, the characteristic information of the defense mechanism of the current network system includes, but is not limited to: configuration parameters of the defense mechanism, actual operation status, execution effect of the strategy, device redundancy and traffic monitoring data.

[0012] Furthermore, the defense mechanism scoring model is trained based on a multi-layer neural network model.

[0013] Furthermore, the loss function of the defense mechanism scoring model during training is:

[0014]

[0015] Among them, S i For real rating, is the prediction score, and n is the number of defense mechanisms.

[0016] Furthermore, the defense mechanism scoring model is trained based on an adaptive weighted algorithm, wherein the weight of each defense mechanism in the defense mechanism scoring model is updated by the adaptive weighted algorithm, namely:

[0017]

[0018] Among them, η is the learning rate and L is the loss function.

[0019] In a second aspect of the present invention, the network security defense mechanism evaluation system of the present invention comprises:

[0020] The analysis module is used to analyze various defense mechanisms in the current network system and extract characteristic information of the defense mechanisms of the current network system;

[0021] The evaluation module is used to input the characteristic information of the defense mechanism of the current network system into the trained defense mechanism scoring model to obtain the evaluation result of the defense mechanism of the current network system.

[0022] The network security defense mechanism evaluation system of the present invention is further improved in that:

[0023] Furthermore, the loss function of the defense mechanism scoring model during training is:

[0024]

[0025] Among them, S i For real rating, is the prediction score, and n is the number of defense mechanisms.

[0026] In a third aspect of the present invention, the computer device of the present invention comprises a memory, a processor and a computer program stored in the memory and executable on the processor, and the processor implements the steps of the network security defense mechanism evaluation method when executing the computer program.

[0027] In a fourth aspect of the present invention, the computer-readable storage medium of the present invention stores a computer program, and when the computer program is executed by a processor, the steps of the network security defense mechanism evaluation method are implemented.

[0028] The present invention has the following beneficial effects:

[0029] During specific operation, the network security defense mechanism evaluation method, system, device and medium described in the present invention analyze various defense mechanisms in the current network system, extract characteristic information of the defense mechanism of the current network system, and consider multiple network defense mechanisms; the characteristic information of the defense mechanism of the current network system is input into the trained defense mechanism scoring model to obtain the evaluation result of the defense mechanism of the current network system, thereby performing evaluation in a complex multi-level network environment, which is extremely practical. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The accompanying drawings constituting a part of the present invention are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the accompanying drawings:

[0031] Figure 1 It is the principle diagram of the present invention;

[0032] Figure 2 The figure is a flow chart of the method of the present invention. DETAILED DESCRIPTION

[0033] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiment of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiment of the present invention. Obviously, the described embodiment is only an embodiment of a part of the present invention, not all embodiments, and is not intended to limit the scope of the present invention. In addition, in the following description, the description of well-known structures and technologies is omitted to avoid unnecessary confusion of the concepts disclosed in the present invention. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work should fall within the scope of protection of the present invention.

[0034] The accompanying drawings show schematic diagrams of structures according to embodiments disclosed in the present invention. These figures are not drawn to scale, and some details are magnified and some details may be omitted for the purpose of clear expression. The shapes of various regions and layers shown in the figures and the relative sizes and positional relationships therebetween are only exemplary, and may deviate in practice due to manufacturing tolerances or technical limitations, and those skilled in the art may additionally design regions / layers with different shapes, sizes, and relative positions according to actual needs.

[0035] Embodiment 1

[0036] refer to Figure 1 and Figure 2 The network security defense mechanism evaluation method of the present invention comprises the following steps:

[0037] 1) Defense mechanism analysis and feature extraction;

[0038] Comprehensively analyze various defense mechanisms in the network system and extract multi-dimensional feature information. The defense mechanisms include firewalls, IDS, ACL, and endpoint security policies. The multi-dimensional feature information includes the configuration parameters of the defense mechanisms, actual operating conditions, policy execution effects, device redundancy, and traffic monitoring data. By extracting multi-dimensional feature information, the actual status of the current network security defense can be more accurately reflected, namely:

[0039] X=[x1,x2,…,x n ]

[0040] Among them, X is the feature vector, x1,x2,…,x n It is the characteristic information of different defense mechanisms, such as the complexity of firewall rules and IDS matching rate.

[0041] 2) Constructing the eigenvector matrix;

[0042] According to the multi-dimensional feature information, a feature vector matrix is ​​constructed. The feature vector matrix is ​​a structured representation of the defense mechanism under multi-dimensional information, reflecting the characteristic parameters of each defense mechanism. Through this structure, various security defense mechanisms in the network can be described in a unified and quantitative manner, which is convenient for subsequent scoring model training and evaluation.

[0043] To ensure the comprehensiveness of the defense mechanism evaluation, the present invention extracts network defense features from multiple dimensions, including but not limited to the following features:

[0044] 21) Firewall rules:

[0045] Complexity: number of rules, hierarchical depth of rule chains.

[0046] Coverage: Whether all parts of the network are effectively covered.

[0047] Update frequency: whether the rules are updated in a timely and accurate manner.

[0048] 22) Intrusion Detection / Prevention System (IDS / IPS) Strategy:

[0049] Rule Match Rate: The ratio of successfully detected intrusion events to actual events.

[0050] False positive and false negative rates: The false positive rate of irrelevant events and the false negative rate of real attacks.

[0051] Response delay: The response time after intrusion detection.

[0052] 23) Access Control List (ACL):

[0053] Number of entries: The number of entries in the ACL and their complexity.

[0054] Execution efficiency: ACL processing speed and execution effect.

[0055] Coverage: Whether all key network devices and nodes are covered.

[0056] 24) Endpoint security strategy:

[0057] Execution rate: The actual execution rate of endpoint security policies.

[0058] Threat protection: Whether adequate endpoint virus and malware protection measures are configured.

[0059] Security patch management: whether terminal patches are installed and updated in a timely manner.

[0060] 25) Encryption protocol usage:

[0061] Usage rate: Whether encryption protocols with sufficient strength are used, such as TLS 1.2 or higher.

[0062] Encryption strength: The security of the encryption algorithm used, such as AES-256.

[0063] Encryption coverage: whether to encrypt all sensitive communication channels.

[0064] 26) Patch management status:

[0065] Real-time: whether the system and software patches are updated in a timely manner.

[0066] Coverage: Whether the patch is applied to all critical system components and devices.

[0067] Security assessment: Whether the patch is effective against known security threats.

[0068] According to the above method, a feature vector matrix is ​​generated. Each row of the matrix represents a feature vector of a defense mechanism. The columns in the feature vector matrix are different dimensions of the features. That is, the feature vector matrix is ​​expressed as:

[0069]

[0070] Where m is the number of features of the defense mechanism. The feature vector matrix can be used as input data for the scoring model in the subsequent steps to quantify and compare the security of different defense mechanisms.

[0071] To ensure that the eigenvectors of the defense mechanism can be effectively processed, the defense features need to be standardized when constructing the matrix to ensure that the magnitudes of the feature values ​​of different dimensions are consistent. The standardized formula is:

[0072]

[0073] Among them, x ij is the original eigenvalue, μ j and σ j are the mean and standard deviation of the jth feature, x i ′ j is the standardized eigenvalue. Through standardization, the data in the eigenvector matrix will be adjusted to a normal distribution with a mean of 0 and a standard deviation of 1, so as to facilitate the effective training of subsequent machine learning models.

[0074] In addition to the characteristic data of the current network defense mechanism, the importance of historical data in the defense mechanism evaluation cannot be ignored. The system can analyze past security events, attack behaviors, and the effects of defense measures, combine these data with the current network security situation, and build a more accurate defense evaluation model.

[0075] The introduction of historical data can be done in the following ways:

[0076] Time-weighted mechanism: Add time weights to historical data. The closer the data is to the current time, the greater the weight, thereby ensuring that the current network security situation can be taken into account during the assessment.

[0077] Anomaly detection logs: Historical security events, abnormal traffic in logs, and other information are used as additional feature inputs to evaluate the effectiveness of defense mechanisms in responding to specific attacks.

[0078] 3) Construct a scoring model;

[0079] A defense mechanism scoring model is constructed through an optimized multi-indicator evaluation model. Specifically, a representative feature vector is constructed using the feature information extracted from various security defense mechanisms. Then, the model is trained through a machine learning algorithm (such as a multi-layer neural network model) to evaluate the effectiveness and security of various defense mechanisms in the network.

[0080] The basic process of the scoring model is:

[0081] 31) Feature extraction;

[0082] According to the extracted network defense mechanism feature information, a multi-dimensional feature vector matrix X is formed, where each vector corresponds to a specific defense mechanism, such as a firewall, an intrusion detection system (IDS), a network access control list (ACL), an endpoint security policy, etc.

[0083] 32) Model construction;

[0084] A multi-layer neural network scoring model is constructed, in which the input layer is the feature vector X, nonlinear transformation is performed through the hidden layer, and the output layer generates the scoring result, that is:

[0085] y=f(WX+b)

[0086] Among them, y is the scoring result, W is the weight matrix, X is the input feature vector, b is the bias term, and f is the activation function, usually the ReLU activation function. Through multiple iterations of training model parameters, the scoring result is close to the actual defense effect.

[0087] 3) Training and optimization of defense mechanism scoring models;

[0088] Through multiple iterations of model training, the weights of the defense mechanism scoring model are gradually adjusted, and the mean square error (MSE) is used as the loss function to measure the scoring error, that is:

[0089]

[0090] Among them, S i For real rating, is the predicted score, n is the number of defense mechanisms, and the parameters of the defense mechanism scoring model are updated through the gradient descent method or the Adam optimization algorithm to optimize the defense mechanism scoring model.

[0091] 4) Real-time scoring and comprehensive situation assessment;

[0092] The characteristic information of the current network's defense mechanism is input into the trained defense mechanism scoring model to generate the evaluation results of the current network's defense mechanism and conduct a comprehensive evaluation of the overall network's security situation. This process not only includes the evaluation of a single defense mechanism, but also integrates the synergistic effects of multiple defense levels and mechanisms to provide a score for the overall security situation.

[0093] The specific scoring method can be expressed as:

[0094]

[0095] Among them, S total Score the overall security posture, S i Score a single defense mechanism, w i is the importance weight of the defense mechanism. This method can quantify and integrate the effects of different defense mechanisms to obtain the final overall defense capability score.

[0096] In addition, the present invention can also combine real-time security situation data, such as abnormal traffic monitoring logs, attack event alarms, network traffic behavior anomalies and other information, to combine static scoring and dynamic scoring to obtain a more comprehensive defense effect.

[0097] The dynamic situation score is:

[0098] S dynamic =α·S static +β·A(t)

[0099] Among them, S dynamic S is the dynamic security situation score. static is a static score, A(t) is real-time situation data, α and β are weighted coefficients of static and dynamic scores respectively. Through dynamic monitoring, the system can adjust the score according to the real-time network security status.

[0100] 5) Generation of optimization suggestions and improvement strategies;

[0101] Based on the evaluation results of each defense mechanism, optimization suggestions are automatically generated and defense improvement strategies are provided.

[0102] Defensive improvement strategies may include the following:

[0103] 51) Firewall Rules: If the score is low, the system may recommend increasing the complexity and precision of the rules, or adjusting the rule configuration based on real-time traffic patterns.

[0104] 52) IDS / IPS strategy: For low-scoring intrusion detection / prevention systems, machine learning-driven anomaly detection algorithms can be introduced to improve rule matching rates and response speeds.

[0105] 53) ACL Improvement: For access control lists (ACLs) with poor scores, we can recommend optimizing the number of entries and coverage to reduce false positives or negatives.

[0106] 54) Endpoint security policy: If the implementation of the endpoint security policy is insufficient, it is recommended to increase the intensity of terminal encryption, virus protection and vulnerability patch management.

[0107] 55) Encryption protocol upgrade: For low-scoring encryption policies, the system may recommend upgrading from a weaker encryption protocol (such as TLS1.0) to a stronger protocol (such as TLS1.3 or AES-256).

[0108] The generation of specific optimization suggestions adopts an algorithm based on a scoring threshold. When the score of a defense mechanism is lower than a certain threshold, the corresponding improvement strategy suggestion will be triggered. The priority of the improvement plan is based on the scoring model to sort the weights and importance of different defense mechanisms.

[0109] 6) Algorithm details and optimization strategies;

[0110] The present invention combines an adaptive weighting algorithm with a neural network scoring model to achieve high efficiency and flexibility in defense mechanism evaluation. By adaptively adjusting the weights of each defense mechanism, the scoring model is more in line with the real-time network defense status, ensuring the accuracy and applicability of the evaluation.

[0111] Adaptive weighting algorithm:

[0112] 61) Initialization weight: When the model is initialized, an initial weight ω is assigned to each defense mechanism. i , where ω i The initial weight distribution formula is adjusted according to the importance of the defense mechanism and specific business needs:

[0113]

[0114] 62) Feature scoring: Based on the previously extracted feature vector matrix, the scoring model will output the initial score S of each defense mechanism i .

[0115] 63) Weight adjustment: Dynamically adjust weights through adaptive formulas to respond to real-time network situation and defense effectiveness:

[0116]

[0117] Among them, η is the learning rate, L is the loss function, and the scoring results of each defense mechanism are optimized by minimizing L.

[0118] Multi-layer neural network model:

[0119] In the scoring model, a multi-layer neural network (MLP) is used to process the feature vector matrix. The input layer is the network defense feature, the middle layer is multiple hidden layers, the activation function is ReLU, and the output layer is the scoring result. The specific neural network is:

[0120] y=σ(WX+b)

[0121] Among them, σ is the activation function, W is the weight matrix, X is the input feature vector, and b is the bias term. Through multiple iterative training, the model parameters are adjusted to obtain the optimal defense mechanism score.

[0122] Through these steps and algorithms, accurate evaluation of network security defense mechanisms can be achieved, and practical optimization suggestions can be provided for improving defenses.

[0123] The present invention can be widely used in enterprise networks, cloud computing environments, the Internet of Things, and edge computing, and is particularly suitable for the evaluation and optimization of multi-level defense systems. By comprehensively analyzing and scoring the characteristic information of each defense mechanism, it can quickly identify defense weaknesses and make optimization suggestions, thereby helping enterprises improve their network security protection capabilities.

[0124] In addition, the dynamic situation assessment function of the present invention enables network administrators to monitor the network security status in real time and take countermeasures quickly when an attack occurs, greatly improving the flexibility and responsiveness of network defense, which is of great significance for defending against complex attacks such as APT (advanced persistent threat) and DDoS attacks.

[0125] The present invention has the following characteristics:

[0126] Comprehensiveness: It takes into account a variety of network defense mechanisms and can be evaluated in complex multi-layered network environments;

[0127] Objectivity: Through the optimized multi-indicator evaluation model, it can provide objective and quantitative evaluation results;

[0128] Practicality: Based on the evaluation results, specific optimization suggestions are generated to help improve network defense mechanisms and enhance overall security.

[0129] Embodiment 2

[0130] The network security defense mechanism evaluation system of the present invention comprises:

[0131] The analysis module is used to analyze various defense mechanisms in the current network system and extract characteristic information of the defense mechanisms of the current network system;

[0132] The evaluation module is used to input the characteristic information of the defense mechanism of the current network system into the trained defense mechanism scoring model to obtain the evaluation result of the defense mechanism of the current network system.

[0133] The network security defense mechanism evaluation system of the present invention is further improved in that:

[0134] Furthermore, the loss function of the defense mechanism scoring model during training is:

[0135]

[0136] Among them, S i For real rating, is the prediction score, and n is the number of defense mechanisms.

[0137] The division of modules in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, each functional module in each embodiment of the present application may be integrated into a processor, or may exist physically separately, or two or more modules may be integrated into one module. The above-mentioned integrated modules may be implemented in the form of hardware or in the form of software functional modules.

[0138] Embodiment 3

[0139] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of implementing the network security defense mechanism evaluation method are implemented, for example, including: analyzing various defense mechanisms in the current network system, extracting characteristic information of the defense mechanism of the current network system; inputting the characteristic information of the defense mechanism of the current network system into the trained defense mechanism scoring model to obtain the evaluation result of the defense mechanism of the current network system. The memory may include a memory, such as a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk memory, etc. The processor, the network interface, and the memory are interconnected through an internal bus, and the internal bus may be an industrial standard architecture bus, a peripheral component interconnection standard bus, an extended industrial standard architecture bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. The memory is used to store programs. Specifically, the program may include a program code, and the program code includes computer operation instructions. The memory may include a memory and a non-volatile memory, and provide instructions and data to the processor.

[0140] Embodiment 4

[0141] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the network security defense mechanism evaluation method are implemented, for example, including: analyzing various defense mechanisms in the current network system, extracting characteristic information of the defense mechanism of the current network system; inputting the characteristic information of the defense mechanism of the current network system into a trained defense mechanism scoring model, and obtaining the evaluation result of the defense mechanism of the current network system. Specifically, the computer-readable storage medium includes, but is not limited to, volatile memory and / or non-volatile memory. The volatile memory may include random access memory (RAM) and / or cache memory (cache), etc. The non-volatile memory may include read-only memory (ROM), hard disk, flash memory, optical disk, magnetic disk, etc.

[0142] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0143] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0144] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0145] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0146] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A network security defense mechanism evaluation method, characterized in that: include: Analyze various defense mechanisms in the current network system and extract characteristic information of the defense mechanisms of the current network system; The characteristic information of the defense mechanism of the current network system is input into the trained defense mechanism scoring model to obtain an evaluation result of the defense mechanism of the current network system.

2. The network security defense mechanism evaluation method according to claim 1, characterized in that: The various defense mechanisms in the current network system include but are not limited to: firewall, IDS, ACL, and endpoint security policy.

3. The network security defense mechanism evaluation method according to claim 1, characterized in that: The characteristic information of the defense mechanism of the current network system includes, but is not limited to: configuration parameters of the defense mechanism, actual operation status, execution effect of the strategy, device redundancy and traffic monitoring data.

4. The network security defense mechanism evaluation method according to claim 1, characterized in that: The defense mechanism scoring model is trained based on a multi-layer neural network model.

5. The network security defense mechanism evaluation method according to claim 1, characterized in that: The loss function of the defense mechanism scoring model during training is: Among them, S i For real rating, is the prediction score, and n is the number of defense mechanisms.

6. The network security defense mechanism evaluation method according to claim 5, characterized in that: The defense mechanism scoring model is trained based on an adaptive weighted algorithm, wherein the weight of each defense mechanism in the defense mechanism scoring model is updated by the adaptive weighted algorithm, namely: Among them, η is the learning rate and L is the loss function.

7. A network security defense mechanism evaluation system, characterized in that: include: The analysis module is used to analyze various defense mechanisms in the current network system and extract characteristic information of the defense mechanisms of the current network system; The evaluation module is used to input the characteristic information of the defense mechanism of the current network system into the trained defense mechanism scoring model to obtain the evaluation result of the defense mechanism of the current network system.

8. The network security defense mechanism evaluation system according to claim 7, characterized in that: The loss function of the defense mechanism scoring model during training is: Among them, S i For real rating, is the prediction score, and n is the number of defense mechanisms.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the network security defense mechanism evaluation method according to any one of claims 1 to 6 are implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the network security defense mechanism evaluation method according to any one of claims 1 to 6 are implemented.

Images