Network security situation awareness method and system based on big data analysis

Abstract

The invention relates to a network security situation awareness method and system based on big data analysis, and belongs to the technical field of network security. The method comprises the steps of collecting original network data which comprises original network data flow and original protocol data in broadband service, training a network security situation awareness model based on a preset network security situation awareness standard set, the network security situation awareness model comprises a network flow analysis model and a protocol analysis model, generating a network state label through the network security situation awareness model, and evaluating a network security level through a rating rule according to the network state label. And outputting a network security situation awareness instruction through an instruction control script according to the network security level, generating a network security situation report through an automatic reporting tool according to the original network data, the network state label and the network security level, and displaying the network security situation report through a data visualization tool.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and specifically relates to a network security situation awareness method and system based on big data analysis. Background Art

[0002] With the rapid development of the Internet, network security issues have become increasingly prominent, especially in broadband services involving large-scale data transmission and processing. Traditional network security defense strategies are often limited by fixed rules and preset feature libraries, making it difficult to effectively resist increasingly complex and diverse network attack methods, and their protection effects are often limited. In addition, traditional network security defense strategies have deficiencies in real-time monitoring, dynamic analysis, and rapid response to network problems, which can easily lead to user data leakage and service interruptions. Summary of the invention

[0003] In order to solve the above problems existing in the prior art, the present invention provides a network security situation awareness method and system based on big data analysis, which generates a network status label through a network security situation awareness model according to the original network data collected in real time, evaluates the network security level according to the network status label, and outputs a network security situation awareness instruction according to the network security level, so as to realize intelligent perception, evaluation and response to the network security situation, thereby effectively ensuring the safe and stable operation of broadband services and providing a safe and stable network environment for broadband users. A network security situation report is generated through an automated reporting tool based on the original network data, the network status label and the network security level and displayed through a data visualization tool, so as to facilitate security managers to quickly view and analyze the network security situation.

[0004] The purpose of the present invention can be achieved through the following technical solutions:

[0005] A network security situation awareness method based on big data analysis, comprising:

[0006] S1: collecting original network data in real time through network traffic monitoring probes and deep packet inspection equipment, wherein the original network data includes original network data flows and original protocol data in broadband services;

[0007] S2: Preset a network security situation awareness standard set, train a network security situation awareness model according to the network security situation awareness standard set, the network security situation awareness standard set includes a network traffic standard set and a protocol analysis standard set, the network security situation awareness model includes a network traffic analysis model and a protocol analysis model, train the network traffic analysis model through a self-attention temporal convolutional network and a support vector machine according to the network traffic standard set, and train the protocol analysis model through a TF-IDF algorithm and a support vector machine according to the protocol analysis standard set;

[0008] S3: obtaining network data through preprocessing the original network data, generating a network status label through the network security situation awareness model according to the network data, wherein the network status label includes a network traffic status label and a protocol status label, and evaluating the network security level through a rating rule according to the network status label;

[0009] S4: Outputting network security situation awareness instructions through an instruction control script according to the network security level, wherein the network security situation awareness instructions include firewall configuration instructions and intrusion detection system response instructions;

[0010] S5: Obtain a network security situation report through an automated reporting tool according to the original network data, the network status tag, and the network security level, and display the network security situation report through a data visualization tool.

[0011] Preferably, the training of the network traffic analysis model in step S2 specifically includes:

[0012] S2-11: Acquire historical network traffic data, obtain historical network traffic standard data through preprocessing according to the historical network traffic data, obtain the network traffic standard set according to the historical network traffic standard data, the network traffic standard set includes normal traffic and abnormal traffic, and divide the network traffic standard set into a network traffic training set and a network traffic test set;

[0013] S2-12: constructing a self-attention temporal convolutional network by adding a self-attention mechanism to a self-attention residual block, wherein the self-attention residual block is a residual block in the temporal convolutional network;

[0014] S2-13: extracting features through the self-attention temporal convolutional network according to the network traffic standard set to obtain a network traffic feature vector set;

[0015] S2-14: performing feature selection based on the network traffic feature vector set by using a PCA algorithm to obtain a network traffic key feature vector set;

[0016] S2-15: Identify the normal traffic and the abnormal traffic by training a support vector machine according to the network traffic key feature vector set;

[0017] S2-16: According to the network traffic training set, an initial network traffic analysis model is obtained by training the self-attention temporal convolutional network and the support vector machine; according to the network traffic test set, the initial network traffic analysis model is tested to obtain an initial network traffic analysis model test result; according to the initial network traffic analysis model test result, a comprehensive score of the initial network traffic analysis model is calculated by using the initial network traffic analysis model evaluation index;

[0018] S2-17: The network traffic analysis model is obtained according to the comprehensive score of the initial network traffic analysis model through threshold determination. When the comprehensive score of the network traffic analysis model reaches or exceeds the set threshold of 0.9, the network traffic analysis model is obtained.

[0019] Preferably, the step S2-13 specifically includes:

[0020] S2-131: Obtain a query vector, a key vector, and a value vector by calculating a weight matrix according to the historical network traffic standard data;

[0021] S2-132: Calculating feature similarity based on the historical network traffic standard data by using attention weights, where the feature similarity is the feature similarity of each element in the historical network traffic standard data;

[0022] S2-133: Obtain a network traffic feature vector set based on the historical network traffic standard data through weighted value vector calculation.

[0023] Preferably, the training of the protocol analysis model in step S2 specifically includes:

[0024] S2-21: Acquire historical protocol interaction text data, obtain historical protocol interaction text standard data through preprocessing according to the historical protocol interaction text data, obtain the protocol analysis standard set according to the historical protocol interaction text standard data, the protocol analysis standard set includes normal protocol interaction text and abnormal protocol interaction text, and divide the protocol analysis standard set into a protocol analysis training set and a protocol analysis test set;

[0025] S2-22: extracting features by using the TF-IDF algorithm according to the protocol analysis standard set to obtain a protocol data feature vector set;

[0026] S2-23: performing feature selection by using a PCA algorithm according to the protocol data feature vector set to obtain a key feature vector set of the protocol data;

[0027] S2-24: Analyzing key feature vectors of the protocol and identifying the normal protocol interaction text and the abnormal protocol interaction text by training a support vector machine;

[0028] S2-25: obtaining an initial protocol analysis model through the TF-IDF algorithm and the support vector machine training according to the protocol analysis training set, testing the initial protocol analysis model according to the protocol analysis test set to obtain an initial protocol analysis model test result, and obtaining an initial protocol analysis model comprehensive score through initial protocol analysis model evaluation index calculation according to the initial protocol analysis model test result;

[0029] S2-26: Obtain the protocol analysis model according to the comprehensive score of the initial protocol analysis model through threshold determination: when the comprehensive score of the initial protocol analysis model reaches or exceeds the set threshold of 0.9, the protocol analysis model is obtained.

[0030] Preferably, the step S2-22 specifically includes:

[0031] S2-221: Calculate the term frequency by using the total number of terms in the protocol data and the number of terms in the protocol according to the historical protocol interaction text standard data;

[0032] S2-222: Calculate the inverse document frequency based on the total number of protocol documents and the number of documents containing the term according to the historical protocol interaction text standard data;

[0033] S2-223: Obtain the protocol data feature vector set by calculating the feature term weights according to the historical protocol interaction text standard data;

[0034] Preferably, the step S3 specifically includes:

[0035] S3-1: obtaining network data through preprocessing according to the original network data, wherein the preprocessing includes data cleaning, data format standardization, and data normalization;

[0036] S3-2: Outputting the network traffic status label through the network traffic analysis model according to the network data;

[0037] S3-3: Outputting the protocol status label through the protocol analysis model according to the network data;

[0038] S3-4: Evaluate the network security level according to the network traffic status label and the protocol status label using a rating rule;

[0039] When the network traffic status tag is normal and the protocol status tag is normal, the network security level is the third-level network security level;

[0040] When the network traffic status tag is normal and the protocol status tag is abnormal, the network security level is the first-level network security level;

[0041] When the network traffic status tag is abnormal and the protocol status tag is normal, the network security level is the secondary network security level;

[0042] When the network traffic state label is abnormal and the protocol state label is abnormal, the network security level is the zero-level network security level.

[0043] Preferably, the instruction control script in step S4 specifically includes:

[0044] When the network security level is zero network security level, outputting firewall configuration instructions and intrusion detection system response instructions at the same time;

[0045] When the network security level is the first-level network security level, outputting an intrusion detection system response instruction;

[0046] When the network security level is level 2 network security level, outputting a firewall configuration instruction;

[0047] When the network security level is the third level network security level, no instruction is output.

[0048] A network security situation awareness system based on big data analysis, including a data acquisition module, a data preprocessing module, a network security situation awareness module, an automated response module, and a reporting and visualization module.

[0049] The data acquisition module includes a network traffic monitoring probe and a deep packet inspection device, which is used to collect original network data in real time, and the original network data includes original network data flow and original protocol data in broadband services;

[0050] The data preprocessing module is used to perform data cleaning, data format standardization and data normalization on the original network data to obtain network data;

[0051] The network security situation awareness module trains a network security situation awareness model based on a preset network security situation awareness standard set, generates a network traffic status label and a protocol status label through the network security situation awareness model according to the network data, and evaluates the network security level through a rating rule according to the network traffic status label and the protocol status label;

[0052] The automated response module outputs situation awareness instructions through an instruction control script according to the network security level, wherein the situation awareness instructions include firewall configuration instructions and intrusion detection system response instructions;

[0053] The reporting and visualization module obtains a network security situation report through an automated reporting tool according to the original network data, the network status tag and the network security level, and the network security situation report is displayed through a data visualization tool.

[0054] An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the network security situation awareness method based on big data analysis is implemented.

[0055] A storage medium containing computer executable instructions, which, when executed by a computer processor, are used to execute the above-mentioned network security situation awareness method based on big data analysis.

[0056] The beneficial effects of the present invention are:

[0057] (1) Through network traffic monitoring probes and deep packet inspection equipment, the original network data flow and original protocol data in broadband services are collected in real time to comprehensively judge the network security status; based on the preset network security situation awareness standard set, the network security situation awareness model is trained to achieve network security situation awareness, which is convenient for timely and accurate judgment of network security status and taking response strategies to maintain the network security environment;

[0058] (2) By adding the self-attention mechanism to the self-attention residual block to construct a self-attention temporal convolutional network, we can focus on the important information of network traffic data and more effectively process the intrinsic relationship in network traffic data;

[0059] (3) The TF-IDF algorithm is used to extract features of protocol interaction text data, which can identify text patterns that are different from normal protocol interactions, thereby providing support for network security situation awareness;

[0060] (4) Based on the network traffic feature vector set and the protocol data feature vector set, feature selection is performed through the PCA algorithm to obtain the network traffic key feature vector set and the protocol data key feature vector set, which can reduce the feature dimension and improve the efficiency of the network traffic analysis model and the protocol analysis model;

[0061] (5) Training a support vector machine based on the key feature vector set of network traffic and the key feature vector set of protocol data can improve the accuracy and efficiency of network traffic data detection and protocol interaction text data detection;

[0062] (6) Generate network status labels through the network security situation awareness model and evaluate the network security level through the rating rules, so as to monitor the network security status in real time; output network security situation awareness instructions through the instruction control script according to the network security level, so as to maintain the network environment security in time;

[0063] (7) Generate network security situation reports through automated reporting tools, and intuitively display the network security situation through data visualization tools, so that security managers can view and analyze the network security situation and provide effective decision-making support for security managers. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] In order to facilitate understanding by those skilled in the art, the present invention is further described below with reference to the accompanying drawings.

[0065] Figure 1The present invention is a flowchart of a network security situation awareness method based on big data analysis. DETAILED DESCRIPTION

[0066] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the specific implementation methods, structures, features and effects of the present invention are described in detail below in conjunction with the accompanying drawings and preferred embodiments.

[0067] See also Figure 1 , a network security situation awareness method based on big data analysis, including:

[0068] S1: collecting original network data in real time through network traffic monitoring probes and deep packet inspection equipment, wherein the original network data includes original network data flows and original protocol data in broadband services;

[0069] S2: training a network security situation awareness model based on a preset network security situation awareness standard set, wherein the network security situation awareness standard set includes a network traffic standard set and a protocol analysis standard set, and the network security situation awareness model includes a network traffic analysis model and a protocol analysis model, and training the network traffic analysis model through a self-attention temporal convolutional network and a support vector machine according to the network traffic standard set, and training the protocol analysis model through a TF-IDF algorithm and a support vector machine according to the protocol analysis standard set;

[0070] S3: preprocessing the original network data to obtain network data, generating a network status label according to the network data through the network security situation awareness model, the network status label including a network traffic status label and a protocol status label, and evaluating the network security level according to the network status label through a rating rule;

[0071] S4: Outputting network security situation awareness instructions through an instruction control script according to the network security level, wherein the network security situation awareness instructions include firewall configuration instructions and intrusion detection system response instructions;

[0072] S5: Obtain a network security situation report through an automated reporting tool according to the original network data, the network status tag, and the network security level, and display the network security situation report through a data visualization tool.

[0073] In step S1, network traffic monitoring probes and deep packet inspection equipment are used to collect network data flows and protocol data in broadband services in real time, which facilitates network security situation awareness, enables the system to respond to abnormal network behavior in a timely manner, and effectively maintains a stable and secure network environment.

[0074] In step S2, a network security situation awareness model is trained by presetting a network security situation awareness standard set, wherein the network security situation awareness standard set includes a network traffic standard set and a protocol analysis standard set, and the network security situation awareness model includes a network traffic analysis model and a protocol analysis model;

[0075] In this embodiment, the network traffic analysis model is trained by a self-attention temporal convolutional network and a support vector machine according to the network traffic standard set, which is specifically implemented by the following steps:

[0076] S2-11: Acquire historical network traffic data, the historical network traffic data including data packet size and transmission rate, preprocess the historical network traffic data to obtain historical network traffic standard data, the preprocessing including data cleaning, data format normalization, and data normalization, obtain the network traffic standard set according to the historical network traffic standard data, the network traffic standard set including normal traffic and abnormal traffic, and divide the network traffic standard set into a network traffic training set and a network traffic test set;

[0077] S2-12: constructing a self-attention temporal convolutional network by adding a self-attention mechanism to a self-attention residual block, wherein the self-attention residual block is a residual block in the temporal convolutional network;

[0078] S2-13: Extracting features through the self-attention temporal convolutional network according to the network traffic standard set to obtain a network traffic feature vector set, specifically comprising the following steps:

[0079] S2-131: Obtain a query vector, a key vector, and a value vector by calculating the weight matrix according to the historical network traffic standard data, wherein the query vector is the element x in the historical network traffic standard data. i The key vector is the information correlation of other elements in the historical network traffic standard data, and the key vector is the element x in the historical network traffic standard data. i The index of the key vector is the matching value of the query vector and the key vector, and the calculation formula is:

[0080] q i =W q ·x i

[0081] k i =W k ·x i

[0082] v i =W v ·x i

[0083] Among them, x iis the i-th element in the historical network traffic standard data, q i is the query vector of the i-th element in the historical network traffic standard data, k i is the key vector of the i-th element in the historical network traffic standard data, v i is the value vector of the i-th element in the historical network traffic standard data, W q is the weight matrix of the query vector, W k is the weight matrix of the key vector, W v is the weight matrix of the value vector;

[0084] S2-132: Calculate feature similarity based on the historical network traffic standard data by using attention weights. The feature similarity is the feature similarity of each element in the historical network traffic standard data. The calculation formula is:

[0085]

[0086] Among them, d k is the dimension of the key vector, q i is the query vector of the i-th element in the historical network traffic standard data, is the transpose of the key vector of the jth element in the historical network traffic standard data, α ij is the similarity between the query vector of the i-th element in the historical network traffic standard data and the key vector of the j-th element in the historical network traffic standard data;

[0087] S2-133: Obtain a network traffic feature vector set by calculating a weighted value vector according to the historical network traffic standard data. The weighted value vector is information of all positions in the historical network traffic standard data. The calculation formula is:

[0088]

[0089] where α ij is the similarity between the query vector of the i-th element in the historical network traffic standard data and the key vector of the j-th element in the historical network traffic standard data, v i is the value vector of the jth element in the historical network traffic standard data, and N is the number of elements in the historical network traffic standard data;

[0090] S2-14: performing feature selection based on the network traffic feature vector set by using a PCA algorithm to obtain a network traffic key feature vector set;

[0091] S2-15: Identify the normal traffic and the abnormal traffic by training a support vector machine according to the network traffic key feature vector set;

[0092] S2-16: According to the network traffic training set, an initial network traffic analysis model is obtained by training the self-attention temporal convolutional network and the support vector machine. According to the network traffic test set, the initial network traffic analysis model is tested to obtain an initial network traffic analysis model test result. According to the initial network traffic analysis model test result, an initial network traffic analysis model comprehensive score is calculated by using an initial network traffic analysis model evaluation index. The initial network traffic analysis model evaluation index includes an initial network traffic analysis model accuracy, an initial network traffic analysis model recall rate, and an initial network traffic analysis model F1 value. The calculation formula is:

[0093]

[0094] Sc1=a1*ACC1+b1*R1+c1*F11

[0095] Among them, ACC1 is the accuracy of the initial network traffic analysis model, R1 is the recall rate of the initial network traffic analysis model, F11 is the F1 value of the initial network traffic analysis model, TP1 is the number of samples that the initial network traffic analysis model correctly predicts as abnormal traffic when the samples are actually abnormal traffic, FP1 is the number of samples that the initial network traffic analysis model correctly predicts as abnormal traffic when the samples are actually normal traffic but are incorrectly predicted as abnormal traffic by the model, TN1 is the number of samples that the initial network traffic analysis model correctly predicts as normal traffic when the samples are actually normal traffic, FN1 is the number of samples that the initial network traffic analysis model incorrectly predicts as normal traffic when the samples are actually abnormal traffic, a1 is the accuracy weight of the initial network traffic analysis model, b1 is the recall weight of the initial network traffic analysis model, c1 is the F1 value weight of the initial network traffic analysis model, and Sc1 is the comprehensive score of the initial network traffic analysis model;

[0096] S2-17: Obtain the network traffic analysis model according to the comprehensive score of the initial network traffic analysis model through threshold determination; when the comprehensive score of the initial network traffic analysis model reaches or exceeds the set threshold of 0.9, obtain the network traffic analysis model.

[0097] In this embodiment, the protocol analysis model is trained by the TF-IDF algorithm and the support vector machine according to the protocol analysis standard set, which is specifically implemented by the following steps:

[0098] S2-21: Acquire historical protocol interaction text data, preprocess the historical protocol interaction text data to obtain historical protocol interaction text standard data, the preprocessing includes data cleaning, data format normalization, and data normalization, obtain the protocol analysis standard set according to the historical protocol interaction text standard data, the protocol analysis standard set includes normal protocol interaction text and abnormal protocol interaction text, and divide the protocol analysis standard set into a protocol analysis training set and a protocol analysis test set;

[0099] S2-22: extracting features by using the TF-IDF algorithm according to the protocol analysis standard set to obtain a protocol data feature vector set, specifically comprising the following steps:

[0100] S2-221: Calculate the term frequency according to the historical protocol interaction text standard data by using the total number of protocol data words and the number of protocol term times, wherein the number of protocol term times is the number of times a protocol term in the historical protocol interaction text standard data appears in a single protocol document of the historical protocol interaction text standard data, and the total number of protocol data words is the total number of words in a single protocol document in the historical protocol interaction text standard data;

[0101] The term frequency is the frequency of the protocol terms in the historical protocol interaction text standard data appearing in a single protocol document of the historical protocol interaction text standard data, and the calculation formula is:

[0102] TF(t)=S / n

[0103] Wherein, TF(t) is the term frequency, t is the protocol term in the historical protocol interaction text standard data, S is the number of times of the protocol term, and n is the total number of words in the protocol data;

[0104] S2-222: Calculate the inverse document frequency according to the historical protocol interaction text standard data by using the total number of protocol documents and the number of documents containing terms, wherein the number of documents containing terms is the number of documents containing protocol terms in the historical protocol interaction text standard data, the total number of protocol documents is the total number of documents in the historical protocol interaction text standard data, and the inverse document frequency is the importance of the protocol terms in the historical protocol interaction text standard data to distinguish different protocol document categories in the historical protocol interaction text standard data, and the calculation formula is:

[0105] IDF(t)=log(p / w)

[0106] Wherein, IDF(t) is the inverse document frequency, p is the total number of the protocol documents, w is the number of documents containing the term, and t is the protocol term in the historical protocol interaction text standard data;

[0107] S2-223: Obtain the protocol data feature vector set by calculating feature term weights according to the historical protocol interaction text standard data, wherein the feature term weights are the importance of protocol terms in the historical protocol interaction text standard data to a single protocol document in the historical protocol interaction text standard data, and the calculation formula is:

[0108] TF-IDF(t)=TF(t)*IDF(t)

[0109] Wherein, TF-IDF(t) is the feature term weight, TF(t) is the term frequency, and IDF(t) is the inverse document frequency;

[0110] S2-23: performing feature selection by using a PCA algorithm according to the protocol data feature vector set to obtain a key feature vector set of the protocol data;

[0111] S2-24: Analyzing key feature vectors of the protocol and identifying the normal protocol interaction text and the abnormal protocol interaction text by training a support vector machine;

[0112] S2-25: According to the protocol analysis training set, an initial protocol analysis model is obtained by training the TF-IDF algorithm and the support vector machine; according to the protocol analysis test set, the initial protocol analysis model is tested to obtain an initial protocol analysis model test result; according to the initial protocol analysis model test result, an initial protocol analysis model comprehensive score is obtained by calculating the initial protocol analysis model evaluation index; the initial protocol analysis model evaluation index includes the initial protocol analysis model accuracy, the initial protocol analysis model recall and the initial protocol analysis model F1 value, and the calculation formula is:

[0113]

[0114] Sc2=a2*ACC2+b2*R2+c2*F12

[0115] Among them, ACC2 is the accuracy of the initial protocol analysis model, R2 is the recall rate of the initial protocol analysis model, F12 is the F1 value of the initial protocol analysis model, TP2 is the number of samples that the initial protocol analysis model correctly predicts as abnormal protocol interaction texts when the samples are actually abnormal protocol interaction texts, FP2 is the number of samples that the initial protocol analysis model correctly predicts as abnormal protocol interaction texts when the samples are actually normal protocol interaction texts but are incorrectly predicted as abnormal protocol interaction texts by the model, TN2 is the number of samples that the initial protocol analysis model correctly predicts as normal protocol interaction texts when the samples are actually normal protocol interaction texts, FN2 is the number of samples that the initial protocol analysis model incorrectly predicts as normal protocol interaction texts when the samples are actually abnormal protocol interaction texts but are incorrectly predicted as normal protocol interaction texts by the model, b2 is the recall weight of the initial protocol analysis model, c2 is the F1 value weight of the initial protocol analysis model, and Sc2 is the comprehensive score of the initial protocol analysis model;

[0116] S2-26: Obtain the protocol analysis model according to the comprehensive score of the initial protocol analysis model through threshold determination; when the comprehensive score of the initial protocol analysis model reaches or exceeds the set threshold of 0.9, obtain the protocol analysis model.

[0117] In step S3, network data is obtained by preprocessing the original network data, and a network status label is generated according to the network data through the network security situation awareness model, wherein the network status label includes a network flow status label and a protocol status label, and the network security level is evaluated according to the network status label, which is specifically achieved by the following steps:

[0118] S3-1: obtaining network data through preprocessing according to the original network data, wherein the preprocessing includes data cleaning, data format standardization, and data normalization;

[0119] S3-2: Outputting the network traffic status label through the network traffic analysis model according to the network data;

[0120] S3-3: Outputting the protocol status label through the protocol analysis model according to the network data;

[0121] S3-4: Evaluate the network security level according to the network traffic status label and the protocol status label through a rating rule;

[0122] When the network traffic status tag is normal and the protocol status tag is normal, the network security level is the third-level network security level;

[0123] When the network traffic status tag is normal and the protocol status tag is abnormal, the network security level is the first-level network security level;

[0124] When the network traffic status tag is abnormal and the protocol status tag is normal, the network security level is the secondary network security level;

[0125] When the network traffic state label is abnormal and the protocol state label is abnormal, the network security level is the zero-level network security level.

[0126] In step S4, a network security situation awareness instruction is output through an instruction control script according to the network security level, and the network security situation awareness instruction includes a firewall configuration instruction and an intrusion detection system response instruction;

[0127] The command control script includes:

[0128] When the network security level is zero network security level, outputting firewall configuration instructions and intrusion detection system response instructions at the same time;

[0129] When the network security level is the first-level network security level, outputting an intrusion detection system response instruction;

[0130] When the network security level is level 2 network security level, outputting a firewall configuration instruction;

[0131] When the network security level is the third level network security level, no instruction is output.

[0132] In step S5, a network security situation report is obtained through an automated reporting tool according to the original network data, the network status tag and the network security level, and the network security situation report is displayed through a data visualization tool, which is specifically achieved through the following steps:

[0133] S5-1: Obtaining a network security situation analysis result, wherein the network security situation analysis result includes the original network data, the network traffic status label, the protocol status label, and the network security level;

[0134] S5-2: Generate a network security situation report through an automated reporting tool based on the network security situation analysis results;

[0135] S5-3: Based on the network security situation report, a chart is created using the data visualization tool Power BI to visually display the network security situation data.

[0136] In this embodiment, the network security situation data is intuitively displayed through a data visualization tool, which facilitates security management personnel to quickly understand and analyze the network security situation.

[0137] A network security situation awareness system based on big data analysis includes a data acquisition module, a data preprocessing module, a network security situation awareness module, an automated response module, and a reporting and visualization module;

[0138] The data acquisition module includes a network traffic monitoring probe and a deep packet inspection device, which is used to collect original network data in real time, and the original network data includes original network data flow and original protocol data in broadband services;

[0139] The data preprocessing module is used to perform data cleaning, data format standardization and data normalization on the original network data to obtain network data;

[0140] The network security situation awareness module trains a network security situation awareness model based on a preset network security situation awareness standard set, generates a network traffic status label and a protocol status label through the network security situation awareness model according to the network data, and evaluates the network security level through a rating rule according to the network traffic status label and the protocol status label;

[0141] The automated response module outputs situation awareness instructions through an instruction control script according to the network security level, wherein the situation awareness instructions include firewall configuration instructions and intrusion detection system response instructions;

[0142] The reporting and visualization module obtains a network security situation report through an automated reporting tool according to the original network data, the network status tag and the network security level, and the network security situation report is displayed through a data visualization tool.

[0143] The computer storage medium of the embodiment of the present invention may adopt any combination of one or more computer-readable media. The computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device.

[0144] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0145] The program code included on the computer readable medium can be transmitted with any appropriate medium, including but not limited to wireless, electric wire, optical cable, RF, etc., or any suitable combination of the above. The computer program code for performing the operation of the present invention can be written in one or more programming languages ​​or their combinations, and the programming language includes object-oriented programming languages-such as Java, Smalltalk, C++, and also includes conventional procedural programming languages-such as "C" language or similar programming languages. The program code can be executed completely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer and partially on the remote computer, or completely on the remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0146] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Although the present invention has been disclosed as a preferred embodiment as above, it is not used to limit the present invention. Any technical personnel in this field can make some changes or modify the technical contents disclosed above into equivalent embodiments without departing from the scope of the technical solution of the present invention. However, any simple modification, equivalent change and modification made to the above embodiments according to the technical essence of the present invention without departing from the content of the technical solution of the present invention still fall within the scope of the technical solution of the present invention.

Claims

1. A network security situation awareness method based on big data analysis, characterized in that: include: S1: collecting original network data in real time through network traffic monitoring probes and deep packet inspection equipment, wherein the original network data includes original network data flows and original protocol data in broadband services; S2: Preset a network security situation awareness standard set, train a network security situation awareness model according to the network security situation awareness standard set, the network security situation awareness standard set includes a network traffic standard set and a protocol analysis standard set, the network security situation awareness model includes a network traffic analysis model and a protocol analysis model, train the network traffic analysis model through a self-attention temporal convolutional network and a support vector machine according to the network traffic standard set, and train the protocol analysis model through a TF-IDF algorithm and a support vector machine according to the protocol analysis standard set; S3: obtaining network data through preprocessing the original network data, generating a network status label through the network security situation awareness model according to the network data, wherein the network status label includes a network traffic status label and a protocol status label, and evaluating the network security level through a rating rule according to the network status label; S4: Outputting network security situation awareness instructions through an instruction control script according to the network security level, wherein the network security situation awareness instructions include firewall configuration instructions and intrusion detection system response instructions; S5: Obtain a network security situation report through an automated reporting tool according to the original network data, the network status tag, and the network security level, and display the network security situation report through a data visualization tool.

2. The network security situation awareness method based on big data analysis according to claim 1 is characterized in that: The training of the network traffic analysis model in step S2 specifically includes: S2-11: Acquire historical network traffic data, obtain historical network traffic standard data through preprocessing according to the historical network traffic data, obtain the network traffic standard set according to the historical network traffic standard data, the network traffic standard set includes normal traffic and abnormal traffic, and divide the network traffic standard set into a network traffic training set and a network traffic test set; S2-12: constructing a self-attention temporal convolutional network by adding a self-attention mechanism to a self-attention residual block, wherein the self-attention residual block is a residual block in the temporal convolutional network; S2-13: extracting features through the self-attention temporal convolutional network according to the network traffic standard set to obtain a network traffic feature vector set; S2-14: performing feature selection based on the network traffic feature vector set by using a PCA algorithm to obtain a network traffic key feature vector set; S2-15: Identify the normal traffic and the abnormal traffic by training a support vector machine according to the network traffic key feature vector set; S2-16: According to the network traffic training set, an initial network traffic analysis model is obtained by training the self-attention temporal convolutional network and the support vector machine; according to the network traffic test set, the initial network traffic analysis model is tested to obtain an initial network traffic analysis model test result; according to the initial network traffic analysis model test result, a comprehensive score of the initial network traffic analysis model is calculated by using the initial network traffic analysis model evaluation index; S2-17: The network traffic analysis model is obtained according to the comprehensive score of the initial network traffic analysis model through threshold determination. When the comprehensive score of the network traffic analysis model reaches or exceeds the set threshold of 0.9, the network traffic analysis model is obtained.

3. The network security situation awareness method based on big data analysis according to claim 2 is characterized in that: The step S2-13 specifically includes: S2-131: Obtain a query vector, a key vector, and a value vector by calculating a weight matrix according to the historical network traffic standard data; S2-132: Calculating feature similarity based on the historical network traffic standard data by using attention weights, where the feature similarity is the feature similarity of each element in the historical network traffic standard data; S2-133: Obtain a network traffic feature vector set based on the historical network traffic standard data by calculating a weighted value vector.

4. The network security situation awareness method based on big data analysis according to claim 1 is characterized in that: The training of the protocol analysis model in step S2 specifically includes: S2-21: Acquire historical protocol interaction text data, obtain historical protocol interaction text standard data through preprocessing according to the historical protocol interaction text data, obtain the protocol analysis standard set according to the historical protocol interaction text standard data, the protocol analysis standard set includes normal protocol interaction text and abnormal protocol interaction text, and divide the protocol analysis standard set into a protocol analysis training set and a protocol analysis test set; S2-22: extracting features by using the TF-IDF algorithm according to the protocol analysis standard set to obtain a protocol data feature vector set; S2-23: performing feature selection by using a PCA algorithm according to the protocol data feature vector set to obtain a key feature vector set of the protocol data; S2-24: Analyzing key feature vectors of the protocol and identifying the normal protocol interaction text and the abnormal protocol interaction text by training a support vector machine; S2-25: obtaining an initial protocol analysis model through the TF-IDF algorithm and the support vector machine training according to the protocol analysis training set, testing the initial protocol analysis model according to the protocol analysis test set to obtain an initial protocol analysis model test result, and obtaining an initial protocol analysis model comprehensive score through initial protocol analysis model evaluation index calculation according to the initial protocol analysis model test result; S2-26: Obtain the protocol analysis model according to the comprehensive score of the initial protocol analysis model through threshold determination: when the comprehensive score of the initial protocol analysis model reaches or exceeds the set threshold of 0.9, the protocol analysis model is obtained.

5. The network security situation awareness method based on big data analysis according to claim 4 is characterized in that: The step S2-22 specifically includes: S2-221: Calculate the term frequency by using the total number of terms in the protocol data and the number of terms in the protocol according to the historical protocol interaction text standard data; S2-222: Calculate the inverse document frequency based on the total number of protocol documents and the number of documents containing the term according to the historical protocol interaction text standard data; S2-223: Obtain the protocol data feature vector set by calculating feature term weights according to the historical protocol interaction text standard data.

6. The network security situation awareness method based on big data analysis according to claim 1 is characterized in that: The step S3 specifically includes: S3-1: obtaining network data through preprocessing according to the original network data, wherein the preprocessing includes data cleaning, data format standardization, and data normalization; S3-2: Outputting the network traffic status label through the network traffic analysis model according to the network data; S3-3: Outputting the protocol status label through the protocol analysis model according to the network data; S3-4: Evaluate the network security level according to the network traffic status label and the protocol status label using a rating rule; When the network traffic status tag is normal and the protocol status tag is normal, the network security level is the third-level network security level; When the network traffic status tag is normal and the protocol status tag is abnormal, the network security level is the first-level network security level; When the network traffic status tag is abnormal and the protocol status tag is normal, the network security level is the secondary network security level; When the network traffic state label is abnormal and the protocol state label is abnormal, the network security level is the zero-level network security level.

7. The network security situation awareness method based on big data analysis according to claim 1 is characterized in that: The instruction control script in step S4 specifically includes: When the network security level is zero network security level, outputting firewall configuration instructions and intrusion detection system response instructions at the same time; When the network security level is the first-level network security level, outputting an intrusion detection system response instruction; When the network security level is level 2 network security level, outputting a firewall configuration instruction; When the network security level is the third level network security level, no instruction is output.

8. A network security situation awareness system based on big data analysis, comprising a data acquisition module, a data preprocessing module, a network security situation awareness module, an automated response module, and a reporting and visualization module, characterized in that: The data acquisition module includes a network traffic monitoring probe and a deep packet inspection device, which is used to collect original network data in real time, and the original network data includes original network data flow and original protocol data in broadband services; The data preprocessing module is used to perform data cleaning, data format standardization and data normalization on the original network data to obtain network data; The network security situation awareness module trains a network security situation awareness model based on a preset network security situation awareness standard set, generates a network traffic status label and a protocol status label through the network security situation awareness model according to the network data, and evaluates the network security level through a rating rule according to the network traffic status label and the protocol status label; The automated response module outputs situation awareness instructions through an instruction control script according to the network security level, wherein the situation awareness instructions include firewall configuration instructions and intrusion detection system response instructions; The reporting and visualization module obtains a network security situation report through an automated reporting tool according to the original network data, the network status tag and the network security level, and the network security situation report is displayed through a data visualization tool.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, it implements the network security situation awareness method based on big data analysis as described in any one of claims 1-7.

10. A storage medium containing computer executable instructions, characterized in that: The computer executable instructions, when executed by a computer processor, are used to execute the network security situation awareness method based on big data analysis as described in any one of claims 1 to 7.

Images