Risk assessment and prediction method based on network security situation awareness system

Abstract

The invention discloses a risk assessment and prediction method based on a network security situation awareness system, and relates to the technical field of network security. According to the risk assessment and prediction method based on the network security situation awareness system, a current network potential risk data set is obtained, and a current network potential risk assessment value is obtained through comprehensive analysis based on the obtained current network potential risk data set; acquiring a current network traffic data set, and based on the acquired current network traffic data set, performing comprehensive analysis to obtain a current network traffic evaluation value; comprehensively analyzing the current network potential risk assessment value and the current network flow assessment value to obtain a network security risk coefficient and a network security risk level; by comprehensively analyzing the current risk and flow data, a more comprehensive, real-time and dynamic network security management scheme is provided, potential threats can be effectively identified, and the early warning capability is improved. The problem that the existing network security situation awareness system is inconvenient to comprehensively reflect the network security situation is solved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a risk assessment and prediction method based on a network security situation awareness system. Background Art

[0002] With the rapid development of information technology, the popularity of the Internet and the increase in the types of applications, network security faces increasingly complex challenges. The means and tools of network attacks are becoming increasingly diverse, making the threat of network attacks more severe. Network security situation awareness is to describe and understand the security status of the network by collecting, integrating and analyzing information from different sources. Its goal is to identify potential security threats in a timely manner and take corresponding measures to ensure network security.

[0003] Existing network security situation awareness systems often rely on a single data source and lack the integration of multiple data sources, resulting in one-sided assessment results and inconvenience in fully reflecting the network security situation. Summary of the invention

[0004] In view of the shortcomings of the existing technology, the present invention provides a risk assessment and prediction method based on a network security situation awareness system, which solves the problem that the existing network security situation awareness system often relies on a single data source and lacks integration of multiple data sources, resulting in one-sided assessment results and inconvenience in fully reflecting the network security situation.

[0005] To achieve the above objectives, the present invention is implemented through the following technical solutions: a risk assessment and prediction method based on a network security situation awareness system, comprising the following steps: obtaining a current network potential risk data set, and based on the obtained current network potential risk data set, comprehensively analyzing to obtain a current network potential risk assessment value; obtaining a current network traffic data set, and based on the obtained current network traffic data set, comprehensively analyzing to obtain a current network traffic assessment value; comprehensively analyzing the current network potential risk assessment value and the current network traffic assessment value to obtain a network security risk coefficient and a network security risk level; obtaining a historical network security risk coefficient, and combining the historical network security risk coefficient with the network security risk coefficient to re-evaluate the network security risk level.

[0006] Furthermore, based on the obtained current network potential risk data set, a comprehensive analysis is performed to obtain a current network potential risk assessment value, and the specific analysis process is: obtaining the current network potential risk data set; The obtained current network potential risk data set is analyzed with the participating network potential risk data set stored in the database to obtain the current network potential risk assessment value.

[0007] Furthermore, the current network potential risk data set specifically includes a potential threat index, a vulnerability exposure value and a potential loss value; the determined network potential risk data set specifically includes a determined potential threat index, a determined vulnerability exposure value and a determined potential loss value; the specific analysis process for obtaining the current network potential risk data set is: obtaining and analyzing network traffic, detecting potential malicious behaviors of suspicious activities, and obtaining a potential threat index; identifying vulnerabilities by scanning devices, operating systems and applications in the network, and obtaining a vulnerability exposure value; obtaining security incidents that may affect the business, evaluating the economic impact of the incidents on the business, and obtaining a potential loss value.

[0008] Furthermore, the current network potential risk assessment value is specifically calculated as follows: ; In the formula, is the current network potential risk assessment value, is the potential threat index, The potential threat index for the parameters stored in the database, is the vulnerability exposure value, is the parameterized vulnerability exposure value stored in the database, is the potential loss value, The potential loss value of the parameter stored in the database, is the weight factor of the potential threat index stored in the database, is the weight factor of the vulnerability exposure value stored in the database, A weighting factor for the potential loss values ​​stored in the database.

[0009] Furthermore, based on the acquired current network traffic data set, a comprehensive analysis is performed to obtain a current network traffic evaluation value, and the specific analysis process is: obtaining the current network traffic data set; obtaining a parameter network traffic data set stored in a database; and comprehensively analyzing the acquired current network traffic data set with the parameter network traffic data set stored in the database to obtain a current network traffic evaluation value.

[0010] Furthermore, the current network traffic data set specifically includes the network traffic rate, the number of network connections and the ratio of abnormal network traffic packet types; the reference network traffic data set specifically includes the reference network traffic rate, the number of network connections and the ratio of abnormal network traffic packet types.

[0011] Furthermore, the specific analysis process of obtaining the current network traffic data set is as follows: traffic analysis is performed by capturing data packets in the network, and the amount of data transmitted per second during the transmission process is obtained, and the network traffic rate is calculated; network traffic data and connection status are collected through network traffic monitoring software to obtain the number of network connections; abnormal packets in the network traffic are detected through a network monitoring system, and their types and quantities are counted, so as to calculate the number of network connections and the ratio of network traffic abnormal packet types.

[0012] Furthermore, the specific analysis process of the network security risk level is: obtaining a network security risk coefficient; obtaining a parameterized network security risk coefficient stored in the data; comparing the network security risk coefficient with the parameterized network security risk coefficient stored in the database to obtain a network security risk level.

[0013] Furthermore, the network security risk coefficient is compared with the parameterized network security risk coefficient stored in the database to obtain the network security risk level. The specific analysis process is: if the network security risk coefficient is lower than the parameterized network security risk coefficient stored in the database, the network risk level corresponding to the network security risk coefficient is marked as level one; if the network security risk coefficient is equal to the parameterized network security risk coefficient stored in the database, the network risk level corresponding to the network security risk coefficient is marked as level two; if the network security risk coefficient is higher than the parameterized network security risk coefficient stored in the database, the network risk level corresponding to the network security risk coefficient is marked as level three.

[0014] Furthermore, the historical network security risk coefficient is combined with the network security risk coefficient to re-evaluate the network security risk level. The specific analysis process is: comparing the network security risk coefficient with the historical network security risk coefficient stored in the database; if the network security risk coefficient is higher than the historical network security risk coefficient stored in the database, the network risk level corresponding to the network security risk coefficient is increased by one level; if the network security risk coefficient is equal to the historical network security risk coefficient stored in the database, the network risk level corresponding to the network security risk coefficient remains unchanged; if the network security risk coefficient is lower than the historical network security risk coefficient stored in the database, the network risk level corresponding to the network security risk coefficient is reduced by one level.

[0015] The present invention has the following beneficial effects: (1) This risk assessment and prediction method based on the network security situation awareness system provides a more comprehensive, real-time and dynamic network security management solution by comprehensively analyzing current risks and traffic data, which can effectively identify potential threats and improve early warning capabilities. It solves the problem that the existing network security situation awareness system often relies on a single data source and lacks the integration of multiple data sources, resulting in one-sided assessment results and inconvenience in fully reflecting the network security situation; (2) The risk assessment and prediction method based on the network security situation awareness system can prioritize high-risk areas by grading network security risk factors, thereby improving the efficiency and pertinence of resource allocation and ensuring that the most urgent security issues are dealt with in a timely manner; (3) The risk assessment and prediction method based on the network security situation awareness system can better adapt to the changing network environment and threat situation by combining the historical network security risk coefficient with the current assessment results for re-evaluation, thereby enhancing the accuracy of the assessment; Of course, any product implementing the present invention does not necessarily need to achieve all of the advantages described above at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 This is a flow chart of the risk assessment and prediction method based on the network security situation awareness system of the present invention. DETAILED DESCRIPTION

[0017] The embodiment of the present application uses a risk assessment and prediction method based on a network security situation awareness system to achieve a more comprehensive, real-time and dynamic network security management solution by comprehensively analyzing current risks and traffic data, which can effectively identify potential threats and improve early warning capabilities.

[0018] See also Figure 1 The embodiment of the present invention provides a technical solution: a risk assessment and prediction method based on a network security situation awareness system, comprising the following steps: obtaining a current network potential risk data set, and based on the obtained current network potential risk data set, comprehensively analyzing to obtain a current network potential risk assessment value; obtaining a current network traffic data set, and based on the obtained current network traffic data set, comprehensively analyzing to obtain a current network traffic assessment value; comprehensively analyzing the current network potential risk assessment value and the current network traffic assessment value to obtain a network security risk coefficient and a network security risk level; obtaining a historical network security risk coefficient, and combining the historical network security risk coefficient with the network security risk coefficient to re-evaluate the network security risk level.

[0019] Specifically, based on the acquired current network potential risk data set, a comprehensive analysis is performed to obtain a current network potential risk assessment value, and the specific analysis process is: obtaining the current network potential risk data set; obtaining a participating network potential risk data set stored in a database; and performing a comprehensive analysis on the acquired current network potential risk data set and the participating network potential risk data set stored in the database to obtain a current network potential risk assessment value.

[0020] In this implementation scheme, first, a potential risk data set of the current network is obtained, and the potential risk data set of the current network reflects the current network status. After that, the potential risk data set of the participating network stored in the database is extracted and used as a benchmark for comparison. The potential risk data set of the participating network stored in the database can continuously collect real-time network activity data through the intrusion detection system. The network activity data is used to identify and record potential risk indicators, and then the potential risk data set of the participating network stored in the database is obtained. The obtained current network potential risk data set and the participating network potential risk data set stored in the database are comprehensively analyzed to obtain the current network potential risk assessment value. By combining real-time data and historical benchmarks, the assessment value can more truly reflect the risk level of the current network. Real-time data can reveal new threat patterns, and the participating data provides a stable basis for comparison. Through risk assessment, its security strategy can be continuously optimized, protection capabilities can be enhanced, and adaptation to the ever-changing network environment can be achieved.

[0021] Specifically, the current network potential risk data set includes a potential threat index, a vulnerability exposure value and a potential loss value; the determined network potential risk data set includes a determined potential threat index, a determined vulnerability exposure value and a determined potential loss value; the specific analysis process for obtaining the current network potential risk data set is: obtaining and analyzing network traffic, detecting potential malicious behaviors of suspicious activities, and obtaining a potential threat index; identifying vulnerabilities by scanning devices, operating systems and applications in the network, and obtaining a vulnerability exposure value; obtaining security incidents that may affect the business, evaluating the economic impact of the incidents on the business, and obtaining a potential loss value.

[0022] In this implementation scheme, the current network potential risk data set specifically includes a potential threat index, a vulnerability exposure value, and a potential loss value. The potential threat index reflects the threats that may be faced in the current network environment, including malware attacks, phishing, internal threats, etc. By using network monitoring tools to monitor data packets transmitted in the network in real time, abnormal behaviors are captured, such as a surge in network traffic, multiple login attempts by suspicious IP addresses, unauthorized users accessing sensitive information, and frequent transmission and reception of data packets that are not in line with the norm. In this embodiment, the risk ratio can be obtained by monitoring the ratio between the number of normal data packet transmissions and the total number of data packet transmissions, and the potential threat index corresponding to the risk ratio stored in the database is obtained by matching the risk ratio; the vulnerability exposure value indicates the number and severity of security vulnerabilities in the system or network, including Unpatched software, configuration errors, etc., use vulnerability scanning tools to conduct a comprehensive scan of the target network, operating system, server, application and network equipment to identify potential security vulnerabilities and configuration errors. In this embodiment, the identified security vulnerabilities can be matched with the vulnerability exposure values ​​corresponding to the security vulnerabilities in the database to obtain the corresponding vulnerability exposure values; the potential loss value is used to calculate the economic losses that may be caused by network security incidents, covering direct financial losses, business interruptions, etc. In this embodiment, the cost of purchasing new hardware, software or hiring external data recovery experts after the network incident is considered, and the corresponding potential loss value can be obtained by matching the sum of the potential threat index and the vulnerability exposure value. The specific steps of matching to obtain the corresponding potential loss value are: constructing a mapping set between the sum of the potential threat index and the vulnerability exposure value and the potential loss value based on historical data, inputting the sum of the potential threat index and the vulnerability exposure value, and obtaining the corresponding potential loss value.

[0023] By combining the potential threat index, vulnerability exposure value and potential loss value, it can provide a comprehensive understanding of the network security status and help identify high-risk areas. The acquisition and update of real-time data enables organizations to quickly adapt to the changing threat environment, improve response capabilities, and reduce potential losses. By evaluating different types of risks, organizations can prioritize the most serious security issues and optimize resource allocation. The current network potential risk data set complements the participating network potential risk data set, providing a comprehensive, dynamic and efficient network risk assessment framework, which helps to improve the effectiveness and responsiveness of network security management.

[0024] Specifically, the current network potential risk assessment value is calculated as follows: ; In the formula, is the current network potential risk assessment value, is the potential threat index, The potential threat index for the parameters stored in the database, is the vulnerability exposure value, is the parameterized vulnerability exposure value stored in the database, is the potential loss value, The potential loss value of the parameter stored in the database, is the weight factor of the potential threat index stored in the database, is the weight factor of the vulnerability exposure value stored in the database, A weighting factor for the potential loss values ​​stored in the database.

[0025] In this embodiment, is the potential threat index, The ratio is the potential threat index stored in the database. When the potential threat index is higher than the potential threat index stored in the database, this ratio will be greater than 1, resulting in an increase in the current network potential risk assessment value. This reflects that the threat level of the network has increased, indicating that there is a greater security risk. On the contrary, if the current potential threat index is lower than the potential threat index stored in the database, this ratio will be less than 1, and the risk assessment value will decrease accordingly, indicating that the security of the network has improved. is the vulnerability exposure value, is the parameterized vulnerability exposure value stored in the database. Similarly, if the current vulnerability exposure value is higher than the parameterized vulnerability exposure value stored in the database, the ratio is greater than 1, resulting in an increase in the risk assessment value, indicating that the network's vulnerability to attacks is increased. Conversely, if the current vulnerability is lower than the parameterized value, the risk assessment value is reduced, indicating that the network's security is enhanced. is the potential loss value, The square root function is used in the denominator of the formula to reflect the impact of the potential loss value on the risk assessment. The denominator ensures that the current network potential risk assessment value will not be overestimated when the potential loss value is high. The use of square roots also makes the risk assessment value change more smoothly in extreme loss situations, reducing the impact of extreme values ​​on the final result. By combining the above two parts, the current network potential risk assessment value calculated will comprehensively reflect the security status of the network. , , They are the weight factors of potential threat index, vulnerability exposure value and potential loss value, which are used to adjust the influence of different indicators on the final risk assessment to reflect their relative importance. Natural logarithm function The introduction of makes the risk assessment value smoother when changing, reducing the assessment instability caused by the fluctuation of a single indicator. It helps to obtain more accurate and stable risk assessment results in the face of a complex network security environment, so as to make effective decisions and risk management. This formula provides a multi-dimensional risk assessment method by combining potential threats, vulnerabilities and loss values. This quantitative risk assessment not only helps to identify the security status of the current network, but also provides an important basis for formulating corresponding security policies. Through reasonable weight setting and relative comparison, the formula can flexibly adapt to the risk assessment needs of different network environments, thereby improving the efficiency and effectiveness of network security management.

[0026] Weight Factor , , The weight factors corresponding to the potential threat index, vulnerability exposure value and potential loss value preset in the database respectively represent the values ​​of the influence of the potential threat index, vulnerability exposure value and potential loss value on the current network potential risk assessment value. When used, the weight factors corresponding to the potential threat index, vulnerability exposure value and potential loss value can be directly obtained from the database. The corresponding relationship can be a preset mapping relationship, in which the mapping relationship can be one-to-one or many-to-one. For example, the potential threat index and the weight factor of the reference potential threat index stored in the database form a mapping set, and the potential threat index is input into the mapping set to obtain the weight factor of the brightness in the public room, and its value range in this example is between 0 and 1; for example, the vulnerability exposure value and the weight factor of the reference vulnerability exposure value stored in the database form a mapping set, and the vulnerability exposure value is input into the mapping set to obtain the weight factor of the vulnerability exposure value, and its value range in this example is between 0 and 1; for example, the potential loss value and the weight factor of the reference potential loss value stored in the database form a mapping set, and the potential loss value is input into the mapping set to obtain the weight factor of the potential loss value, and its value range in this example is between 0 and 1.

[0027] Specifically, based on the acquired current network traffic data set, a comprehensive analysis is performed to obtain a current network traffic evaluation value, and the specific analysis process is: obtaining the current network traffic data set; obtaining a parameter network traffic data set stored in a database; and comprehensively analyzing the acquired current network traffic data set with the parameter network traffic data set stored in the database to obtain a current network traffic evaluation value.

[0028] In this embodiment, the current network traffic data set is the traffic data obtained in real time by monitoring the current network operation, which reflects the current network operation status and potential risks. The reference network traffic data set stored in the database provides a basis for benchmarking the current network traffic. The obtained current network traffic data set is comprehensively analyzed with the reference network traffic data set stored in the database to obtain the current network traffic evaluation value. By comparing the difference between the current network traffic data set and the reference network traffic data set stored in the database, the current network traffic status can be evaluated. The reference network traffic data set stored in the database can be obtained through environmental simulation. The specific method is to build a standardized network test environment, use traffic generation tools such as Iperf or Wireshark, create and record network traffic patterns under normal operation in this environment, and then organize and store the collected traffic data in the database as a reference data set for subsequent network traffic evaluation. The current network traffic evaluation value is obtained by quantitatively analyzing the difference between the current network traffic data set. This evaluation value can be used to quantify the health of the current network in terms of traffic, so that the security system decides whether further network optimization or security measures need to be taken. By acquiring current network traffic data, determining traffic data and conducting comprehensive analysis, the network traffic assessment process achieves a real-time quantitative assessment of network health. This assessment method can not only detect anomalies in network operation, but also provide a basis for network optimization and security protection. It is an important means to improve network management and security.

[0029] Specifically, the current network traffic data set specifically includes the network traffic rate, the number of network connections and the ratio of abnormal network traffic packet types; the reference network traffic data set specifically includes the reference network traffic rate, the number of network connections and the ratio of abnormal network traffic packet types.

[0030] Specifically, the current network traffic data set is obtained, and the specific analysis process is as follows: traffic analysis is performed by capturing data packets in the network, and the amount of data transmitted per second during the transmission process is obtained, and the network traffic rate is calculated; network traffic data and connection status are collected through network traffic monitoring software to obtain the number of network connections; abnormal packets in the network traffic are detected through a network monitoring system, and their types and quantities are counted, so as to calculate the number of network connections and the ratio of network traffic abnormal packet types.

[0031] In this implementation scheme, the network traffic rate is obtained by capturing data packets in the network for traffic analysis. A network packet capture tool, such as Wireshark, is used to monitor traffic in the network and record the amount of data transmitted. The traffic rate directly reflects the utilization and performance of the network. If the traffic rate is too high, it may indicate that the network is facing congestion or under attack; if the traffic rate is too low, it may mean that network resources are not fully utilized. The number of network connections is obtained through network traffic monitoring software such as NetFlow Analyzer or Nagios. The software monitors active TCP and UDP connections in the network, collects and analyzes connection status in real time, and obtains the number of network connections. The number of network connections is an important indicator for evaluating network load and potential security risks. Too high a number of connections may mean that the network is under attack or overused, while too low a number of connections may reflect low user activity or network availability issues. Real-time monitoring can help administrators adjust resource configuration in a timely manner to ensure network stability. The acquisition of the proportion of abnormal network traffic packet types is carried out through a network monitoring system, such as an intrusion detection system IDS or an intrusion prevention system IPS. The monitoring system analyzes network traffic in real time, detects abnormal packets, and counts the number of different types of abnormal packets, such as malicious traffic, error packets, etc., to obtain the proportion of abnormal network traffic packet types. The proportion of abnormal network traffic packet types can timely identify potential security threats and network problems. The increase in the proportion of abnormal packets usually indicates that the network may be attacked or there are configuration errors, which enables administrators to respond quickly and take protective measures to reduce security risks. Through a comprehensive analysis of network traffic rate, number of network connections and proportion of abnormal network traffic packet types, we can fully understand the health of the network and take timely countermeasures. As the network environment continues to change, continuous traffic monitoring and data analysis can ensure the efficient and safe operation of the network. Through a deep understanding of traffic rate, number of connections and abnormal packet ratio, we can better manage and optimize network resources and improve user experience and system stability.

[0032] The current network traffic evaluation value calculation formula; ; In the formula, is the current network traffic evaluation value, is the network traffic rate, The network traffic rate is stored in the database. is the number of network connections, The number of network connections stored in the database. is the proportion of abnormal network traffic packet types, The ratio of abnormal network traffic packet types stored in the database. is the weight factor of the network traffic rate stored in the database, is the weight factor of the number of network connections stored in the database, It is the weight factor of the proportion of abnormal network traffic packet types stored in the database.

[0033] It should be noted that is the network traffic rate, The network traffic rate stored in the database is the reference network traffic rate. This part evaluates the deviation between the current traffic rate and the reference network traffic rate stored in the database by calculating the absolute difference between the current network traffic rate and the reference network traffic rate stored in the database. A large difference indicates that the current traffic is significantly different from the normal state, which means that the network is abnormal, such as a surge in traffic or an attack. is the number of network connections, The parameterized network connection number stored in the database. By calculating the ratio of the number of connections under normal circumstances to the number of parameterized network connections stored in the database, we can understand the relative relationship between the current network connection status and the normal status. If the current number of connections is much higher than the normal number of connections, it may indicate network overload, DDoS attack or other abnormal situations. Conversely, too low a number of connections may indicate that the network is idle or faulty. is the proportion of abnormal network traffic packet types, By calculating the absolute difference between the abnormal packet type ratio in the current network traffic and the abnormal packet type ratio in the database, the abnormal traffic situation in the network can be judged. The increase of abnormal packets usually indicates potential security threats or network problems. Timely identification of abnormal packets helps to carry out more effective security protection. Using the logarithmic function to convert the calculation results into logarithmic values ​​helps to compress larger values ​​into a smaller range. The logarithmic function can reduce the impact of extreme values ​​on the results, making the evaluation value more stable. The weight factor of the network traffic rate stored in the database is used to indicate the importance of the traffic rate in the overall network evaluation. is the weight factor of the number of network connections stored in the database, which is used to reflect the importance of the number of network connections in the evaluation. It is the weight factor of the proportion of abnormal network traffic packet types stored in the database, which is used to reflect the importance of the number of network connections in the evaluation. The formula integrates multiple key indicators such as network traffic rate, number of network connections and proportion of abnormal network traffic packet types, making the evaluation more comprehensive and covering more potential network problems. The calculation of the evaluation value provides a basis for subsequent network management and optimization, and a reasonable network management strategy is formulated based on the evaluation results, thereby improving network performance and security.

[0034] Weight Factor , , , which are the weight factors corresponding to the network traffic rate, number of network connections and proportion of network traffic abnormal packet types preset in the database, respectively, and represent the numerical value of the influence of the network traffic rate, number of network connections and proportion of network traffic abnormal packet types on the current network traffic assessment value. When used, the weight factors corresponding to the network traffic rate, number of network connections and proportion of network traffic abnormal packet types can be directly obtained from the database, and the corresponding relationship can be a preset mapping relationship, in which the mapping relationship can be a one-to-one correspondence or a many-to-one relationship. For example, the network traffic rate and the weight factor of the parameterized network traffic rate stored in the database form a mapping set, and the network traffic rate is input into the mapping set to obtain the weight factor of the network traffic rate, and its value range in this instance is between 0 and 1; for example, the number of network connections and the weight factor of the parameterized network connection number stored in the database form a mapping set, and the number of network connections is input into the mapping set to obtain the weight factor of the number of network connections, and its value range in this instance is between 0 and 1; for example, the network traffic abnormality packet type ratio and the weight factor of the parameterized network traffic abnormality packet type ratio stored in the database form a mapping set, and the network traffic abnormality packet type ratio is input into the mapping set to obtain the weight factor of the network traffic abnormality packet type ratio, and its value range in this instance is between 0 and 1.

[0035] Specifically, the network security risk level, the specific analysis process is: obtain the network security risk coefficient; obtain the parameterized network security risk coefficient stored in the data; compare the network security risk coefficient with the parameterized network security risk coefficient stored in the database to obtain the network security risk level.

[0036] In this implementation scheme, the network security risk coefficient is a quantitative indicator calculated by comprehensively analyzing the current network potential risk assessment value and the current network traffic assessment value. It reflects the degree of risk currently faced by the network. Through risk assessment, the network security risk coefficient can provide empirical basis for subsequent decision-making. The network security risk coefficient is compared with the reference network security risk coefficient stored in the database to obtain the network security risk level. The reference network security risk coefficient can be obtained through simulation experiments, that is, simulated tests of different types of network attacks and abnormal traffic in a controlled environment, and the performance and response of the system under these attacks are recorded. The test results are used as the reference network security risk coefficient. Through clear risk coefficients and level divisions, network risks can be quantitatively evaluated to obtain the current security status of the network.

[0037] The calculation formula for the network security risk factor is: ; In the formula, is the network security risk factor, is the current network potential risk assessment value, The potential risk assessment value of the participating network stored in the database, is the current network traffic evaluation value, The network traffic evaluation value stored in the database. is the weight factor of the current network potential risk assessment value stored in the database, The weight factor of the current network traffic evaluation value stored in the database.

[0038] It should be noted that the formula compares the current network potential risk assessment value and the current network traffic assessment value with the reference network potential risk assessment value and the reference network traffic assessment value stored in the database, respectively, to provide a clear perspective for risk assessment, identify potential problems, and weight factors. , , adjust the importance of each factor in the risk assessment according to the specific network environment and needs. The logarithmic function is used to process the traffic assessment value, so that small changes will not cause excessive changes in the risk factor when the traffic is large, ensuring the stability and rationality of the assessment. This formula combines potential risks and traffic assessment together, providing a comprehensive risk assessment mechanism that can take into account both the security and traffic status of the network. By calculating the risk factor in real time, the network security status can be monitored in a timely manner, and potential security threats can be quickly identified and responded to.

[0039] Weight Factor , , which are the weight factors corresponding to the current network potential risk assessment value and the current network traffic assessment value preset in the database, respectively, and represent the numerical values ​​of the influence of the current network potential risk assessment value and the current network traffic assessment value on the network security risk coefficient. When used, the weight factors corresponding to the current network potential risk assessment value and the current network traffic assessment value can be directly obtained from the database, and the corresponding relationship can be a pre-set mapping relationship, in which the mapping relationship can be one-to-one or many-to-one. For example, the current network potential risk assessment value and the weight factor of the reference network potential risk assessment value stored in the database form a mapping set, and the current network potential risk assessment value is input into the mapping set to obtain the weight factor of the current network potential risk assessment value, and its value range in this example is between 0 and 1; for example, the current network traffic assessment value and the reference network traffic assessment value stored in the database form a mapping set, and the current network traffic assessment value is input into the mapping set to obtain the weight factor of the current network traffic assessment value, and its value range in this example is between 0 and 1.

[0040] Specifically, the network security risk coefficient is compared with the parameterized network security risk coefficient stored in the database to obtain the network security risk level. The specific analysis process is: if the network security risk coefficient is lower than the parameterized network security risk coefficient stored in the database, the network risk level corresponding to the network security risk coefficient is marked as level one; if the network security risk coefficient is equal to the parameterized network security risk coefficient stored in the database, the network risk level corresponding to the network security risk coefficient is marked as level two; if the network security risk coefficient is higher than the parameterized network security risk coefficient stored in the database, the network risk level corresponding to the network security risk coefficient is marked as level three.

[0041] In this implementation scheme, if the network security risk coefficient is lower than the determined network security risk coefficient stored in the database, the network risk level corresponding to the network security risk coefficient is marked as level one, indicating high security. If the network security risk coefficient is equal to the determined network security risk coefficient stored in the database, the network risk level corresponding to the network security risk coefficient is marked as level two, indicating medium security. If the network security risk coefficient is higher than the determined network security risk coefficient stored in the database, the network risk level corresponding to the network security risk coefficient is marked as level three, indicating low security. Dividing network security risks into three levels facilitates a quick understanding of the current network security situation. By clarifying the risk level, resources and energy can be more effectively concentrated, high-risk issues can be prioritized, and security risks can be reduced.

[0042] Specifically, the historical network security risk coefficient is combined with the network security risk coefficient to re-evaluate the network security risk level. The specific analysis process is: compare the network security risk coefficient with the historical network security risk coefficient stored in the database; if the network security risk coefficient is higher than the historical network security risk coefficient stored in the database, the network risk level corresponding to the network security risk coefficient is increased by one level; if the network security risk coefficient is equal to the historical network security risk coefficient stored in the database, the network risk level corresponding to the network security risk coefficient remains unchanged; if the network security risk coefficient is lower than the historical network security risk coefficient stored in the database, the network risk level corresponding to the network security risk coefficient is reduced by one level.

[0043] In this implementation scheme, the network security risk coefficient is compared with the historical network security risk coefficient stored in the database; if the network security risk coefficient is higher than the historical network security risk coefficient stored in the database, the network risk level corresponding to the network security risk coefficient is increased by one level. The current risk is higher than the historical level, which means that the network security situation has deteriorated. At this time, the network risk level is increased by one level to reflect the higher risk. If the network security risk coefficient is equal to the historical network security risk coefficient stored in the database, the network risk level corresponding to the network security risk coefficient remains unchanged; the current risk is the same as the historical level, indicating that the network security situation is stable. At this time, the network risk level remains unchanged and the status quo is maintained. If the network security risk coefficient is lower than the historical network security risk coefficient stored in the database, the network risk level corresponding to the network security risk coefficient is reduced by one level. The current risk is lower than the historical level, indicating that the network security situation has improved. At this time, the network risk level is reduced by one level to reflect a lower risk. By comparing the current risk with the historical risk, the changing trend of network security can be dynamically evaluated, potential problems can be identified in a timely manner, and adjustments can be made to past risk points with the support of historical data to avoid similar incidents from happening again. The historical network security risk coefficient is combined with the current risk coefficient for re-evaluation, which not only provides a more comprehensive risk assessment perspective, but also provides dynamic decision support for network security management.

[0044] In summary, this application has at least the following effects: This risk assessment and prediction method based on the network security situation awareness system provides a more comprehensive, real-time and dynamic network security management solution by comprehensively analyzing current risks and traffic data, which can effectively identify potential threats and improve early warning capabilities. It solves the problem that the existing network security situation awareness system often relies on a single data source and lacks the integration of multiple data sources, resulting in one-sided assessment results and inconvenience in fully reflecting the network security situation.

[0045] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0046] The present invention is described with reference to flowcharts and / or block diagrams of systems, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0047] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0048] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0049] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0050] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A risk assessment and prediction method based on a network security situation awareness system, characterized in that: The following steps are involved: Acquire a current network potential risk data set, and obtain a current network potential risk assessment value through comprehensive analysis based on the acquired current network potential risk data set; Acquire a current network traffic data set, and obtain a current network traffic evaluation value through comprehensive analysis based on the acquired current network traffic data set; Comprehensively analyze the current network potential risk assessment value and the current network traffic assessment value to obtain the network security risk coefficient and network security risk level; Obtain historical network security risk coefficients, and re-evaluate the network security risk level by combining the historical network security risk coefficients with the network security risk coefficients.

2. The risk assessment and prediction method based on the network security situation awareness system according to claim 1 is characterized in that: Based on the obtained current network potential risk data set, a comprehensive analysis is performed to obtain the current network potential risk assessment value. The specific analysis process is as follows: Obtain the current network potential risk data set; Obtaining a dataset of potential network risks stored in a database; The acquired current network potential risk data set is comprehensively analyzed with the reference network potential risk data set stored in the database to obtain the current network potential risk assessment value.

3. The risk assessment and prediction method based on the network security situation awareness system according to claim 2 is characterized in that: The current network potential risk data set specifically includes a potential threat index, a vulnerability exposure value, and a potential loss value; The network potential risk data set includes a potential threat index, a vulnerability exposure value and a potential loss value; The specific analysis process of obtaining the current network potential risk data set is as follows: Obtain and analyze network traffic, detect suspicious activities and potential malicious behaviors, and obtain potential threat index; By scanning the devices, operating systems and applications in the network, vulnerabilities are identified and vulnerability exposure values ​​are obtained; Obtain security incidents that may affect the business, assess the economic impact of the incidents on the business, and obtain potential loss values.

4. The risk assessment and prediction method based on the network security situation awareness system according to claim 3 is characterized in that: The current network potential risk assessment value is specifically calculated as follows: ； In the formula, is the current network potential risk assessment value, is the potential threat index, The potential threat index for the parameters stored in the database, is the vulnerability exposure value, is the parameterized vulnerability exposure value stored in the database, is the potential loss value, The potential loss value of the parameter stored in the database, is the weight factor of the potential threat index stored in the database, is the weight factor of the vulnerability exposure value stored in the database, A weighting factor for the potential loss values ​​stored in the database.

5. The risk assessment and prediction method based on the network security situation awareness system according to claim 1 is characterized in that: Based on the obtained current network traffic data set, a comprehensive analysis is performed to obtain the current network traffic evaluation value. The specific analysis process is as follows: Get the current network traffic data set; Obtain a set of network traffic data stored in a database; The current network traffic data set obtained is comprehensively analyzed with the reference network traffic data set stored in the database to obtain the current network traffic evaluation value.

6. The risk assessment and prediction method based on the network security situation awareness system according to claim 5 is characterized by: The current network traffic data set specifically includes network traffic rate, number of network connections and proportion of abnormal network traffic packet types; The network traffic data set specifically includes the network traffic rate, the number of network connections, and the proportion of abnormal network traffic packet types.

7. The risk assessment and prediction method based on the network security situation awareness system according to claim 5 is characterized by: The specific analysis process of obtaining the current network traffic data set is as follows: By capturing data packets in the network to perform traffic analysis and obtaining the amount of data transmitted per second during the transmission process, the network traffic rate is calculated; Collect network traffic data and connection status through network traffic monitoring software to obtain the number of network connections; The network monitoring system detects abnormal packets in the network traffic, and counts their types and quantities, so as to calculate the number of network connections and the ratio of abnormal network traffic packet types.

8. The risk assessment and prediction method based on the network security situation awareness system according to claim 1 is characterized by: The specific analysis process of the network security risk level is as follows: Obtain network security risk factor; Obtain the network security risk factor stored in the data; Compare the network security risk factor with the parameterized network security risk factor stored in the database to obtain the network security risk level.

9. The risk assessment and prediction method based on the network security situation awareness system according to claim 8 is characterized by: Compare the network security risk factor with the reference network security risk factor stored in the database to obtain the network security risk level. The specific analysis process is as follows: If the network security risk factor is lower than the reference network security risk factor stored in the database, the network risk level corresponding to the network security risk factor is marked as level one; If the network security risk factor is equal to the reference network security risk factor stored in the database, the network risk level corresponding to the network security risk factor is marked as level 2; If the network security risk coefficient is higher than the reference network security risk coefficient stored in the database, the network risk level corresponding to the network security risk coefficient will be marked as level three.

10. The risk assessment and prediction method based on the network security situation awareness system according to claim 9 is characterized in that: The historical network security risk coefficient is combined with the network security risk coefficient to re-evaluate the network security risk level. The specific analysis process is as follows: Compare the cybersecurity risk factor with the historical cybersecurity risk factors stored in the database; If the network security risk factor is higher than the historical network security risk factor stored in the database, the network risk level corresponding to the network security risk factor is increased by one level; If the network security risk factor is equal to the historical network security risk factor stored in the database, the network risk level corresponding to the network security risk factor remains unchanged; If the network security risk coefficient is lower than the historical network security risk coefficient stored in the database, the network risk level corresponding to the network security risk coefficient will be reduced by one level.

Images