A network security dynamic early warning method and system based on multi-source data fusion

Abstract

The present invention discloses a network security dynamic early warning method and system based on multi-source data fusion, which specifically relates to the technical field of network security monitoring and early warning. By fusing multi-source data, the network protection quality is evaluated and the protection strength and effectiveness are measured; an attack probability prediction model is built based on a long-short-term memory network to obtain the attack probability of the network in the future time period T; by analyzing user operation behavior, abnormal behavior parameters that do not conform to normal behavior patterns are identified; the abnormal behavior parameters are input into the operation behavior analysis model to obtain the operation behavior abnormality index; the problems of one-sided information, inaccurate evaluation, inaccurate prediction and slow response are effectively overcome, and dynamic early warning of network security situation is realized; when Anx is lower than the safety threshold, the early warning mechanism is immediately triggered, providing efficient and comprehensive technical support for network security management, and ensuring the stability and security of the network environment.

Description

Technical Field

[0001] The present invention relates to the technical field of network security monitoring and early warning, and more specifically, to a network security dynamic early warning method and system based on multi-source data fusion. Background Art

[0002] With the rapid development of information technology, security threats in cyberspace are becoming increasingly severe. Cyber ​​attack methods are not only diverse but also continuously evolving, becoming more complex and covert. Traditional network security early warning methods can no longer meet current security needs. Existing network security early warning systems can monitor and respond to network security incidents to a certain extent.

[0003] However, in actual use, it still has many shortcomings, such as technical problems such as one-sided information, inaccurate assessment, inaccurate prediction and untimely response in existing network security warnings.

[0004] The network security dynamic early warning method based on multi-source data fusion is a comprehensive network security protection strategy. It aims to achieve real-time, comprehensive and accurate monitoring and prediction of network security situation by integrating data from different sources and using advanced data processing technologies and algorithms, thereby improving the efficiency and effectiveness of network security protection. Summary of the Invention

[0005] In order to overcome the above-mentioned defects of the prior art, the present invention provides a network security dynamic early warning method and system based on multi-source data fusion to solve the problems raised in the above-mentioned background technology.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a network security dynamic early warning method based on multi-source data fusion, comprising the following steps:

[0007] Step 1: Data collection: Obtain key indicators of network protection quality by collecting system configuration, security vulnerability information, and security event records; obtain historical attack records, network monitoring, and user behavior time series data from security logs and intrusion monitoring systems; and analyze user operation behaviors to identify abnormal behavior parameters that do not conform to normal behavior patterns.

[0008] Step 2: Data preprocessing: Remove duplicate data, invalid data, and noisy data; convert data from different sources and formats into a unified format and normalize it for subsequent analysis;

[0009] Step 3: Input the key indicators of network protection quality into the network protection quality analysis model and output the network protection quality index NPQ. The network protection quality index reflects the strength and effectiveness of network protection.

[0010] Step 4: Build an attack probability prediction model based on the long short-term memory network. Input historical attack records, network monitoring, and user behavior time series data into the attack probability prediction model, and output the attack probability in the future time period T;

[0011] Step 5: Input the abnormal behavior parameters into the operation behavior analysis model and output the operation behavior abnormality index CY, which reflects the abnormal degree of user behavior and potential security risks; the abnormal behavior parameters include the severity and frequency of the abnormal behavior and the identity information of the network visitor corresponding to the abnormal behavior;

[0012] Step 6: Combined analysis to obtain the network security coefficient: Combined analysis of the network protection quality index, attack probability, and operational behavior abnormality index yields the network security coefficient Anx, which reflects the overall level and potential risks of network security. Dynamic early warning is performed based on the network security coefficient. When Anx falls below the preset security threshold, the network security early warning mechanism is triggered.

[0013] Preferably, the time period T is dynamically adjusted according to changes in the network environment and security status; the time period T represents a specific length of time, and the selection of the time length depends on the requirements of the application scenario, the availability of data, and the predictive ability of the model.

[0014] Preferably, the abnormal operation behavior index CY is obtained in the following manner:

[0015] Let the total number of abnormal behaviors detected be n, and i represent the sequence number of the abnormal behavior;

[0016] The severity of the i-th abnormal behavior is recorded as yci;

[0017] The frequency of the i-th abnormal behavior occurring within a certain time window is recorded as pyi;

[0018] Obtain the identity information of the network visitor corresponding to the i-th abnormal behavior, and retrieve a credit adjustment factor based on the network visitor's identity credit. The credit adjustment factor is used to amplify or reduce the impact of the abnormal behavior; the credit adjustment factor of the network visitor corresponding to the i-th abnormal behavior is recorded as xfi;

[0019] Through the operational behavior analysis model The abnormal operation behavior index CY was calculated.

[0020] Preferably, the credit adjustment factor is obtained by: setting evaluation indicators and initial credit scores for identity credit, where the evaluation indicators include login success rate and operation compliance; assigning corresponding credit score weights to different evaluation indicators, where the credit score weights reflect the importance of the evaluation indicators in the identity credit evaluation; updating the network visitor's identity credit comprehensive score based on the evaluation indicators and credit score weights; and determining the corresponding identity credit adjustment factor based on the identity credit comprehensive score.

[0021] Preferably, the network protection quality index NPQ is obtained in the following manner:

[0022] Obtain key indicators of network protection quality, including at least firewall efficiency, intrusion detection rate, and encryption technology;

[0023] Assume that the number of key indicators of network protection quality is m, and j is used to represent the sequence number of key indicators; the actual measured value of the j-th key indicator is recorded as sc-j, the optimal value of the j-th key indicator is recorded as max_U, and the worst value of the j-th key indicator is recorded as max_N; wj is used to represent the weight of the j-th key indicator. Through the network protection quality analysis model The network protection quality index (NPQ) is calculated, where Form(·) represents a linear normalization function, which is used to convert the values ​​in the brackets to the range of 0 to 1. α represents an optional adjustment factor, which is used to adjust the nonlinear effect of the index value on NPQ.

[0024] Preferably, the process of building the attack probability prediction model includes the following steps:

[0025] Step S11: Automatically collect time series data from multiple data sources. The time series data includes historical attack records, network monitoring, and user behavior. Automated collection reduces manual intervention and ensures data comprehensiveness and timeliness.

[0026] Step S12: remove duplicate, missing, and erroneous data, process timestamps to ensure data continuity, identify and process outliers, and obtain preprocessed time series data; divide the preprocessed time series data into a training set and a validation set;

[0027] Step S13: Based on correlation data analysis, basic features related to the predicted attack probability are selected from the pre-processed time series data. The basic features include at least attack frequency, trend of specific attack type, network traffic change rate, abnormal user behavior ratio, and abnormal user behavior frequency. Feature derivation is performed on the basic features, and statistics of the basic features within the sliding window are calculated to capture the dynamic characteristics of the time series.

[0028] Step S14, data conversion and encoding: for categorical features, use encoding to convert to numerical type; for numerical features, perform linear normalization processing;

[0029] Step S15: Specify that the prediction task is time series prediction; select the long short-term memory network as the initialization model, and use the cross-validation method to adjust the long short-term memory network hyperparameters, such as the learning rate, hidden layer size, and number of iterations; train the long short-term memory network on the training set, monitor the loss function during training and the performance indicators on the validation set, and output the trained attack probability prediction model;

[0030] Step S16: Based on the validation set, obtain evaluation indicators of the attack probability prediction model, and adjust the parameters of the model according to the evaluation indicators;

[0031] Step S17, output and deployment: Deploy the trained attack probability prediction model to the production environment, receive multi-source data input in real time, and predict future attack probabilities.

[0032] Preferably, the network protection quality index, attack probability and operation behavior abnormality index are jointly analyzed and the formula The network security coefficient Anx is calculated, where γ and δ represent adjustment parameters, which are used to control the sensitivity of the attack probability and the operation behavior abnormality index to the network security coefficient, respectively. The network security coefficient is converted into a threat level, and corresponding measures are taken based on the threat level.

[0033] To achieve the above objectives, the present invention provides the following technical solution: a network security dynamic early warning system based on multi-source data fusion, comprising:

[0034] The data collection module collects system configuration, security vulnerability information, and security event records to obtain key indicators of network protection quality; obtains historical attack records, network monitoring, and user behavior time series data from security logs and intrusion monitoring systems; and analyzes user operation behavior to identify abnormal behavior parameters that do not conform to normal behavior patterns;

[0035] The data preprocessing module removes duplicate data, invalid data, and noisy data; converts data from different sources and formats into a unified format and normalizes it for subsequent analysis;

[0036] The network protection quality analysis module is used to input the key indicators of network protection quality into the network protection quality analysis model and output the network protection quality index NPQ;

[0037] The short-term attack probability prediction module builds an attack probability prediction model based on the long short-term memory network. It inputs historical attack records, network monitoring, and user behavior time series data into the attack probability prediction model and outputs the attack probability in the future time period T.

[0038] A user abnormal behavior analysis module is used to input abnormal behavior parameters into the operation behavior analysis model and output an operation behavior abnormality index CY. The abnormal behavior parameters include the severity and frequency of the abnormal behavior and the identity information of the network visitor corresponding to the abnormal behavior;

[0039] The network security comprehensive assessment module jointly analyzes the network protection quality index, attack probability and operation behavior abnormality index to obtain the network security coefficient Anx, and performs dynamic early warning based on the network security coefficient.

[0040] Preferably, the process of obtaining the network security factor Anx includes:

[0041] Assume that the total number of abnormal behaviors detected is n, and i represents the sequence number of abnormal behaviors; the severity of the i-th abnormal behavior is recorded as yci, which is a value obtained by evaluating based on predefined rules or machine learning models; the frequency of the i-th abnormal behavior in a certain time window is recorded as pyi; the credit adjustment factor of the network visitor corresponding to the i-th abnormal behavior is recorded as xfi; through the operation behavior analysis model The abnormal operation behavior index CY was calculated;

[0042] Assume that the number of key indicators of network protection quality is m, and j is used to represent the sequence number of key indicators; the actual measured value of the j-th key indicator is recorded as sc-j, the optimal value of the j-th key indicator is recorded as max_U, and the worst value of the j-th key indicator is recorded as max_N; wj is used to represent the weight of the j-th key indicator. Through the network protection quality analysis model The Network Protection Quality Index (NPQ) is calculated, where Form(·) represents a linear normalization function, which is used to convert the values ​​in the brackets to the range of 0 to 1. α represents an optional adjustment factor, which is used to adjust the nonlinear effect of the index value on NPQ.

[0043] Deploy the trained attack probability prediction model to the production environment, receive multi-source data input in real time, and output the predicted attack probability YP within time T;

[0044] By formula The network security coefficient Anx is calculated, where γ and δ represent adjustment parameters, which are used to control the sensitivity of the attack probability and the operation behavior abnormality index to the network security coefficient, respectively. The network security coefficient is converted into a threat level, and corresponding measures are taken based on the threat level.

[0045] Technical effects and advantages of the present invention:

[0046] (1) The network security dynamic early warning method based on multi-source data fusion provided by the present invention obtains key indicators of network protection quality by collecting system configuration, security vulnerability information, and security event records; inputs the key indicators of network protection quality into the network protection quality analysis model, and outputs the network protection quality index NPQ; the network protection quality index reflects the strength and effectiveness of network protection; builds an attack probability prediction model based on a long-short-term memory network, inputs historical attack records, network monitoring, and user behavior time series data into the attack probability prediction model, and outputs the attack probability in the future time period T; identifies abnormal behavior parameters that do not conform to normal behavior patterns by analyzing user operation behaviors; inputs the abnormal behavior parameters into the operation behavior analysis model, Output the operation behavior anomaly index CY, which reflects the degree of abnormality of user behavior and potential security risks; the abnormal behavior parameters include the severity and frequency of the abnormal behavior and the identity information of the network visitor corresponding to the abnormal behavior; jointly analyze the network protection quality index, attack probability and operation behavior anomaly index to obtain the network security coefficient Anx, which reflects the overall level and potential risks of network security; based on the network security coefficient, dynamic early warning is carried out. When Anx is lower than the preset security threshold, the network security early warning mechanism is triggered, which effectively solves technical problems in network security early warning, such as one-sided information, inaccurate evaluation, inaccurate prediction and untimely response, and provides strong support for the comprehensive and efficient management of network security.

[0047] (2) The network security dynamic early warning method based on multi-source data fusion provided by the present invention dynamically adjusts the attack probability in time period T according to changes in the network environment and security status. In security scenarios that require rapid response, time period T is set to a shorter time so that the system can quickly identify and respond to potential attack threats; when the system detects abnormal behavior or potential threats, time period T is shortened to update the attack probability prediction more frequently, thereby responding to security incidents more quickly. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 This is a flow chart of the network security dynamic early warning method of the present invention.

[0049] Figure 2 This is a structural block diagram of the network security dynamic early warning system of the present invention. DETAILED DESCRIPTION

[0050] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0051] The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way intended to limit the present disclosure, its application, or uses.

[0052] Technologies, methods, and equipment known to ordinary technicians in the relevant art may not be discussed in detail, but where appropriate, the technologies, methods, and equipment should be considered part of the specification.

[0053] Example 1

[0054] See Figure 1 The present invention provides a flow chart of a network security dynamic early warning method. Figure 1 A network security dynamic early warning method based on multi-source data fusion is shown, characterized in that it includes the following steps:

[0055] Step 1: Data collection: Obtain key indicators of network protection quality by collecting system configuration, security vulnerability information, and security event records; obtain historical attack records, network monitoring, and user behavior time series data from security logs and intrusion monitoring systems; and analyze user operation behaviors to identify abnormal behavior parameters that do not conform to normal behavior patterns.

[0056] Step 2: Data preprocessing: Remove duplicate data, invalid data (such as data with incorrect format or missing key fields), and noisy data; convert data from different sources and formats into a unified format and normalize it for subsequent analysis; store the preprocessed data in the data center;

[0057] Step 3: Input the key indicators of network protection quality into the network protection quality analysis model and output the network protection quality index NPQ. The network protection quality index reflects the strength and effectiveness of network protection.

[0058] Step 4: Build an attack probability prediction model based on the long short-term memory network. Input historical attack records, network monitoring, and user behavior time series data into the attack probability prediction model, and output the attack probability in the future time period T;

[0059] Step 5: Input the abnormal behavior parameters into the operation behavior analysis model and output the operation behavior abnormality index CY, which reflects the abnormal degree of user behavior and potential security risks; the abnormal behavior parameters include the severity and frequency of the abnormal behavior and the identity information of the network visitor corresponding to the abnormal behavior;

[0060] Step 6: Combined analysis to obtain the network security coefficient: Combined analysis of the network protection quality index, attack probability, and operational behavior abnormality index yields the network security coefficient Anx, which reflects the overall level and potential risks of network security. Dynamic early warning is performed based on the network security coefficient. When Anx falls below the preset security threshold, the network security early warning mechanism is triggered.

[0061] What needs to be further explained in the embodiments of the present invention is that the time period T is not fixed, but is dynamically adjusted according to changes in the network environment and security status; the time period T represents a specific length of time, such as the next hour, the next 24 hours, the next week, etc., and the selection of the time length depends on the needs of the application scenario, the availability of data, and the predictive ability of the model; for example, in security scenarios that require rapid response, the time period T is set to a shorter time so that the system can quickly identify and respond to potential attack threats; when the system detects abnormal behavior or potential threats, the time period T is shortened to update the attack probability prediction more frequently, thereby responding to security incidents more quickly; and in scenarios where real-time requirements are not high, the time period T is relatively long.

[0062] It needs to be further explained in the embodiment of the present invention that the method for obtaining the abnormal operation behavior index CY is:

[0063] Let the total number of abnormal behaviors detected be n, and i represent the sequence number of the abnormal behavior;

[0064] The severity of the i-th abnormal behavior is recorded as yci, which is a numerical value evaluated based on predefined rules or machine learning models;

[0065] The frequency of the i-th abnormal behavior occurring within a certain time window is recorded as pyi;

[0066] Obtain the identity information of the network visitor corresponding to the i-th abnormal behavior, and retrieve a credit adjustment factor based on the network visitor's identity credit. The credit adjustment factor is used to amplify or reduce the impact of the abnormal behavior. The credit adjustment factor of the network visitor corresponding to the i-th abnormal behavior is recorded as xfi. For example, for a high-credit user, this factor may be close to 1 or slightly less than 1, while for a low-credit user, this factor may be greater than 1.

[0067] Through the operational behavior analysis model The abnormal operation behavior index CY was calculated.

[0068] What needs to be further explained in the embodiments of the present invention is that the credit adjustment factor is obtained in the following manner: setting evaluation indicators and initial credit score values ​​for identity credit, where the evaluation indicators include login success rate, operation compliance, and initial credit score value; assigning corresponding credit score weights to different evaluation indicators, where the credit score weights reflect the importance of the evaluation indicators in the identity credit evaluation; updating the comprehensive identity credit score of the network visitor based on the evaluation indicators and credit score weights; determining the corresponding identity credit adjustment factor based on the comprehensive identity credit score; the higher the comprehensive identity credit score, the smaller the adjustment factor (i.e., the impact of abnormal behavior is reduced); the lower the comprehensive identity credit score, the larger the adjustment factor (i.e., the impact of abnormal behavior is amplified).

[0069] It should be further explained in the embodiment of the present invention that the network protection quality index NPQ is obtained in the following manner:

[0070] Obtain key indicators of network protection quality, including at least firewall efficiency, intrusion detection rate, and encryption technology;

[0071] Assume that the number of key indicators of network protection quality is m, and j is used to represent the sequence number of key indicators; the actual measured value of the j-th key indicator is recorded as sc-j, the optimal value of the j-th key indicator is recorded as max_U, and the worst value of the j-th key indicator is recorded as max_N; wj is used to represent the weight of the j-th key indicator. Through the network protection quality analysis model The network protection quality index (NPQ) is calculated, where Form(·) represents a linear normalization function, which is used to convert the values ​​in the brackets to the range of 0 to 1. α represents an optional adjustment factor, which is used to adjust the nonlinear effect of the index value on NPQ. When α = 1, it indicates a linear relationship. When α > 1, the penalty for deviation from the optimal value is increased. When 0 < α < 1, the penalty for deviation from the optimal value is reduced. The adjustment factor is adjusted according to the actual situation to better reflect the impact of different indicators on NPOI.

[0072] It should be further explained in the embodiment of the present invention that the process of building the attack probability prediction model includes the following steps:

[0073] Step S11: Automatically collect time series data from multiple data sources. The time series data includes historical attack records, network monitoring, and user behavior. Automated collection reduces manual intervention and ensures data comprehensiveness and timeliness.

[0074] Explanation: The historical attack records refer to the records of historical network security attack events, including the attack type, time, impact range, and source IP address information; the network monitoring data refers to the data collected through network monitoring tools, and the network monitoring data includes network traffic, session information, and connection attempt records; network monitoring data can reflect the normal and abnormal patterns of network activities; the user behavior data refers to the user's behavior data on the network, including login activities, file access, and system operation behavior data. Abnormal user behavior is often a sign of attack activity.

[0075] Step S12: remove duplicate, missing, and erroneous data, process timestamps to ensure data continuity, identify and process outliers, and obtain preprocessed time series data; divide the preprocessed time series data into a training set and a validation set;

[0076] Step S13: Based on the correlation data analysis, basic features related to the predicted attack probability are selected from the pre-processed time series data. The basic features include at least the attack frequency, the trend of specific attack types, the network traffic change rate, the proportion of abnormal user behaviors, and the frequency of abnormal user behaviors. The basic features are derived and the statistics (mean, standard deviation, maximum value) of the basic features within the sliding window are calculated to capture the dynamic characteristics of the time series.

[0077] Explanation: The correlation data analysis is used to analyze the correlation between each feature and the target variable (ie, attack probability), and to determine which features are most helpful in predicting the attack probability through statistical methods (such as correlation coefficient and chi-square test).

[0078] Step S14, data conversion and encoding: For categorical features, use encoding (such as one-hot encoding, label encoding, or target encoding) to convert them into numerical types; for numerical features, perform linear normalization;

[0079] Step S15: Specify that the prediction task is time series prediction (e.g., predicting the probability of an attack occurring within the next few hours); select a long short-term memory network as the initialization model, and use cross-validation to adjust the long short-term memory network hyperparameters, such as the learning rate, hidden layer size, and number of iterations; train the long short-term memory network on the training set, monitor the loss function during training and the performance indicators on the validation set, and output the trained attack probability prediction model;

[0080] Explanation: During the training process, early stopping or regularization techniques are used to prevent overfitting. The loss function is the cross entropy loss function between the predicted attack probability YP and the actual attack probability SP.

[0081] Step S16: Based on the validation set, obtain evaluation indicators of the attack probability prediction model, such as accuracy, recall rate, F1 score, and area under the AUC-ROC curve; adjust the model parameters (such as learning rate and regularization coefficient) according to the evaluation indicators;

[0082] Step S17, output and deployment: Deploy the trained attack probability prediction model to the production environment, receive multi-source data input in real time, and predict future attack probabilities.

[0083] In the embodiment of the present invention, it is necessary to further explain that the network protection quality index, attack probability and operation behavior abnormality index are jointly analyzed and the formula The network security coefficient Anx is calculated, where γ and δ represent adjustment parameters, which are used to control the sensitivity of the attack probability and the operation behavior abnormality index to the network security coefficient, respectively. Adjustments are made according to actual conditions to reflect the importance of various factors in different network environments. The greater the attack probability, the smaller the network security coefficient Anx; the greater the operation behavior abnormality index, the smaller the network security coefficient Anx; the greater the protection quality, the greater the network security coefficient Anx.

[0084] It is necessary to further explain in the embodiment of the present invention that the network security coefficient is converted into a threat level, and the value range of the network security coefficient [0, 1] is divided into several intervals, each interval corresponding to a threat level; for example:

[0085] When the network security coefficient is in [0.8, 1.0], it corresponds to a low threat level, indicating that the network security status in the future time T is good;

[0086] When the network security coefficient is in [0.4, 0.8), it corresponds to a medium threat level, indicating that the network security situation in the future time T needs attention;

[0087] When the network security coefficient is in [0.2, 0.4), it corresponds to a high threat level, indicating that protective measures need to be taken for the network security situation in the future time T;

[0088] When the network security coefficient is in [0.0, 0.2), it corresponds to an extremely high threat level, indicating that the network security situation in the future time T is in an emergency state and network protection resources need to be increased immediately.

[0089] For example, assume that the network protection quality index NPQ = 0.7, which is medium protection quality; the predicted attack probability YP = 0.3, which is a low attack probability; the operation behavior abnormality index CY = 0.2, which is a low operation behavior abnormality, and set γ = 2 and δ = 1.5, and γ and δ are adjusted according to actual conditions, then According to the threat level classification, this network security coefficient corresponds to a medium threat level, and network administrators need to pay real-time attention to the network security coefficient.

[0090] Example 2

[0091] See Figure 2 The embodiment of the present invention provides a network security dynamic early warning system based on multi-source data fusion, including:

[0092] The data collection module collects system configuration, security vulnerability information, and security event records to obtain key indicators of network protection quality; obtains historical attack records, network monitoring, and user behavior time series data from security logs and intrusion monitoring systems; and analyzes user operation behavior to identify abnormal behavior parameters that do not conform to normal behavior patterns;

[0093] The data preprocessing module removes duplicate data, invalid data, and noisy data; converts data from different sources and formats into a unified format and normalizes it for subsequent analysis;

[0094] The network protection quality analysis module is used to input the key indicators of network protection quality into the network protection quality analysis model and output the network protection quality index NPQ;

[0095] The short-term attack probability prediction module builds an attack probability prediction model based on the long short-term memory network. It inputs historical attack records, network monitoring, and user behavior time series data into the attack probability prediction model and outputs the attack probability in the future time period T.

[0096] A user abnormal behavior analysis module is used to input abnormal behavior parameters into the operation behavior analysis model and output an operation behavior abnormality index CY. The abnormal behavior parameters include the severity and frequency of the abnormal behavior and the identity information of the network visitor corresponding to the abnormal behavior;

[0097] The network security comprehensive assessment module jointly analyzes the network protection quality index, attack probability and operation behavior abnormality index to obtain the network security coefficient Anx, and performs dynamic early warning based on the network security coefficient.

[0098] It should be further explained in the embodiment of the present invention that the process of obtaining the network security factor Anx includes:

[0099] Assume that the total number of abnormal behaviors detected is n, and i represents the sequence number of abnormal behaviors; the severity of the i-th abnormal behavior is recorded as yci, which is a value obtained by evaluating based on predefined rules or machine learning models; the frequency of the i-th abnormal behavior in a certain time window is recorded as pyi; the credit adjustment factor of the network visitor corresponding to the i-th abnormal behavior is recorded as xfi; through the operation behavior analysis model The abnormal operation behavior index CY was calculated;

[0100] Assume that the number of key indicators of network protection quality is m, and j is used to represent the sequence number of key indicators; the actual measured value of the j-th key indicator is recorded as sc-j, the optimal value of the j-th key indicator is recorded as max_U, and the worst value of the j-th key indicator is recorded as max_N; wj is used to represent the weight of the j-th key indicator. Through the network protection quality analysis model The Network Protection Quality Index (NPQ) is calculated, where Form(·) represents a linear normalization function, which is used to convert the values ​​in the brackets to the range of 0 to 1. α represents an optional adjustment factor, which is used to adjust the nonlinear effect of the index value on NPQ.

[0101] Deploy the trained attack probability prediction model to the production environment, receive multi-source data input in real time, and output the predicted attack probability YP within time T;

[0102] By formula The network security coefficient Anx is calculated, where γ and δ represent adjustment parameters, which are used to control the sensitivity of the attack probability and the operation behavior abnormality index to the network security coefficient, respectively. The network security coefficient is converted into a threat level, and corresponding measures are taken based on the threat level.

[0103] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A network security dynamic early warning method based on multi-source data fusion, characterized in that: The following steps are involved: Step 1: Data collection: Obtain key indicators of network protection quality by collecting system configuration, security vulnerability information, and security event records; obtain historical attack records, network monitoring, and user behavior time series data from security logs and intrusion monitoring systems; and analyze user operation behaviors to identify abnormal behavior parameters that do not conform to normal behavior patterns. Step 2: Data preprocessing: Remove duplicate data, invalid data, and noisy data; convert data from different sources and formats into a unified format and normalize it for subsequent analysis; Step 3: Input the key indicators of network protection quality into the network protection quality analysis model and output the network protection quality index NPQ. The network protection quality index reflects the strength and effectiveness of network protection. Step 4: Build an attack probability prediction model based on the long short-term memory network. Input historical attack records, network monitoring, and user behavior time series data into the attack probability prediction model, and output the attack probability in the future time period T; Step 5: Input the abnormal behavior parameters into the operation behavior analysis model and output the operation behavior abnormality index CY, which reflects the abnormal degree of user behavior and potential security risks; the abnormal behavior parameters include the severity and frequency of the abnormal behavior and the identity information of the network visitor corresponding to the abnormal behavior; Step 6: Combined analysis to obtain the network security coefficient: Combined analysis of the network protection quality index, attack probability, and operational behavior abnormality index yields the network security coefficient Anx, which reflects the overall level and potential risks of network security. Dynamic early warning is performed based on the network security coefficient. When Anx falls below the preset security threshold, the network security early warning mechanism is triggered.

2. A network security dynamic early warning method based on multi-source data fusion according to claim 1, characterized in that: The time period T is dynamically adjusted according to changes in the network environment and security status; the time period T represents a specific length of time, and the selection of the time length depends on the requirements of the application scenario, the availability of data, and the predictive ability of the model.

3. A network security dynamic early warning method based on multi-source data fusion according to claim 1, characterized in that: The method for obtaining the abnormal operation behavior index CY is as follows: Let the total number of abnormal behaviors detected be n, and i represent the sequence number of the abnormal behavior; The severity of the i-th abnormal behavior is recorded as yci; The frequency of the i-th abnormal behavior occurring within a certain time window is recorded as pyi; Obtain the identity information of the network visitor corresponding to the i-th abnormal behavior, and retrieve a credit adjustment factor based on the network visitor's identity credit. The credit adjustment factor is used to amplify or reduce the impact of the abnormal behavior; the credit adjustment factor of the network visitor corresponding to the i-th abnormal behavior is recorded as xfi; Through the operational behavior analysis model The abnormal operation behavior index CY was calculated.

4. A network security dynamic early warning method based on multi-source data fusion according to claim 3, characterized in that: The credit adjustment factor is obtained by: setting evaluation indicators for identity credit and initial credit score values, where the evaluation indicators include login success rate and operation compliance; assigning corresponding credit score weights to different evaluation indicators, where the credit score weights reflect the importance of the evaluation indicators in the identity credit evaluation; updating the network visitor's identity credit comprehensive score based on the evaluation indicators and credit score weights; and determining the corresponding identity credit adjustment factor based on the identity credit comprehensive score.

5. The method for dynamic network security early warning based on multi-source data fusion according to claim 1 is characterized in that: The network protection quality index NPQ is obtained as follows: Obtain key indicators of network protection quality, including at least firewall efficiency, intrusion detection rate, and encryption technology; Assume that the number of key indicators of network protection quality is m, and j is used to represent the sequence number of key indicators; the actual measured value of the j-th key indicator is recorded as sc-j, the optimal value of the j-th key indicator is recorded as max_U, and the worst value of the j-th key indicator is recorded as max_N; wj is used to represent the weight of the j-th key indicator. Through the network protection quality analysis model The network protection quality index (NPQ) is calculated, where Form(·) represents a linear normalization function, which is used to convert the values ​​in the brackets to the range of 0 to 1. α represents an optional adjustment factor, which is used to adjust the nonlinear effect of the index value on NPQ.

6. The method for dynamic network security early warning based on multi-source data fusion according to claim 1 is characterized in that: The process of building the attack probability prediction model includes the following steps: Step S11: Automatically collect time series data from multiple data sources. The time series data includes historical attack records, network monitoring, and user behavior. Automated collection reduces manual intervention and ensures data comprehensiveness and timeliness. Step S12: remove duplicate, missing, and erroneous data, process timestamps to ensure data continuity, identify and process outliers, and obtain pre-processed time series data; Divide the preprocessed time series data into training set and validation set; Step S13: Based on correlation data analysis, basic features related to the predicted attack probability are selected from the pre-processed time series data. The basic features include at least attack frequency, trend of specific attack type, network traffic change rate, abnormal user behavior ratio, and abnormal user behavior frequency. Feature derivation is performed on the basic features, and statistics of the basic features within the sliding window are calculated to capture the dynamic characteristics of the time series. Step S14, data conversion and encoding: for categorical features, use encoding to convert to numerical type; for numerical features, perform linear normalization processing; Step S15: Specify that the prediction task is time series prediction; select the long short-term memory network as the initialization model, and use the cross-validation method to adjust the long short-term memory network hyperparameters; train the long short-term memory network on the training set, monitor the loss function during training and the performance indicators on the validation set, and output the trained attack probability prediction model; Step S16: Based on the validation set, obtain evaluation indicators of the attack probability prediction model, and adjust the parameters of the model according to the evaluation indicators; Step S17, output and deployment: Deploy the trained attack probability prediction model to the production environment, receive multi-source data input in real time, and predict the future attack probability YP.

7. The method for dynamic network security early warning based on multi-source data fusion according to claim 1 is characterized in that: Combined analysis of network protection quality index, attack probability and operation behavior abnormality index, through the formula The network security coefficient Anx is calculated, where γ and δ represent adjustment parameters, which are used to control the sensitivity of the attack probability and the operation behavior abnormality index to the network security coefficient, respectively. The network security coefficient is converted into a threat level, and corresponding measures are taken based on the threat level.

8. A network security dynamic early warning system based on multi-source data fusion, characterized by: include: The data collection module collects system configuration, security vulnerability information, and security event records to obtain key indicators of network protection quality; Obtain historical attack records, network monitoring, and user behavior time series data from security logs and intrusion monitoring systems; analyze user operation behaviors to identify abnormal behavior parameters that do not conform to normal behavior patterns; The data preprocessing module removes duplicate data, invalid data, and noisy data; converts data from different sources and formats into a unified format and normalizes it for subsequent analysis; The network protection quality analysis module is used to input the key indicators of network protection quality into the network protection quality analysis model and output the network protection quality index NPQ; The short-term attack probability prediction module builds an attack probability prediction model based on the long short-term memory network. It inputs historical attack records, network monitoring, and user behavior time series data into the attack probability prediction model and outputs the attack probability in the future time period T. A user abnormal behavior analysis module is used to input abnormal behavior parameters into the operation behavior analysis model and output an operation behavior abnormality index CY. The abnormal behavior parameters include the severity and frequency of the abnormal behavior and the identity information of the network visitor corresponding to the abnormal behavior; The network security comprehensive assessment module jointly analyzes the network protection quality index, attack probability and operation behavior abnormality index to obtain the network security coefficient Anx, and performs dynamic early warning based on the network security coefficient.

Images