Network boundary protection situation awareness method, device and system

Abstract

The invention discloses a network boundary protection situation awareness method, device and system, and particularly relates to the technical field of network security, and the network boundary protection situation awareness method comprises the following steps: S1, collecting network alarm information, analyzing the abnormal condition proportion of the alarm intensity of the network alarm information and the deviation degree of the abnormal condition, and calculating a jolt evaluation index; s2, presetting a network security disposal model, inputting the network alarm information into the network security disposal model for calculation, and generating defense data; and S3, carrying out data missing proportion comparison on the bump evaluation index and the defense data. According to the method, the alarm information can be automatically prompted, the low-risk alarms can be automatically eliminated, the interference of massive low-risk alarms and false alarms can be well eliminated by network security analysts, and the network security situation can be effectively perceived and the abnormity of the network security situation can be timely found.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and more specifically, to a network boundary protection situation awareness method, device and system. Background Art

[0002] The Industrial Internet combines sensor measurement technology, information communication technology, and automatic control technology with process industries. It uses the Industrial Internet to perceive the status information and parameter data of process industries, and issue control instructions to achieve remote real-time control of industrial processes. The application of the Industrial Internet has improved the controllability, observability, and real-time nature of industrial production, and has a trend of resource integration, remote control, and interconnection with portals and external Internet. Although the application of the Industrial Internet has improved the production efficiency of process industries, it has also caused network security issues in the traditional Internet to pose a threat to industrial production. Typical types of network attacks such as denial of service attacks, data eavesdropping, and man-in-the-middle attacks are also effective and harmful in the Industrial Internet.

[0003] In order to ensure network security and the ability to perceive potential network threats, many companies will choose network situation awareness systems to improve the ability of network security and stable operation. However, the network situation awareness systems purchased by some companies have a limit on the number of times they can be used for defense, so some companies will choose to use situation awareness systems for analysis and defense, and use this defense to achieve pre-emptive defense of abnormal items in the network environment, reduce the number of times the situation awareness system defense is used, and ensure the maximum use of resource costs while avoiding more serious alarm events through this defense.

[0004] To ensure the normal operation of the production process, even if the network security systems and equipment deployed in the industrial Internet continuously generate a large number of false alarms, the network devices that trigger the alarms cannot be blocked. A large number of low-risk alarms and false alarms are mixed with a small number of alarms with greater security risks, which brings huge challenges to network security analysts in dealing with abnormal network traffic. It is difficult for network security analysts to eliminate the interference of massive low-risk alarms and false alarms, and it is impossible to effectively perceive the network security situation and discover abnormal network security situation in time, which restricts network security to a certain extent.

[0005] In order to solve the above problems, a technical solution is now provided. Summary of the invention

[0006] In order to overcome the above-mentioned defects of the prior art, the embodiments of the present invention provide a network border protection situation awareness method, device and system to solve the problems raised in the above-mentioned background technology.

[0007] To achieve the above object, the present invention provides the following technical solutions:

[0008] A network border protection situation awareness method comprises the following steps:

[0009] Step S1: collecting network alarm information, analyzing the abnormal proportion of the alarm intensity of the network alarm information and the deviation degree of the abnormal situation, and calculating the turbulence assessment index;

[0010] Step S2: presetting a network security disposal model, inputting network alarm information into the network security disposal model for calculation, and generating defense data;

[0011] Step S3: Compare the data missing ratio of the turbulence assessment index and the defense data to generate a network boundary protection situation awareness index;

[0012] Step S4: Prompt an alarm based on the network boundary protection situation awareness index.

[0013] In a preferred embodiment, in step S1, the logic for obtaining the turbulence assessment index is specifically as follows:

[0014] Set the network alarm information monitoring interval and obtain the time length corresponding to the network alarm information monitoring interval; obtain the alarm intensity of the network alarm information monitoring interval in real time; set the alarm intensity threshold and obtain the time length during which the alarm intensity in the network alarm information monitoring interval is less than the alarm intensity threshold;

[0015] Calculate the turbulence assessment index, the expression is: Wherein, m and p are the number of abnormal conditions marked as alarm intensity in the network alarm information monitoring interval and the number of abnormal conditions marked as alarm intensity in the network alarm information monitoring interval respectively; p = 1, 2, 3, 4, ..., m, p, m are positive integers greater than 1; pgzs, t1, t2, xjz p , Q are respectively the turbulence assessment index, the time length that the alarm intensity of the network alarm information monitoring interval is less than the alarm intensity threshold, the time length corresponding to the network alarm information monitoring interval, and the average value corresponding to the pth abnormal situation monitoring interval marked as alarm intensity in the network alarm information monitoring interval.

[0016] In a preferred embodiment, in step S2, the specific acquisition logic of the network security disposal model is:

[0017] Acquire an initial network alarm information sample set, a first feature set corresponding to the initial network alarm information sample set, and acquire an initial network alarm information sample set, a second feature set corresponding to the initial network alarm information sample set;

[0018] Inputting the initial network alarm information sample set and the first feature set into a first initial safety disposal network model for training to generate a trained first safety disposal network model;

[0019] The initial network alarm information sample set and the second feature set are input into a second initial security disposal network model for training to generate a trained second security disposal network model; based on the trained first security disposal network model and the trained second security disposal network model, the network security disposal model is generated.

[0020] In a preferred embodiment, in step S3, the specific acquisition logic of the network border protection situation awareness index is:

[0021] Calculate the missing data ratio of the turbulence assessment index and defense data;

[0022] The missing data ratio is denoted as Q i , i=1, 2, 3, 4, ..., n, n is a positive integer;

[0023] By Q i The standard deviation of Q i The standard deviation of is calibrated as X1;

[0024] The calculation formula is: In the formula, is the average value of the missing data ratio, X1 is the standard deviation of the missing data ratio, and the dynamic degree of remote sensing data missingness is obtained through the standard deviation of the missing data ratio.

[0025] In a preferred embodiment, the standard deviation thresholds of the data missing ratio are set, marked as X2 and X3, where X2<X3;

[0026] The standard deviation X1 of the data missing ratio is compared with the standard deviation thresholds X2 and X3 of the data missing ratio to generate the network border protection situation awareness index.

[0027] In a preferred embodiment, when X1≤X2<X3, a first abnormal signal is output;

[0028] When X1≥X3, the second abnormal signal is output;

[0029] When X2<X1<X3, the output is normal signal;

[0030] When the first abnormal signal and the second abnormal signal are output, an alarm is issued, and when the normal signal is output, no alarm is issued.

[0031] In a preferred embodiment, a network border protection situation awareness device includes:

[0032] The network alarm information collection module is used to analyze the abnormal proportion of the alarm intensity of the network alarm information and the deviation degree of the abnormal situation, and calculate the turbulence assessment index;

[0033] A preset network security disposal model module is used to input network alarm information into the network security disposal model for calculation and generate defense data;

[0034] The data missing ratio comparison module is used to compare the data missing ratio of the turbulence assessment index and the defense data to generate the network boundary protection situation awareness index;

[0035] The alarm prompt module is used to issue alarm prompts based on the network boundary protection situation awareness index.

[0036] In a preferred embodiment, a network border protection situation awareness system includes:

[0037] The server is used to collect network alarm information, input the network alarm information into a network security disposal model for calculation, compare the data missing ratio of the turbulence assessment index with the defense data, and issue an alarm prompt based on the network boundary protection situation awareness index.

[0038] The technical effects and advantages of a network border protection situation awareness method, device and system of the present invention are as follows:

[0039] 1. By analyzing the proportion of abnormal situations in the alarm intensity of network alarm information and the degree of deviation of abnormal situations, and calculating the turbulence assessment index, a comprehensive analysis of the network alarm information is carried out to facilitate subsequent comparative processing of the network alarm information and improve the accuracy of subsequent alarms.

[0040] 2. By inputting network alarm information into the network security disposal model for calculation, generating defense data, comparing the data missing ratio between the turbulence assessment index and the defense data, and generating the network boundary protection situation awareness index, the alarm information can be automatically prompted, and low-risk alarms can be automatically eliminated. Network security analysts can effectively eliminate the interference of massive low-risk alarms and false alarms, and can effectively perceive the network security situation and promptly discover abnormal network security situation. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 A schematic diagram of a network border protection situation awareness method of the present invention. DETAILED DESCRIPTION

[0042] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0043] Example 1

[0044] Figure 1 The present invention provides a network border protection situation awareness method, which includes the following steps:

[0045] Step S1: collecting network alarm information, analyzing the abnormal proportion of the alarm intensity of the network alarm information and the deviation degree of the abnormal situation, and calculating the turbulence assessment index;

[0046] Step S2: presetting a network security disposal model, inputting network alarm information into the network security disposal model for calculation, and generating defense data;

[0047] Step S3: Compare the data missing ratio of the turbulence assessment index and the defense data to generate a network boundary protection situation awareness index;

[0048] Step S4: Prompt an alarm based on the network boundary protection situation awareness index.

[0049] In step S1, the logic for obtaining the turbulence evaluation index is as follows:

[0050] Set the network alarm information monitoring interval and obtain the time length corresponding to the network alarm information monitoring interval; obtain the alarm intensity of the network alarm information monitoring interval in real time; set the alarm intensity threshold and obtain the time length during which the alarm intensity in the network alarm information monitoring interval is less than the alarm intensity threshold;

[0051] Calculate the turbulence assessment index, the expression is: Wherein, m and p are the number of abnormal conditions marked as alarm intensity in the network alarm information monitoring interval and the number of abnormal conditions marked as alarm intensity in the network alarm information monitoring interval respectively; p = 1, 2, 3, 4, ..., m, p, m are positive integers greater than 1; pgzs, t1, t2, xjz p , Q are respectively the turbulence assessment index, the time length that the alarm intensity of the network alarm information monitoring interval is less than the alarm intensity threshold, the time length corresponding to the network alarm information monitoring interval, and the average value corresponding to the pth abnormal situation monitoring interval marked as alarm intensity in the network alarm information monitoring interval.

[0052] It should be added that by analyzing the proportion of abnormal situations in the alarm intensity of network alarm information and the degree of deviation of abnormal situations, and calculating the turbulence assessment index, the approximate range of the alarm intensity of the network alarm information can be well judged, which is conducive to further analysis and comparison of the alarm intensity of the network alarm information and facilitates the subsequent elimination of some low-risk alarm information.

[0053] In step S2, the specific acquisition logic of the network security disposal model is:

[0054] Acquire an initial network alarm information sample set, a first feature set corresponding to the initial network alarm information sample set, and acquire an initial network alarm information sample set, a second feature set corresponding to the initial network alarm information sample set;

[0055] Inputting the initial network alarm information sample set and the first feature set into a first initial safety disposal network model for training to generate a trained first safety disposal network model;

[0056] The initial network alarm information sample set and the second feature set are input into a second initial security disposal network model for training to generate a trained second security disposal network model; based on the trained first security disposal network model and the trained second security disposal network model, the network security disposal model is generated.

[0057] It should be added that by directly calculating the network alarm information through the pre-trained security disposal network model, the corresponding defense results can be obtained, which improves the intelligence level of network security protection.

[0058] In step S3, the specific acquisition logic of the network border protection situation awareness index is:

[0059] Calculate the missing data ratio of the turbulence assessment index and defense data;

[0060] The missing data ratio is denoted as Q i , i=1, 2, 3, 4, ..., n, n is a positive integer;

[0061] By Q i The standard deviation of Q i The standard deviation of is calibrated as X1;

[0062] The calculation formula is: In the formula, is the average value of the missing data ratio, X1 is the standard deviation of the missing data ratio, and the dynamic degree of remote sensing data missingness is obtained through the standard deviation of the missing data ratio.

[0063] Set the standard deviation thresholds of the missing data ratio, labeled as X2 and X3, where X2<X3;

[0064] The standard deviation X1 of the data missing ratio is compared with the standard deviation thresholds X2 and X3 of the data missing ratio to generate the network border protection situation awareness index.

[0065] It should be added that the network boundary protection situation awareness index is generated by comparing the data missing ratio of the turbulence assessment index with the defense data. The generated network boundary protection situation awareness index can automatically eliminate low-risk alarms, and network security analysts can effectively eliminate the interference of massive low-risk alarms and false alarms, and can effectively perceive the network security situation and promptly discover network security situation anomalies.

[0066] When X1≤X2<X3, the first abnormal signal is output;

[0067] When X1≥X3, the second abnormal signal is output;

[0068] When X2<X1<X3, the output is normal signal;

[0069] When the first abnormal signal and the second abnormal signal are output, an alarm is issued, and when the normal signal is output, no alarm is issued.

[0070] It should be added that when the first abnormal signal and the second abnormal signal are output, the alarm information is automatically prompted, and the low-risk alarms can be automatically eliminated. Network security analysts can effectively eliminate the interference of massive low-risk alarms and false alarms, and can effectively perceive the network security situation and promptly discover abnormalities in the network security situation.

[0071] Example 2

[0072] The present invention also provides a network border protection situation awareness device, comprising:

[0073] The network alarm information collection module is used to analyze the abnormal proportion of the alarm intensity of the network alarm information and the deviation degree of the abnormal situation, and calculate the turbulence assessment index;

[0074] A preset network security disposal model module is used to input network alarm information into the network security disposal model for calculation and generate defense data;

[0075] The data missing ratio comparison module is used to compare the data missing ratio of the turbulence assessment index and the defense data to generate the network boundary protection situation awareness index;

[0076] The alarm prompt module is used to issue alarm prompts based on the network boundary protection situation awareness index.

[0077] Example 3

[0078] The present invention also provides a network border protection situation awareness system, including:

[0079] The server is used to collect network alarm information, input the network alarm information into a network security disposal model for calculation, compare the data missing ratio of the turbulence assessment index with the defense data, and issue an alarm prompt based on the network boundary protection situation awareness index.

[0080] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters and thresholds in the formula are set by technicians in this field according to actual conditions.

[0081] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0082] Those of ordinary skill in the art will appreciate that the modules and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0083] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and modules described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0084] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0085] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, and may be located in one place or distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0086] In addition, each functional module in each embodiment of the present application may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

[0087] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0088] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0089] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A network border protection situation awareness method, characterized in that: The steps include: Step S1: collecting network alarm information, analyzing the abnormal proportion of the alarm intensity of the network alarm information and the deviation degree of the abnormal situation, and calculating the turbulence assessment index; Step S2: presetting a network security disposal model, inputting network alarm information into the network security disposal model for calculation, and generating defense data; Step S3: Compare the data missing ratio of the turbulence assessment index and the defense data to generate a network boundary protection situation awareness index; Step S4: Prompt an alarm based on the network boundary protection situation awareness index.

2. A network border protection situation awareness method according to claim 1, characterized in that: In step S1, the logic for obtaining the turbulence evaluation index is as follows: Set the network alarm information monitoring interval and obtain the time length corresponding to the network alarm information monitoring interval; obtain the alarm intensity of the network alarm information monitoring interval in real time; set the alarm intensity threshold and obtain the time length during which the alarm intensity in the network alarm information monitoring interval is less than the alarm intensity threshold; Calculate the turbulence assessment index, the expression is: Wherein, m and p are the number of abnormal conditions marked as alarm intensity in the network alarm information monitoring interval and the number of abnormal conditions marked as alarm intensity in the network alarm information monitoring interval respectively; p = 1, 2, 3, 4, ..., m, p, m are positive integers greater than 1; pgzs, t1, t2, xjz p , Q are respectively the turbulence assessment index, the time length that the alarm intensity of the network alarm information monitoring interval is less than the alarm intensity threshold, the time length corresponding to the network alarm information monitoring interval, and the average value corresponding to the pth abnormal situation monitoring interval marked as alarm intensity in the network alarm information monitoring interval.

3. A network border protection situation awareness method according to claim 1, characterized in that: In step S2, the specific acquisition logic of the network security disposal model is: Acquire an initial network alarm information sample set, a first feature set corresponding to the initial network alarm information sample set, and acquire an initial network alarm information sample set, a second feature set corresponding to the initial network alarm information sample set; Inputting the initial network alarm information sample set and the first feature set into a first initial safety disposal network model for training to generate a trained first safety disposal network model; The initial network alarm information sample set and the second feature set are input into a second initial security disposal network model for training to generate a trained second security disposal network model; based on the trained first security disposal network model and the trained second security disposal network model, the network security disposal model is generated.

4. A network border protection situation awareness method according to claim 1, characterized in that: In step S3, the specific acquisition logic of the network border protection situation awareness index is: Calculate the missing data ratio of the turbulence assessment index and defense data; The missing data ratio is denoted as Q i , i=1, 2, 3, 4, ..., n, n is a positive integer; By Q i The standard deviation of Q i The standard deviation of is calibrated as X1; The calculation formula is: In the formula, is the average value of the missing data ratio, X1 is the standard deviation of the missing data ratio, and the dynamic degree of remote sensing data missingness is obtained through the standard deviation of the missing data ratio.

5. A network border protection situation awareness method according to claim 4, characterized in that: Set the standard deviation thresholds of the missing data ratio, labeled as X2 and X3, where X2<X3; The standard deviation X1 of the data missing ratio is compared with the standard deviation thresholds X2 and X3 of the data missing ratio to generate the network border protection situation awareness index.

6. A network border protection situation awareness method according to claim 5, characterized in that: When X1≤X2<X3, the first abnormal signal is output; When X1≥X3, the second abnormal signal is output; When X2<X1<X3, the output is normal signal; When the first abnormal signal and the second abnormal signal are output, an alarm is issued, and when the normal signal is output, no alarm is issued.

7. A network border protection situation awareness device, characterized in that: include: The network alarm information collection module is used to analyze the abnormal proportion of the alarm intensity of the network alarm information and the deviation degree of the abnormal situation, and calculate the turbulence assessment index; A preset network security disposal model module is used to input network alarm information into the network security disposal model for calculation and generate defense data; The data missing ratio comparison module is used to compare the data missing ratio of the turbulence assessment index and the defense data to generate the network boundary protection situation awareness index; The alarm prompt module is used to issue alarm prompts based on the network boundary protection situation awareness index.

8. A network border protection situation awareness system, characterized by: include: The server is used to collect network alarm information, input the network alarm information into a network security disposal model for calculation, compare the data missing ratio of the turbulence assessment index with the defense data, and issue an alarm prompt based on the network boundary protection situation awareness index.

Images