Network security situation assessment method, system and equipment

Abstract

The invention discloses a network security situation assessment method, system and device, and relates to the field of network security, and the method comprises the steps: obtaining a network traffic data set; the network flow data set comprises multiple pieces of network flow data in a set time period; based on a traffic classification model, classifying each network traffic data in the network traffic data set to determine an attack type of each network traffic data; the traffic classification model is obtained by training based on a training set by adopting a sparrow search algorithm in advance, and the training set comprises multiple groups of network traffic sample data and corresponding attack types; the traffic classification model is constructed based on a multi-scale convolution attention mechanism and a residual network; and calculating a network security situation value according to the attack type of each piece of network traffic data so as to determine a network security situation corresponding to the network traffic data set. According to the invention, the accuracy of network security situation assessment is improved.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a network security situation assessment method, system and device. Background Art

[0002] With the rapid development of the Internet, security issues are becoming increasingly prominent. Although various network security protection measures have been taken, a single security protection measure does not comprehensively consider the correlation between various protection measures and cannot meet the needs of evaluating network security from a macro perspective. Network security situation awareness is an important part of network security defense and is crucial for network security managers to cope with increasingly complex network threats. Network security situation awareness can identify the behavior of various activities in the network, understand the intention and evaluate the impact from a macro perspective, thereby providing reasonable decision support and predicting the development trend of network security. However, the current network security situation awareness method has low accuracy and cannot effectively avoid network risks. Summary of the invention

[0003] The purpose of this application is to provide a network security situation assessment method, system and device to improve the accuracy of network security perception.

[0004] To achieve the above objectives, this application provides the following solutions:

[0005] In a first aspect, the present application provides a network security situation assessment method, comprising:

[0006] Acquire a network traffic data set; the network traffic data set includes a plurality of network traffic data within a set time period;

[0007] Based on the traffic classification model, each network traffic data in the network traffic data set is classified to determine the attack type of each network traffic data; the traffic classification model is pre-trained based on a training set using a sparrow search algorithm, and the training set includes multiple groups of network traffic sample data and corresponding attack types; the traffic classification model is constructed based on a multi-scale convolutional attention mechanism and a residual network;

[0008] According to the attack type of each network traffic data, a network security situation value is calculated to determine the network security situation corresponding to the network traffic data set.

[0009] In a second aspect, the present application provides a network security situation assessment system, comprising:

[0010] A flow data acquisition module is used to acquire a network flow data set; the network flow data set includes a plurality of network flow data within a set time period;

[0011] An attack type determination module is connected to the traffic data acquisition module and is used to classify each network traffic data in the network traffic data set based on a traffic classification model to determine the attack type of each network traffic data; the traffic classification model is pre-trained based on a training set using a sparrow search algorithm, and the training set includes multiple groups of network traffic sample data and corresponding attack types; the traffic classification model is constructed based on a multi-scale convolutional attention mechanism and a residual network;

[0012] The situation value calculation module is connected to the attack type determination module and is used to calculate the network security situation value according to the attack type of each network flow data to determine the network security situation corresponding to the network flow data set.

[0013] In a third aspect, the present application provides a computer device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above-mentioned network security situation assessment method.

[0014] According to the specific embodiments provided in this application, this application has the following technical effects:

[0015] The present application provides a network security situation assessment method, system and device, which adopts a sparrow search algorithm to optimize the traffic classification model, improves the training efficiency and accuracy of the traffic classification model, and further adopts a multi-scale convolutional attention mechanism and a residual network to construct a traffic classification model, so that the traffic classification model can extract features of network traffic data from different dimensions and scales, effectively avoiding the problem of feature loss and improving the accuracy of network security situation assessment. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 This is an application environment diagram of a network security situation assessment method in one embodiment of the present application;

[0018] Figure 2 A flowchart of a network security situation assessment method provided in one embodiment of the present application;

[0019] Figure 3 A schematic diagram of the structure of a traffic classification model provided in an embodiment of the present application;

[0020] Figure 4 A schematic diagram of the structure of an attention residual block provided in an embodiment of the present application;

[0021] Figure 5 A schematic diagram of the structure of a multi-scale convolutional attention mechanism layer provided in one embodiment of the present application;

[0022] Figure 6 This is a schematic diagram of the true situation value and the model predicted situation value of the UNSW-NB15 data set;

[0023] Figure 7 A schematic diagram of the functional modules of a network security situation assessment system provided in one embodiment of the present application. DETAILED DESCRIPTION

[0024] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0025] At present, many researchers have applied machine learning and deep learning to the field of network security situation awareness, such as combining decomposition convolution technology with deep separable convolution technology to predict network conditions, and using crowd search algorithms to optimize hidden Markov models (HMM) to better evaluate network conditions. The whale optimization algorithm is adaptively improved in weights to optimize the support vector machine (SVM) network. Convolutional Neural Networks (CNN) is combined with Long Short-Term Memory (LSTM) to simultaneously learn spatial and temporal features from phasor measurement units.

[0026] Although various technologies have widely promoted the application of artificial intelligence in the field of network security situation assessment, these methods still need to be improved due to certain limitations. For example, due to the limited receptive field of CNN, information may be lost during the training process. The decision tree artificial neural network (DT-ANN) does not consider the long-range dependency of the input data, and has a weak ability to obtain the correlation between different elements. Therefore, it is still necessary to improve the relevant technologies and propose a better evaluation model for network traffic, so that current network security personnel can better evaluate the network security status and effectively avoid network risks.

[0027] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0028] The network security situation assessment method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be set up separately, or it can be integrated on the server 104, or it can be placed on the cloud or other servers. The terminal 102 can send a network traffic data set to be processed to the server 104. After the server 104 receives the network traffic data set to be processed, it classifies each network traffic data in the network traffic data set based on the traffic classification model, and calculates the network security situation value according to the attack type of each network traffic data. The server 104 can feedback the obtained network security situation value to the terminal 102. In addition, in some embodiments, the network security situation assessment method can also be implemented by the server 104 or the terminal 102 alone.

[0029] The terminal 102 may be, but is not limited to, various desktop computers, laptop computers, smart phones, tablet computers, IoT devices, and portable wearable devices. The IoT devices may be smart speakers, smart TVs, smart air conditioners, smart vehicle-mounted devices, etc. The portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. The server 104 may be implemented as an independent server or a server cluster consisting of multiple servers, or may be a cloud server.

[0030] In an exemplary embodiment, Figure 2 As shown, a network security situation assessment method is provided. The method is executed by a computer device, and can be executed by a computer device such as a terminal or a server alone, or by a terminal and a server together. In the embodiment of the present application, the method is applied to Figure 1 The server 104 in the example is used as an example to illustrate, including the following steps 201 to 203. Among them:

[0031] Step 201, obtaining a network traffic data set, wherein the network traffic data set includes a plurality of network traffic data within a set period of time.

[0032] In an exemplary embodiment, after the network traffic data set is acquired, the network traffic data is digitized and normalized.

[0033] Step 202: classify each network traffic data in the network traffic data set based on the traffic classification model to determine the attack type of each network traffic data.

[0034] The traffic classification model is pre-trained using a Sparrow Search Algorithm (SSA) based on a training set, and the training set includes multiple groups of network traffic sample data and corresponding attack types.

[0035] In an exemplary embodiment, the training process of the traffic classification model includes: labeling, digitizing and normalizing the network traffic sample set, and then dividing the sample set into a training set and a test set, specifically dividing the first 80% of the sample set into a training set and the last 20% into a test set. Then, the traffic classification model is trained based on the training set using the sparrow search algorithm. The network traffic sample data is used as input, and the corresponding attack type label is used as output to train the traffic classification model.

[0036] The sparrow search algorithm is inspired by the foraging and anti-predation behavior of sparrows. It has the advantages of strong optimization ability and fast convergence speed.

[0037] The sparrow search algorithm mainly includes three types of members: discoverers, joiners, and vigilants. In the simulation experiment, virtual sparrows are needed to find food. The population composed of n sparrows can be expressed as:

[0038]

[0039] Among them, X is the population, d represents the dimension of the variable to be optimized, n is the number of sparrows, is the position information of the nth sparrow in the dth dimension.

[0040] Then, the fitness value of all sparrows can be expressed as:

[0041]

[0042] Among them, F x is the fitness matrix of all sparrows, and f() represents the fitness value.

[0043] In SSA, the sparrow with a better fitness value is the discoverer, which can obtain food first and guide the movement of other sparrows. The update formula of the discoverer's position in the iteration is:

[0044]

[0045] Where t represents the current iteration number, k = 1, 2, 3, ..., n, j = 1, 2, 3, ..., d, item maxis a constant representing the maximum number of iterations, α ∈ (0, 1] is a random number, R2 represents the warning value, ST represents the safety value, R2 ∈ (2, 1], ST ∈ (0.5, 1], Q is a random number following a normal distribution, and L represents a 1×d matrix where each element is all 1. When R2 < ST, there are no predators around the foraging environment, and the discoverers can perform extensive search operations. If R2 ≥ ST, some sparrows in the population have discovered a predator and sent an alarm to other sparrows in the population. At this time, all sparrows need to quickly fly to other safe places to forage.

[0046] During the foraging process, some followers will constantly monitor the discoverers. Once they notice that the discoverers have found better food, they will immediately leave their current positions to compete for the food. If they succeed in the competition, they can immediately obtain the food of the discoverers; otherwise, they need to continue foraging.

[0047] The position update formula for the followers is:

[0048]

[0049] where, is the optimal position occupied by the discoverer at the (t + 1)-th iteration, x worst is the current global worst position, A represents a 1×d matrix whose each element is randomly assigned 1 or -1, A + = A T (AA T ) -1 . When , it indicates that the k-th follower with a lower fitness value has not obtained food and is in a very hungry state. At this time, it needs to fly to other places to forage to obtain more energy.

[0050] In the simulation experiment, it is assumed that the vigilant sparrows account for 10% to 20% of the total number. The initial positions of these sparrows are randomly generated in the population. The position update formula for the vigilant sparrows is:

[0051]

[0052] where, is the current global optimal position, β as the step size control parameter is a random number following a normal distribution with a mean of 0 and a variance of 1. K ∈ [-1, 1] is a random number representing the direction of the sparrow's movement and also the step size control parameter, f k is the fitness value of the current sparrow individual, f g and f ω are the current global best and worst fitness values respectively, and ε is a constant to avoid a zero denominator.

[0053] For simplicity, when f k >f g When the sparrows are at the edge of the population, they are extremely vulnerable to attacks by predators. best This means that the sparrow in this position is the best position in the population and is also very safe. k =f g This indicates that sparrows in the middle of the population are aware of the danger and need to move closer to other sparrows to minimize their risk of being preyed upon.

[0054] The process of searching for the optimal parameters of the traffic classification model using the sparrow search algorithm is as follows:

[0055] (1) Initialize the algorithm’s related parameters, including population size, maximum number of iterations, proportion of discoverers, proportion of alerters, and warning value.

[0056] (2) Set the dimension of the sparrow population and the range of the dimension.

[0057] (3) Set the fitness function of the sparrow search algorithm, randomly generate the initial population, calculate the fitness value of the individual sparrows, obtain the final initial population, and record the current optimal solution.

[0058] (4) Calculate the individual fitness value of the sparrow, update the optimal solution, and use the above formula to update the positions of the discoverer, joiner, and guard.

[0059] (5) If the maximum number of iterations is reached, proceed to the next step; otherwise, return to the previous step and continue iterating.

[0060] (6) Obtain the optimal parameters of the traffic classification model.

[0061] The traffic classification model is constructed based on a multi-scale convolutional attention mechanism and a residual network. Specifically, the traffic classification model is obtained by improving the ResNet residual network based on the multi-scale convolutional attention mechanism. Among them, the multi-scale convolutional attention mechanism is a multi-scale convolutional attention mechanism suitable for traffic data proposed based on the convolutional network.

[0062] In an exemplary embodiment, Figure 3 As shown, the traffic classification model includes a convolution module, a first attention residual module, a second attention residual module, a third attention residual module, a fourth attention residual module, a fully connected module and a random dropout module, which are connected in sequence.

[0063] The convolution module uses a 1×1 two-dimensional convolution to change the number of channels of the input data from 1 to 4, and performs batch normalization and RELU activation. The fully connected module maps the output to the number of categories. The dropout rate of the random inactivation module is 0.2.

[0064] The first attention residual module includes an attention residual block.

[0065] The second attention residual module includes two attention residual blocks connected sequentially.

[0066] The third attention residual module includes three attention residual blocks connected in sequence.

[0067] The fourth attention residual module includes an attention residual block.

[0068] The attention residual block is constructed based on a multi-scale convolutional attention mechanism and a residual network.

[0069] Among them, Figure 4 As shown, the attention residual block includes a first convolutional layer, a batch normalization activation layer, a multi-scale convolutional attention mechanism layer and a second convolutional layer connected in sequence. The second convolutional layer is also residually connected to the first convolutional layer.

[0070] The first convolutional layer is a 1×1 two-dimensional convolution. The batch normalization activation layer includes batch normalization operations and RELU activation operations, which are used to normalize the output of the first convolutional layer so that the model can learn more complex features. The second convolutional layer is a 1×1 two-dimensional convolution. A RELU activation layer is also connected after the second convolutional layer. Note that the residual block finally uses residual connections to solve the gradient vanishing problem in deep networks.

[0071] like Figure 5 As shown, the multi-scale convolutional attention mechanism layer includes: a spatial convolution layer, a temporal convolution layer, a first adaptive pooling layer, a second adaptive pooling layer, a first feedforward layer, a second feedforward layer and a feature fusion layer.

[0072] The spatial convolution layer and the temporal convolution layer are both connected to the batch normalization activation layer. The first adaptive pooling layer is connected to the spatial convolution layer. The second adaptive pooling layer is connected to the temporal convolution layer. The first feedforward layer is connected to the first adaptive pooling layer. The second feedforward layer is connected to the second adaptive pooling layer. The feature fusion layer is respectively connected to the first feedforward layer and the second feedforward layer, and is residually connected to the batch normalization activation layer.

[0073] The spatial convolution layer uses lateral convolution to extract the spatial features of the network traffic features output by the batch normalization activation layer. The first adaptive pooling layer performs adaptive average pooling on the spatial features in the x-direction and the y-direction, respectively, to obtain a spatial feature map in the x-direction and a spatial feature map in the y-direction. The first feedforward layer performs output dimension mapping on the spatial feature map in the x-direction and the spatial feature map in the y-direction to obtain a final spatial feature map.

[0074] The temporal convolution layer uses vertical convolution to extract the temporal features of the network traffic features output by the batch normalization activation layer. The second adaptive pooling layer performs adaptive average pooling on the temporal features in the x-direction and the y-direction, respectively, to obtain a temporal feature map in the x-direction and a temporal feature map in the y-direction. The second feedforward layer performs output dimension mapping on the temporal feature map in the x-direction and the temporal feature map in the y-direction to obtain a final temporal feature map.

[0075] Among them, time refers to the time series of network traffic data, and each row in the network traffic data set represents a different time node; space represents the different features of each column, and these features have spatial correlation. Extracting these two aspects of features separately can extract network traffic features more accurately.

[0076] In an exemplary embodiment, the horizontal convolution sequentially uses a 3×1 convolution block, a 5×1 convolution block, a 7×1 convolution block, and a 3×1 convolution block to extract traffic features of different scales in the spatial dimension to obtain spatial features. The vertical convolution sequentially uses a 1×3 convolution block, a 1×5 convolution block, a 1×7 convolution block, and a 1×3 convolution block to extract traffic features of different scales in the time dimension to obtain time features. By extracting multi-dimensional and multi-scale traffic features through multiple convolutions of different sizes in different directions, feature loss can be prevented.

[0077] In the first adaptive pooling layer and the second adaptive pooling layer, the height of the output feature map of the adaptive average pooling in the x direction is h and the width is 1, and the height of the output feature map of the adaptive average pooling in the y direction is 1 and the width is h. After adaptive pooling, the output feature map in the x direction is added to the output feature map in the y direction and mapped to a feature map of h×h through the feedforward layer.

[0078] The feature fusion layer performs feature fusion on the final spatial feature map, the final temporal feature map and the network traffic features output by the batch normalization activation layer.

[0079] The traffic classification model can extract features from network traffic data from different dimensions and scales, effectively avoiding feature loss and improving the accuracy of network security situation assessment.

[0080] Step 203: Calculate the network security situation value according to the attack type of each network traffic data to determine the network security situation corresponding to the network traffic data set.

[0081] In an exemplary embodiment, the attack types include: normal, analysis attack, reconnaissance attack, fuzz testing, denial of service, Trojan attack, vulnerability code, worm, backdoor and penetration attack.

[0082] Step 203 includes: determining the attack impact of each attack type according to the characteristics of the network traffic, and calculating the network security situation value according to the attack type of each network traffic data and the attack impact of each attack type.

[0083] Specifically, the following formula is used to determine the attack impact of the i-th attack type:

[0084] E i =C i +I i +A i ;

[0085] Among them, E i is the attack impact of the i-th attack type, C i is the confidentiality index value of the i-th attack type, I i is the integrity index value of the i-th attack type, A i is the availability index value of the ith attack type. The confidentiality index value, integrity index value, and availability index value of each attack type are determined according to the vulnerability scoring system and the characteristics of the attack type in the network traffic data. Specifically, the impact level range of the confidentiality index value, integrity index value, and availability index value is first determined according to the vulnerability scoring system, and then the impact of the attack is determined according to the characteristics of the attack type in the network traffic data.

[0086] In an exemplary embodiment, the impact levels and values ​​of confidentiality, integrity, and availability are shown in Table 1.

[0087] Table 1 Impact levels and values ​​of confidentiality, integrity, and availability

[0088] index Impact Level Value Confidentiality None / Low / High 0 / 0.25 / 0.5 Completeness None / Low / High 0 / 0.25 / 0.5 Availability None / Low / High 0 / 0.25 / 0.5

[0089] The network security situation value is calculated using the following formula:

[0090]

[0091] Among them, V is the network security situation value, M is the number of attack types of network traffic data in the network traffic data set, and P i is the number of network traffic data of the i-th attack type in the network traffic dataset, E i is the attack impact of the i-th attack type, and N is the number of network traffic data in the network traffic dataset.

[0092] In order to verify the effectiveness of the network security situation assessment method provided in this application, the UNSW-NB15 dataset was used for training and testing. The specific process is as follows.

[0093] (1) Obtain and process network traffic data, and divide the network traffic data into training set and test set.

[0094] The UNSW-NB15 dataset is a dataset obtained by the Australian Cyber ​​Security Center Laboratory using a traffic generator to simulate a real attack environment. This dataset contains real modern network activity data, and the sample distribution of the training set and the test set is similar, which is more suitable for the research requirements of network security situation awareness. The UNSW-NB15 dataset contains four datasets: UNSW_NB15_1.csv, UNSW_NB15_2.csv, UNSW_NB15_3.csv, and UNSW_NB15_4.csv. This experiment merges the two parts of UNSW-NB15_2.csv and UNSW-NB15_3.csv as the training set of the model, and UNSW-NB15_4.csv as the test set of the model.

[0095] In order to meet the input requirements of the model, the non-numeric data is digitized, the Protocol, State, and Service in the data set are uniquely encoded, and the data set is normalized using the maximum-minimum normalization method:

[0096]

[0097] Among them, X is the original data in the data set, X′ is the normalized data, maxB and minB represent the maximum and minimum values ​​in attribute B respectively.

[0098] (2) Construct a traffic classification model.

[0099] (3) Train the traffic classification model and test the trained traffic classification model using the test set.

[0100] (4) Determine the attack impact of each type of network traffic data based on the characteristics of the network traffic data.

[0101] In the UNSW-NB15 dataset, there are 10 network states: Normal, Shellcode, Worms, Exploits, Backdoor, Analysis, Reconnaissance, Fuzzers, DoS, and Generic. Normal is the normal network state; Shellcode is a small piece of code used as a payload when exploiting a software vulnerability; Worms is a worm virus that spreads to other computers by replicating itself; Exploits is a vulnerability exploit, in which attackers exploit security holes in the operating system or software to obtain information; Backdoor is a technology that bypasses the system security mechanism to access the target computer; Analysis includes various attacks such as port scanning, spam, and penetration; Reconnaissance is a reconnaissance attack that can simulate all attacks that collect information; Fuzzers is a fuzzy attack that can suspend the network or target program by providing randomly generated data to it; DoS is a denial of service attack that can suspend or stop the target computer or network; Generic is a technology applicable to all cipher blocks.

[0102] According to the characteristics of the attack types in the UNSW-NB15 dataset, the impact of each attack type is quantified, as shown in Table 2.

[0103] Table 2 Quantification of attack impact on UNSW-NB15 dataset

[0104] Attack Types Confidentiality Index Value Integrity Index Value Availability index value Normal 0 0 0 Analysis 0.5 0.2 0.3 Reconnaissance 0.5 0.1 0.1 Fuzzers 0.3 0.2 0.5 DoS 0 0.3 0.5 Generic 0.4 0.1 0.2 Shellcode 0.3 0.3 0.4 Worms 0.3 0.3 0.3 Exploits 0.2 0.2 0.3 Backdoor 0.5 0.2 0.1

[0105] (5) Calculate the network security situation value.

[0106] In the UNSW-NB15 dataset, N is set to 2000.

[0107] like Figure 6 As shown in the figure, in the ten-class experiment of UNSW-NB15, the predicted value of the traffic classification model is basically in line with the true value. The accuracy of the traffic classification model is 82.4%, the precision is 82.13%, and the F1 value is 80.56%. It can be seen that the classification effect is relatively good.

[0108] Based on the same inventive concept, the embodiment of the present application also provides a network security situation assessment system for implementing the network security situation assessment method involved above. The implementation scheme for solving the problem provided by the system is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more network security situation assessment system embodiments provided below can refer to the limitations of the network security situation assessment method above, and will not be repeated here.

[0109] In an exemplary embodiment, Figure 7 As shown, a network security situation assessment system is provided, including: a flow data acquisition module 701, an attack type determination module 702 and a situation value calculation module 703.

[0110] The flow data acquisition module 701 is used to acquire a network flow data set, wherein the network flow data set includes a plurality of network flow data within a set period of time.

[0111] The attack type determination module 702 is connected to the traffic data acquisition module 701, and the attack type determination module 702 is used to classify each network traffic data in the network traffic data set based on the traffic classification model to determine the attack type of each network traffic data. The traffic classification model is pre-trained based on a training set using a sparrow search algorithm, and the training set includes multiple groups of network traffic sample data and corresponding attack types. The traffic classification model is constructed based on a multi-scale convolutional attention mechanism and a residual network.

[0112] The situation value calculation module 703 is connected to the attack type determination module 702, and the situation value calculation module 703 is used to calculate the network security situation value according to the attack type of each network traffic data to determine the network security situation corresponding to the network traffic data set.

[0113] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0114] In an exemplary embodiment, a computer-readable storage medium is provided, storing a computer program, and when the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0115] In an exemplary embodiment, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0116] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0117] In this application, all actions to obtain signals, information or data are carried out in compliance with the relevant data protection laws and policies of the country where they are located and with the authorization given by the owner of the corresponding device.

[0118] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ReadOnlyMemory, ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (Magnetoresistive RandomAccess Memory, MRAM), ferroelectric random access memory (Ferroelectric RandomAccess Memory, FRAM), phase change memory (Phase Change Memory, PCM), graphene memory, etc. Volatile memory can include random access memory (RandomAccess Memory, RAM) or external cache memory, etc. By way of illustration and not limitation, RAM may be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0119] The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. The non-relational database may include a distributed database based on blockchain, etc., but is not limited thereto. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but is not limited thereto.

[0120] The technical features of the above embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0121] This article uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method and core ideas of this application. At the same time, for those skilled in the art, according to the ideas of this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting this application.

Claims

1. A network security situation assessment method, characterized in that: The network security situation assessment method comprises: Acquire a network traffic data set; the network traffic data set includes a plurality of network traffic data within a set time period; Based on the traffic classification model, each network traffic data in the network traffic data set is classified to determine the attack type of each network traffic data; the traffic classification model is pre-trained based on a training set using a sparrow search algorithm, and the training set includes multiple groups of network traffic sample data and corresponding attack types; the traffic classification model is constructed based on a multi-scale convolutional attention mechanism and a residual network; According to the attack type of each network traffic data, a network security situation value is calculated to determine the network security situation corresponding to the network traffic data set.

2. The network security situation assessment method according to claim 1, characterized in that: The traffic classification model includes a convolution module, a first attention residual module, a second attention residual module, a third attention residual module, a fourth attention residual module, a fully connected module and a random inactivation module connected in sequence; The first attention residual module includes an attention residual block; The second attention residual module includes two attention residual blocks connected in sequence; The third attention residual module includes three attention residual blocks connected in sequence; The fourth attention residual module includes an attention residual block; The attention residual block is constructed based on a multi-scale convolutional attention mechanism and a residual network.

3. The network security situation assessment method according to claim 2, characterized in that: The attention residual block includes a first convolutional layer, a batch normalization activation layer, a multi-scale convolutional attention mechanism layer and a second convolutional layer connected in sequence; the second convolutional layer is also residually connected to the first convolutional layer.

4. The network security situation assessment method according to claim 3 is characterized in that: The multi-scale convolutional attention mechanism layer includes: a spatial convolution layer, a temporal convolution layer, a first adaptive pooling layer, a second adaptive pooling layer, a first feedforward layer, a second feedforward layer and a feature fusion layer; The spatial convolution layer and the temporal convolution layer are both connected to the batch normalization activation layer; the first adaptive pooling layer is connected to the spatial convolution layer; the second adaptive pooling layer is connected to the temporal convolution layer; the first feedforward layer is connected to the first adaptive pooling layer; the second feedforward layer is connected to the second adaptive pooling layer; the feature fusion layer is respectively connected to the first feedforward layer and the second feedforward layer, and is residually connected to the batch normalization activation layer; The spatial convolution layer uses lateral convolution to extract the spatial features of the network traffic features output by the batch normalization activation layer; the first adaptive pooling layer performs adaptive average pooling in the x-direction and the y-direction on the spatial features to obtain a spatial feature map in the x-direction and a spatial feature map in the y-direction; the first feedforward layer performs output dimension mapping on the spatial feature map in the x-direction and the spatial feature map in the y-direction to obtain a final spatial feature map; The temporal convolution layer uses vertical convolution to extract the temporal features of the network traffic features output by the batch normalization activation layer; the second adaptive pooling layer performs adaptive average pooling in the x-direction and the y-direction on the temporal features to obtain a temporal feature map in the x-direction and a temporal feature map in the y-direction; the second feedforward layer performs output dimension mapping on the temporal feature map in the x-direction and the temporal feature map in the y-direction to obtain a final temporal feature map; The feature fusion layer performs feature fusion on the final spatial feature map, the final temporal feature map and the network traffic features output by the batch normalization activation layer.

5. The network security situation assessment method according to claim 4 is characterized in that: The horizontal convolution sequentially uses a 3×1 convolution block, a 5×1 convolution block, a 7×1 convolution block, and a 3×1 convolution block to extract flow features of different scales in the spatial dimension to obtain spatial features; The vertical convolution sequentially uses a 1×3 convolution block, a 1×5 convolution block, a 1×7 convolution block, and a 1×3 convolution block to extract flow features of different scales in the time dimension to obtain a time feature.

6. The network security situation assessment method according to claim 1, characterized in that: Calculate the network security situation value based on the attack type of each network traffic data, including: Determine the attack impact of each attack type based on the characteristics of network traffic; The network security situation value is calculated based on the attack type of each network traffic data and the attack impact of each attack type.

7. The network security situation assessment method according to claim 6, characterized in that: The attack impact of the i-th attack type is determined using the following formula: E i =C i +I i +A i ; Among them, E i is the attack impact of the i-th attack type, C i is the confidentiality index value of the i-th attack type, I i is the integrity index value of the i-th attack type, A i is the availability index value of the ith attack type. The confidentiality index value, integrity index value, and availability index value of each attack type are determined according to the vulnerability scoring system and the characteristics of the attack type in the network traffic data.

8. The network security situation assessment method according to claim 6, characterized in that: The network security situation value is calculated using the following formula: Among them, V is the network security situation value, M is the number of attack types of network traffic data in the network traffic data set, and P i is the number of network traffic data of the i-th attack type in the network traffic dataset, E i is the attack impact of the i-th attack type, and N is the number of network traffic data in the network traffic dataset.

9. A network security situation assessment system, applied to the network security situation assessment method according to any one of claims 1 to 8, characterized in that: The network security situation assessment system comprises: A flow data acquisition module is used to acquire a network flow data set; the network flow data set includes a plurality of network flow data within a set time period; An attack type determination module is connected to the traffic data acquisition module and is used to classify each network traffic data in the network traffic data set based on a traffic classification model to determine the attack type of each network traffic data; the traffic classification model is pre-trained based on a training set using a sparrow search algorithm, and the training set includes multiple groups of network traffic sample data and corresponding attack types; the traffic classification model is constructed based on a multi-scale convolutional attention mechanism and a residual network; The situation value calculation module is connected to the attack type determination module and is used to calculate the network security situation value according to the attack type of each network flow data to determine the network security situation corresponding to the network flow data set.

10. A computer device comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the network security situation assessment method according to any one of claims 1 to 8.

Images