Big data driven network and information security risk assessment method and system

Abstract

The embodiment of the invention provides a big data driven network and information security risk assessment method and system, and belongs to the technical field of wireless communication. The method comprises the following steps: obtaining network transmission data of a wireless communication network, and performing abnormal feature extraction on the network transmission data to obtain a target network node in the wireless communication network and initial security related data of the target network node; performing data preprocessing on the initial security related data to obtain target security related data, wherein the target security related data comprises target vulnerability data and target attack data; determining an association relationship between the target network nodes according to the target vulnerability data and the target attack data, and determining related network nodes corresponding to the target network nodes according to the association relationship; and obtaining associated security related data of the related network node, and performing risk assessment on the target network node by using a risk identification model according to the associated security related data and the target security related data to obtain a risk assessment result of the target network node.

Description

Technical Field

[0001] The present invention relates to the field of wireless communication technologies, and in particular to a big data driven network and information security risk assessment method and system. Background Art

[0002] With the rapid advancement of wireless communication technology, all walks of life have become increasingly dependent on wireless communication, making it the core infrastructure of many businesses and services. However, with the widespread popularity of wireless communication applications, the security issues it faces have become more severe. Existing technologies still have certain risks in preventing abnormal behaviors such as data theft and data attacks during wireless communications, which may seriously affect the security and reliability of wireless communications. Current network and information security risk assessment technologies often have deficiencies in capturing the complex correlations between network nodes during wireless communications. Therefore, related technologies may not be able to fully integrate and analyze the interactive relationships between different network nodes, thereby affecting the accurate identification and comprehensive assessment of potential security threats. Summary of the invention

[0003] The main purpose of the embodiments of the present invention is to provide a big data-driven network and information security risk assessment method and system, aiming to solve the problem that the relevant technology cannot fully integrate and analyze the interactive relationship between different network nodes, thereby affecting the accurate identification and comprehensive assessment of potential security threats.

[0004] In a first aspect, an embodiment of the present invention provides a big data driven network and information security risk assessment method, comprising: Obtaining network transmission data corresponding to the wireless communication network, and performing abnormal feature extraction on the network transmission data to obtain a target network node in the wireless communication network and initial security-related data corresponding to the target network node; Performing data preprocessing on the initial security-related data to obtain target security-related data, wherein the target security-related data includes target vulnerability data and target attack data; Determine the association relationship between the target network nodes according to the target vulnerability data and the target attack data, and determine the relevant network nodes corresponding to the target network nodes according to the association relationship; The associated security related data corresponding to the associated network node is obtained, and the risk assessment of the target network node is performed using a risk identification model according to the associated security related data and the target security related data to obtain a risk assessment result corresponding to the target network node.

[0005] In a second aspect, an embodiment of the present invention provides a big data driven network and information security risk assessment system, including: A data acquisition module, used to obtain network transmission data corresponding to the wireless communication network, and extract abnormal features from the network transmission data to obtain a target network node in the wireless communication network and initial security-related data corresponding to the target network node; A data processing module, used for performing data preprocessing on the initial security-related data to obtain target security-related data, wherein the target security-related data includes target vulnerability data and target attack data; A relationship analysis module, used to determine the association relationship between the target network nodes according to the target vulnerability data and the target attack data, and determine the relevant network nodes corresponding to the target network nodes according to the association relationship; The risk assessment module is used to obtain the associated security-related data corresponding to the relevant network node, and use the risk identification model to perform risk assessment on the target network node according to the associated security-related data and the target security-related data to obtain the risk assessment result corresponding to the target network node.

[0006] The embodiment of the present invention provides a big data driven network and information security risk assessment method and system, the method comprising: by extracting abnormal features of network transmission data of a wireless communication network, abnormal behaviors in the network can be more accurately identified, target network nodes can be identified, and initial security-related data of these nodes can be obtained. Next, data preprocessing is performed on these initial security-related data, which can effectively remove noise, redundant and inconsistent information, thereby obtaining more accurate and reliable target security-related data, including target vulnerability data and target attack data. These data lay a solid foundation for subsequent risk assessment. By analyzing the target vulnerability data and the target attack data, the association relationship between the target network nodes can be determined, and the relevant network nodes related thereto can be identified. This helps to deeply understand the security situation of the network, reveal potential risk propagation paths, and provide an important basis for formulating effective defense strategies. Further integrating the associated security-related data and the target security-related data, and using the risk identification model to perform risk assessment on the target network nodes, a more comprehensive and accurate risk assessment result can be obtained. This assessment method can timely discover and solve security problems in the network, effectively reduce potential security risks, and thus significantly improve the security of the wireless communication network. In addition, this method also solves the problem in related technologies that it is impossible to fully integrate and analyze the interactive relationships between different network nodes, thereby improving the accuracy of identifying and comprehensively evaluating potential security threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0008] Figure 1 A flowchart of a big data driven network and information security risk assessment method provided by an embodiment of the present invention; Figure 2 A schematic diagram of the module structure of a big data driven network and information security risk assessment system provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0009] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0010] The flowcharts shown in the accompanying drawings are only examples and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may be decomposed, combined or partially merged, so the actual execution order may change according to actual conditions.

[0011] It should be understood that the terms used in this specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the specification of the present invention and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0012] The embodiment of the present invention provides a big data driven network and information security risk assessment method and system. The big data driven network and information security risk assessment method can be applied to a terminal device, which can be an electronic device such as a tablet computer, a laptop computer, a desktop computer, a personal digital assistant, and a wearable device. The terminal device can be a server or a server cluster.

[0013] Some embodiments of the present invention are described in detail below in conjunction with the accompanying drawings. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0014] Please refer to Figure 1 , Figure 1A flowchart of a big data driven network and information security risk assessment method provided in an embodiment of the present invention.

[0015] like Figure 1 As shown, the big data driven network and information security risk assessment method includes steps S101 to S104.

[0016] Step S101: obtaining network transmission data corresponding to a wireless communication network, and extracting abnormal features from the network transmission data to obtain a target network node in the wireless communication network and initial security-related data corresponding to the target network node.

[0017] For example, identify the network devices and communication nodes that need to be monitored. This includes wireless access points, routers, switches, etc. Configure network monitoring tools or traffic analysis tools that can capture network traffic data. Common tools include network sniffers, traffic analyzers, etc., and then run collection tools to capture real-time network transmission data from the wireless communication network.

[0018] Exemplarily, based on the characteristics of the wireless communication network, features required for anomaly detection are selected, such as flow rate, packet size, protocol type, source and destination addresses, etc. The above features are extracted from the network transmission data. The benchmark of normal behavior is determined by analyzing historical data or network traffic patterns. The data features in the network transmission data are compared with the normal benchmark to identify behaviors that significantly deviate from the normal pattern. For example, abnormal patterns are detected by setting thresholds or using machine learning models.

[0019] Exemplarily, the abnormal detection results are used to determine which network nodes exhibit abnormal behavior. These nodes are usually potential attack sources or targets, and the network nodes exhibiting abnormal behavior are then determined as target network nodes in the wireless communication network. Thus, initial security-related data corresponding to the target network nodes are obtained from the network transmission data.

[0020] In some embodiments, the extracting abnormal features of the network transmission data to obtain the target network node in the wireless communication network and the initial security-related data corresponding to the target network node includes: obtaining the normal transmission data corresponding to the wireless communication network during normal data transmission, and performing vector representation on the normal transmission data to obtain a first network vector; performing vector representation on the network transmission data to obtain a second network vector, and calculating the gap information between the first network vector and the second network vector; extracting abnormal features of the network transmission data according to the gap information to obtain the target network node in the wireless communication network; determining a data window, and performing data interception on the network transmission data according to the data window to obtain window transmission data; performing abnormal feature analysis on the window transmission data to obtain the abnormal distribution probability corresponding to the window transmission data; performing data analysis on the window transmission data according to the abnormal distribution probability to obtain the initial security-related data corresponding to the target network node.

[0021] Exemplarily, the standard for normal operation of the wireless communication network is clarified, including network traffic mode, data transmission characteristics, etc., so as to collect data in a normal network environment and record normal transmission data in network transmission.

[0022] Exemplarily, a suitable model is selected for vector representation, such as principal component analysis, autoencoder, Word2Vec, BERT, etc. The normal transmission data is used as input to the selected model for vector representation to obtain a first network vector. Similarly, the network transmission data is input into the selected model for vector representation to obtain a second network vector.

[0023] Exemplarily, a suitable distance measurement method is selected, such as Euclidean distance, cosine similarity, Manhattan distance, etc. The selected distance measurement method is used to calculate the gap information between the first network vector and the second network vector. According to the calculated gap information, abnormal behavior in the network data is analyzed. A larger distance or a lower similarity generally indicates that an abnormal situation exists or there is a significant deviation from a normal mode, thereby obtaining a target network node in the wireless communication network, and the target network node is a network node that deviates significantly from a normal mode.

[0024] Exemplarily, the window size corresponding to the data window is determined according to the data call frequency or the node transmission frequency in the normal mode, so that the data transmitted in the target network node in the network transmission data is intercepted according to the data window to obtain the window transmission data.

[0025] For example, key features such as packet size, transmission rate, protocol type, source and destination IP addresses, etc. are extracted from the window transmission data. The extracted features are standardized to ensure that different features are compared at the same scale. The standardized features are then classified using a support vector machine to obtain the abnormal distribution probability corresponding to the window transmission data.

[0026] Exemplarily, an abnormality threshold is set. If the probability of an abnormality in the abnormal distribution probability is greater than the abnormality threshold, the window transmission data is determined as the initial security-related data corresponding to the target network node; otherwise, the data window continues to be intercepted in the data corresponding to the target network node in the network transmission data until all the initial security-related data of the target network node are obtained.

[0027] Specifically, implementing the above steps can not only improve the network's security protection capabilities, but also optimize network performance and improve anomaly detection and response capabilities. Through data-driven anomaly detection and feature analysis, potential security threats can be more accurately identified and responded to, thereby providing support for subsequent strengthening of overall network security and stability.

[0028] In some embodiments, the abnormal feature analysis of the window transmission data to obtain the abnormal distribution probability corresponding to the window transmission data includes: obtaining the first transmission data corresponding to the previous data window of the window transmission data and the second transmission data corresponding to the next data window; calculating the forward probability corresponding to the window transmission data according to the first transmission data, and calculating the backward probability corresponding to the window transmission data according to the second transmission data; using the hidden Markov layer of the abnormal distribution model in combination with the forward probability and the backward probability to extract the abnormal features of the window transmission data to obtain the target abnormal vector corresponding to the window transmission data; performing abnormal identification on the target abnormal vector according to the abnormal classification layer of the abnormal distribution model to obtain the abnormal distribution probability corresponding to the window transmission data.

[0029] Exemplarily, the window transmission data before the window transmission data is obtained in the data corresponding to the target network node in the network transmission data is determined as the first transmission data, and the window transmission data after the window transmission data is obtained in the data corresponding to the target network node in the network transmission data is determined as the second transmission data.

[0030] Exemplarily, the first transmission data is preprocessed, including denoising, standardization, etc. A statistical or probability model (such as Markov chain, time series analysis, etc.) is used to calculate the forward probability of the window transmission data relative to the first transmission data. The forward probability measures the position and trend of the window transmission data in the time series.

[0031] Exemplarily, the second transmission data is preprocessed. A statistical or probability model is used to calculate the backward probability of the window transmission data relative to the second transmission data. The backward probability measures the possibility and trend of the window transmission data in the future time series.

[0032] Exemplarily, the hidden Markov layer of the abnormal distribution model is used to capture the time series pattern of the window transmission data. The hidden state network of the hidden Markov layer can capture the hidden pattern and state change in the window transmission data. Thus, the forward probability and backward probability of the window transmission data are input into the hidden Markov layer of the abnormal distribution model, and the forward probability and backward probability are input into the hidden state network of the hidden Markov layer as features, and then combined with the data features corresponding to the window transmission data, so as to comprehensively consider the before and after relationship and dynamic changes of the window transmission data in the time series, so as to more comprehensively understand the behavior of the window transmission data, and then based on the output of the hidden Markov layer, the features and states of the window transmission data are integrated to obtain a target abnormal vector. The target abnormal vector reflects the degree of deviation of the window transmission data from the normal mode and represents the abnormal features in the data.

[0033] Exemplarily, the generation of the target anomaly vector enables the anomaly distribution model to clearly identify the abnormal characteristics of the window transmission data relative to normal behavior. The target anomaly vector provides a quantitative way to measure the severity of the anomaly. The target anomaly vector is thus classified using the anomaly classification layer of the anomaly distribution model, thereby obtaining the anomaly distribution probability corresponding to the window transmission data calculated according to the output of the classification model. The anomaly distribution probability represents the possibility that the window transmission data is classified as anomaly.

[0034] Specifically, by combining the forward and backward probabilities of window transmission data, the model can comprehensively consider the relationship between the data window before and after the time series. This comprehensive perspective can more accurately capture the full picture of abnormal behavior, rather than just being limited to the anomalies of a single window. This makes anomaly detection not only rely on window transmission data, but also integrates its relationship with the previous and next data windows, improving the accuracy of anomaly detection.

[0035] Step S102: preprocess the initial security-related data to obtain target security-related data, where the target security-related data includes target vulnerability data and target attack data.

[0036] Exemplarily, those obviously abnormal or erroneous records are identified and removed from the initial security-related data, which may be caused by data input errors or system failures. Also, duplicate records in the initial security-related data are removed to ensure that each record in the initial security-related data is unique, thereby obtaining target security-related data, wherein the target security-related data includes target vulnerability data and target attack data.

[0037] Step S103: determining the association relationship between the target network nodes according to the target vulnerability data and the target attack data, and determining the related network nodes corresponding to the target network nodes according to the association relationship.

[0038] Exemplarily, the target vulnerability data is vulnerability information related to the target network node, including vulnerability description, affected nodes, vulnerability severity, etc. The target attack data is attack information related to the target network node, including attack source, attack target, attack type, attack time, etc.

[0039] Exemplarily, all involved network nodes are extracted from the target vulnerability data and the target attack data, and based on the vulnerability impact range mentioned in the target vulnerability data, it is determined which network nodes that are connected to the target network node may be associated with each other. For example, if the target network node A and node B are both affected by the same vulnerability, then the target network node A and node B may be associated. Based on the attack source and attack target mentioned in the target attack data, an association relationship of the attack behavior is established. For example, if the target network node A attacks node D, there is an association between the target network node A and node D.

[0040] For example, target vulnerability data and target attack data are cross-analyzed to identify potential associations between target network nodes and nodes with which target network nodes have data transmission. For example, target network node A is exploited in a certain attack and is also affected in another vulnerability data, which indicates that target network node A may be a key node with a strong association with other nodes.

[0041] For example, if in the same time period, in addition to the target network node being attacked or having a vulnerability, there are also multiple other nodes that are attacked or have vulnerabilities exploited, then there may be a strong correlation between the target network node and the other multiple nodes, and then the other multiple nodes with the strong correlation are determined as related network nodes corresponding to the target network node.

[0042] In some implementations, the target network node includes a first network node and a second network node, the target vulnerability data includes first vulnerability data corresponding to the first network node and second vulnerability data corresponding to the second network node, the target attack data includes first attack data corresponding to the first network node and second attack data corresponding to the second network node, and determining the association relationship between the target network nodes based on the target vulnerability data and the target attack data includes: calculating the probability of an abnormality occurring on the first network node based on the first vulnerability data and the first attack data to obtain a first abnormality value; calculating the probability of an abnormality occurring on the first network node based on the first vulnerability data, the first attack data, the second vulnerability data, and the second attack data to obtain a second abnormality value; calculating the The method comprises the steps of: calculating the first gap information between the first abnormal value and the second abnormal value, and determining the first relationship corresponding to the second network node to the first network node according to the first gap information; calculating the abnormal occurrence probability of the second network node according to the second vulnerability data and the second attack data to obtain a third abnormal value; calculating the abnormal occurrence probability of the second network node according to the first vulnerability data, the first attack data, the second vulnerability data, and the second attack data to obtain a fourth abnormal value; calculating the second gap information between the third abnormal value and the fourth abnormal value, and determining the second relationship corresponding to the first network node to the second network node according to the second gap information; and determining the association relationship between the first network node and the second network node according to the first relationship and the second relationship.

[0043] Exemplarily, the target network nodes include at least a first network node and a second network node, the target vulnerability data includes at least first vulnerability data corresponding to the first network node and second vulnerability data corresponding to the second network node, and the target attack data includes at least first attack data corresponding to the first network node and second attack data corresponding to the second network node.

[0044] Exemplarily, the first vulnerability data includes all vulnerability information related to the first network node; the first attack data includes all attack information related to the first network node. Commonly used anomaly classification models include statistical anomaly detection methods (such as Z-score, mean-variance), machine learning methods (such as isolation forest, anomaly detection in support vector machine) or deep learning methods (such as autoencoder, variational autoencoder, etc.). The first vulnerability data and the first attack data are input into the trained anomaly classification model. The model predicts whether the data is abnormal based on the input data features. If the model predicts that the data is abnormal, the anomaly value can be further calculated. According to the anomaly score or anomaly probability output by the model, the first anomaly value of the first network node is calculated.

[0045] Exemplarily, the second vulnerability data includes all vulnerability information related to the second network node; the second attack data includes all attack information related to the second network node. The second vulnerability data and the second attack data, the first vulnerability data and the first attack data are input into the trained anomaly classification model. The model predicts whether the data is abnormal based on the input data features. If the model predicts that the data is abnormal, the anomaly value can be further calculated. According to the anomaly score or anomaly probability output by the model, the second anomaly value under the influence state of the second network node on the first network node is calculated.

[0046] Exemplarily, the first gap information corresponding to the second network node to the first network node is obtained by calculating the absolute difference or relative difference between the first abnormal value and the second abnormal value. When the first gap information is less than a preset value, the first relationship corresponding to the second network node to the first network node is no relationship or a low relationship; when the first gap information is greater than or equal to the preset value, the first relationship corresponding to the second network node to the first network node is an existing relationship or a strong relationship. A larger first gap information may indicate that the two nodes have a significant correlation in security behavior, which may lead to a certain security association.

[0047] Exemplarily, commonly used anomaly classification models include statistical anomaly detection methods (such as Z-score, mean-variance), machine learning methods (such as isolation forest, anomaly detection in support vector machine) or deep learning methods (such as autoencoder, variational autoencoder, etc.). The second vulnerability data and the second attack data are input into the trained anomaly classification model. The model predicts whether the data is abnormal based on the input data features. If the model predicts that the data is abnormal, the anomaly value can be further calculated. According to the anomaly score or anomaly probability output by the model, the third anomaly value of the second network node is calculated.

[0048] Exemplarily, the second vulnerability data and the second attack data, the first vulnerability data and the first attack data are input into a trained anomaly classification model. The model predicts whether the data is abnormal based on the input data features. If the model predicts that the data is abnormal, the outlier value can be further calculated. According to the anomaly score or anomaly probability output by the model, the fourth outlier value under the influence state of the first network node on the second network node is calculated. It should be noted that when the second vulnerability data and the second attack data, the first vulnerability data and the first attack data are input into the trained anomaly classification model to calculate the second outlier value and the fourth outlier value, the weights corresponding to the second vulnerability data and the second attack data, the first vulnerability data and the first attack data are different, so that the emphasis is different when calculating the second outlier value and the fourth outlier value.

[0049] Exemplarily, the second gap information corresponding to the first network node and the second network node is obtained by calculating the absolute difference or relative difference between the third abnormal value and the fourth abnormal value. When the second gap information is less than a preset value, the second relationship corresponding to the first network node and the second network node is no relationship or a low relationship; when the second gap information is greater than or equal to the preset value, the second relationship corresponding to the first network node and the second network node is an existing relationship or a strong relationship. A larger second gap information may indicate that the two nodes have a significant correlation in security behavior, which may lead to a certain security association.

[0050] Exemplarily, the first relationship is the influence relationship of the first network node on the second network node, and the second relationship is the influence relationship of the second network node on the first network node, and then the association relationship between the first network node and the second network node is determined according to the first relationship and the second relationship.

[0051] For example, if the first relationship is no relationship and the second relationship is an existence relationship, then the association relationship between the first network node and the second network node is that the first network node has an influence on the second network node; if the first relationship is an existence relationship and the second relationship is an existence relationship, then the association relationship between the first network node and the second network node is that the first network node and the second network node influence each other, and so on.

[0052] Specifically, by calculating the gap between the first outlier and the second outlier, as well as the gap between the third outlier and the fourth outlier, we can gain an in-depth understanding of the relative degree of abnormality between two network nodes, which in turn helps identify the relationship between the nodes, such as which node has a greater impact on the abnormality of another node, thereby better understanding the potential dependencies and impacts between nodes in the network.

[0053] In some embodiments, the calculating of the first gap information between the first abnormal value and the second abnormal value and the calculating of the second gap information between the third abnormal value and the fourth abnormal value include: dividing the first abnormal value and the second abnormal value to obtain a first ratio, and taking the logarithm of the first ratio to obtain a first numerical value; determining the first gap information according to the first numerical value and the first abnormal value; dividing the third abnormal value and the fourth abnormal value to obtain a second ratio, and taking the logarithm of the second ratio to obtain a second numerical value; determining the second gap information according to the second numerical value and the third abnormal value; wherein the first gap information and the second gap information are obtained according to the following formula: ; ; in, indicating the first gap information; indicating the second gap information; represents the first abnormal value, represents the second outlier; represents the third outlier, represents the fourth outlier.

[0054] Exemplarily, the first abnormal value and the second abnormal value are divided to obtain a first ratio, and the logarithm of the first ratio is taken to obtain a first numerical value; the first gap information is determined according to the first numerical value and the first abnormal value; wherein the first gap information is obtained according to the following formula: ; in, Indicates the first gap information; represents the first outlier, Indicates the second outlier.

[0055] Exemplarily, by taking the logarithm of the first ratio, the ratio of the first outlier to the second outlier can be converted into a relatively more standardized metric. This logarithmic transformation helps to reduce the impact of extreme values, making the first gap information more stable and reliable, thereby making the comparison between the first outlier and the second outlier more reasonable. The logarithmic function has the effect of amplifying small gaps and reducing large gaps, which means that when the outlier gap is not large, the change in the first gap information will be more sensitive. This increased sensitivity can help capture the slight impact of the second network node on the first network node more finely. Therefore, obtaining the first gap information through the above formula can better determine the impact of the second network node on the first network node, and then more accurately obtain the first relationship of the second network node to the first network node.

[0056] Exemplarily, the third abnormal value and the fourth abnormal value are divided to obtain a second ratio, and the second ratio is logarithmically taken to obtain a second value; the second gap information is determined according to the second value and the third abnormal value; wherein the second gap information is obtained according to the following formula: ; in, Indicates the second gap information; represents the third outlier, Indicates the fourth outlier.

[0057] Exemplarily, by taking the logarithm of the second ratio, the ratio of the third outlier to the fourth outlier can be converted into a relatively more standardized metric. This logarithmic transformation helps to reduce the impact of extreme values, making the second gap information more stable and reliable, thereby making the comparison of the third outlier and the fourth outlier more reasonable. The logarithmic function has the effect of amplifying small gaps and reducing large gaps, which means that when the outlier gap is not large, the change in the second gap information will be more sensitive. This increased sensitivity can help capture the slight impact of the first network node on the second network node more finely. Therefore, obtaining the second gap information through the above formula can better determine the impact of the first network node on the second network node, and then more accurately obtain the second relationship of the first network node to the second network node.

[0058] Step S104: obtaining the associated security-related data corresponding to the associated network node, and performing risk assessment on the target network node using a risk identification model according to the associated security-related data and the target security-related data, to obtain a risk assessment result corresponding to the target network node.

[0059] Exemplarily, associated security-related data corresponding to related network nodes are obtained from network transmission data, and risk identification models such as machine learning models (such as decision trees, random forests, support vector machines) and deep learning models (such as neural networks) are used to perform feature fusion on the associated security-related data and target security-related data, and then perform risk assessment to obtain risk assessment results corresponding to the target network nodes.

[0060] In some embodiments, the risk assessment of the target network node using a risk identification model according to the associated security-related data and the target security-related data to obtain a risk assessment result corresponding to the target network node includes: using the weight calculation layer of the risk identification model to determine the first weight corresponding to the target vulnerability data and the second weight corresponding to the target attack data according to the associated security-related data and the target security-related data; using the first feature extraction layer of the risk identification model to feature represent the target vulnerability data to obtain a first characterization vector; using the second feature extraction layer of the risk identification model to feature represent the target attack data to obtain a second characterization vector; using the feature fusion layer of the risk identification model to perform information fusion according to the first weight, the second weight, the first characterization vector and the second characterization vector to obtain a target characterization vector; using the risk classification layer of the risk identification model to risk assess the target network node according to the target characterization vector to obtain the risk assessment result corresponding to the target network node.

[0061] Exemplarily, the weight calculation layer of the risk identification model is used to calculate a first weight based on the characteristics of the target vulnerability data. The first weight indicates the importance of the target vulnerability data in the risk assessment. The weight calculation layer of the risk identification model is used to calculate a second weight based on the characteristics of the target attack data. The second weight indicates the importance of the target attack data in the risk assessment.

[0062] Exemplarily, the target vulnerability data is processed using the first feature extraction layer of the risk identification model to extract features and generate a first characterization vector. The first characterization vector is a high-dimensional representation of the features of the target vulnerability data. The target attack data is processed using the second feature extraction layer of the risk identification model to extract features and generate a second characterization vector. The second characterization vector is a high-dimensional representation of the features of the target attack data.

[0063] Exemplarily, the first weight, the second weight, the first characterization vector, and the second characterization vector are fused using the feature fusion layer of the risk identification model. For example, the first weight and the second weight are applied to the corresponding first characterization vector and the second characterization vector, their influence in the fusion process is adjusted, and the weighted feature vectors are merged to generate a target characterization vector.

[0064] Exemplarily, the generated target representation vector is input into the risk classification layer of the risk identification model. The risk classification layer uses the target representation vector for evaluation and outputs the risk evaluation results of the target network node. These results usually include risk level, risk score or other relevant indicators.

[0065] Specifically, the risk identification model is effectively used to conduct risk assessment on the target network node. The key lies in reasonably calculating weights, extracting features, integrating information, and conducting accurate risk assessment. These steps can not only help identify and assess the risks of the target node, but also provide data support for the formulation of network security strategies.

[0066] In some embodiments, the weight calculation layer of the risk identification model is used to determine the first weight corresponding to the target vulnerability data and the second weight corresponding to the target attack data according to the associated security-related data and the target security-related data, including: determining the associated vulnerability data and the associated attack data corresponding to the associated security-related data; using the first fuzzy calculation network of the weight calculation layer to calculate the first entropy value corresponding to any vulnerability parameter in the target vulnerability data in the target vulnerability data and the associated vulnerability data; using the second fuzzy calculation network of the weight calculation layer to calculate the second entropy value corresponding to any attack parameter in the target attack data in the target attack data and the associated attack data; using the risk parameter acquisition network of the weight calculation layer to obtain the first expected entropy value corresponding to any vulnerability parameter in the target vulnerability data and the second expected entropy value corresponding to any attack parameter in the target attack data; using the first rule calculation network of the weight calculation layer to calculate the first weight corresponding to the target vulnerability data according to the first entropy value and the first expected entropy value; using the second rule calculation network of the weight calculation layer to calculate the second weight corresponding to the target attack data according to the second entropy value and the second expected entropy value.

[0067] Exemplarily, the associated vulnerability data and associated attack data corresponding to the associated security-related data are determined, and then each vulnerability parameter in the target vulnerability data is compared with the corresponding parameter in the associated vulnerability data using the first fuzzy calculation network of the weight calculation layer, and the entropy values ​​of these parameters are calculated to quantify the uncertainty or information content of the parameters. This involves quantifying the uncertainty of the corresponding parameters in the target vulnerability data and the associated vulnerability data.

[0068] For example, extract corresponding vulnerability parameters from target vulnerability data and associated vulnerability data. Vulnerability parameters may include description of vulnerability, severity score, frequency of occurrence, etc. Design a fuzzy computing network that can process and compare vulnerability parameters in target vulnerability data and associated vulnerability data. Fuzzy computing networks usually include modules such as fuzzification, rule evaluation, and defuzzification. Convert target vulnerability parameters and associated vulnerability parameters into fuzzy sets. The fuzzification process maps these parameters into fuzzy sets to represent their uncertainty and fuzziness. For example, map the severity of the vulnerability into fuzzy levels such as low, medium, and high. Define and apply rules in the fuzzy computing network to evaluate the relationship between the parameters of target vulnerability data and the parameters of associated vulnerability data. For example, rules can be set to evaluate similarity, difference, etc., and calculate the intersection or union of fuzzy sets. Entropy is used to measure the uncertainty or information content of a parameter. In the fuzzy computing network, entropy is calculated by evaluating the distribution of fuzzy sets. The calculation of entropy takes into account the distribution of parameters in fuzzy sets. For each vulnerability parameter in the target vulnerability data, calculate its first entropy value corresponding to the target vulnerability data and the associated vulnerability data.

[0069] For example, according to the fuzzification results, the distribution of parameters in the fuzzy set is calculated. The first entropy value of the fuzzy set is calculated using an entropy formula (such as the information entropy formula) to measure the uncertainty of the parameters.

[0070] Similarly, the second fuzzy calculation network of the weight calculation layer is used to calculate the second entropy value corresponding to any attack parameter in the target attack data in the target attack data and the associated attack data.

[0071] Exemplarily, the risk parameter acquisition network of the weight calculation layer is used to calculate the first expected entropy value corresponding to each vulnerability parameter in the target vulnerability data according to the first entropy value of each vulnerability parameter in the target vulnerability data. The first expected entropy value is usually an entropy value that takes into account a certain weighting or expected value calculation method, reflecting the expected uncertainty of the vulnerability parameter in the target data. The risk parameter acquisition network of the weight calculation layer is used to calculate the second expected entropy value corresponding to each attack parameter in the target attack data according to the second entropy value. The second expected entropy value takes into account the weighted or expected value of the attack parameter, reflecting the expected uncertainty of the parameter in the attack data.

[0072] Exemplarily, the difference between the first entropy value and the first expected entropy value is calculated using the first regular calculation network of the weight calculation layer, and then based on the calculated difference, a weight mapping is performed through a nonlinear function to obtain the first weight. The difference between the second entropy value and the second expected entropy value is calculated using the second regular calculation network of the weight calculation layer, and then based on the calculated difference, a weight mapping is performed through a nonlinear function to obtain the second weight.

[0073] In some embodiments, after obtaining the risk assessment result corresponding to the target network node, the method also includes: determining the risk type corresponding to the target network node based on the risk assessment result; determining a policy mapping table, and determining the risk handling strategy corresponding to the target network node based on the risk type and the policy mapping table.

[0074] Exemplarily, different risk types are determined based on risk assessment results, such as information leakage, denial of service, privilege escalation, etc.

[0075] For example, a policy mapping table containing risk types and corresponding risk handling strategies is established. Each risk type should have one or more handling strategies. For example, if the risk type is information leakage, the risk handling strategy is encryption and access control; if the risk type is service denial, the risk handling strategy is traffic filtering and load balancing; if the risk type is privilege escalation, the risk handling strategy is privilege audit and the principle of least privilege.

[0076] Exemplarily, the risk types are matched with the processing strategies in the strategy mapping table. By querying the strategy mapping table, a corresponding risk processing strategy is assigned to each risk type.

[0077] In some embodiments, determining the risk handling strategy corresponding to the target network node based on the risk type and the policy mapping table includes: determining the attack path corresponding to the risk type based on the association relationship and the target network node; obtaining the risk level corresponding to each network node in the attack path, and sorting the attack paths according to the risk level to obtain the target path; determining the risk handling strategy corresponding to the target network node based on the target path and the policy mapping table.

[0078] Exemplarily, when the association relationship is an existence relationship, the related network node corresponding to the target network node is obtained, and then the related network node is used as the target network node, and the related network node corresponding to the target network node is continued to be obtained, and so on to obtain the attack path corresponding to the risk type.

[0079] Exemplarily, a risk level is assigned to each network node in the attack path using network transmission data according to a risk assessment model. The risk level is usually assessed based on factors such as the vulnerability, attack surface, and historical vulnerability records of the network node. The risk level of each network node is extracted from the risk assessment report, so that the attack paths are sorted from high to low according to the risk level to obtain the target path.

[0080] Exemplarily, a policy mapping table is established, which contains different risk types and corresponding processing strategies. Therefore, for each network node in the target path, the corresponding processing strategy is found from the policy mapping table according to its risk type. The risk type of each node should match the risk type in the mapping table to obtain the corresponding processing strategy. For each network node in the target path, its specific processing strategy is determined, and these strategies are integrated into the overall risk processing strategy. For example, if a network node on the target path faces the risk of information leakage, the processing strategy may include data encryption and access control; if another network node faces the risk of service denial, the processing strategy may include traffic filtering and load balancing. The processing strategies of each network node in the target path are summarized to form a comprehensive risk handling strategy. This strategy should cover all network nodes on the path to ensure that the risks of each network node are effectively managed.

[0081] The embodiment of the present invention provides a big data driven network and information security risk assessment method and system, the method comprising: by extracting abnormal features of network transmission data of a wireless communication network, abnormal behaviors in the network can be more accurately identified, target network nodes can be identified, and initial security-related data of these nodes can be obtained. Next, data preprocessing is performed on these initial security-related data, which can effectively remove noise, redundant and inconsistent information, thereby obtaining more accurate and reliable target security-related data, including target vulnerability data and target attack data. These data lay a solid foundation for subsequent risk assessment. By analyzing the target vulnerability data and the target attack data, the association relationship between the target network nodes can be determined, and the relevant network nodes related thereto can be identified. This helps to deeply understand the security situation of the network, reveal potential risk propagation paths, and provide an important basis for formulating effective defense strategies. Further integrating the associated security-related data and the target security-related data, and using the risk identification model to perform risk assessment on the target network nodes, a more comprehensive and accurate risk assessment result can be obtained. This assessment method can timely discover and solve security problems in the network, effectively reduce potential security risks, and thus significantly improve the security of the wireless communication network. In addition, this method also solves the problem in related technologies that it is impossible to fully integrate and analyze the interactive relationships between different network nodes, thereby improving the accuracy of identifying and comprehensively evaluating potential security threats.

[0082] See also Figure 2 , Figure 2 A big data-driven network and information security risk assessment system 200 is provided for an embodiment of the present application. The big data-driven network and information security risk assessment system 200 includes a data acquisition module 201, a data processing module 202, a relationship analysis module 203, and a risk assessment module 204, wherein the data acquisition module 201 is used to obtain network transmission data corresponding to the wireless communication network, and perform abnormal feature extraction on the network transmission data to obtain the target network node in the wireless communication network and the initial security-related data corresponding to the target network node; the data processing module 202 is used to perform data preprocessing on the initial security-related data to obtain target security-related data, and the target security-related data includes target vulnerability data and target attack data; the relationship analysis module 203 is used to determine the association relationship between the target network nodes according to the target vulnerability data and the target attack data, and determine the relevant network nodes corresponding to the target network nodes according to the association relationship; the risk assessment module 204 is used to obtain the associated security-related data corresponding to the relevant network nodes, and perform risk assessment on the target network nodes using a risk identification model according to the associated security-related data and the target security-related data, and obtain the risk assessment result corresponding to the target network node.

[0083] In some implementations, the data acquisition module 201, during the process of extracting abnormal features from the network transmission data to obtain the target network node in the wireless communication network and the initial security-related data corresponding to the target network node, performs: Obtaining normal transmission data corresponding to the wireless communication network during normal data transmission, and performing vector representation on the normal transmission data to obtain a first network vector; Performing vector representation on the network transmission data to obtain a second network vector, and calculating gap information between the first network vector and the second network vector; Extracting abnormal features of the network transmission data according to the gap information to obtain the target network node in the wireless communication network; Determine a data window, and intercept the network transmission data according to the data window to obtain window transmission data; Performing abnormal feature analysis on the window transmission data to obtain abnormal distribution probability corresponding to the window transmission data; The window transmission data is analyzed according to the abnormal distribution probability to obtain initial security-related data corresponding to the target network node.

[0084] In some implementations, the data acquisition module 201 performs, during the process of performing abnormal feature analysis on the window transmission data to obtain abnormal distribution probability corresponding to the window transmission data: Obtain first transmission data corresponding to a previous data window of the window transmission data and second transmission data corresponding to a subsequent data window; Calculate the forward probability corresponding to the window transmission data according to the first transmission data, and calculate the backward probability corresponding to the window transmission data according to the second transmission data; Using the hidden Markov layer of the abnormal distribution model in combination with the forward probability and the backward probability, the abnormal feature extraction is performed on the window transmission data to obtain a target abnormal vector corresponding to the window transmission data; The target abnormality vector is identified according to the abnormality classification layer of the abnormality distribution model to obtain the abnormal distribution probability corresponding to the window transmission data.

[0085] In some implementations, the target network node includes a first network node and a second network node, the target vulnerability data includes first vulnerability data corresponding to the first network node and second vulnerability data corresponding to the second network node, the target attack data includes first attack data corresponding to the first network node and second attack data corresponding to the second network node, and the relationship analysis module 203 performs, in the process of determining the association relationship between the target network nodes according to the target vulnerability data and the target attack data: Calculating the probability of abnormal occurrence of the first network node based on the first vulnerability data and the first attack data to obtain a first abnormal value; Calculate the probability of an abnormality occurring at the first network node according to the first vulnerability data, the first attack data, the second vulnerability data, and the second attack data to obtain a second abnormality value; Calculating first gap information between the first abnormal value and the second abnormal value, and determining a first relationship between the second network node and the first network node according to the first gap information; Calculating the probability of abnormal occurrence of the second network node based on the second vulnerability data and the second attack data to obtain a third abnormal value; Calculate the probability of an abnormality occurring at the second network node according to the first vulnerability data, the first attack data, the second vulnerability data, and the second attack data to obtain a fourth abnormality value; Calculating second gap information between the third abnormal value and the fourth abnormal value, and determining a second relationship between the first network node and the second network node according to the second gap information; The association relationship between the first network node and the second network node is determined according to the first relationship and the second relationship.

[0086] In some implementations, the relationship analysis module 203 performs, during the process of calculating the first gap information between the first outlier value and the second outlier value and calculating the second gap information between the third outlier value and the fourth outlier value: Dividing the first abnormal value and the second abnormal value to obtain a first ratio, and taking the logarithm of the first ratio to obtain a first value; Determine the first gap information according to the first value and the first abnormal value; Dividing the third abnormal value by the fourth abnormal value to obtain a second ratio, and taking the logarithm of the second ratio to obtain a second value; Determine the second gap information according to the second value and the third abnormal value; The first gap information and the second gap information are obtained according to the following formula: ; ; in, indicating the first gap information; indicating the second gap information; represents the first abnormal value, represents the second outlier; represents the third outlier, represents the fourth outlier.

[0087] In some implementations, the risk assessment module 204, in the process of performing risk assessment on the target network node using the risk identification model according to the associated security-related data and the target security-related data to obtain a risk assessment result corresponding to the target network node, executes: Determine, using the weight calculation layer of the risk identification model, a first weight corresponding to the target vulnerability data and a second weight corresponding to the target attack data according to the associated security-related data and the target security-related data; Using the first feature extraction layer of the risk identification model to perform feature representation on the target vulnerability data to obtain a first representation vector; Using the second feature extraction layer of the risk identification model to perform feature representation on the target attack data to obtain a second representation vector; Using the feature fusion layer of the risk identification model, fusing information according to the first weight, the second weight, the first representation vector, and the second representation vector to obtain a target representation vector; The risk classification layer of the risk identification model is used to perform risk assessment on the target network node according to the target characterization vector to obtain the risk assessment result corresponding to the target network node.

[0088] In some implementations, the risk assessment module 204, in the process of determining the first weight corresponding to the target vulnerability data and the second weight corresponding to the target attack data according to the associated security-related data and the target security-related data by using the weight calculation layer of the risk identification model, performs: Determining associated vulnerability data and associated attack data corresponding to the associated security-related data; Using the first fuzzy calculation network of the weight calculation layer, calculating the first entropy value corresponding to any vulnerability parameter in the target vulnerability data in the target vulnerability data and the associated vulnerability data; Using the second fuzzy calculation network of the weight calculation layer to calculate the second entropy value corresponding to any attack parameter in the target attack data in the target attack data and the associated attack data; Obtaining a first expected entropy value corresponding to any vulnerability parameter in the target vulnerability data and a second expected entropy value corresponding to any attack parameter in the target attack data using the risk parameter acquisition network of the weight calculation layer; Calculate the first weight corresponding to the target vulnerability data according to the first entropy value and the first expected entropy value using the first regularity calculation network of the weight calculation layer; The second weight corresponding to the target attack data is calculated according to the second entropy value and the second expected entropy value by using the second rule calculation network of the weight calculation layer.

[0089] In some implementations, after obtaining the risk assessment result corresponding to the target network node, the risk assessment module 204 further performs: Determine the risk type corresponding to the target network node according to the risk assessment result; A policy mapping table is determined, and a risk handling policy corresponding to the target network node is determined according to the risk type and the policy mapping table.

[0090] In some implementations, the risk assessment module 204, in the process of determining the risk handling strategy corresponding to the target network node according to the risk type and the strategy mapping table, performs: Determine an attack path corresponding to the risk type according to the association relationship and the target network node; Obtaining a risk level corresponding to each network node in the attack path, and sorting the attack paths according to the risk levels to obtain a target path; The risk handling strategy corresponding to the target network node is determined according to the target path and the strategy mapping table.

[0091] In some embodiments, the big data driven network and information security risk assessment system 200 can be applied to terminal devices.

[0092] It should be noted that technical personnel in the relevant field can clearly understand that for the convenience and conciseness of description, the specific working process of the big data driven network and information security risk assessment system 200 described above can refer to the corresponding process in the aforementioned big data driven network and information security risk assessment method embodiment, and will not be repeated here.

[0093] An embodiment of the present invention also provides a storage medium for computer-readable storage, wherein the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of any big data-driven network and information security risk assessment method provided in the description of the embodiment of the present invention.

[0094] The storage medium may be an internal storage unit of the terminal device in the aforementioned embodiment, such as a hard disk or memory of the terminal device. The storage medium may also be an external storage device of the terminal device, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the terminal device.

[0095] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In a hardware embodiment, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or transient medium). As is known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0096] It should be understood that the term "and / or" used in the present specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, including these combinations. It should be noted that, in this article, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "including a..." does not exclude the presence of other identical elements in the process, method, article or system including the element.

[0097] The serial numbers of the embodiments of the present invention are only for description and do not represent the advantages and disadvantages of the embodiments. The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A big data driven network and information security risk assessment method, characterized in that: The method comprises: Obtaining network transmission data corresponding to the wireless communication network, and performing abnormal feature extraction on the network transmission data to obtain a target network node in the wireless communication network and initial security-related data corresponding to the target network node; Performing data preprocessing on the initial security-related data to obtain target security-related data, wherein the target security-related data includes target vulnerability data and target attack data; Determine an association relationship between the target network nodes according to the target vulnerability data and the target attack data, and determine a related network node corresponding to the target network node according to the association relationship; The associated security related data corresponding to the associated network node is obtained, and the risk assessment of the target network node is performed using a risk identification model according to the associated security related data and the target security related data to obtain a risk assessment result corresponding to the target network node.

2. The method according to claim 1, characterized in that The extracting abnormal features of the network transmission data to obtain a target network node in the wireless communication network and initial security-related data corresponding to the target network node includes: Obtaining normal transmission data corresponding to the wireless communication network during normal data transmission, and performing vector representation on the normal transmission data to obtain a first network vector; Performing vector representation on the network transmission data to obtain a second network vector, and calculating gap information between the first network vector and the second network vector; Extracting abnormal features of the network transmission data according to the gap information to obtain the target network node in the wireless communication network; Determine a data window, and intercept the network transmission data according to the data window to obtain window transmission data; Performing abnormal feature analysis on the window transmission data to obtain abnormal distribution probability corresponding to the window transmission data; The window transmission data is analyzed according to the abnormal distribution probability to obtain initial security-related data corresponding to the target network node.

3. The method according to claim 2, characterized in that The performing abnormal feature analysis on the window transmission data to obtain the abnormal distribution probability corresponding to the window transmission data includes: Obtain first transmission data corresponding to a previous data window of the window transmission data and second transmission data corresponding to a subsequent data window; Calculate the forward probability corresponding to the window transmission data according to the first transmission data, and calculate the backward probability corresponding to the window transmission data according to the second transmission data; Using the hidden Markov layer of the abnormal distribution model in combination with the forward probability and the backward probability, the abnormal feature extraction is performed on the window transmission data to obtain a target abnormal vector corresponding to the window transmission data; The target abnormality vector is identified according to the abnormality classification layer of the abnormality distribution model to obtain the abnormal distribution probability corresponding to the window transmission data.

4. The method according to claim 1, characterized in that The target network node includes a first network node and a second network node, the target vulnerability data includes first vulnerability data corresponding to the first network node and second vulnerability data corresponding to the second network node, the target attack data includes first attack data corresponding to the first network node and second attack data corresponding to the second network node, and determining the association relationship between the target network nodes according to the target vulnerability data and the target attack data includes: Calculating the probability of abnormal occurrence of the first network node based on the first vulnerability data and the first attack data to obtain a first abnormal value; Calculate the probability of an abnormality occurring at the first network node according to the first vulnerability data, the first attack data, the second vulnerability data, and the second attack data to obtain a second abnormality value; Calculating first gap information between the first abnormal value and the second abnormal value, and determining a first relationship between the second network node and the first network node according to the first gap information; Calculating the probability of abnormal occurrence of the second network node based on the second vulnerability data and the second attack data to obtain a third abnormal value; Calculate the probability of an abnormality occurring at the second network node according to the first vulnerability data, the first attack data, the second vulnerability data, and the second attack data to obtain a fourth abnormality value; Calculating second gap information between the third abnormal value and the fourth abnormal value, and determining a second relationship between the first network node and the second network node according to the second gap information; The association relationship between the first network node and the second network node is determined according to the first relationship and the second relationship.

5. The method according to claim 4, characterized in that The calculating of the first gap information between the first abnormal value and the second abnormal value and the calculating of the second gap information between the third abnormal value and the fourth abnormal value include: Dividing the first abnormal value and the second abnormal value to obtain a first ratio, and taking the logarithm of the first ratio to obtain a first value; Determine the first gap information according to the first value and the first abnormal value; Dividing the third abnormal value by the fourth abnormal value to obtain a second ratio, and taking the logarithm of the second ratio to obtain a second value; Determine the second gap information according to the second value and the third abnormal value; The first gap information and the second gap information are obtained according to the following formula: ； ； in, indicating the first gap information; indicating the second gap information; represents the first abnormal value, represents the second outlier; represents the third outlier, represents the fourth outlier.

6. The method according to claim 1, characterized in that The step of performing risk assessment on the target network node using a risk identification model according to the associated security-related data and the target security-related data to obtain a risk assessment result corresponding to the target network node includes: Determine, using the weight calculation layer of the risk identification model, a first weight corresponding to the target vulnerability data and a second weight corresponding to the target attack data according to the associated security-related data and the target security-related data; Using the first feature extraction layer of the risk identification model to perform feature representation on the target vulnerability data to obtain a first representation vector; Using the second feature extraction layer of the risk identification model to perform feature representation on the target attack data to obtain a second representation vector; Using the feature fusion layer of the risk identification model, fusing information according to the first weight, the second weight, the first representation vector, and the second representation vector to obtain a target representation vector; The risk classification layer of the risk identification model is used to perform risk assessment on the target network node according to the target characterization vector to obtain the risk assessment result corresponding to the target network node.

7. The method according to claim 6, characterized in that The weight calculation layer using the risk identification model determines the first weight corresponding to the target vulnerability data and the second weight corresponding to the target attack data according to the associated security-related data and the target security-related data, including: Determining associated vulnerability data and associated attack data corresponding to the associated security-related data; Using the first fuzzy calculation network of the weight calculation layer, calculating the first entropy value corresponding to any vulnerability parameter in the target vulnerability data in the target vulnerability data and the associated vulnerability data; Using the second fuzzy calculation network of the weight calculation layer to calculate the second entropy value corresponding to any attack parameter in the target attack data in the target attack data and the associated attack data; Obtaining a first expected entropy value corresponding to any vulnerability parameter in the target vulnerability data and a second expected entropy value corresponding to any attack parameter in the target attack data using the risk parameter acquisition network of the weight calculation layer; Calculate the first weight corresponding to the target vulnerability data according to the first entropy value and the first expected entropy value using the first regularity calculation network of the weight calculation layer; The second weight corresponding to the target attack data is calculated according to the second entropy value and the second expected entropy value by using the second rule calculation network of the weight calculation layer.

8. The method according to any one of claims 1 to 7, characterized in that After obtaining the risk assessment result corresponding to the target network node, the method further includes: Determine the risk type corresponding to the target network node according to the risk assessment result; A policy mapping table is determined, and a risk handling policy corresponding to the target network node is determined according to the risk type and the policy mapping table.

9. The method according to claim 8, characterized in that The determining, according to the risk type and the policy mapping table, a risk handling policy corresponding to the target network node includes: Determine an attack path corresponding to the risk type according to the association relationship and the target network node; Obtaining a risk level corresponding to each network node in the attack path, and sorting the attack paths according to the risk levels to obtain a target path; The risk handling strategy corresponding to the target network node is determined according to the target path and the strategy mapping table.

10. A big data driven network and information security risk assessment system, characterized in that: include: A data acquisition module, used to obtain network transmission data corresponding to the wireless communication network, and extract abnormal features from the network transmission data to obtain a target network node in the wireless communication network and initial security-related data corresponding to the target network node; A data processing module, used for performing data preprocessing on the initial security-related data to obtain target security-related data, wherein the target security-related data includes target vulnerability data and target attack data; A relationship analysis module, used to determine the association relationship between the target network nodes according to the target vulnerability data and the target attack data, and determine the relevant network nodes corresponding to the target network nodes according to the association relationship; The risk assessment module is used to obtain the associated security-related data corresponding to the relevant network node, and use the risk identification model to perform risk assessment on the target network node according to the associated security-related data and the target security-related data to obtain the risk assessment result corresponding to the target network node.

Images