Situation awareness analysis method and system based on network event

Abstract

The invention relates to the field of network equipment analysis, and discloses a situation awareness analysis method based on a network event, which comprises the following analysis steps: a data acquisition module acquires data in network equipment in real time and uploads the acquired data to an analysis module for analysis, and the data comprises network data, equipment working state data and log information; the threat analysis module analyzes the data based on a deep learning algorithm, discovers potential security threats in the network equipment, processes the security threats in time, and obtains a threat coefficient through calculation. The invention further discloses a situation awareness analysis system based on the network events. According to the method, the security situation report is generated according to the scoring result, a visual security situation overview is provided for managers, the report content is detailed and accurate, the managers can quickly know the network security situation and make corresponding decisions, and network security situation awareness is more comprehensive, accurate and efficient.

Description

Technical Field

[0001] The present invention relates to the field of network equipment analysis, and in particular to a situation awareness analysis method and system based on network events. Background Art

[0002] As one of the core systems in the production system, the information security and reliability of the power monitoring system is directly related to the safe and stable operation of power production. However, in recent years, with the increasing complexity and advancement of hacker attack methods and technologies, attacks targeting industrial control systems have emerged in an endless stream, resulting in an increasing number of security threats to the power monitoring system. In order to effectively respond to these challenges, network security situation awareness technology has emerged and has become an important means to ensure network security. However, the existing technology only analyzes the threats of current network events, identifies the threats existing in network devices, and solves the threats, but does not assess the risks of network devices, cannot understand the current security status of network devices, and cannot effectively make targeted solutions, resulting in an increase in the number of attacks on some vulnerable devices and poor prevention. In this regard, we propose a situation awareness analysis method and system based on network events. Summary of the invention

[0003] The present invention aims at the technical problems existing in the prior art, provides a situation awareness analysis method and system based on network events, and solves the problem that risk assessment cannot be effectively performed.

[0004] The technical solution of the present invention to solve the above technical problem is as follows: a situation awareness analysis method based on network events, the analysis steps are: The data acquisition module acquires data from network devices in real time and uploads the acquired data to the analysis module for analysis. The data includes network data, device working status data and log information; The threat analysis module analyzes data based on deep learning algorithms, discovers potential security threats in network devices, handles security threats in a timely manner, and calculates threat coefficients; The vulnerability assessment module evaluates the vulnerability of network devices by acquiring the status data of network devices and determines the vulnerability index of network devices; The record storage module records and saves the currently discovered security threats, generates historical records, and obtains the attack frequency of the current network equipment through historical data analysis; The rating module obtains a score value based on the threat coefficient, vulnerability index and attack frequency. Based on the score value, it rates the current security status of network devices, generates a security situation report and delivers it to the management personnel. Different management methods are used for different levels of network equipment to maintain and improve network equipment and perform work.

[0005] Preferably, the data acquisition module acquires data through an API interface. The network device provides an API interface. The data of the access device is acquired through the API interface, and the data of the device is retrieved, and the retrieved data is uploaded to the threat analysis module for analysis; the threat analysis module analyzes the data based on a deep learning algorithm, discovers potential security threats in the network device, pre-processes the acquired data, and extracts the features of the data, and compares the currently extracted data features with abnormal behaviors that match known threats. If they are consistent, it means that there is a security threat in the network device, otherwise it means that there is no security threat in the network device; when a security threat is detected, an early warning mechanism is triggered to notify the management personnel to take action.

[0006] Preferably, when comparing the abnormal behavior matching the known threat, it is checked whether the data meets the defined rules, and the data is compared by cosine similarity. When comparing, the data is converted into a vector form, and the comparison formula is:

[0007] A is the currently extracted data feature vector, and B is the feature vector of known threats. is the angle between the two vectors, is the modulus of eigenvector A and eigenvector B, cos is the result of similarity comparison. When the calculated value is close to 1, it indicates that the two feature vectors are similar, indicating that there is a security threat in the current network device. When the calculated value is close to 0, it means that the two feature vectors are not similar, which means that there is no security threat in the current network device.

[0008] Preferably, the calculation formula of the threat coefficient is:

[0009] Where C is the threat coefficient, d is the asset value of network equipment loss caused by the current threat, c is the severity of the current threat, and e is the weight. The weight is determined based on the entropy weight method. The information entropy of d and c is calculated and the obtained threat coefficient is uploaded to the rating module through calculation.

[0010] Preferably, the calculation formula of the vulnerability index of the vulnerability assessment module is:

[0011] Among them, g is the vulnerability index, f is the comprehensive evaluation function, h is the configuration security, i is the port risk, and k is the software security. The vulnerability of the current network device is obtained through calculation and evaluation, and the attribute value is quantified into a specific numerical value. The configuration security h checks whether the configuration of the network device complies with the best security practices and gives a numerical value. The port risk i analyzes the open ports of the network device to evaluate whether they are used for attacks and gives an analysis coefficient. The software security k determines whether there are vulnerabilities in the current network device by querying the software vulnerabilities and gives a numerical value. The vulnerability index of the current network device is uploaded to the rating module for evaluation.

[0012] Preferably, the record storage module calculates the frequency of attacks on the current network device within a unit time through internally stored records, calculates based on statistical analysis to obtain the current attack frequency value L, and uploads the obtained frequency value L to the rating module for evaluation.

[0013] Preferably, the rating module score numerical calculation formula is:

[0014] Among them, M is the value obtained by weighted summation, C is the threat coefficient, g is the vulnerability index, L is the frequency value, W1, W2 and W3 are weights, where the weights are usually determined in advance and allocated according to the relative importance of each coefficient in the overall rating.

[0015] Preferably, the obtained M value is rated, and the rating standards are determined in advance, including excellent, good, fair and poor, and different score range thresholds are established for different rating standards. The obtained M value is compared with the thresholds of different score ranges, and the current M value is rated to obtain the security status level standard of the current network device, and a corresponding report is generated for delivery. The report includes the rating results, problems existing in the network equipment and given suggestions.

[0016] A situational awareness analysis system based on network events. The analysis system includes: data acquisition module, threat analysis module, vulnerability assessment module, record storage module and rating module; The data acquisition module is used to acquire data of network devices in real time; The threat analysis module analyzes data to identify potential security threats; The vulnerability assessment module assesses the vulnerability of the device; The record storage module records and saves the security threats of the current device; The rating module rates the security of current network devices and generates a security situation report.

[0017] Preferably, the record storage module stores the data analyzed by the analysis system in a cloud network-based manner to make decisions for subsequent analysis.

[0018] The beneficial effects of the present invention are: using deep learning algorithms to analyze big data can more accurately identify potential security threats in network devices, including known and unknown threat types, and comprehensively evaluate the vulnerability of network devices by obtaining status data of network devices, including loopholes and weaknesses in hardware, software and configuration. A comprehensive score is given based on multiple dimensions such as threat coefficient, vulnerability index and attack frequency to obtain a security status score for the network device. This scoring method can comprehensively reflect the security level of the network device, and a security situation report is generated based on the scoring results, providing managers with an intuitive security status overview. The report content is detailed and accurate, which helps managers quickly understand the network security status and make corresponding decisions, making network security situation awareness more comprehensive, accurate and efficient. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 Flow chart of the analysis steps of the present invention; Figure 2 This is a block diagram of the analysis system of the present invention. DETAILED DESCRIPTION

[0020] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0021] In the description of this application, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, "plurality" means two or more, unless otherwise clearly and specifically defined.

[0022] In the description of the present application, the term "for example" is used to mean "used as an example, illustration or description". Any embodiment described as "for example" in the present application is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is given to enable any technician in the field to implement and use the present invention. In the following description, details are listed for the purpose of explanation. It should be understood that a person of ordinary skill in the art can recognize that the present invention can be implemented without using these specific details. In other examples, well-known structures and processes will not be elaborated in detail to avoid unnecessary details to obscure the description of the present invention. Therefore, the present invention is not intended to be limited to the embodiments shown, but is consistent with the widest scope consistent with the principles and features disclosed in the present application.

[0023] Reference Figure 1 As shown in the figure, the situation awareness analysis method based on network events has the following analysis steps: The data acquisition module acquires data from network devices in real time and uploads the acquired data to the analysis module for analysis. The data includes network data, device working status data and log information; The threat analysis module analyzes data based on deep learning algorithms, discovers potential security threats in network devices, handles security threats in a timely manner, and calculates threat coefficients; The vulnerability assessment module evaluates the vulnerability of network devices by acquiring the status data of network devices and determines the vulnerability index of network devices; The record storage module records and saves the currently discovered security threats, generates historical records, and obtains the attack frequency of the current network equipment through historical data analysis; The rating module obtains a score value based on the threat coefficient, vulnerability index and attack frequency. Based on the score value, it rates the current security status of network devices, generates a security situation report and delivers it to the management personnel. Different management methods are used for different levels of network equipment to maintain and improve network equipment and perform work.

[0024] This application uses deep learning algorithms to analyze big data, which can more accurately identify potential security threats in network devices, including known and unknown threat types. The deep learning model can automatically extract data features, reduce manual intervention, and improve the accuracy and efficiency of threat identification. By comprehensively evaluating the severity and frequency of threats, the threat coefficient is calculated, providing a quantitative basis for subsequent security decisions. Once a potential threat is discovered, the system can respond quickly and take corresponding measures to prevent and deal with it, effectively reducing the damage of security incidents to the network; By obtaining the status data of network devices, the vulnerability of network devices is comprehensively assessed, including loopholes and weaknesses in hardware, software, and configuration. Based on the assessment results, the vulnerability index of network devices is calculated, providing an important reference for security reinforcement and protection; The currently discovered security threats are recorded and saved to form a historical record library. These historical records provide an important basis for subsequent security analysis and auditing. By analyzing historical data, the attack frequency of network devices can be obtained, which helps to identify devices or systems that are frequently attacked, so as to focus on protection. A comprehensive score is given based on threat coefficient, vulnerability index and attack frequency to obtain the security status score of the network equipment. This scoring method can comprehensively reflect the security level of the network equipment. A security situation report is generated based on the scoring results to provide managers with an intuitive security status overview. The report content is detailed and accurate, which helps managers quickly understand the network security status and make corresponding decisions.

[0025] The data acquisition module acquires data through the API interface. The network device provides an API interface. The data of the access device is acquired through the API interface, and the data of the device is retrieved and uploaded to the threat analysis module for analysis. The threat analysis module analyzes the data based on the deep learning algorithm, discovers potential security threats in the network device, pre-processes the acquired data, and extracts the features of the data. The currently extracted data features are compared with abnormal behaviors that match the known threats. If they are consistent, it means that there is a security threat in the network device. Otherwise, it means that there is no security threat in the network device. When a security threat is detected, the early warning mechanism is triggered to notify the management personnel to take action.

[0026] This application obtains data from network devices in real time through the API interface, which can ensure that the threat analysis module can respond quickly to changes in the network. This real-time performance is crucial for timely detection and response to potential security threats. The entire process from data acquisition to threat analysis to early warning notification is automated, reducing the need for manual intervention. This not only improves work efficiency but also reduces the risk of human error. Deep learning algorithms can process complex data patterns, extract key features, and accurately match them with known threat patterns. This highly accurate analysis helps reduce false positives and negatives and improves the reliability of security defenses.

[0027] When comparing the abnormal behavior that matches the known threat, check whether the data meets the defined rules, and compare them by cosine similarity. When comparing, convert the data into a vector form, and the comparison formula is:

[0028] A is the currently extracted data feature vector, and B is the feature vector of known threats. is the angle between the two vectors, is the modulus of eigenvector A and eigenvector B, cos is the result of similarity comparison. When the calculated value is close to 1, it indicates that the two feature vectors are similar, indicating that there is a security threat in the current network device. When the calculated value is close to 0, it means that the two feature vectors are not similar, which means that there is no security threat in the current network device.

[0029] The formula for calculating the threat factor is:

[0030] Where C is the threat coefficient, d is the asset value of network equipment loss caused by the current threat, c is the severity of the current threat, and e is the weight. The weight is determined based on the entropy weight method. The information entropy of d and c is calculated and the obtained threat coefficient is uploaded to the rating module through calculation.

[0031] The calculation formula of the vulnerability index of the vulnerability assessment module is:

[0032] Among them, g is the vulnerability index, f is the comprehensive evaluation function, h is the configuration security, i is the port risk, and k is the software security. The vulnerability of the current network device is obtained through calculation and evaluation, and the attribute value is quantified into a specific numerical value. The configuration security h checks whether the configuration of the network device complies with the best security practices and gives a numerical value. The port risk i analyzes the open ports of the network device to evaluate whether they are used for attacks and gives an analysis coefficient. The software security k determines whether there are vulnerabilities in the current network device by querying the software vulnerabilities and gives a numerical value. The vulnerability index of the current network device is uploaded to the rating module for evaluation.

[0033] The comprehensive evaluation function in this application is the process of integrating multiple evaluation indicators or factors into a single evaluation value through certain mathematical methods. This process involves the selection of evaluation indicators, the determination of weights and the application of comprehensive calculation methods. The evaluation indicators are the basic units that reflect the characteristics of the evaluation objects, and the weights reflect the importance of each indicator in the overall evaluation.

[0034] The record storage module calculates the frequency of attacks on the current network device in unit time through internally stored records, calculates based on statistical analysis methods, obtains the current attack frequency value L, and uploads the obtained frequency value L to the rating module for evaluation.

[0035] The statistical analysis method of this application is a prior art and will not be described in detail here.

[0036] The numerical calculation formula for the rating module score is:

[0037] Among them, M is the value obtained by weighted summation, C is the threat coefficient, g is the vulnerability index, L is the frequency value, W1, W2 and W3 are weights, where the weights are usually determined in advance and allocated according to the relative importance of each coefficient in the overall rating.

[0038] The obtained M value is rated. The rating standards are determined in advance, including excellent, good, fair and poor. Different score range thresholds are established for different rating standards. The obtained M value is compared with the thresholds of different score ranges, and the current M value is rated to obtain the security status level standard of the current network device. A corresponding report is generated and delivered. The report includes the rating results, problems existing in the network equipment and given suggestions.

[0039] By comparing the M value with the pre-set rating standards, this application can clearly understand the security status level of the current network equipment. This clear understanding helps managers quickly grasp the overall situation of network security and provide a basis for subsequent decision-making and actions. During the rating process, the system will identify problems with network equipment based on the specific performance of the M value. These problems may be known vulnerabilities, configuration errors, and abnormal behaviors. By clearly listing these problems in the report, managers can quickly locate the problem and point out the direction for subsequent repair and improvement work.

[0040] Reference Figure 2 As shown, the situational awareness analysis system based on network events includes: data acquisition module, threat analysis module, vulnerability assessment module, record storage module and rating module; The data acquisition module is used to acquire data of network devices in real time; The threat analysis module analyzes data to identify potential security threats; The vulnerability assessment module assesses the vulnerability of the device; The record storage module records and saves the security threats of the current device; The rating module rates the security of current network devices and generates a security situation report.

[0041] The record storage module stores the data analyzed by the analysis system in a cloud network-based manner to make decisions for subsequent analysis.

[0042] The cloud network of this application usually has extremely high storage capacity and scalability, and can easily handle the data generated by a large number of network devices. The record storage module uses the cloud network for storage, which can ensure that the data processed by all analysis systems are completely and securely saved, providing a solid data foundation for subsequent analysis and decision-making. Cloud network service providers usually use redundancy and disaster recovery technologies to ensure data reliability and availability. Even in the event of hardware failures or natural disasters, data stored in the cloud can be restored and accessed in a timely manner. This high reliability and availability is crucial to ensuring continuous monitoring and security analysis of network equipment.

[0043] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A situation awareness analysis method based on network events, characterized in that: The analysis steps are: The data acquisition module acquires data from network devices in real time and uploads the acquired data to the analysis module for analysis. The data includes network data, device working status data and log information; The threat analysis module analyzes data based on deep learning algorithms, discovers potential security threats in network devices, handles security threats in a timely manner, and calculates threat coefficients; The vulnerability assessment module evaluates the vulnerability of network devices by acquiring the status data of network devices and determines the vulnerability index of network devices; The record storage module records and saves the currently discovered security threats, generates historical records, and obtains the attack frequency of the current network equipment through historical data analysis; The rating module obtains a score value based on the threat coefficient, vulnerability index and attack frequency. Based on the score value, it rates the current security status of network devices, generates a security situation report and delivers it to the management personnel. Different management methods are used for different levels of network equipment to maintain and improve network equipment and perform work.

2. The situation awareness analysis method based on network events according to claim 1 is characterized in that: The data acquisition module acquires data through the API interface. The network device provides an API interface. The data of the access device is acquired through the API interface, and the data of the device is retrieved and uploaded to the threat analysis module for analysis. The threat analysis module analyzes the data based on the deep learning algorithm, discovers potential security threats in the network device, pre-processes the acquired data, extracts the features of the data, and compares the currently extracted data features with the abnormal behaviors matching the known threats. If they are consistent, it means that there is a security threat in the network device, otherwise it means that there is no security threat in the network device. When a security threat is detected, the early warning mechanism is triggered to notify the management personnel to take action.

3. The situation awareness analysis method based on network events according to claim 2 is characterized in that: When comparing the abnormal behavior that matches the known threat, check whether the data meets the defined rules, and compare them by cosine similarity. When comparing, convert the data into a vector form, and the comparison formula is: A is the currently extracted data feature vector, and B is the feature vector of known threats. is the angle between the two vectors, is the modulus of eigenvector A and eigenvector B, cos is the result of similarity comparison. When the calculated value is close to 1, it indicates that the two feature vectors are similar, indicating that there is a security threat in the current network device. When the calculated value is close to 0, it means that the two feature vectors are not similar, which means that there is no security threat in the current network device.

4. The situation awareness analysis method based on network events according to claim 1 is characterized in that: The formula for calculating the threat factor is: Where C is the threat coefficient, d is the asset value of network equipment loss caused by the current threat, c is the severity of the current threat, and e is the weight. The weight is determined based on the entropy weight method. The information entropy of d and c is calculated and the obtained threat coefficient is uploaded to the rating module through calculation.

5. The situation awareness analysis method based on network events according to claim 1 is characterized in that: The calculation formula of the vulnerability index of the vulnerability assessment module is: Among them, g is the vulnerability index, f is the comprehensive evaluation function, h is the configuration security, i is the port risk, and k is the software security. The vulnerability of the current network device is obtained through calculation and evaluation, and the attribute value is quantified into a specific numerical value. The configuration security h checks whether the configuration of the network device complies with the best security practices and gives a numerical value. The port risk i analyzes the open ports of the network device to evaluate whether they are used for attacks and gives an analysis coefficient. The software security k determines whether there are vulnerabilities in the current network device by querying the software vulnerabilities and gives a numerical value. The vulnerability index of the current network device is uploaded to the rating module for evaluation.

6. The situation awareness analysis method based on network events according to claim 1 is characterized in that: The record storage module calculates the frequency of attacks on the current network device in unit time through the internally stored records, calculates based on statistical analysis methods, obtains the current attack frequency value L, and uploads the obtained frequency value L to the rating module for evaluation.

7. The situation awareness analysis method based on network events according to claim 1 is characterized in that: The numerical calculation formula for the rating module score is: ； Among them, M is the value obtained by weighted summation, C is the threat coefficient, g is the vulnerability index, L is the frequency value, W1, W2 and W3 are weights, where the weights are usually determined in advance and allocated according to the relative importance of each coefficient in the overall rating.

8. The situation awareness analysis method based on network events according to claim 7 is characterized in that: The obtained M value is rated. The rating standards are determined in advance, including excellent, good, fair and poor. Different score range thresholds are established for different rating standards. The obtained M value is compared with the thresholds of different score ranges, and the current M value is rated to obtain the security status level standard of the current network device. A corresponding report is generated and delivered. The report includes the rating results, problems existing in the network equipment and given suggestions.

9. A situational awareness analysis system based on network events, characterized in that: The analysis system includes: data acquisition module, threat analysis module, vulnerability assessment module, record storage module and rating module; The data acquisition module is used to acquire data of network devices in real time; The threat analysis module analyzes data to identify potential security threats; The vulnerability assessment module assesses the vulnerability of the device; The record storage module records and saves the security threats of the current device; The rating module rates the security of current network devices and generates a security situation report.

10. The situational awareness analysis system based on network events according to claim 9, characterized in that: The record storage module stores the data analyzed by the analysis system in a cloud network-based manner to make decisions for subsequent analysis.

Images