Network security situation awareness prediction method and system, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a network security situation awareness prediction method and system, electronic equipment and a storage medium, and belongs to the field of network security. The method comprises the steps that data related to network security are collected, and the data related to the network security at least comprise network structure data, network service data, vulnerability data and threat and intrusion data; on the basis of the collected data related to the network security, a network security situation map is constructed by using a graph technology, feature data in the data related to the network security is extracted by using a deep neural network, nodes in the network security situation map represent entities in the network, and edges in the network security situation map represent association relationships among the entities; based on the feature data, the deep Q network is adopted to predict the change of the network security situation, real-time perception and accurate prediction of the network security situation can be realized in a high-dimensional state space, defense measures can be taken in time, and the network security protection level is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a prediction method, system, electronic device and storage medium for network security situation awareness. Background Art

[0002] With the rapid development of the Internet, the scale and complexity of networks are constantly increasing, and the methods and means of network attacks are becoming increasingly diverse and complex. Traditional network security defense measures are mainly based on preset rules and feature matching. The core idea of ​​these measures is to build a set of rule systems by analyzing known network attack patterns and malicious behavior characteristics to detect and intercept potential threats in network traffic or system behavior. For example, firewalls are deployed at the network boundary. According to preset security rules, they filter and check data packets entering and leaving the network to prevent the flow of data that does not comply with the rules; intrusion detection systems monitor network traffic or system logs to find behavioral features that match known attack patterns, thereby discovering potential intrusion behaviors; anti-virus software relies on virus feature libraries to scan files in computer systems, identify and remove infected viruses; and content filtering systems match bad information or sensitive data in the network through keywords or content features to filter and block information.

[0003] Traditional network security defense measures mainly rely on preset rules and feature matching, which makes it difficult to deal with new and complex attacks. For example, firewalls and anti-virus software are highly dependent on known attack patterns and virus features, which means that they have limited defense capabilities against new attacks or unknown threats, because these threats may not be included in any existing rule base or feature base, and sometimes false positives and false negatives will occur. In addition, the dynamic and uncertain nature of the network environment makes it particularly important to monitor and predict the network security situation in real time. Summary of the invention

[0004] The purpose of the embodiments of the present invention is to provide a prediction method, system, electronic device and storage medium for network security situation awareness, which are used to fully or at least partially solve the technical problems existing in the above-mentioned prior art that it is difficult to cope with new and complex attacks, sometimes false alarms and missed alarms, and it is impossible to perceive and accurately predict network security in real time.

[0005] In order to achieve the above object, an embodiment of the present invention provides a prediction method for network security situation awareness, comprising: Collecting network security related data, wherein the network security related data at least includes network structure data, network service data, vulnerability data, and threat and intrusion data; Based on the collected network security related data, a network security situation map is constructed using graph technology, and feature data in the network security related data is extracted using a deep neural network, wherein the nodes in the network security situation map represent entities in the network, and the edges represent the association relationship between the entities; Based on the characteristic data, a deep Q network is used to predict changes in network security situation.

[0006] Optionally, a deep neural network is used to extract feature data from network security related data, including: Standardizing the network security-related data to obtain target data, and calculating the covariance matrix of the target data to describe the linear relationship between different features; Performing eigenvalue decomposition on the obtained covariance matrix to obtain eigenvalues ​​and corresponding eigenvectors, wherein the eigenvalues ​​represent the variance along the direction of the eigenvectors, and the eigenvectors are the directions of the principal components; Select the principal components, sort them according to the size of the eigenvalues, select new principal components whose cumulative variance explanation rate reaches the preset threshold, and determine the projection of the target data on the new principal component structure to obtain the characteristic data.

[0007] Optionally, the deep Q network includes an input layer, a fully connected layer, and an output layer. Based on the feature data, the deep Q network is used to predict changes in network security situation, including: Input the status information of the current network environment, network traffic characteristics, characteristic dimensions, characteristic composition, node characteristics and security event characteristics into the input layer to obtain the output result of the input layer, wherein the network traffic characteristics at least include the number of packets per second, the number of bytes per second, and the protocol distribution; the node characteristics at least include the number of connections of the node, the CPU usage rate, and the memory occupancy rate; the security event characteristics at least include the most recent attack events and the number of alarms; The output results of the input layer are fused through the fully connected layer, and the Q value of each action is output through the Q function adopted by the deep Q network, and the changes in the network security situation are predicted based on the Q value.

[0008] Optionally, the Q function used by the deep Q network is as follows: ; In the formula, is the expected value, which represents all possible new states The weighted average of Indicates the status information of the current network environment The reward immediately after taking the action, is the discount factor, Is to perform an action After reaching the new state, is a possible follow-up action.

[0009] Optionally, update the Q function according to the following update rule: ; In the formula, Indicates updated value, represents the learning rate, Indicates the target Value, used to guide the current The update of 𝑠 represents the status information of the current network environment. Is to perform an action After reaching the new state, is a possible follow-up action, is the discount factor, Indicates the status information of the current network environment The reward you get immediately after taking the action.

[0010] On the other hand, the present invention also provides a prediction system for network security situation awareness, comprising: A collection unit, used to collect network security related data, wherein the network security related data at least includes network structure data, network service data, vulnerability data, and threat and intrusion data; An extraction unit is used to construct a network security situation map based on the collected network security related data using graph technology, and extract feature data from the network security related data using a deep neural network, wherein the nodes in the network security situation map represent entities in the network, and the edges represent associations between the entities; The prediction unit is used to predict changes in network security situation based on the feature data using a deep Q network.

[0011] Optionally, the extraction unit is specifically used for: Standardizing the network security-related data to obtain target data, and calculating the covariance matrix of the target data to describe the linear relationship between different features; Performing eigenvalue decomposition on the obtained covariance matrix to obtain eigenvalues ​​and corresponding eigenvectors, wherein the eigenvalues ​​represent the variance along the direction of the eigenvectors, and the eigenvectors are the directions of the principal components; Select the principal components, sort them according to the size of the eigenvalues, select new principal components whose cumulative variance explanation rate reaches the preset threshold, and determine the projection of the target data on the new principal component structure to obtain the characteristic data.

[0012] Optionally, the prediction unit is specifically used for: Input the status information of the current network environment, network traffic characteristics, characteristic dimensions, characteristic composition, node characteristics and security event characteristics into the input layer to obtain the output result of the input layer, wherein the network traffic characteristics at least include the number of packets per second, the number of bytes per second, and the protocol distribution; the node characteristics at least include the number of connections of the node, the CPU usage rate, and the memory occupancy rate; the security event characteristics at least include the most recent attack events and the number of alarms; The output results of the input layer are fused through the fully connected layer, and the Q value of each action is output through the Q function adopted by the deep Q network, and the changes in the network security situation are predicted based on the Q value; Among them, the deep Q network includes an input layer, a fully connected layer, and an output layer.

[0013] On the other hand, the present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned network security situation awareness prediction method when executing the program.

[0014] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the above-mentioned prediction method for network security situation awareness.

[0015] Through the above technical solution, it is possible to achieve real-time perception and accurate prediction of network security situation in high-dimensional state space, take defensive measures in time, and improve the level of network security protection.

[0016] Other features and advantages of the embodiments of the present invention will be described in detail in the subsequent detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings are used to provide a further understanding of the embodiments of the present invention and constitute a part of the specification. Together with the following specific implementations, they are used to explain the embodiments of the present invention, but do not constitute a limitation on the embodiments of the present invention. In the accompanying drawings: Figure 1 It is an implementation flow chart of a prediction method for network security situation awareness provided by an embodiment of the present invention; Figure 2 Schematic diagram of a model structure of a deep Q network provided by an embodiment of the present invention; Figure 3 It is a training schematic diagram of a deep Q network model provided by an embodiment of the present invention; Figure 4 It is a structural diagram of a prediction system for network security situation awareness provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0018] The specific implementation of the embodiment of the present invention is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described here is only used to illustrate and explain the embodiment of the present invention, and is not used to limit the embodiment of the present invention.

[0019] See also Figure 1 As shown, it is an implementation flow chart of a prediction method for network security situation awareness provided by an embodiment of the present invention, including the following execution steps: Step 100: Collect network security related data, wherein the network security related data at least includes network structure data, network service data, vulnerability data, and threat and intrusion data.

[0020] In some implementations, network security-related data is collected, including network structure data, network service data, vulnerability data, threat and intrusion data, etc. These data will serve as the basis for subsequent situational awareness and prediction. The collected data needs to be preprocessed, such as cleaning and normalization, to eliminate outliers and noise and improve data quality.

[0021] Step 101: Based on the collected network security related data, a network security situation map is constructed using graph technology, and feature data in the network security related data is extracted using a deep neural network, wherein the nodes in the network security situation map represent entities in the network, and the edges represent the association relationship between the entities.

[0022] In some implementations, graph technology is used to construct a network security situation map, construct a high-dimensional state space containing multi-dimensional features such as network traffic features, node connection relationships, and security event logs, and use a deep neural network to automatically extract effective features.

[0023] In this graph, nodes can represent various entities in the network, including hosts, devices, services, etc., while edges can represent the relationships between entities, including communication connections, dependencies, etc. The situation diagram can intuitively display the current security status of the network and the relationship between various entities. The specific features are: (1) Network traffic characteristics: number of packets per second (PPS), number of bytes per second (BPS), protocol distribution (TCP, UDP, ICMP, etc.), SYN packet ratio and TCP connection failure rate. (2) Node connection relationship: network topology, node degree, centrality index. Communication frequency and data volume between nodes. (3) Security event log: historical attack event type, occurrence time and frequency. System alarm information and processing records. (4) Feature extraction method: Use principal component analysis (PCA) dimensionality reduction method to reduce feature dimensions and improve computational efficiency.

[0024] Specifically, when executing step 101, the following steps may be specifically performed: S1010: Standardize the network security-related data to obtain target data, and calculate the covariance matrix of the target data to describe the linear relationship between different features.

[0025] S1011: Perform eigenvalue decomposition on the obtained covariance matrix to obtain eigenvalues ​​and corresponding eigenvectors, wherein the eigenvalues ​​represent the variance along the direction of the eigenvector, and the eigenvector is the direction of the principal component.

[0026] S1012: Select principal components, sort them according to the size of the eigenvalues, select new principal components whose cumulative variance explanation rate reaches a preset threshold, and determine the projection of the target data on the new principal component structure to obtain characteristic data.

[0027] In some embodiments, the feature extraction method uses the principal component analysis (PCA) dimensionality reduction method to reduce feature dimensions and improve computational efficiency. The process is as follows: Step 1: Data standardization. In PCA, the scale difference of features will affect the extraction of principal components. Therefore, before performing PCA, the data needs to be standardized. Each feature is subtracted from its mean and divided by the standard deviation:

[0028] The data after this processing are centered around zero and have the same scale.

[0029] Step 2: Calculate the covariance matrix, which is used to describe the linear relationship between different features. The goal of PCA is to find the direction with the largest variation in the data, so it is necessary to calculate the covariance matrix between the features:

[0030] in, is a standardized data matrix (each row represents a sample and each column represents a feature), is the calculated covariance matrix.

[0031] Step 3: Eigenvalue decomposition, covariance matrix Perform eigenvalue decomposition and obtain the eigenvalue ( ) and the corresponding eigenvector ( ):

[0032] The eigenvalue represents the variance along the direction of the eigenvector, and the eigenvector is the direction of the principal component.

[0033] Step 4: Select the principal components, sort them by eigenvalue, and select the first few principal components that explain the most data variance. The selection criterion is the cumulative variance explanation rate, that is, select the first few principal components that make the cumulative variance explanation rate reach a certain threshold (such as 95% or 99%):

[0034] in is the number of principal components chosen, is the number of original features.

[0035] Step 5: Project the original data into a new low-dimensional space to obtain the reduced-dimensional data:

[0036] in, It is a representation of data after dimensionality reduction, with fewer dimensions and retaining most of the information.

[0037] The dimensionality reduction process of PCA is equivalent to finding the projection of the data matrix 𝑋 on the new principal components. The new principal components are composed of the eigenvectors of the covariance matrix. Therefore, PCA can be regarded as a coordinate transformation from the original coordinate system to the new coordinate system composed of the principal components.

[0038] Step 102: Based on the feature data, a deep Q network is used to predict changes in network security situation.

[0039] Specifically, the deep Q network includes an input layer, a fully connected layer, and an output layer. When executing step 102, the following steps may be specifically performed: S1020: Input the status information of the current network environment, network traffic characteristics, feature dimensions, feature composition, node characteristics and security event characteristics into the input layer to obtain the output result of the input layer, wherein the network traffic characteristics at least include the number of packets per second, the number of bytes per second, and the protocol distribution; the node characteristics at least include the number of connections of the node, the CPU usage rate, and the memory occupancy rate; the security event characteristics at least include the most recent attack events and the number of alarms.

[0040] S1021: The output results of the input layer are fused through the fully connected layer, and the Q value of each action is output through the Q function adopted by the deep Q network, and the changes in the network security situation are predicted based on the Q value.

[0041] In some implementations, the Q learning algorithm is responsible for predicting the future security situation based on the current security situation and possible actions. The Bellman equation is used as the Q learning algorithm. The model structure of the deep Q network (DQN) can be found in Figure 2 As shown, the model is used to approximate the action-value function:

[0042] in is represented as Under parameters , Indicates the status, Indicates action, is the model parameter.

[0043] The Deep Q Network (DQN) is an extended version of the Q learning algorithm, which is used to solve reinforcement learning problems in high-dimensional, continuous state spaces. It introduces deep neural networks into Q learning to approximate the Q value function.

[0044] (1) Input layer: The input content is the feature vector of the receiving state 𝑠, which represents the state information of the current network environment. Feature dimension: The dimension of the input vector is 𝑛, which is the number of state features. Feature composition: Network traffic features include the number of packets per second, the number of bytes per second, and the protocol distribution. Node features include the number of node connections, CPU usage, and memory usage. Security event features include the most recent attack events and the number of alarms.

[0045] (2) Fully connected layer, the number of neurons is configured to be 64, and the activation function uses ReLU (Rectified Linear Unit), which is defined as follows: ; When input When ;when When .

[0046] Choose ReLU, which is simple to calculate and has a small amount of calculation, which speeds up the training process; alleviates the gradient vanishing problem. In deep networks, ReLU helps alleviate the gradient vanishing problem and improves the training efficiency of the model; sparse activation, the output of ReLU is sparse, which helps to improve the generalization ability of the model.

[0047] (3) Output Q value. Output the Q value of each action, that is , the output dimension is |A|, which is the size of the action set. For example, the action set 𝐴: : Maintain the current state and take no action.

[0048] : Adjust firewall rules.

[0049] : Isolate suspicious nodes.

[0050] : A security alert is issued.

[0051] 4) Execution step: In order to train and optimize the deep Q network model, the feature data extracted in step 2) is used, that is, the training set of historical network security situation data. By performing multiple iterations of training on this training set, the prediction accuracy of the model can be gradually improved. The training process can be seen in Figure 3 As shown in Figure 2, experience replay and target network can also be used during the training process to accelerate training and improve model performance. The values ​​are stored in a buffer, from which small batches of data are randomly sampled during training. The Bellman equation is used as the Q learning algorithm here, and the prediction performance of the model is optimized by continuous trial and error and adjustment of strategies during the training process. The Bellman equation learns an action value function, namely the Q function, which represents the expected cumulative reward (including the discounted sum of current rewards and future rewards) of taking action a in state s.

[0052] Specifically, the Q function used by the deep Q network is as follows: ; In the formula, is the expected value, which represents all possible new states The weighted average of Indicates the status information of the current network environment The reward immediately after taking the action, is the discount factor, Is to perform an action After reaching the new state, is a possible follow-up action.

[0053] In some embodiments, the Q function is updated according to the following update rule: ; In the formula, Indicates updated value, represents the learning rate, Indicates the target Value, used to guide the current The update of 𝑠 represents the status information of the current network environment. Is to perform an action After reaching the new state, is a possible follow-up action, is the discount factor, Indicates the status information of the current network environment The reward you get immediately after taking the action.

[0054] The execution process is as follows: DQN first introduces the data collected in the environment, and then calculates the target Q value. For each extracted experience sample, DQN uses two networks to calculate the target Q value: one is the current Q network, which is used to evaluate the value of the current strategy, and the other is the target Q network, whose weights are regularly copied from the current Q network to stabilize the learning process. The target Q value is calculated according to the Bellman equation above, which represents the maximum expected return obtained by taking the optimal action in the current state.

[0055] 5) Feedback step: After training is completed, the trained deep Q network model can be used to predict the future network security situation. Specifically, the current network security situation map is input as the input of the model, and then the model will output a predicted value or a series of possible future security situations and their probabilities. These prediction results can be displayed to users through a visual interface to help users understand the security status of the network in a timely manner and take corresponding protective measures.

[0056] See also Figure 4 As shown, it is a structural schematic diagram of a prediction system for network security situation awareness provided by an embodiment of the present invention, including: A collection unit 40 is used to collect network security related data, wherein the network security related data at least includes network structure data, network service data, vulnerability data, and threat and intrusion data; An extraction unit 41 is used to construct a network security situation map based on the collected network security related data using graph technology, and extract feature data from the network security related data using a deep neural network, wherein the nodes in the network security situation map represent entities in the network, and the edges represent the association relationship between the entities; The prediction unit 42 is used to predict changes in network security situation using a deep Q network based on the feature data.

[0057] In some implementations, the extraction unit 41 is specifically used to: Standardizing the network security-related data to obtain target data, and calculating the covariance matrix of the target data to describe the linear relationship between different features; Performing eigenvalue decomposition on the obtained covariance matrix to obtain eigenvalues ​​and corresponding eigenvectors, wherein the eigenvalues ​​represent the variance along the direction of the eigenvectors, and the eigenvectors are the directions of the principal components; Select the principal components, sort them according to the size of the eigenvalues, select new principal components whose cumulative variance explanation rate reaches the preset threshold, and determine the projection of the target data on the new principal component structure to obtain the characteristic data.

[0058] In some implementations, the prediction unit 42 is specifically configured to: Input the status information of the current network environment, network traffic characteristics, characteristic dimensions, characteristic composition, node characteristics and security event characteristics into the input layer to obtain the output result of the input layer, wherein the network traffic characteristics at least include the number of packets per second, the number of bytes per second, and the protocol distribution; the node characteristics at least include the number of connections of the node, the CPU usage rate, and the memory occupancy rate; the security event characteristics at least include the most recent attack events and the number of alarms; The output results of the input layer are fused through the fully connected layer, and the Q value of each action is output through the Q function adopted by the deep Q network, and the changes in the network security situation are predicted based on the Q value; Among them, the deep Q network includes an input layer, a fully connected layer, and an output layer.

[0059] The prediction system for network security situation awareness includes a processor and a memory. The above-mentioned acquisition unit, extraction unit, prediction unit, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0060] The processor contains a kernel, which calls the corresponding program unit from the memory. The kernel can be set to one or more, and the kernel parameters can be adjusted to adapt to new attack modes and changes in the network environment. Make defense decisions in real time in a dynamic environment, respond to network threats in a timely manner, reduce reliance on human intervention, and improve defense efficiency and accuracy.

[0061] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0062] An embodiment of the present invention provides a storage medium on which a program is stored. When the program is executed by a processor, the prediction method of network security situation awareness is implemented.

[0063] An embodiment of the present invention provides a processor, which is used to run a program, wherein the prediction method of network security situation awareness is executed when the program is running.

[0064] The embodiment of the present invention provides a device, the device includes a processor, a memory and a program stored in the memory and can be run on the processor, and the processor implements the following steps when executing the program: collecting network security related data, wherein the network security related data at least includes network structure data, network service data, vulnerability data and threat and intrusion data; based on the collected network security related data, using graph technology to build a network security situation map, and using a deep neural network to extract feature data from the network security related data, wherein the nodes in the network security situation map represent various entities in the network, and the edges represent the association relationship between various entities; based on the feature data, using a deep Q network to predict changes in network security situation. The device in this article can be a server, PC, PAD, mobile phone, etc.

[0065] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program that initializes the following method steps: collecting network security related data, wherein the network security related data at least includes network structure data, network service data, vulnerability data, and threat and intrusion data; based on the collected network security related data, using graph technology to construct a network security situation map, and using a deep neural network to extract feature data from the network security related data, wherein the nodes in the network security situation map represent various entities in the network, and the edges represent the association relationship between various entities; based on the feature data, using a deep Q network to predict changes in the network security situation.

[0066] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0067] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0068] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0069] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0070] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0071] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0072] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0073] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0074] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A prediction method for network security situation awareness, characterized in that: include: Collecting network security related data, wherein the network security related data at least includes network structure data, network service data, vulnerability data, and threat and intrusion data; Based on the collected network security related data, a network security situation map is constructed using graph technology, and feature data in the network security related data is extracted using a deep neural network, wherein the nodes in the network security situation map represent entities in the network, and the edges represent the association relationship between the entities; Based on the characteristic data, a deep Q network is used to predict changes in network security situation.

2. The prediction method for network security situation awareness according to claim 1 is characterized in that: Use deep neural networks to extract feature data from network security related data, including: Standardizing the network security-related data to obtain target data, and calculating the covariance matrix of the target data to describe the linear relationship between different features; Performing eigenvalue decomposition on the obtained covariance matrix to obtain eigenvalues ​​and corresponding eigenvectors, wherein the eigenvalues ​​represent the variance along the direction of the eigenvectors, and the eigenvectors are the directions of the principal components; Select the principal components, sort them according to the size of the eigenvalues, select new principal components whose cumulative variance explanation rate reaches the preset threshold, and determine the projection of the target data on the new principal component structure to obtain the characteristic data.

3. The prediction method for network security situation awareness according to claim 1 is characterized in that: The deep Q network includes an input layer, a fully connected layer, and an output layer. Based on the feature data, the deep Q network is used to predict changes in network security situation, including: Input the status information of the current network environment, network traffic characteristics, characteristic dimensions, characteristic composition, node characteristics and security event characteristics into the input layer to obtain the output result of the input layer, wherein the network traffic characteristics at least include the number of packets per second, the number of bytes per second, and the protocol distribution; the node characteristics at least include the number of connections of the node, the CPU usage rate, and the memory occupancy rate; the security event characteristics at least include the most recent attack events and the number of alarms; The output results of the input layer are fused through the fully connected layer, and the Q value of each action is output through the Q function adopted by the deep Q network, and the changes in the network security situation are predicted based on the Q value.

4. The prediction method for network security situation awareness according to claim 3 is characterized in that: The Q function used by the deep Q network is as follows: ； In the formula, is the expected value, which represents all possible new states The weighted average of Indicates the status information of the current network environment The reward immediately after taking the action, is the discount factor, Is to perform an action After reaching the new state, is a possible follow-up action.

5. The prediction method for network security situation awareness according to claim 4 is characterized in that: Update the Q function according to the following update rule: ； In the formula, Indicates updated value, represents the learning rate, Indicates the target Value, used to guide the current The update of 𝑠 represents the status information of the current network environment. Is to perform an action After reaching the new state, is a possible follow-up action, is the discount factor, Indicates the status information of the current network environment The reward you get immediately after taking the action.

6. A prediction system for network security situation awareness, characterized in that: include: A collection unit, used to collect network security related data, wherein the network security related data at least includes network structure data, network service data, vulnerability data, and threat and intrusion data; An extraction unit is used to construct a network security situation map based on the collected network security related data using graph technology, and extract feature data from the network security related data using a deep neural network, wherein the nodes in the network security situation map represent entities in the network, and the edges represent associations between the entities; The prediction unit is used to predict changes in network security situation based on the feature data using a deep Q network.

7. The prediction system for network security situation awareness according to claim 6 is characterized in that: The extraction unit is specifically used for: Standardizing the network security-related data to obtain target data, and calculating the covariance matrix of the target data to describe the linear relationship between different features; Performing eigenvalue decomposition on the obtained covariance matrix to obtain eigenvalues ​​and corresponding eigenvectors, wherein the eigenvalues ​​represent the variance along the direction of the eigenvectors, and the eigenvectors are the directions of the principal components; Select the principal components, sort them according to the size of the eigenvalues, select new principal components whose cumulative variance explanation rate reaches the preset threshold, and determine the projection of the target data on the new principal component structure to obtain the characteristic data.

8. The prediction system for network security situation awareness according to claim 6, characterized in that: The prediction unit is specifically used for: Input the status information of the current network environment, network traffic characteristics, characteristic dimensions, characteristic composition, node characteristics and security event characteristics into the input layer to obtain the output result of the input layer, wherein the network traffic characteristics at least include the number of packets per second, the number of bytes per second, and the protocol distribution; the node characteristics at least include the number of connections of the node, the CPU usage rate, and the memory occupancy rate; the security event characteristics at least include the most recent attack events and the number of alarms; The output results of the input layer are fused through the fully connected layer, and the Q value of each action is output through the Q function adopted by the deep Q network, and the changes in the network security situation are predicted based on the Q value; Among them, the deep Q network includes an input layer, a fully connected layer, and an output layer.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the prediction method for network security situation awareness as described in any one of claims 1-5 are implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the prediction method for network security situation awareness as described in any one of claims 1 to 5 are implemented.

Images