Network security situation awareness system and method based on big data

Abstract

The invention discloses a network security situation awareness system and method based on big data, and relates to the technical field of network situation awareness. The system comprises a data acquisition module, a data processing module, a security architecture generation module, a security coefficient calculation module, a priority coefficient calculation module and a detection execution module. The data acquisition module is used for collecting real-time network flow data and other security equipment data; the data processing module is used for preprocessing data, generating a sample data set and training an equipment demand model; the security architecture generation module is used for determining the number of security devices, generating a security architecture diagram and converting the security architecture diagram into a security architecture multi-way tree; the safety coefficient calculation module is used for calculating a first safety coefficient and a second safety coefficient; the priority coefficient calculation module is used for calculating a priority coefficient and generating a detection sequence; and the detection execution module is used for detecting nodes in the security architecture multi-way tree according to the detection sequence and implementing a closed-loop mechanism.

Description

Technical Field

[0001] The present invention belongs to the technical field of network situation awareness, and specifically relates to a network security situation awareness system and method based on big data. Background Art

[0002] With the rapid development of information technology and the widespread application of the Internet, network security issues have become increasingly prominent and have become one of the major challenges facing enterprises and organizations. Traditional network security management methods have been unable to cope with the complex threats in the modern network environment. In order to better deal with network security issues, a new security management method is needed that can monitor network status in real time, predict potential threats, and take timely measures.

[0003] At present, most enterprises adopt a static security management strategy, that is, to protect network boundaries and internal resources by deploying security facilities such as firewalls and intrusion detection systems. However, with the continuous evolution of attack methods, traditional passive defense methods can no longer meet the needs of modern network security. Traditional security management systems often have the following shortcomings:

[0004] 1. Lack of dynamic perception capabilities: Most existing security management systems rely on fixed rule bases and preset defense strategies and are unable to perceive changes in the network environment and potential threats in real time.

[0005] 2. Unreasonable resource allocation: Due to the lack of an effective resource optimization mechanism, enterprises’ investment in safety facilities is often not fully utilized, resulting in a waste of resources.

[0006] 3. Untimely emergency response: When faced with sudden security incidents, traditional security management systems often fail to respond in a timely manner due to the lack of an effective early warning mechanism, resulting in increased losses.

[0007] 4. Lack of quantitative evaluation methods: The existing safety management system lacks quantitative evaluation methods for the effectiveness of safety facilities and cannot accurately evaluate the actual effects of safety facilities. Summary of the invention

[0008] In order to overcome the shortcomings and deficiencies of the above-mentioned prior art, the first purpose of the present invention is to provide a network security situation awareness system based on big data; the second purpose of the present invention is to provide a network security situation awareness method based on big data.

[0009] The first object of the present invention adopts the following technical solution:

[0010] A network security situation awareness system based on big data, the system includes a data acquisition module, a data processing module, a security architecture generation module, a safety factor calculation module, a priority factor calculation module and a detection execution module;

[0011] The data collection module is used to collect real-time network traffic data and other security device data;

[0012] The data processing module is used to preprocess data, generate sample data sets, and train equipment demand models;

[0013] The security architecture generation module is used to determine the number of security devices, generate a security architecture diagram, and convert it into a security architecture multi-branch tree;

[0014] The safety factor calculation module is used to calculate the first safety factor and the second safety factor;

[0015] The priority coefficient calculation module is used to calculate the priority coefficient and generate a detection sequence;

[0016] The detection execution module is used to detect the nodes in the multi-branch tree of the security architecture according to the detection sequence and implement a closed-loop mechanism.

[0017] The second object of the present invention adopts the following technical solution:

[0018] The network security situation awareness method based on big data is used to realize the network security situation awareness system based on big data. The method flow is as follows:

[0019] Step 1: Obtain the security architecture diagram of the target network area and convert it into a security architecture multi-branch tree;

[0020] Step 2: Calculate the first safety factor based on the full life cycle information of the safety facility to obtain the first safety factor;

[0021] Step 3: Build a safety status prediction model to obtain predicted safety status information;

[0022] Step 4: Calculate a second safety factor based on the predicted safety status information;

[0023] Step 5: obtaining a priority coefficient based on the first safety coefficient and the second safety coefficient, and determining a detection sequence of each node in the security architecture multi-branch tree according to the priority coefficient;

[0024] Step 6: Detect each node in the security architecture multi-branch tree based on the detection sequence, and mark the detected nodes; when all nodes in the security architecture multi-branch tree are marked, clear the marks corresponding to each node, based on the closed-loop mechanism, ensure that a new detection cycle can be restarted after each node is detected.

[0025] Preferably, step one is as follows:

[0026] S11, determining the number of security devices; obtaining the network scale of the target network area, dividing the target network area into X sub-network areas according to the network scale; obtaining the flow data of the X sub-network areas, and determining the number of security devices in the sub-network areas according to the flow data;

[0027] S12, building equipment demand model;

[0028] Collect historical traffic data and historical equipment demand data to generate sample data sets;

[0029] The sample data set is divided into a sample training set and a sample test set, and a regression network is constructed. The historical traffic data in the sample training set is used as the input data of the regression network, and the historical equipment demand in the sample training set is used as the output data of the regression network. The regression network is trained to obtain an initial regression network for predicting real-time equipment demand; the initial regression network is tested using the sample test set, and the output of the initial regression network that satisfies a preset error threshold is used as the equipment demand model;

[0030] S13, input the traffic data into the device demand model, obtain the device demand of the sub-network area, determine the corresponding number of security devices according to the device demand of the sub-network area and the mapping relationship; obtain the corresponding number of secondary security devices based on the number of security devices, obtain the number of main security devices based on X sub-network areas, generate a security architecture diagram based on the number of secondary security devices, the number of main security devices and the total number of security devices, X is an integer greater than 1, and the security architecture diagram shows the number of security devices in each sub-network area, and the distribution of security devices in the network, including the relationship between the main device and the secondary device; calculate the total number of main security devices based on the summary information of the X sub-network areas;

[0031] S14. Obtain a security architecture diagram of the target network area and convert it into a security architecture multi-branch tree. The security architecture multi-branch tree includes a root node, A internal nodes, and B leaf nodes, where B>A>0; wherein the target network area is the area where the network architecture is located.

[0032] Preferably, step 2 is as follows:

[0033] Obtaining the full life cycle information of the security facilities in the target network area, and calculating the first safety factor based on the full life cycle information of the security facilities, the first safety factor being used to measure the comprehensive effectiveness of the security facilities in the network area; the full life cycle information of the security facilities includes the full life cycle information of the total facilities, the full life cycle information of the primary facilities, and the full life cycle information of the secondary facilities;

[0034] The full life cycle information of safety facilities includes deployment date, retirement date, real-time date, number of safety incidents and procurement cost. The first safety factor calculation formula is as follows:

[0035]

[0036] Among them, Safe1 is the first safety factor; e1 is the difference between the real-time date and the deployment date, that is, the deployment time of the facility; e2 is the difference between the retirement date and the real-time date, that is, the remaining life of the facility; f1 is the actual cost-effectiveness ratio, that is, the ratio of the actual procurement cost to the expected benefit; f2 is the standard cost-effectiveness ratio, that is, the ratio of the standard procurement cost to the standard benefit; g1 is the number of real-time safety events; g2 is the number of standard safety events; h1 is the real-time performance index; h2 is the standard performance index; γ1, γ2, γ3 and γ4 are weight factors used to adjust the influence of various parameters on the first safety factor; ln is a logarithmic function with e as the base, and e is a natural number.

[0037] Preferably, step three is as follows:

[0038] Obtain the historical security status information corresponding to each node, train a security status prediction model based on the historical security status information, input the acquired real-time security status information into the security status prediction model, obtain the predicted security status information, thereby obtaining the predicted security status information corresponding to each node in the security architecture multi-branch tree. The root node represents the total facility, the internal node represents the main facility, and the leaf node represents the secondary facility.

[0039] Preferably, step 4 is as follows:

[0040] Calculating a second safety factor based on the predicted safety status information, the second safety factor being used to measure the predicted safety status of each node in the network architecture;

[0041] The predicted safety status information includes the predicted load level, the predicted access frequency, the predicted abnormal activity index, and the predicted protection level. The second safety factor calculation formula is as follows:

[0042]

[0043] Among them, Safe2 is the second safety factor; m y is the predicted load level; m b is the standard load level; p y To predict the access frequency; p y is the average access frequency; s is the predicted abnormal activity index; j is the maximum abnormal activity index; q y is the predicted protection level; q is the highest protection level; δ1, δ2, δ3 and δ4 are weight factors used to adjust the influence of various parameters on the second safety factor.

[0044] Preferably, step five is as follows:

[0045] The priority coefficient is obtained by combining the first safety factor based on the whole life cycle of the facility and the second safety factor based on the predicted safety status to determine which nodes need priority attention; the detection order is dynamically adjusted by continuously updating the priority coefficient;

[0046] The detection sequence of each node in the multi-branch tree of the security architecture is determined according to the priority coefficient. The detection sequence is determined specifically as follows: a mapping relationship is established between the priority coefficient and the corresponding node, and the corresponding nodes are arranged in descending order according to the size of the priority coefficient, so as to determine the detection sequence; the priority coefficient calculation formula is as follows:

[0047] W = ω1Safe1 + ω2Safe2;

[0048] Wherein, W is the priority coefficient, ω1 and ω2 are weight factors corresponding to the first safety factor Safe1 and the second safety factor Safe2, respectively, which are used to adjust the influence of various parameters on the priority coefficient.

[0049] Preferably, step six is ​​as follows:

[0050] S61, determining a detection sequence; and detecting each node in the security architecture multi-branch tree in order according to the determined detection sequence;

[0051] S62, node marking: marking the nodes that have completed detection and recording their detected status;

[0052] S63, closed-loop mechanism implementation; when all nodes in the security architecture multi-branch tree are marked as detected, the marks of all nodes are cleared and a new detection cycle is restarted;

[0053] S64, dynamically adjust the detection sequence; in each detection cycle, continuously update the first safety factor, the second safety factor and the priority factor to reflect the latest network status and security situation; dynamically adjust the detection sequence according to the latest first safety factor, the second safety factor and the priority factor to ensure that high-risk nodes are detected first and low-risk nodes are detected only when necessary;

[0054] S65. Establish a closed-loop feedback mechanism; feed back the results of each test into the safety status prediction model to adjust the model parameters and improve the prediction accuracy;

[0055] S66, periodic report generation: after each detection cycle, a periodic network security situation report is generated.

[0056] Preferably, step three also includes a training method for the security status prediction model, which is as follows: presetting the sliding step size and the sliding window length; converting the historical security status information into multiple training samples using a sliding window method, using the training samples as the input of the security status prediction model, and predicting the historical security status information after the sliding step size as the output, using the subsequent historical security status information of each training sample as the prediction target, and using the prediction accuracy as the training target to train the security status prediction model; generating a security status prediction model that predicts the security status information at future moments based on the real-time security status information.

[0057] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0058] 1. The present invention collects real-time network traffic data and other security device data, generates sample data sets using historical data, trains device demand models, determines the number of security devices, generates security architecture diagrams, and converts them into security architecture multi-branch trees, thereby improving the accuracy and adaptability of security architecture design. The number and distribution of security devices can be dynamically adjusted according to the actual network traffic and historical device demand, ensuring effective use of resources.

[0059] 2. The present invention calculates the first safety factor based on the full life cycle information of the safety facility, and calculates the second safety factor in combination with the predicted safety status information. The safety status of the network is comprehensively evaluated through these two coefficients, making the safety assessment more comprehensive and accurate; the priority coefficient is calculated, and a detection sequence is generated to ensure that high-risk nodes are detected first. By dynamically adjusting the detection order, high-risk nodes are processed first, which improves the efficiency and pertinence of detection and reduces resource waste.

[0060] 3. The present invention adopts a sliding window method and makes full use of historical data for training, which improves the generalization ability and prediction accuracy of the model. The results of each detection are fed back to the safety status prediction model to adjust the model parameters and improve the prediction accuracy. Through the closed-loop feedback mechanism, the safety status prediction model can continuously learn and optimize, thereby improving the prediction accuracy and the system's adaptability. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0062] Figure 1 The module diagram of the network security situation awareness system based on big data of the present invention is shown;

[0063] Figure 2 A flowchart of a network security situation awareness method based on big data of the present invention is shown;

[0064] Figure 3 A flow chart showing the closed loop mechanism of the present invention. DETAILED DESCRIPTION

[0065] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0066] Example 1: See Figure 1 As shown, the network security situation awareness system based on big data of this embodiment includes a data acquisition module, a data processing module, a security architecture generation module, a safety factor calculation module, a priority factor calculation module and a detection execution module.

[0067] Data collection module: used to collect real-time network traffic data and other security device data.

[0068] Data processing module: used to preprocess data, generate sample data sets, and train equipment demand models.

[0069] Security architecture generation module: used to determine the number of security devices, generate a security architecture diagram, and convert it into a security architecture multi-branch tree.

[0070] Safety factor calculation module: used to calculate the first safety factor and the second safety factor.

[0071] Priority coefficient calculation module: used to calculate the priority coefficient and generate the detection sequence.

[0072] Detection execution module: used to detect nodes in the multi-branch tree of the security architecture according to the detection sequence and implement a closed-loop mechanism.

[0073] Beneficial effects of this embodiment: Through big data analysis and machine learning technology, comprehensive perception and dynamic management of network security situation are achieved. The system consists of multiple modules, covering the entire process from the construction of security architecture to the prediction and detection of security status. Through closed-loop mechanism and dynamic adjustment strategy, the efficiency and effect of network security protection are ensured.

[0074] Example 2: See Figure 2 As shown, the network security situation awareness method based on big data in this embodiment has the following process:

[0075] Step 1: Obtain the security architecture diagram of the target network area and convert it into a security architecture multi-branch tree.

[0076] S11. Determine the number of safety devices.

[0077] Obtain the network scale of the target network area, and divide the target network area into X sub-network areas according to the network scale; obtain the flow data of the X sub-network areas, and determine the number of security devices in the sub-network areas according to the flow data;

[0078] S12. Build equipment demand model.

[0079] Collect historical traffic data and historical equipment demand data to generate sample data sets;

[0080] The sample data set is divided into a sample training set and a sample test set, a regression network is constructed, the historical traffic data in the sample training set is used as the input data of the regression network, and the historical equipment demand in the sample training set is used as the output data of the regression network. The regression network is trained to obtain an initial regression network for predicting real-time equipment demand;

[0081] The initial regression network is tested using a sample test set, and the output of the initial regression network that satisfies a preset error threshold is used as the equipment demand model.

[0082] S13. Input the traffic data into the device demand model to obtain the device demand of the sub-network area, and determine the corresponding number of security devices according to the device demand of the sub-network area and the mapping relationship. Obtain the corresponding number of secondary security devices based on the number of security devices, obtain the number of primary security devices based on X sub-network areas, and generate a security architecture diagram based on the number of secondary security devices, the number of primary security devices, and the total number of security devices, where X is an integer greater than 1. The security architecture diagram shows the number of security devices in each sub-network area and the distribution of security devices in the network, including the relationship between primary devices and secondary devices.

[0083] On this basis, the total number of main security devices is calculated according to the summary information of X sub-network areas.

[0084] It should be noted that the "secondary" and "primary" in this embodiment refer to different positions in the network hierarchy, with the primary device usually being at a higher level and the secondary device being at a level closer to the user.

[0085] S14. Obtain a security architecture diagram of the target network area and convert it into a security architecture multi-branch tree. The security architecture multi-branch tree includes a root node, A internal nodes, and B leaf nodes, where B>A>0; wherein the target network area is the area where the network architecture is located.

[0086] Root node: represents the entire network area or the top-level security facility.

[0087] Internal nodes: represent the main security facilities, which are usually located at a higher level, such as firewalls, core routers, etc.

[0088] Leaf nodes: represent secondary security facilities, usually devices directly connected to end users or devices, such as access layer switches, terminal workstations, etc.

[0089] For example, a company's security architecture multitree is as follows:

[0090] Root Node (External Firewall)

[0091] Internal Node 1 (Core Router)

[0092] Leaf node 1 (Finance department switch)

[0093] Leaf node 2 (Human Resources Department switch)

[0094] Internal Node 2 (Internal Firewall)

[0095] Leaf node 3 (R&D department switch)

[0096] Leaf node 4 (sales department switch)

[0097] Step 2: Calculate the first safety factor based on the full life cycle information of the safety facility to obtain the first safety factor.

[0098] S21. Obtain full life cycle information of security facilities in the target network area, and calculate a first safety factor based on the full life cycle information of the security facilities, where the first safety factor is used to measure the comprehensive effectiveness of the security facilities in the network area.

[0099] The full life cycle information of safety facilities includes the full life cycle information of the total facility, the full life cycle information of the main facility and the full life cycle information of the secondary facility.

[0100] The safety facility life cycle information includes deployment date, retirement date, real-time date, number of safety incidents, and procurement cost. The method for calculating the first safety factor based on the safety facility life cycle information includes:

[0101]

[0102] Among them, Safe1 is the first safety factor; e1 is the difference between the real-time date and the deployment date, that is, the deployment time of the facility; e2 is the difference between the retirement date and the real-time date, that is, the remaining life of the facility; f1 is the actual cost-effectiveness ratio, that is, the ratio of the actual procurement cost to the expected benefit; f2 is the standard cost-effectiveness ratio, that is, the ratio of the standard procurement cost to the standard benefit; g1 is the number of real-time safety events; g2 is the number of standard safety events; h1 is the real-time performance index; h2 is the standard performance index; γ1, γ2, γ3 and γ4 are weight factors used to adjust the influence of various parameters on the first safety factor; ln is a logarithmic function with e as the base, and e is a natural number.

[0103] Step 3: Build a safety status prediction model to obtain predicted safety status information.

[0104] S31. Obtain the historical security status information corresponding to each node, train a security status prediction model based on the historical security status information, input the acquired real-time security status information into the security status prediction model, obtain the predicted security status information, thereby obtaining the predicted security status information corresponding to each node in the multi-branch tree of the security architecture, the root node represents the total facility, the internal node represents the main facility, and the leaf node represents the secondary facility.

[0105] The training method of the safety status prediction model is:

[0106] Preset the sliding step size and sliding window length; convert the historical security status information into multiple training samples using the sliding window method, use the training samples as the input of the security status prediction model, and use the historical security status information after the predicted sliding step size as the output. The subsequent historical security status information of each training sample is used as the prediction target. The security status prediction model is trained with the prediction accuracy as the training target; generate a security status prediction model that predicts the security status information at future moments based on the real-time security status information.

[0107] Step 4: Calculate a second safety factor based on the predicted safety status information.

[0108] S41. Calculate a second safety factor based on the predicted safety status information, where the second safety factor is used to measure the predicted safety status of each node in the network architecture.

[0109] The predicted safety status information includes a predicted load level, a predicted access frequency, a predicted abnormal activity index, and a predicted protection level. The method for calculating the second safety factor based on the predicted safety status information includes:

[0110]

[0111] Among them, Safe2 is the second safety factor; m y is the predicted load level; mb is the standard load level; p y To predict the access frequency; p y is the average access frequency; s is the predicted abnormal activity index; j is the maximum abnormal activity index; q y is the predicted protection level; q is the highest protection level; δ1, δ2, δ3 and δ4 are weight factors used to adjust the influence of various parameters on the second safety factor.

[0112] Step 5: Obtain a priority coefficient based on the first safety factor and the second safety factor, and determine a detection sequence for each node in the security architecture multi-branch tree according to the priority coefficient.

[0113] The priority coefficient is obtained by combining the first safety factor based on the entire life cycle of the facility and the second safety factor based on the predicted safety status to determine which nodes need priority attention; by continuously updating the priority coefficient, the detection order is dynamically adjusted to adapt to changes in the network environment.

[0114] The detection sequence of each node in the multi-branch tree of the security architecture is determined according to the priority coefficient. The detection sequence is determined specifically as follows: a mapping relationship is established between the priority coefficient and the corresponding node, and the corresponding nodes are arranged in descending order according to the size of the priority coefficient to determine the detection sequence. This ensures that nodes with higher risks or worse status are detected first.

[0115] The method of determining the priority factor based on the first safety factor and the second safety factor includes:

[0116] W = ω1Safe1 + ω2Safe2;

[0117] Wherein, W is the priority coefficient, ω1 and ω2 are weight factors corresponding to the first safety factor Safe1 and the second safety factor Safe2, respectively, which are used to adjust the influence of various parameters on the priority coefficient.

[0118] Step 6: Detect each node in the security architecture multi-branch tree based on the detection sequence, and mark the detected nodes; when all nodes in the security architecture multi-branch tree are marked, clear the marks corresponding to each node. Based on the closed-loop mechanism, ensure that a new detection cycle can be restarted after each node is detected.

[0119] Refer to 3, the details are as follows:

[0120] S61. Determine the detection order.

[0121] According to the determined detection sequence, each node in the security architecture multi-branch tree is detected in order. The detection sequence is determined based on the priority coefficient, which combines the first safety factor and the second safety factor to ensure that high-risk nodes are detected first;

[0122] S62, node marking.

[0123] Mark the nodes that have completed the detection and record their detected status. The marking mechanism helps to track which nodes have been detected and which nodes have not been detected, which facilitates subsequent detection records and management.

[0124] S63, closed-loop mechanism is realized.

[0125] When all nodes in the security architecture multi-branch tree are marked as detected, the marks of all nodes are cleared and a new detection cycle is restarted; the closed-loop mechanism ensures that each node is detected at least once in a detection cycle, thereby achieving comprehensive coverage of the entire network.

[0126] S64. Dynamically adjust the detection sequence.

[0127] In each detection cycle, the first safety factor, second safety factor and priority factor are continuously updated to reflect the latest network status and security situation;

[0128] The detection sequence is dynamically adjusted according to the latest first safety factor, second safety factor and priority factor to ensure that high-risk nodes are detected first and low-risk nodes are detected only when necessary.

[0129] S65. Establish a closed-loop feedback mechanism.

[0130] Feedback the results of each test into the safety status prediction model to adjust the model parameters and improve the prediction accuracy;

[0131] S66. Generate periodic report.

[0132] After each detection cycle, a periodic network security situation report is generated to summarize the security detection situation during the cycle, the problems found, and the measures taken.

[0133] The beneficial effects of this embodiment are as follows: through a closed-loop mechanism and continuous improvement measures, the network security situation awareness method based on big data proposed in this embodiment can effectively realize comprehensive awareness and dynamic adjustment of network security situation, ensuring the security and stability of the network environment. This method can not only timely discover and deal with potential security threats, but also provide scientific basis and technical support for network security management through long-term trend analysis and risk management.

[0134] The weight factors of the present invention are used to measure the degree of influence of different factors or variables on a certain result or decision. The definition of weight coefficient refers to the value assigned to each factor when comparing and evaluating multiple factors to reflect its importance or priority. These weight coefficients can be determined according to specific circumstances and needs, and are usually jointly formulated and confirmed by professionals or relevant stakeholders. By reasonably setting the weight coefficients, it can help the program or system make decisions or predictions more accurately.

[0135] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

[0136] The preferred embodiments of the present invention disclosed above are only used to help explain the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to only specific implementation methods. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A network security situation awareness system based on big data, characterized by: The system includes a data acquisition module, a data processing module, a safety architecture generation module, a safety factor calculation module, a priority factor calculation module and a detection execution module; The data collection module is used to collect real-time network traffic data and other security device data; The data processing module is used to preprocess data, generate sample data sets, and train equipment demand models; The security architecture generation module is used to determine the number of security devices, generate a security architecture diagram, and convert it into a security architecture multi-branch tree; The safety factor calculation module is used to calculate the first safety factor and the second safety factor; The priority coefficient calculation module is used to calculate the priority coefficient and generate a detection sequence; The detection execution module is used to detect the nodes in the multi-branch tree of the security architecture according to the detection sequence and implement a closed-loop mechanism.

2. A network security situation awareness method based on big data, used to implement the network security situation awareness system based on big data as claimed in claim 1, characterized in that: The method flow is as follows: Step 1: Obtain the security architecture diagram of the target network area and convert it into a security architecture multi-branch tree; Step 2: Calculate and obtain the first safety factor based on the full life cycle information of the safety facility; Step 3: Build a safety status prediction model to obtain predicted safety status information; Step 4: Calculate and obtain a second safety factor based on the predicted safety status information; Step 5: Calculate a priority coefficient based on the first safety coefficient and the second safety coefficient, and determine a detection sequence for each node in the security architecture multi-branch tree according to the priority coefficient; Step 6: Detect each node in the security architecture multi-branch tree in order based on the detection sequence, mark the nodes that have completed the detection, and record their detected status; When all nodes in the security architecture multi-branch tree are marked, the marks corresponding to each node are cleared. Based on the closed-loop mechanism, it is ensured that a new detection cycle can be restarted after each node is detected. After each detection cycle, a periodic network security situation report is generated.

3. The network security situation awareness method based on big data according to claim 2 is characterized in that: The step 1 is specifically as follows: S11, determining the number of security devices; obtaining the network scale of the target network area, dividing the target network area into X sub-network areas according to the network scale; obtaining the flow data of the X sub-network areas, and determining the number of security devices in the sub-network areas according to the flow data; S12, building equipment demand model; Collect historical traffic data and historical equipment demand data to generate sample data sets; The sample data set is divided into a sample training set and a sample test set, a regression network is constructed, the historical traffic data in the sample training set is used as the input data of the regression network, and the historical equipment demand in the sample training set is used as the output data of the regression network. The regression network is trained to obtain an initial regression network for predicting real-time equipment demand; The initial regression network is tested using a sample test set, and an initial regression network that satisfies a preset error threshold is output as the equipment demand model; S13, inputting the traffic data into the device demand model to obtain the device demand in the sub-network area, and determining the corresponding number of security devices according to the device demand in the sub-network area and the mapping relationship; Based on the number of security devices, the corresponding number of secondary security devices is obtained, based on X sub-network areas, the number of primary security devices is obtained, and based on the number of secondary security devices, the number of primary security devices and the total number of security devices, a security architecture diagram is generated, where X is an integer greater than 1, and the security architecture diagram shows the number of security devices in each sub-network area, and the distribution of security devices in the network, including the relationship between primary devices and secondary devices; based on the summary information of X sub-network areas, the total number of primary security devices is calculated; S14. Obtain a security architecture diagram of the target network area and convert it into a security architecture multi-branch tree. The security architecture multi-branch tree includes a root node, A internal nodes, and B leaf nodes, where B>A>0; wherein the target network area is the area where the network architecture is located.

4. The network security situation awareness method based on big data according to claim 2 is characterized in that: The step 2 is specifically as follows: Obtaining the full life cycle information of the security facilities in the target network area, and calculating the first safety factor based on the full life cycle information of the security facilities, the first safety factor being used to measure the comprehensive effectiveness of the security facilities in the network area; the full life cycle information of the security facilities includes the full life cycle information of the total facilities, the full life cycle information of the primary facilities, and the full life cycle information of the secondary facilities; The full life cycle information of safety facilities includes deployment date, retirement date, real-time date, number of safety incidents and procurement cost. The first safety factor calculation formula is as follows: Among them, Safe1 is the first safety factor; e1 is the difference between the real-time date and the deployment date, that is, the deployment time of the facility; e2 is the difference between the retirement date and the real-time date, that is, the remaining life of the facility; f1 is the actual cost-effectiveness ratio, that is, the ratio of the actual procurement cost to the expected benefit; f2 is the standard cost-effectiveness ratio, that is, the ratio of the standard procurement cost to the standard benefit; g1 is the number of real-time safety events; g2 is the number of standard safety events; h1 is the real-time performance index; h2 is the standard performance index; γ1, γ2, γ3 and γ4 are weight factors used to adjust the influence of various parameters on the first safety factor; ln is a logarithmic function with e as the base, and e is a natural number.

5. The network security situation awareness method based on big data according to claim 2 is characterized in that: The step three is as follows: Obtain the historical security status information corresponding to each node, train a security status prediction model based on the historical security status information, input the acquired real-time security status information into the security status prediction model, obtain the predicted security status information, thereby obtaining the predicted security status information corresponding to each node in the security architecture multi-branch tree. The root node represents the total facility, the internal node represents the main facility, and the leaf node represents the secondary facility.

6. The network security situation awareness method based on big data according to claim 2 is characterized in that: The step 4 is specifically as follows: Calculating a second safety factor based on the predicted safety status information, the second safety factor being used to measure the predicted safety status of each node in the network architecture; The predicted safety status information includes the predicted load level, the predicted access frequency, the predicted abnormal activity index, and the predicted protection level. The second safety factor calculation formula is as follows: Among them, Safe2 is the second safety factor; m y is the predicted load level; m b is the standard load level; p y To predict the access frequency; p y is the average access frequency; s is the predicted abnormal activity index; j is the maximum abnormal activity index; q y is the predicted protection level; q is the highest protection level; δ1, δ2, δ3 and δ4 are weight factors used to adjust the influence of various parameters on the second safety factor.

7. The network security situation awareness method based on big data according to claim 2 is characterized in that: The step five is as follows: The priority coefficient is obtained by combining the first safety factor based on the whole life cycle of the facility and the second safety factor based on the predicted safety status to determine which nodes need priority attention; the detection order is dynamically adjusted by continuously updating the priority coefficient; The detection sequence of each node in the multi-branch tree of the security architecture is determined according to the priority coefficient. The detection sequence is determined specifically as follows: a mapping relationship is established between the priority coefficient and the corresponding node, and the corresponding nodes are arranged in descending order according to the size of the priority coefficient, so as to determine the detection sequence; the priority coefficient calculation formula is as follows: W = ω1Safe1 + ω2Safe2; Wherein, W is the priority coefficient, ω1 and ω2 are weight factors corresponding to the first safety factor Safe1 and the second safety factor Safe2, respectively, which are used to adjust the influence of various parameters on the priority coefficient.

8. The network security situation awareness method based on big data according to claim 2 is characterized in that: The step six also includes dynamically adjusting the detection sequence and establishing a closed-loop feedback mechanism, as follows: Dynamically adjust the detection sequence; in each detection cycle, continuously update the first safety factor, second safety factor and priority factor to reflect the latest network status and security situation; Dynamically adjust the detection sequence based on the latest first safety factor, second safety factor, and priority factor to ensure that high-risk nodes are detected first and low-risk nodes are detected only when necessary; Establish a closed-loop feedback mechanism; feed back the results of each test into the safety status prediction model to adjust the model parameters and improve prediction accuracy.

9. The network security situation awareness method based on big data according to claim 2 is characterized in that: The step three also includes a training method for the safety status prediction model, which is as follows: preset a sliding step size and a sliding window length; convert the historical safety status information into multiple training samples using a sliding window method, use the training samples as input of the safety status prediction model, predict the historical safety status information after the sliding step size as output, use the subsequent historical safety status information of each training sample as a prediction target, use the prediction accuracy as a training target, and train the safety status prediction model; Generate a security status prediction model that predicts security status information at future moments based on real-time security status information.

Images