A network security situation awareness method and system

Abstract

The present invention is applicable to the field of network security technology, and provides a network security situation awareness method and system, including the following steps: monitoring file data reading information, computer resource occupancy and time information; monitoring total flow data and software operation status, the software operation status includes each running software name and corresponding sub-flow data and resource occupancy data; determining abnormal flow data according to the software operation status and total flow data, and performing risk analysis on the abnormal flow data; performing risk analysis on file leakage according to the software operation status and file data reading information; retrieving historical user behavior data, and performing risk analysis on abnormal resource occupancy according to time information, historical user behavior data, software operation status and computer resource occupancy. The present invention can timely discover potential security threats and enhance the ability to prevent security risks by performing risk analysis on abnormal flow data, file leakage and abnormal resource occupancy.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security situation awareness method and system. Background Art

[0002] With the rapid development of information technology and the widespread popularity of the Internet, network security issues have increasingly become an important factor affecting the security of individuals and enterprises. In the current digital age, a large amount of sensitive data and key information are transmitted and processed through the network, and network attack methods are constantly evolving and upgrading, bringing unprecedented challenges to network security. In the traditional network security protection system, single or combined security measures such as firewalls, intrusion detection systems (IDS) and antivirus software are usually used to resist external threats. However, these traditional methods often focus on the defense of known threats, and have limited ability to prevent unknown threats and internal threats. In addition, with the widespread application of emerging technologies such as cloud computing, big data and the Internet of Things, the complexity and dynamics of the network environment have increased significantly, and traditional static security strategies can no longer meet current security needs. In practical applications, network security incidents are often accompanied by abnormal network traffic, resource occupation and file operations. However, due to the complexity of the network environment and the diversity of user behaviors, these abnormal behaviors are often difficult to be discovered in time. Therefore, it is necessary to provide a network security situation awareness method and system to solve the above problems. Summary of the invention

[0003] In view of the deficiencies in the prior art, the purpose of the present invention is to provide a network security situation awareness method and system to solve the problems existing in the above-mentioned background technology.

[0004] The present invention is implemented as follows: a network security situation awareness method, the method comprising the following steps:

[0005] Monitor file data reading information, computer resource usage and time information, wherein the file data reading information includes the reading and editing status of each file;

[0006] Monitor total traffic data and software operation status, wherein the software operation status includes the name of each running software and the corresponding sub-traffic data and resource usage data;

[0007] Determine abnormal traffic data based on software operation status and total traffic data, and conduct risk analysis on abnormal traffic data;

[0008] Conduct risk analysis on file leakage based on software operation status and file data reading information;

[0009] Retrieve historical user behavior data and conduct risk analysis on abnormal resource usage based on time information, historical user behavior data, software operation status, and computer resource usage.

[0010] As a further solution of the present invention: the step of determining abnormal traffic data according to the software operation status and the total traffic data and performing risk analysis on the abnormal traffic data specifically includes:

[0011] Calculate the sum of all sub-flow data, and compare the sum of sub-flow data with the total flow data to determine abnormal flow data;

[0012] Determine the source information of abnormal traffic data through NetFlow traffic tracking technology, and determine the source risk level based on the source information;

[0013] Abnormal traffic risk assessment information is obtained based on the abnormal traffic size, duration and source risk level.

[0014] As a further solution of the present invention: the step of performing risk analysis on file leakage according to the software operation status and file data reading information specifically includes:

[0015] Determine the permission information and file reading function corresponding to each software according to the name of the running software;

[0016] Determine the file type, read permission and edit permission of each file based on the file data read information;

[0017] The file type, read permission, and edit permission of each file are matched with the permission information and file reading function of the running software to obtain file leakage risk assessment information.

[0018] As a further solution of the present invention: the step of matching the file type, read permission and edit permission of each file with the permission information and file read function of the running software to obtain the file leakage risk assessment information specifically includes:

[0019] Determine the risk factor of each file based on its file type, read permissions, and edit permissions;

[0020] Determine the name of the running software corresponding to each file being read and edited in turn, match the read permission and edit permission with the corresponding permission information to determine whether the permissions are in compliance; match the file type with the corresponding file reading function to determine whether the function is in compliance;

[0021] The file leakage risk is obtained based on the risk coefficient of each file, whether the permission is met, and whether the function is met. All file leakage risks are summarized to obtain file leakage risk assessment information.

[0022] As a further solution of the present invention: the step of performing risk analysis on abnormal resource usage based on time information, historical user behavior data, software operation status and computer resource usage status specifically includes:

[0023] Determine the mean and standard deviation of historical resource usage of each running software based on time information, historical user behavior data, and software running status;

[0024] Compare the historical resource usage mean and standard deviation of each running software with the corresponding resource usage data to determine the software abnormal usage risk;

[0025] Calculate the sum of all resource usage data, and compare the sum of resource usage data with the computer resource usage to determine other abnormal usage risks;

[0026] Abnormal resource occupation assessment information is obtained based on software abnormal occupation risk and other abnormal occupation risks.

[0027] As a further solution of the present invention: the step of comparing the historical resource occupancy mean and standard deviation of each running software with the corresponding resource occupancy data to determine the software abnormal occupancy risk specifically includes:

[0028] Calculate the risk base of each running software i on resource dimension j , , R represents resource usage data, μ represents the historical resource usage mean, σ represents the standard deviation, and the resource dimensions include CPU, GPU, and memory;

[0029] Determine the total risk base of each running software based on various resource dimensions, and determine the software abnormal occupancy risk based on all total risk bases.

[0030] Another object of the present invention is to provide a network security situation awareness system, the system comprising:

[0031] Related information monitoring module, used to monitor file data reading information, computer resource usage and time information, the file data reading information includes the reading and editing status of each file;

[0032] The software operation monitoring module is used to monitor the total flow data and software operation status, wherein the software operation status includes the name of each running software and the corresponding sub-flow data and resource usage data;

[0033] The abnormal traffic risk module is used to determine abnormal traffic data based on the software operation status and total traffic data, and conduct risk analysis on the abnormal traffic data;

[0034] File leakage risk module, used to analyze the risk of file leakage based on software operation status and file data reading information;

[0035] The resource occupation risk module is used to retrieve historical user behavior data and conduct risk analysis on abnormal resource occupation based on time information, historical user behavior data, software operation status and computer resource occupation status.

[0036] As a further solution of the present invention: the abnormal traffic risk module includes:

[0037] An abnormal flow data unit is used to calculate the sum of all sub-flow data, and compare the sum of the sub-flow data with the total flow data to determine the abnormal flow data;

[0038] A source risk level unit is used to determine the source information of abnormal traffic data through NetFlow traffic tracking technology, and determine the source risk level according to the source information;

[0039] The traffic risk assessment unit is used to obtain abnormal traffic risk assessment information according to the abnormal traffic size, duration and source risk level.

[0040] As a further solution of the present invention: the file leakage risk module includes:

[0041] The permission reading function unit is used to determine the permission information and file reading function corresponding to each software according to the name of the running software;

[0042] A type and permission determination unit, used to determine the file type, read permission and edit permission of each file according to the file data read information;

[0043] The file risk assessment unit is used to match the file type, read permission and edit permission of each file with the permission information and file reading function of the running software to obtain file leakage risk assessment information.

[0044] As a further solution of the present invention: the resource occupation risk module includes:

[0045] A historical resource occupancy unit is used to determine the mean and standard deviation of historical resource occupancy of each running software according to time information, historical user behavior data and software running status;

[0046] The software abnormal occupancy unit is used to compare the historical resource occupancy mean and standard deviation of each running software with the corresponding resource occupancy data to determine the software abnormal occupancy risk;

[0047] Other abnormal occupancy units are used to calculate the sum of all resource occupancy data, and compare the sum of resource occupancy data with the computer resource occupancy status to determine other abnormal occupancy risks;

[0048] The resource occupancy assessment unit is used to obtain abnormal resource occupancy assessment information according to software abnormal occupancy risks and other abnormal occupancy risks.

[0049] Compared with the prior art, the present invention has the following beneficial effects:

[0050] The present invention can collect and analyze key information in the network more comprehensively by monitoring file data reading information, computer resource occupancy and time information, as well as total flow data and software operation status, thereby improving the accuracy of abnormal detection. And by conducting risk analysis on abnormal flow data, file leakage and abnormal resource occupancy, potential security threats, including unknown threats and internal threats, can be discovered in a timely manner, thereby enhancing the ability to prevent security risks. By real-time monitoring of key information in the network and conducting comprehensive analysis in combination with historical user behavior data, the security situation in the network can be perceived in real time, providing strong support for timely response measures. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 The present invention is a flow chart of a network security situation awareness method.

[0052] Figure 2 The present invention is a flowchart for risk analysis of abnormal traffic data in a network security situation awareness method.

[0053] Figure 3 The present invention is a flowchart of risk analysis of file leakage in a network security situation awareness method.

[0054] Figure 4 The present invention is a flow chart for obtaining file leakage risk assessment information in a network security situation awareness method.

[0055] Figure 5 The present invention is a flowchart for risk analysis of abnormal resource usage in a network security situation awareness method.

[0056] Figure 6 The present invention is a flowchart for determining the risk of abnormal software occupancy in a network security situation awareness method.

[0057] Figure 7 This is a structural diagram of a network security situation awareness system. DETAILED DESCRIPTION

[0058] In order to make the purpose, technical solution and advantages of the present invention clearer, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0059] The specific implementation of the present invention is described in detail below in conjunction with specific embodiments.

[0060] like Figure 1 As shown, an embodiment of the present invention provides a network security situation awareness method, the method comprising the following steps:

[0061] S100, monitoring file data reading information, computer resource usage and time information, wherein the file data reading information includes the reading and editing status of each file;

[0062] S200, monitoring total traffic data and software running status, wherein the software running status includes the name of each running software and the corresponding sub-traffic data and resource usage data;

[0063] S300, determining abnormal traffic data according to the software operation status and the total traffic data, and performing risk analysis on the abnormal traffic data;

[0064] S400, performing risk analysis on file leakage based on software operation status and file data reading information;

[0065] S500, retrieve historical user behavior data, and perform risk analysis on abnormal resource usage based on time information, historical user behavior data, software operation status, and computer resource usage status.

[0066] In the embodiment of the present invention, the file data reading information, computer resource occupancy and corresponding time information are first monitored. The file data reading information includes the reading and editing of each file. Here, third-party monitoring software can be used to record the opening, editing, deletion, and sending of files. The computer resource occupancy specifically includes the occupancy of CPU, GPU and memory. Then the total flow data and software operation of the computer are monitored. The software operation includes the name of each running software and the corresponding sub-flow data and resource occupancy data. Next, the embodiment of the present invention determines the abnormal flow data according to the software operation and the total flow data, and performs risk analysis on the abnormal flow data, so as to timely discover and identify potential network threats; and performs risk analysis on file leakage according to the software operation and file data reading information. In addition, historical user behavior data is retrieved, and abnormal resource occupancy is analyzed according to time information, historical user behavior data, software operation and computer resource occupancy. In this way, potential security threats are discovered through three dimensions, including unknown threats and internal threats, thereby enhancing the ability to prevent security risks.

[0067] like Figure 2 As shown, as a preferred embodiment of the present invention, the step of determining abnormal traffic data according to the software operation status and the total traffic data and performing risk analysis on the abnormal traffic data specifically includes:

[0068] S301, calculating the sum of all sub-flow data, and comparing the sum of the sub-flow data with the total flow data to determine abnormal flow data;

[0069] S302, determining source information of abnormal traffic data by using NetFlow traffic tracking technology, and determining a source risk level according to the source information;

[0070] S303, obtaining abnormal traffic risk assessment information according to the abnormal traffic size, duration and source risk level.

[0071] In the embodiment of the present invention, in order to determine the risk caused by unknown traffic data, the sum of all sub-traffic data is calculated, and the sum of the sub-traffic data is compared with the total traffic data. The part exceeding the total traffic data is the abnormal traffic data, and then the source information of the abnormal traffic data is determined by NetFlow traffic tracking technology. The source information includes the source IP address, the destination IP address and the port number, and the IP geolocation service (such as IPinfo, MaxMind GeoIP) is used to determine the geographical location of the source. According to the geographical location of the source, known security threat intelligence (such as threat intelligence database) and the security policy of the organization, the risk level of the source is evaluated, and the risk level is divided into low, medium, high or emergency level, and then the abnormal traffic risk assessment information is obtained according to the abnormal traffic size, duration and source risk level. The embodiment of the present invention needs to establish a risk assessment model in advance, take the abnormal traffic size, duration and source risk level as input variables, and output the risk assessment information of the abnormal traffic. The risk assessment model can be constructed using machine learning algorithms such as linear regression, logistic regression, and random forest.

[0072] like Figure 3 As shown, as a preferred embodiment of the present invention, the step of performing risk analysis on file leakage according to software operation status and file data reading information specifically includes:

[0073] S401, determining the permission information and file reading function corresponding to each software according to the name of the running software;

[0074] S402, determining the file type, read permission and edit permission of each file according to the file data read information;

[0075] S403, matching the file type, read permission and edit permission of each file with the permission information of the running software and the file reading function to obtain file leakage risk assessment information.

[0076] In an embodiment of the present invention, in order to assess the risk of file leakage, first, the permission information and file reading function corresponding to each software are determined according to the name of the running software, which requires user customization, and then the file type, read permission and edit permission of each file are determined according to the file data reading information. The read permission and edit permission of each file also require user customization. If not defined, the default permission is used, and then the file type, read permission and edit permission of each file are matched with the permission information and file reading function of the running software, and the file leakage risk assessment information is obtained according to the matching of type and function and the matching of permission.

[0077] like Figure 4 As shown, as a preferred embodiment of the present invention, the step of matching the file type, read permission and edit permission of each file with the permission information and file read function of the running software to obtain the file leakage risk assessment information specifically includes:

[0078] S4031, determining the risk factor of each file based on the file type, read permission, and edit permission of the file;

[0079] S4032, sequentially determine the name of the running software corresponding to each file to be read and edited, match the read permission and edit permission with the corresponding permission information to determine whether the permissions are in compliance; match the file type with the corresponding file reading function to determine whether the function is in compliance;

[0080] S4033, obtaining the file leakage risk according to the risk coefficient of each file, whether the permission is in compliance, and whether the function is in compliance, and summarizing all the file leakage risks to obtain the file leakage risk assessment information.

[0081] In the embodiment of the present invention, the risk factor of each file is determined according to the file type, read permission and edit permission of the file. The more sensitive the file type, the higher the read permission and edit permission, and the higher the corresponding risk factor. Then, the name of the running software corresponding to each file being read and edited is determined in turn, and the read permission and edit permission are matched with the corresponding permission information to determine whether the permission is in compliance. For example, reading or editing beyond the permission is not in compliance; the file type is matched with the corresponding file reading function to determine whether the function is in compliance. For example, the opening of the source code of the image viewing software is a function that is not in compliance. The image viewing software is likely to carry malicious plug-ins. In this way, the file leakage risk can be obtained according to the risk factor of each file, whether the permission is in compliance, and whether the function is in compliance. All file leakage risks are summarized to obtain file leakage risk assessment information, which is detailed and comprehensive.

[0082] like Figure 5As shown, as a preferred embodiment of the present invention, the step of performing risk analysis on abnormal resource usage according to time information, historical user behavior data, software operation status and computer resource usage specifically includes:

[0083] S501, determining the mean and standard deviation of historical resource usage of each running software according to time information, historical user behavior data and software running status;

[0084] S502, comparing the historical resource occupancy mean and standard deviation of each running software with the corresponding resource occupancy data to determine the software abnormal occupancy risk;

[0085] S503, calculating the sum of all resource occupancy data, and comparing the sum of resource occupancy data with the computer resource occupancy status to determine other abnormal occupancy risks;

[0086] S504, obtaining abnormal resource occupation assessment information according to the software abnormal occupation risk and other abnormal occupation risks.

[0087] In the embodiment of the present invention, the resource occupancy data of each running software in the past period of time (such as one month, one quarter, etc.), including memory, CPU, GPU, etc., will be automatically collected from the log system or resource monitoring tool, and the historical user behavior data will be obtained in combination with the time data. Then, the historical resource occupancy mean and standard deviation of each running software will be determined based on the time information and the historical user behavior data, and then the historical resource occupancy mean and standard deviation of each running software will be compared with the corresponding resource occupancy data to determine the software abnormal occupancy risk, so as to detect the risk of software runtime. In addition, the sum of the resource occupancy data of all software will be calculated, and the sum of the resource occupancy data will be compared with the computer resource occupancy to know the resource occupancy of unknown processes and malicious software, and then determine other abnormal occupancy risks. Other abnormal occupancy risk situations are obtained according to the size of other abnormal occupied resources. Finally, the software abnormal occupancy risk and other abnormal occupancy risks are summarized to obtain abnormal resource occupancy assessment information.

[0088] like Figure 6 As shown, as a preferred embodiment of the present invention, the step of comparing the historical resource occupancy mean and standard deviation of each running software with the corresponding resource occupancy data to determine the software abnormal occupancy risk specifically includes:

[0089] S5021, calculate the risk base of each running software i on resource dimension j , , R represents resource usage data, μ represents the historical resource usage mean, σ represents the standard deviation, and the resource dimensions include CPU, GPU, and memory;

[0090] S5022, determine the total risk base of each running software according to each resource dimension, and determine the software abnormal occupancy risk according to all the total risk bases.

[0091] In the embodiment of the present invention, in order to determine the risk of abnormal software occupation, the risk base of each running software i on resource dimension j is calculated. , , Indicates the occupancy data of resource dimension j by running software i, represents the historical average resource usage of resource dimension j by running software i, represents the standard deviation of the historical resource usage of resource dimension j by running software i. When it is less than 0, Directly take 0. The resource dimensions in the embodiment of the present invention include CPU, GPU and memory. Then, the total risk base of each running software is determined according to each resource dimension. The total risk base is calculated by The software abnormality occupancy risk is finally determined based on the total risk base.

[0092] like Figure 7 As shown, an embodiment of the present invention further provides a network security situation awareness system, the system comprising:

[0093] Related information monitoring module 100, used to monitor file data reading information, computer resource usage and time information, wherein the file data reading information includes the reading and editing status of each file;

[0094] The software operation monitoring module 200 is used to monitor the total flow data and the software operation status, wherein the software operation status includes the name of each running software and the corresponding sub-flow data and resource occupancy data;

[0095] The abnormal traffic risk module 300 is used to determine the abnormal traffic data according to the software operation status and the total traffic data, and perform risk analysis on the abnormal traffic data;

[0096] The file leakage risk module 400 is used to perform risk analysis on file leakage according to the software operation status and file data reading information;

[0097] The resource occupation risk module 500 is used to retrieve historical user behavior data and perform risk analysis on abnormal resource occupation according to time information, historical user behavior data, software operation status and computer resource occupation status.

[0098] As a preferred embodiment of the present invention, the abnormal traffic risk module 300 includes:

[0099] An abnormal flow data unit is used to calculate the sum of all sub-flow data, and compare the sum of the sub-flow data with the total flow data to determine the abnormal flow data;

[0100] A source risk level unit is used to determine the source information of abnormal traffic data through NetFlow traffic tracking technology, and determine the source risk level according to the source information;

[0101] The traffic risk assessment unit is used to obtain abnormal traffic risk assessment information according to the abnormal traffic size, duration and source risk level.

[0102] As a preferred embodiment of the present invention, the file leakage risk module 400 includes:

[0103] The permission reading function unit is used to determine the permission information and file reading function corresponding to each software according to the name of the running software;

[0104] A type and permission determination unit, used to determine the file type, read permission and edit permission of each file according to the file data read information;

[0105] The file risk assessment unit is used to match the file type, read permission and edit permission of each file with the permission information and file reading function of the running software to obtain file leakage risk assessment information.

[0106] As a preferred embodiment of the present invention, the resource occupation risk module 500 includes:

[0107] A historical resource occupancy unit is used to determine the mean and standard deviation of historical resource occupancy of each running software according to time information, historical user behavior data and software running status;

[0108] The software abnormal occupancy unit is used to compare the historical resource occupancy mean and standard deviation of each running software with the corresponding resource occupancy data to determine the software abnormal occupancy risk;

[0109] Other abnormal occupancy units are used to calculate the sum of all resource occupancy data, and compare the sum of resource occupancy data with the computer resource occupancy status to determine other abnormal occupancy risks;

[0110] The resource occupancy assessment unit is used to obtain abnormal resource occupancy assessment information according to software abnormal occupancy risks and other abnormal occupancy risks.

[0111] The above only describes in detail the preferred embodiments of the present invention, which is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

[0112] It should be understood that, although each step in the flow chart of each embodiment of the present invention is shown in sequence according to the indication of the arrow, these steps are not necessarily performed in sequence according to the order indicated by the arrow. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be performed in other orders. Moreover, at least a portion of the steps in each embodiment may include a plurality of sub-steps or a plurality of stages, and these sub-steps or stages are not necessarily performed at the same time, but can be performed at different times, and the execution order of these sub-steps or stages is not necessarily performed in sequence, but can be performed in turn or alternately with at least a portion of other steps or sub-steps or stages of other steps.

[0113] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a non-volatile computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0114] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the disclosure in the specification and examples. This application is intended to cover any variations, uses or adaptations of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the claims.

Claims

1. A network security situation awareness method, characterized in that: The method comprises the following steps: Monitor file data reading information, computer resource usage and time information, wherein the file data reading information includes the reading and editing status of each file; Monitor total traffic data and software operation status, wherein the software operation status includes the name of each running software and the corresponding sub-traffic data and resource usage data; Determine abnormal traffic data based on software operation status and total traffic data, and conduct risk analysis on abnormal traffic data; Conduct risk analysis on file leakage based on software operation status and file data reading information; Retrieve historical user behavior data and conduct risk analysis on abnormal resource usage based on time information, historical user behavior data, software operation status, and computer resource usage; The step of determining abnormal traffic data based on the software operation status and the total traffic data and performing risk analysis on the abnormal traffic data specifically includes: Calculate the sum of all sub-flow data, and compare the sum of sub-flow data with the total flow data to determine abnormal flow data; Determine the source information of abnormal traffic data through NetFlow traffic tracking technology, and determine the source risk level based on the source information; Obtain abnormal traffic risk assessment information based on abnormal traffic size, duration and source risk level; The step of performing risk analysis on abnormal resource usage based on time information, historical user behavior data, software operation status, and computer resource usage specifically includes: Determine the mean and standard deviation of historical resource usage of each running software based on time information, historical user behavior data, and software running status; Compare the historical resource usage mean and standard deviation of each running software with the corresponding resource usage data to determine the software abnormal usage risk; Calculate the sum of all resource usage data, and compare the sum of resource usage data with the computer resource usage to determine other abnormal usage risks; Abnormal resource occupation assessment information is obtained based on software abnormal occupation risk and other abnormal occupation risks.

2. The network security situation awareness method according to claim 1 is characterized in that: The step of performing risk analysis on file leakage according to the software operation status and file data reading information specifically includes: Determine the permission information and file reading function corresponding to each software according to the name of the running software; Determine the file type, read permission and edit permission of each file based on the file data read information; The file type, read permission, and edit permission of each file are matched with the permission information and file reading function of the running software to obtain file leakage risk assessment information.

3. The network security situation awareness method according to claim 2 is characterized in that: The step of matching the file type, read permission and edit permission of each file with the permission information and file read function of the running software to obtain the file leakage risk assessment information specifically includes: Determine the risk factor of each file based on its file type, read permissions, and edit permissions; Determine the name of the running software corresponding to each file being read and edited in turn, match the read permission and edit permission with the corresponding permission information to determine whether the permissions are in compliance; match the file type with the corresponding file reading function to determine whether the function is in compliance; The file leakage risk is obtained based on the risk coefficient of each file, whether the permission is met, and whether the function is met. All file leakage risks are summarized to obtain file leakage risk assessment information.

4. The network security situation awareness method according to claim 1 is characterized in that: The step of comparing the historical resource occupancy mean and standard deviation of each running software with the corresponding resource occupancy data to determine the software abnormal occupancy risk specifically includes: Calculate the risk base of each running software i on resource dimension j , , R represents resource usage data, μ represents the historical resource usage mean, σ represents the standard deviation, and the resource dimensions include CPU, GPU, and memory; Determine the total risk base of each running software based on various resource dimensions, and determine the software abnormal occupancy risk based on all total risk bases.

5. A network security situation awareness system, characterized in that: The system comprises: Related information monitoring module, used to monitor file data reading information, computer resource usage and time information, the file data reading information includes the reading and editing status of each file; The software operation monitoring module is used to monitor the total flow data and software operation status, wherein the software operation status includes the name of each running software and the corresponding sub-flow data and resource usage data; The abnormal traffic risk module is used to determine abnormal traffic data based on the software operation status and total traffic data, and conduct risk analysis on the abnormal traffic data; File leakage risk module, used to analyze the risk of file leakage based on software operation status and file data reading information; The resource occupation risk module is used to retrieve historical user behavior data and conduct risk analysis on abnormal resource occupation based on time information, historical user behavior data, software operation status and computer resource occupation status; The abnormal traffic risk module includes: An abnormal flow data unit is used to calculate the sum of all sub-flow data, and compare the sum of the sub-flow data with the total flow data to determine the abnormal flow data; A source risk level unit is used to determine the source information of abnormal traffic data through NetFlow traffic tracking technology, and determine the source risk level according to the source information; A traffic risk assessment unit, used to obtain abnormal traffic risk assessment information according to the abnormal traffic size, duration and source risk level; The resource occupation risk module includes: A historical resource occupancy unit is used to determine the mean and standard deviation of historical resource occupancy of each running software according to time information, historical user behavior data and software running status; The software abnormal occupancy unit is used to compare the historical resource occupancy mean and standard deviation of each running software with the corresponding resource occupancy data to determine the software abnormal occupancy risk; Other abnormal occupancy units are used to calculate the sum of all resource occupancy data, and compare the sum of resource occupancy data with the computer resource occupancy status to determine other abnormal occupancy risks; The resource occupancy assessment unit is used to obtain abnormal resource occupancy assessment information according to software abnormal occupancy risks and other abnormal occupancy risks.

6. The network security situation awareness system according to claim 5, characterized in that: The file leakage risk module includes: The permission reading function unit is used to determine the permission information and file reading function corresponding to each software according to the name of the running software; A type and permission determination unit, used to determine the file type, read permission and edit permission of each file according to the file data read information; The file risk assessment unit is used to match the file type, read permission and edit permission of each file with the permission information and file reading function of the running software to obtain file leakage risk assessment information.

Images