Method and device for constructing data security situation awareness platform, and electronic equipment

Abstract

The embodiment of the invention discloses a data security situation awareness platform construction method and device and electronic equipment. The method comprises the following steps: acquiring network communication data of a to-be-constructed subject, and extracting the network communication data to obtain information transmission data of the to-be-constructed subject; performing analysis according to the information transmission data of the to-be-constructed subject to obtain an information transmission topological structure model; analyzing the information transmission data of the to-be-constructed subject to obtain non-security information transmission data; constructing an abnormal information transmission detection model according to the non-security information transmission data, and performing detection to obtain real-time abnormal information transmission data; integrating the information transmission topological structure model to obtain abnormal node link data; analyzing according to the abnormal node link data and the information transmission data of the to-be-built subject to obtain a security information transmission link structure model; the invention discloses an information transmission security situation awareness platform. According to the invention, data security or network security events can be avoided, and a better network environment is provided.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of network security technology, and in particular to a method, device, and electronic device for building a data security situation awareness platform. Background Art

[0002] With the rapid development of information technology and the widespread application of the Internet, data security has become the primary concern of all kinds of organizations and enterprises. In a digital and networked environment, the transmission, storage and processing of data have become more and more complex, and data security threats have become increasingly serious. From early virus attacks and network intrusions to modern advanced persistent threats (APT), data leaks and ransomware, the types and complexity of data security threats continue to increase.

[0003] Traditional data security protection methods mainly rely on static rules and signature-based detection systems. Traditional methods mainly rely on known attack feature libraries, which may fail once faced with unknown or variant attack methods. Traditional static rules are based on fixed security policies and are difficult to adapt to dynamically changing network environments and attack patterns. They are prone to false positives or missed reports, affecting the accuracy and efficiency of security protection. Summary of the invention

[0004] The embodiments of the present application provide a method, device, and electronic device for building a data security situation awareness platform to improve the real-time and adaptability of push notifications such as transaction risks and marketing content.

[0005] In a first aspect, an embodiment of the present application provides a method for building a data security situation awareness platform, the method comprising:

[0006] Acquire network communication data of the subject to be constructed, and determine information transmission data and information transmission topology structure model of the subject to be constructed according to the network communication data;

[0007] Performing abnormal analysis on the information transmission data to obtain abnormal information transmission data, and performing abnormal network communication correction on the abnormal information transmission data according to the network communication data to obtain non-safe information transmission data;

[0008] An abnormal information transmission detection model is constructed based on the non-safe information transmission data, and the abnormal information transmission detection model is used to perform information transmission anomaly detection on the information transmission data to obtain real-time abnormal information transmission data;

[0009] According to the real-time abnormal information transmission data, the information transmission topology structure model is divided into abnormal information transmission nodes to obtain abnormal information transmission node data, and abnormal node links are integrated according to the abnormal information transmission node data to obtain abnormal node link data;

[0010] According to the abnormal node link data and information transmission data, the abnormal transmission node blocking strategy is analyzed to obtain the abnormal transmission node blocking strategy, and the safe information transmission link structure model is constructed according to the abnormal transmission node blocking strategy and the information transmission topology structure model;

[0011] A security situation awareness platform is constructed based on the security information transmission link structure model and the abnormal information transmission detection model to obtain the information transmission security situation awareness platform of the subject to be constructed.

[0012] In a second aspect, an embodiment of the present application provides a device for constructing a data security situation awareness platform, the device comprising:

[0013] The information transmission topology structure module is used to obtain the network communication data of the subject to be constructed, and determine the information transmission data and the information transmission topology structure model of the subject to be constructed according to the network communication data;

[0014] The abnormal information transmission analysis module is used to perform abnormal analysis on the information transmission data to obtain abnormal information transmission data, and perform abnormal network communication correction on the abnormal information transmission data according to the network communication data to obtain non-safe information transmission data;

[0015] The abnormal information transmission detection model building module is used to build an abnormal information transmission detection model based on the non-safe information transmission data, and perform information transmission anomaly detection on the information transmission data through the abnormal information transmission detection model to obtain real-time abnormal information transmission data;

[0016] The abnormal node link integration module is used to divide the information transmission topology structure model into abnormal information transmission nodes according to the real-time abnormal information transmission data to obtain abnormal information transmission node data, and to integrate the abnormal node links according to the abnormal information transmission node data to obtain abnormal node link data;

[0017] The blocking strategy analysis module is used to analyze the blocking strategy of abnormal transmission nodes according to the abnormal node link data and information transmission data, obtain the blocking strategy of abnormal transmission nodes, and build a safe information transmission link structure model according to the blocking strategy of abnormal transmission nodes and the information transmission topology structure model;

[0018] The security situation awareness platform construction module is used to construct the security situation awareness platform based on the security information transmission link structure model and the abnormal information transmission detection model to obtain the information transmission security situation awareness platform of the subject to be constructed.

[0019] In a third aspect, an embodiment of the present application further provides an electronic device, the electronic device comprising:

[0020] one or more processors;

[0021] a storage device for storing one or more programs,

[0022] When one or more programs are executed by one or more processors, the one or more processors implement the method for building a data security situation awareness platform as provided in any embodiment of the present application.

[0023] The technical solution of the embodiment of the present application obtains the network communication data of the subject to be constructed, extracts it, and obtains the information transmission data of the subject to be constructed; analyzes the information transmission data of the subject to be constructed to obtain the information transmission topology structure model; analyzes the information transmission data of the subject to be constructed to obtain the non-safe information transmission data; constructs an abnormal information transmission detection model according to the non-safe information transmission data, and detects it to obtain real-time abnormal information transmission data; integrates the information transmission topology structure model to obtain abnormal node link data; analyzes the abnormal node link data and the information transmission data of the subject to be constructed to obtain the safe information transmission link structure model; and provides an information transmission security situation awareness platform. The present invention can avoid data security or network security incidents and provide a better network environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 A flowchart of a method for building a data security situation awareness platform provided in Example 1 of the present application;

[0025] Figure 2 A schematic diagram of the structure of a device for building a data security situation awareness platform provided in Example 2 of the present application;

[0026] Figure 3 A schematic diagram of the structure of an electronic device provided in Example 3 of the present application. DETAILED DESCRIPTION

[0027] The present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present application, rather than to limit the present application. It should also be noted that, for ease of description, only the parts related to the present application, rather than all structures, are shown in the accompanying drawings.

[0028] Embodiment 1

[0029] Figure 1 A flow chart of a method for constructing a data security situation awareness platform provided in Example 1 of the present application is shown in FIG. Figure 1 As shown, the method for constructing a data security situation awareness platform provided in this embodiment can be applied to a data security situation awareness platform constructed on a device with data processing capabilities such as a computer, and can be used in conjunction with some application software to achieve a better experience. Specifically, the method may include the following steps:

[0030] Step 101: Acquire network communication data of the subject to be constructed, and determine information transmission data and information transmission topology structure model of the subject to be constructed according to the network communication data.

[0031] In this step, the subject to be constructed can be an organization, enterprise or other entity that needs to build a data security situation awareness platform.

[0032] In this embodiment, a network traffic monitoring tool (such as Wireshark or NetFlow) is used to collect the flow data of the intranet and extranet of the subject to be constructed. These data should contain information such as IP packets, transport layer protocols (such as TCP, UDP), source / destination IP addresses and port numbers, transmission time, etc. Through data analysis tools (such as Python's pandas library or R language), features are extracted from the original traffic data, including packet size, transmission rate, connection duration, and transmission protocol type, to generate a feature data set, for example, the features of each connection (number of packets, total amount of data, average delay) will be used as the information transmission data of the subject to be constructed. Use a network topology analysis tool (such as Graphviz or Gephi) to perform topological analysis on the extracted feature data, build a network model of information transmission of the subject to be constructed, including nodes (such as servers, terminals) and edges (such as communication paths), and generate an information transmission topology structure model, such as a graph structure file (.dot) or a graph database (such as Neo4j).

[0033] Specifically, it includes: obtaining the network communication data of the subject to be constructed, and extracting the enterprise information transmission characteristics of the network communication data. When the information transmission data with the subject to be constructed is obtained, a traffic capture device, such as a network analyzer or a proxy server, can be deployed in the internal network of the subject to be constructed. These devices will collect network traffic data in real time, including the source IP address, destination IP address, protocol type, packet size, and transmission time of the data packet. Then, a specific algorithm (for example, a feature extraction algorithm based on traffic pattern analysis) is used to analyze the captured data to extract the characteristics of the information transmission of the subject to be constructed. These characteristics include network bandwidth usage, data transmission frequency, common communication paths, etc. In this way, preliminary information transmission data of the subject to be constructed can be obtained, providing basic data for subsequent analysis.

[0034] When information transmission data is divided into information transmission nodes to obtain information storage node data and information relay node data, after data extraction is completed, the network topology analysis tool is used to process the data to identify each information transmission node in the network. Information transmission nodes include information storage nodes (such as servers, databases) and information relay nodes (such as routers, switches). By analyzing the IP addresses and port numbers in the network traffic data, the data can be classified into different nodes. For example, nodes with large traffic storage access requests are marked as information storage nodes, while nodes that handle a large number of forwarding operations are marked as information relay nodes. These node data are recorded in the database for further analysis.

[0035] When the information transmission node connection data is obtained by performing information transmission node connection analysis on the information relay node data, a detailed connection analysis is performed on the information relay node data, and a network graph analysis tool is used to construct a connection graph between nodes. By analyzing the data flow and communication path between information relay nodes, the connection relationship between nodes can be determined. The connection degree calculation method in graph theory is applied, such as calculating the degree of each relay node (i.e., the number of directly connected nodes) and identifying key relay nodes, which play an important role in network data transmission. This connection information is saved as node connection data for subsequent analysis.

[0036] Specifically, node transmission frequency statistics can be performed based on information transmission data to obtain high-frequency transmission node data and low-frequency transmission node data; node intersection calculation can be performed on high-frequency transmission node data and information relay node data to obtain core relay node data; node intersection calculation can be performed on low-frequency transmission node data and information relay node data to obtain edge relay node data; node connection relationship integration can be performed on core relay node data and edge relay node data based on information transmission data to obtain core relay node connection data and edge relay node connection data; node connection similarity calculation can be performed on core relay node connection data and edge relay node connection data to obtain relay node connection similarity data; node connection network clustering can be performed on core relay node connection data and edge relay node connection data based on relay node connection similarity data to obtain information transmission node connection data.

[0037] Among them, in the process of obtaining high-frequency transmission node data and low-frequency transmission node data, in the information system of the subject to be built, the transmission data of all nodes are first collected, which includes the number and frequency of data packets sent and received by each node. Data sources can include network logs, traffic monitoring systems, and network analysis tools. Use data processing scripts written in Python to analyze these data and count the transmission frequency of each node. Assume that the transmission frequency of node A is 1000 times / minute, node B is 500 times / minute, and node C is 50 times / minute. According to the statistical results, nodes A and B are marked as high-frequency transmission nodes, and node C is marked as a low-frequency transmission node.

[0038] After obtaining the high-frequency and low-frequency transmission node data, use set operations to calculate the intersection. Assume that the high-frequency transmission node set is {A, B, D} and the low-frequency transmission node set is {C, D, E}. Through the intersection calculation, the core relay node set is {D} and the edge relay node set is {C, E}. This intersection calculation can be implemented through Python set operations, core_relay_nodes = high_freq_nodes.intersection(mid_relay_nodes) and edge_relay_nodes = low_freq_nodes.intersection(mid_relay_nodes).

[0039] In the process of obtaining the core relay node connection data and the edge relay node connection data, the connection relationship of the core relay node (such as D) and the edge relay node (such as C, E) is integrated. Assume that in the network, node D is connected to nodes A and B, node C is connected to nodes F and G, and node E is connected to nodes H and I. By constructing a network topology graph, the connection relationship of the core relay node D is integrated as {A, B}, the connection relationship of the edge relay node C is {F, G}, and the connection relationship of the edge relay node E is {H, I}. This can be achieved through a graph theory library such as NetworkX to achieve the integration of nodes and connection relationships.

[0040] When performing similarity calculation, calculate the connection similarity between the core relay node and the edge relay node. Use cosine similarity or Jaccard similarity as the metric. Assume that the connection nodes of the core relay node D are {A, B}, and the connection nodes of the edge relay node C are {F, G}. The similarity can be calculated as 0 because the nodes connected by the two have no intersection. If Jaccard similarity is used, the formula is J(A, B) = \frac{|A\cap B|}{|A\cup B|}, in which case the result is 0.

[0041] When clustering the node connection network clusters, the connection data of the core relay nodes and the edge relay nodes can be clustered and analyzed based on the calculated relay node connection similarity data. The node connection data is divided into multiple clusters using the K-means clustering algorithm. Assume that the node connection data is divided into two categories: one category contains highly similar nodes, and the other category contains low-similarity nodes. Use the KMeans class in Python's Scikit-learn library for clustering to obtain the final node connection network cluster. The result may be that nodes D, A, and B are divided into one cluster, and nodes C, F, and G are divided into another cluster.

[0042] The information storage node data and the information transmission node connection data are associated with each other to obtain the information transmission node connection data, and the topology structure analysis is performed based on the information transmission node connection data. When the information transmission topology structure is obtained, the data of the information storage node and the information relay node connection data are combined to establish a complete network topology structure. Use the topology analysis tool to build a network graph model based on the node connection data and perform topology structure analysis. The analysis includes the connectivity of the nodes, the path efficiency of the network, potential bottlenecks, etc. For example, the Kruskal algorithm or the Prim algorithm is used to calculate the minimum spanning tree of the network, so as to identify the main data flow paths and the connection between nodes. Through these analyses, the overall topology structure of information transmission can be obtained.

[0043] When the information transmission topology model is obtained by selecting node security protocols for the information transmission topology structure based on the information storage node data and the information relay node data, after completing the topology structure analysis, select a suitable security protocol according to the type and function of each node. For example, for information storage nodes, select a strong encryption protocol (such as AES encryption) to ensure the security of data storage; for information relay nodes, select a network layer security protocol (such as IPsec) to protect the security of data transmission. A security protocol selection tool can be used to automatically recommend the most suitable protocol based on the characteristics of the node (such as data sensitivity, communication frequency). Apply the selected security protocol to the network topology and form a security protocol model, which can effectively protect the security of the information transmission system of the entire subject to be built.

[0044] The process of obtaining the information transmission topology structure model may specifically include: calculating the storage node access volume of the information storage node data, thereby obtaining the storage node access volume data, and selecting a data encryption protocol for the information storage node data according to the storage node access volume data, thereby obtaining the information storage security protocol;

[0045] In the present embodiment, in a large-scale distributed storage system in a subject to be constructed, the access volume of each storage node is first monitored, including the number of read and write operations. In order to accurately calculate the access volume, statistical software can be used to summarize and analyze the operation logs of the storage nodes. Assume that the access volume of storage node A is 10,000 times and the access volume of storage node B is 5,000 times. According to the access volume data, a suitable data encryption protocol is selected. For example, for node A with high access volume, the AES-256 encryption protocol can be selected to ensure the security of data transmission, and for node B with low access volume, a lighter encryption protocol such as AES-128 can be selected to reduce resource consumption. These selections are then applied to node A and node B to protect their data.

[0046] Perform relay node performance evaluation on information relay node data according to the information transmission data of the subject to be constructed, thereby obtaining relay node performance data;

[0047] In this embodiment, the performance of the information relay node is evaluated. Assume that there are three relay nodes X, Y and Z. The performance evaluation includes the measurement of bandwidth, delay and throughput. Use a network performance monitoring tool (such as iperf) to test the bandwidth and delay of each relay node. For example, the bandwidth of node X is 1Gbps and the delay is 5ms; the bandwidth of node Y is 500Mbps and the delay is 10ms; the bandwidth of node Z is 750Mbps and the delay is 8ms. Based on these performance data, an appropriate secure communication protocol is selected. For example, for node X with higher bandwidth, a more complex security protocol (such as TLS1.3) is selected, and for node Y with lower bandwidth, a simpler protocol (such as TLS1.2) is selected to balance performance and security.

[0048] Selecting a secure communication protocol for information relay node data according to relay node performance data, thereby obtaining an information relay security protocol;

[0049] In this embodiment, a secure communication protocol is selected based on the relay node performance data. For example, if node X has good bandwidth and latency, a protocol with strong security (such as IPsec or VPN) can be selected to ensure data confidentiality and integrity. For node Y, a more basic protocol (such as ordinary HTTPS) is selected to reduce system burden and ensure basic security of communication. The selection process is based on the performance requirements and network security requirements of each node.

[0050] Extract terminal node features from the information transmission topology structure to obtain terminal node data, and perform communication network level statistics on the terminal node data to obtain terminal node communication network level data;

[0051] In this embodiment, in a multi-level communication network, the characteristics of each terminal node, such as IP address, device type and connection frequency, are extracted. By statistically analyzing the communication data of the terminal nodes, for example, using a network traffic analysis tool (such as Wireshark), the communication data of each terminal node at different network levels (such as the physical layer, data link layer and network layer) is obtained. Assuming that a terminal node has a high frequency of connection, it is counted as a high-level node, and nodes with low connection frequency are counted as low-level nodes. These data are used to optimize network configuration and resource allocation.

[0052] Select a data encryption protocol for the terminal node data according to the terminal node connection volume data, so as to obtain the terminal transmission security protocol;

[0053] In this embodiment, an appropriate data encryption protocol is selected based on the connection volume data of the terminal node. For example, if the connection volume of terminal node C is very high, a more complex encryption protocol (such as TLS1.3) will be selected to ensure the security of data transmission. For terminal node D with a small number of connections, a lighter encryption protocol (such as TLS1.2) is selected to balance security and performance requirements. The encryption protocol finally selected will be applied to the data transmission process of these terminal nodes to ensure the confidentiality and integrity of the data.

[0054] A network public key encryption architecture is constructed according to the information storage security protocol, the information relay security protocol and the terminal transmission security protocol to obtain the information transmission public key encryption architecture, and node architecture mapping is performed on the information transmission public key encryption architecture and the information transmission topology structure to obtain the information transmission topology structure model.

[0055] In this embodiment, when constructing a network public key encryption architecture, the information storage security protocol, information relay security protocol and terminal transmission security protocol are integrated. For example, the RSA 2048-bit public key encryption algorithm is selected as the public key encryption standard for the entire network. These protocols are applied to each node of the network topology, and the node architecture is mapped according to the connection relationship between the nodes of the topology (such as star, ring or mesh structure). Assuming that the network topology is a star structure, the central node applies RSA 2048-bit encryption, and the surrounding nodes use the public key provided by the central node for encryption. Finally, a complete public key encryption architecture model is generated to ensure the security and confidentiality of data transmission in the entire network.

[0056] Step 102: Perform an abnormal analysis on the information transmission data to obtain abnormal information transmission data, and perform abnormal network communication correction on the abnormal information transmission data according to the network communication data to obtain non-safe information transmission data.

[0057] In this embodiment, an anomaly detection algorithm (such as Isolation Forest or a statistically based method) is applied to analyze the abnormal patterns in the information transmission data of the subject to be constructed, such as abnormal traffic, frequent connections, and abnormal packet size, to generate abnormal information transmission data and mark abnormal transmission events. According to the known normal traffic pattern and anomaly detection results, the data is corrected to exclude false positives. For example, by comparing with historical data, normal high-traffic events are excluded, non-safe information transmission data is generated, and those traffic events that are still abnormal after correction are marked. In this step, it can specifically include:

[0058] Extracting transmission frequency characteristics and data packet transmission characteristics of the information transmission data of the subject to be constructed, thereby obtaining the information transmission frequency data and data packet transmission data of the subject to be constructed;

[0059] In this embodiment, when analyzing the network information transmission data of the subject to be constructed, the transmission frequency feature extraction is first performed. Assume that 1000 data packets are transmitted per second in the network of the subject to be constructed. Using the time window method, the data stream is divided into multiple time windows, each window length is 1 minute. The number of data packets in each window is counted to calculate the data packet transmission frequency. Further, the data packet transmission time interval in each time window is counted, and the mean and standard deviation of the time interval are extracted as data packet transmission features. Finally, these frequency and time interval features will be used as input data for subsequent analysis and processing.

[0060] Perform frequency domain conversion according to the information transmission frequency data of the subject to be constructed, thereby obtaining the information transmission spectrum of the subject to be constructed, and perform periodic information transmission statistics on the information transmission spectrum of the subject to be constructed, thereby obtaining information transmission periodic data;

[0061] In this embodiment, after obtaining the information transmission frequency data of the subject to be constructed, the time domain data is converted into frequency domain data using a fast Fourier transform (FFT). This can help identify the periodic pattern of information transmission. For example, assuming that the data after frequency domain conversion shows obvious periodic peaks, it means that there is a periodic pattern in information transmission. Perform periodic statistics on the spectrum data and calculate the main periodic components in the spectrum. For example, if there is a periodic peak every 5 minutes in the spectrum, the information transmission cycle is 5 minutes. Periodic statistics may include calculating the cycle length, peak intensity, etc., so as to obtain periodic information transmission data.

[0062] Calculating the transmission packet loss rate according to the data packet transmission data, thereby obtaining the data packet transmission packet loss rate data, and clustering the data packet transmission data with high packet loss rate according to the data packet transmission packet loss rate data, thereby obtaining the high packet loss rate information transmission data;

[0063] In this embodiment, when calculating the packet loss rate of data packet transmission data, the number of packet losses in a specific time window is first counted. For example, in a 10-minute time window, 1,000 data packets are expected to be received, but 900 data packets are actually received, and the packet loss rate is 10%. After calculating the packet loss rate of each time window, high packet loss rate transmission clustering is performed based on these packet loss rate data. For example, the K-means clustering algorithm can be used to classify data with a packet loss rate higher than 15% as high packet loss rate transmission data. These data will be used to identify time periods where network problems may exist, thereby obtaining high packet loss rate information transmission data.

[0064] According to the information transmission periodic data, the information transmission data of the subject to be constructed is clustered into non-periodic transmission, so as to obtain non-periodic information transmission data;

[0065] In this embodiment, according to the obtained information transmission cycle data, the information transmission data of the subject to be constructed is clustered for non-periodic transmission. First, a time model is created based on the periodic statistical results, for example, 5 minutes is set as the periodic time period. If the actual transmission data does not have an obvious periodic pattern within this periodic time period, these data are classified as non-periodic data. For example, the DBSCAN clustering algorithm is used to perform cluster analysis on the data outside the periodic pattern, and the transmission data that fails to conform to the periodic model is marked as non-periodic information transmission data.

[0066] Performing information transmission intersection operation on information transmission data with high packet loss rate and non-periodic information transmission data, thereby obtaining abnormal information transmission data;

[0067] In this embodiment, the obtained high packet loss rate information transmission data and the obtained non-periodic information transmission data are subjected to intersection operations. For example, using set operations, the intersection of these two types of data is identified as abnormal information transmission data. If there are intersection data points in the high packet loss rate and non-periodic data, these data are considered to be abnormal information transmission. This method can effectively screen out abnormal data that appears in high packet loss rate and non-periodic modes.

[0068] According to the network communication data of the subject to be constructed, abnormal network communication correction is performed on the abnormal information transmission data, thereby obtaining non-safe information transmission data.

[0069] In this embodiment, for the identified abnormal information transmission data, abnormal network communication correction is performed. First, the network communication mode of the abnormal data is analyzed. For example, the abnormal data may appear as an abnormally high packet loss rate or an abnormal transmission delay. Then, a correction algorithm (for example, an adaptive filter or a machine learning algorithm) is used to adjust the network configuration or optimize the data transmission path. Assuming that the abnormal data is found to be related to the high packet loss rate of a certain network node, the network performance of the node can be optimized to reduce the packet loss rate, thereby obtaining non-safe information transmission data and performing subsequent processing.

[0070] Extracting communication delay features based on the network communication data of the subject to be constructed, thereby obtaining the network communication delay data of the subject to be constructed;

[0071] In this embodiment, the network communication delay feature extraction step of the subject to be constructed includes collecting communication data between internal nodes of the subject to be constructed, for example, using network monitoring tools such as Wireshark or NetFlow to collect the transmission time of data packets. The timestamps of these data packets are analyzed to calculate the delay between each pair of nodes. The delay feature extraction includes calculating the RTT (Round-Trip Time) from the sending time and receiving time of each data packet, and then counting the characteristic indicators such as the average delay, maximum delay, minimum delay and standard deviation of the delay in different time periods. These indicators can help understand the performance of the network in different time periods and serve as the data basis for subsequent steps.

[0072] Perform sliding window network congestion time statistics on the network communication delay data of the subject to be constructed, so as to obtain the network congestion time data of the subject to be constructed;

[0073] In this embodiment, the extracted communication delay data is analyzed using a sliding window method. Assuming the window size is 5 minutes, the data is divided into multiple windows by time period, and the performance of network congestion is counted in each window. The delay distribution in each window can be calculated, for example, the maximum delay in the window, the average value of the delay, and the number of delays exceeding the threshold. These statistics can indicate whether the network is congested in the time window. For example, if the delay in a window exceeds a set threshold (such as 200ms), the time period is marked as network congestion time.

[0074] Perform time series correlation on the network congestion time data and abnormal information transmission data of the construction subject to obtain network congestion transmission data;

[0075] In this embodiment, the network congestion time data and the abnormal information transmission data are time-series correlated. First, the standard for abnormal information transmission data is defined, for example, the packet loss rate during transmission exceeds 5% or the error rate is higher than a certain threshold. Next, the network congestion time data and the abnormal information transmission data are aligned by timestamp. Time series analysis techniques, such as cross-correlation analysis or dynamic time warping (DTW), are applied to evaluate the relationship between network congestion and abnormal transmission events. If it is found that when congestion occurs frequently in certain time periods, abnormal transmission events also increase significantly, this indicates that network congestion is one of the factors leading to abnormal transmission.

[0076] Abnormal network communication correction is performed on abnormal information transmission data according to network congestion transmission data, thereby obtaining non-safe information transmission data.

[0077] In this embodiment, the abnormal information transmission is corrected according to the network congestion transmission data obtained in the above steps. For example, a model is established using a machine learning algorithm (such as a random forest or a support vector machine), and the model is trained with network congestion data as input features and abnormal information transmission data as labels. Then, the newly received abnormal information transmission data is corrected using the trained model. The correction process includes identifying abnormal conditions caused by network congestion and adjusting these abnormal data. For example, if the model detects transmission errors caused by network congestion, these errors can be retransmitted or the data can be corrected to obtain more accurate non-safe information transmission data.

[0078] By extracting transmission frequency characteristics and packet transmission characteristics, the subject to be built can gain in-depth understanding of the behavioral patterns of its network communications. For example, the common time intervals for data transmission and the basic characteristics of data packets can be determined, which is crucial for subsequent analysis. It provides basic data support for subsequent data analysis and anomaly detection steps, making the analysis process more accurate and effective. Frequency domain transformation can reveal periodic patterns in information transmission data. This helps to identify normal periodic communication behaviors, such as regular data backup or business updates. By understanding the information transmission cycle, the subject to be built can optimize its network resource allocation and scheduling strategies to reduce latency and improve efficiency. Calculating and clustering packet loss rates can help identify high packet loss problem areas in the network, which is often a sign of network performance problems or potential failures. By identifying and clustering data transmissions with high packet loss rates, the subject to be built can perform targeted network optimization and troubleshooting, thereby improving overall network performance and stability. By analyzing information transmission cycle data, non-periodic data transmission behaviors can be identified, which indicate abnormal or unplanned activities in the network. Identifying non-periodic transmissions helps to discover potential security threats, such as unauthorized access or data leakage, and then take appropriate security measures. By combining high packet loss rates and non-periodic information transmission data through intersection operations, abnormal information transmission can be more accurately identified, which usually indicates network security issues or system failures. Combining multiple abnormal indicators can help reduce false positives and false negatives, and improve the accuracy and reliability of anomaly detection. By correcting the abnormal information transmission data, the detected network communication anomalies can be corrected, so as to accurately identify the real security threats. The non-safe information transmission data finally obtained can help the subject to be built take measures to strengthen network security protection, such as updating firewall rules or adjusting network monitoring strategies, thereby effectively reducing security risks.

[0079] By extracting communication delay features, we can gain in-depth insights into the specific causes of delays in the network. This helps identify bottlenecks or unstable factors in the network. After analyzing the delay features, we can optimize the network configuration, improve network performance, and increase the efficiency of data transmission. The extracted delay features can help predict potential network problems and take early measures to prevent network delay problems. The sliding window statistical method allows dynamic monitoring of network congestion time and timely reflects the changing trend of network congestion. By counting network congestion time, we can more accurately evaluate the actual use of the network and understand the network load and its fluctuations. Through congestion time data, we can optimize the allocation of network resources, adjust network configuration, and reduce the impact of congestion on network performance. Time series association can reveal the relationship between network congestion and abnormal information transmission, and help identify the specific network conditions that cause the anomaly. By correlating congestion time with abnormal information transmission data, abnormal events can be more effectively detected and diagnosed, and the efficiency of network troubleshooting can be improved. The correlation analysis results provide network managers with data-driven decision-making basis and help formulate more effective network management strategies. By correcting abnormal information transmission data, transmission errors caused by network congestion can be corrected to ensure the correctness and integrity of data transmission. Correcting abnormal network communications helps eliminate potential security risks and ensure the security of transmitted data. By correcting abnormal data, the overall reliability and stability of the network are improved, reducing business interruptions caused by network problems.

[0080] Step 103: construct an abnormal information transmission detection model based on the non-safe information transmission data, and perform information transmission anomaly detection on the information transmission data through the abnormal information transmission detection model to obtain real-time abnormal information transmission data.

[0081] In this embodiment, non-safe information transmission data is used to train a machine learning model (such as a support vector machine SVM, a neural network or an integrated method) to construct an abnormal information transmission detection model, and the trained model is used to perform abnormality detection on the real-time transmission data in the information transmission data of the subject to be constructed. If the real-time transmission data is detected as abnormal data, the real-time transmission data is marked as real-time abnormal information transmission data; if the real-time transmission data is not detected as abnormal data, the real-time transmission data is uploaded to the information transmission management system of the subject to be constructed to continue the information transmission task.

[0082] Step 104: divide the information transmission topology structure model into abnormal information transmission nodes according to the real-time abnormal information transmission data to obtain abnormal information transmission node data, and integrate abnormal node links according to the abnormal information transmission node data to obtain abnormal node link data.

[0083] In this step, the information transmission topology model is analyzed based on the real-time abnormal information transmission data, abnormal nodes (such as servers or network devices) are identified, and they are classified (for example, high risk, medium risk, low risk), and abnormal information transmission node data is generated. The data of abnormal nodes is combined with the topology model to identify the connection links between abnormal nodes (such as the path of abnormal data flow), generate abnormal node link data, and point out abnormal transmission paths and potential attack paths.

[0084] This step may specifically include: extracting transmission terminal node features from real-time abnormal information transmission data, thereby obtaining abnormal transmission terminal node data;

[0085] In this embodiment, terminal node features are extracted from real-time abnormal information transmission data. It is assumed that the abnormal information in the network of the entity to be constructed includes high latency, packet loss, or erroneous data. A network monitoring tool (such as SolarWinds) can be used to capture data packets in real time, and extract the IP address, port number, and performance indicators related to abnormal transmission (such as packet loss rate) of each terminal node. These characteristic data form abnormal transmission terminal node data, recording all affected terminal nodes and their performance. For example, if the packet loss rate of a terminal reaches 10% in the past hour, the IP address and port number of the terminal will be marked as abnormal.

[0086] According to the abnormal transmission terminal node data, the information transmission topology structure model is divided into terminal connection nodes, thereby obtaining the abnormal terminal connection node data;

[0087] In this embodiment, the terminal connection nodes in the information transmission topology are divided according to the abnormal transmission terminal node data. By using a network topology tool (such as Cisco Network Assistant), the abnormal terminal node is associated with other nodes directly connected to it to form a connection node list. The system analyzes the connection relationship of the abnormal terminal and identifies the affected switches, routers and other network devices. For example, if an abnormal terminal is directly connected to a specific switch, the switch will also be marked as an abnormal terminal connection node.

[0088] Extract information transmission encryption public key features from abnormal transmission terminal node data, thereby obtaining abnormal terminal transmission encryption public key data;

[0089] In this embodiment, the encryption public key feature extraction is performed on the abnormal transmission terminal node. By analyzing the encryption information of the transmission data, the public key features used by each terminal are extracted. Use an encryption analysis tool (such as Cryptool in Kali Linux) to decrypt the transmission data and extract the encrypted public key information of each terminal. Generate abnormal terminal transmission encrypted public key data, and record the public key used by each abnormal terminal and its related encryption algorithm. For example, if an abnormal terminal uses the RSA-2048 encryption algorithm, its public key will be extracted and recorded.

[0090] According to the information transmission encryption public key architecture, the encryption public key data transmitted by the abnormal terminal is divided into encryption public key associated nodes, thereby obtaining the abnormal terminal key associated node data;

[0091] In this embodiment, the encrypted public key associated nodes are divided for abnormal terminals according to the extracted encrypted public key information. The system uses a public key infrastructure (PKI) tool to map the relationship between public keys and nodes. The terminals using the same public key are divided into a group to form abnormal terminal key associated node data. For example, if multiple abnormal terminals use the same public key for data encryption, these terminals will be classified into the same key associated node group.

[0092] Performing node intersection operation on abnormal terminal connection node data and abnormal terminal key associated node data, thereby obtaining abnormal information transmission node data;

[0093] In this embodiment, node intersection operation is performed on abnormal terminal connection node data and abnormal terminal key associated node data. By using set operation tools (such as Python's set library), the intersection of two data sets is calculated. The intersection operation will identify nodes that exist in both data sets, that is, those terminals that are both connection nodes and key associated nodes. For example, if a node exists in both abnormal connection node data and abnormal key associated node data, it will be marked as abnormal information transmission node data.

[0094] The abnormal transmission terminal node data and the abnormal information transmission node data are node-link integrated to obtain the abnormal node link data.

[0095] In this embodiment, node link integration is performed on abnormal transmission terminal node data and abnormal information transmission node data. A network link analysis tool (such as Grapher) is used to integrate all abnormal terminal nodes and their associated links to form abnormal node link data. A network diagram containing all abnormal terminal nodes and their connecting links can be drawn to help identify abnormal propagation paths. For example, if an abnormal terminal node is connected to other nodes through multiple links, these links will be integrated into a link set to further analyze the abnormal propagation pattern.

[0096] Extracting terminal node features can identify the source and target nodes of abnormal information transmission and provide accurate data for subsequent analysis. By extracting features in real time, it is possible to quickly respond to and handle abnormal situations in the network and reduce the impact on the business. Providing detailed terminal node data helps to locate specific abnormal points in the network, thereby improving the efficiency of troubleshooting. By dividing the topology structure, you can better understand the connection method of abnormal terminals and optimize the network layout. Determining the connection nodes of abnormal terminals helps to identify potential security vulnerabilities and weaknesses and enhance network protection. Dividing terminal connection nodes can help accurately identify the propagation path of abnormalities and quickly locate the problem. Extracting encryption public key features helps to identify abnormal encryption behavior and protect the security of data transmission. It can find out whether there are problems with the encryption public keys used by abnormal terminals, so as to take protective measures as soon as possible. Providing encryption public key data helps to conduct security audits and ensure that data transmission in the network meets security standards. By dividing the associated nodes, encryption keys can be managed and distributed more effectively, improving the security of the network. Determining the key associated nodes helps to deeply analyze the relationship between abnormal terminals and other nodes and identify potential security risks. Strengthening the monitoring of abnormal terminal keys helps to enhance the network's protection capabilities and data security. By performing node intersection operations and comprehensively considering the anomalies of terminal connections and key associations, it helps to fully identify and understand the transmission path of abnormal information. Providing more accurate abnormal node data provides network managers with a complete picture of abnormal situations and improves data analysis and decision-making. Ensuring the accuracy of abnormal node data helps to respond to and handle security incidents in a timely manner and reduce the impact. Integrating node link data can obtain a complete link view of abnormal transmission, helping to analyze the propagation path and impact range of abnormalities. By fully understanding abnormal links, the network can be repaired and optimized in a timely manner to reduce the impact of link anomalies on the business.

[0097] Step 105: analyze the abnormal transmission node blocking strategy based on the abnormal node link data and the information transmission data to obtain the abnormal transmission node blocking strategy, and construct a secure information transmission link structure model based on the abnormal transmission node blocking strategy and the information transmission topology structure model.

[0098] In this embodiment, the abnormal node link data and the information transmission data of the subject to be constructed are analyzed to formulate a blocking strategy (such as disconnecting the abnormal node and adding access control). A policy analysis tool (such as Palo Alto Networks' Threat Intelligence or Cisco's AMP) can be used to evaluate the effects of different blocking strategies and generate an abnormal transmission node blocking strategy. Based on the blocking strategy, the information transmission topology structure model is adjusted to optimize the network security link, such as reconfiguring the network path and adding firewall rules, and generating a secure information transmission link structure model, including an updated network topology and security policy.

[0099] This step specifically includes: integrating abnormal patterns according to abnormal node link data, thereby obtaining abnormal transmission pattern data; in this embodiment, by analyzing data on abnormal node links, it is found that there are frequent data transmission anomalies in these links. These abnormal links are integrated to identify common abnormal transmission patterns, such as specific bandwidth fluctuations, delay increases, or data packet loss patterns, thereby obtaining abnormal transmission pattern data. For example, if multiple nodes are found to have data packet loss within a specific time period, a common abnormal pattern is formed by integration.

[0100] According to the information transmission data of the subject to be constructed, the abnormal mode impact assessment is performed on the abnormal transmission mode data, so as to obtain the abnormal mode impact assessment data; in this embodiment, for the abnormal transmission mode data found, its impact on the information transmission of the subject to be constructed is analyzed. For example, by simulating the actual impact of the abnormal mode, the impact of these abnormalities on the data transmission speed and reliability of the key application programs of the subject to be constructed can be determined. The integrated abnormal transmission mode can be combined with the information transmission data of the subject to be constructed, and the impact of each mode on the overall network performance can be evaluated by regression analysis. For example, the impact of the high-latency mode on the response time of the business system is analyzed to obtain the impact assessment data of the mode, such as the risk probability of response time delay exceeding 10%. Assume that the connection interruption between node C and node D in the network of the subject to be constructed seriously affects the online trading system. The evaluation process includes analyzing the degree of impact of the abnormal mode on the business process, such as the delay and data loss caused by the interruption of the connection between node C and node D. By modeling and simulating the delay and data loss caused by different abnormal modes, a comprehensive evaluation is performed to generate abnormal mode impact assessment data, showing which abnormal modes have the most significant impact on the subject to be constructed, and providing detailed evaluation results.

[0101] According to the abnormal mode impact assessment data, the abnormal node link data is assigned an abnormal node priority, thereby obtaining the abnormal node priority data; in this embodiment, based on the abnormal mode impact assessment data, the abnormal node link is assigned a priority. For example, an abnormal mode with a greater impact may cause certain node links to have a higher priority, so that these high-priority abnormal nodes can be given priority in subsequent processing to ensure that the impact on the business of the construction subject is minimized. A weighted sorting algorithm can be used to determine the priority in combination with the degree of impact and the frequency of occurrence. For example, nodes that appear frequently and have a serious impact are assigned a high priority for priority processing. Assuming that the abnormal modes of nodes E and F are found to have the greatest impact on the core business system, these nodes need to be given priority. A priority is assigned to each abnormal node using a priority algorithm (e.g., a weighted scoring system based on the impact assessment results). For example, the priority of nodes E and F is set to the highest, and the priorities of other nodes are assigned in turn, so that these key nodes are given priority in resource allocation and policy formulation.

[0102] The information transmission data of the subject to be constructed is subjected to transmission node resource allocation feature extraction to obtain transmission node resource allocation data; in this embodiment, transmission node resource allocation features such as bandwidth utilization, node load, etc. are extracted from the information transmission data of the subject to be constructed. Feature selection techniques (such as principal component analysis PCA) are used to extract the most representative features to obtain resource allocation data to ensure the effective utilization of transmission nodes under limited resources. Assume that the CPU utilization of node G often reaches 90%, while the network bandwidth utilization of node H is close to 100%. Through monitoring tools and data analysis techniques, the resource usage of each transmission node is extracted, and these data are organized into transmission node resource allocation data. For example, node G may require more computing resources, while node H may require bandwidth expansion to maintain network performance when abnormal modes occur.

[0103] The node blocking strategy is analyzed according to the transmission node resource allocation data and the abnormal node priority data, so as to obtain the abnormal transmission node blocking strategy; in this embodiment, the node blocking strategy is analyzed using the resource allocation data and the node priority data. For example, if some nodes frequently have abnormalities due to high load, a strategy can be formulated to preferentially block the traffic of these high-priority nodes when resources are tight to reduce the overall network burden. Assume that node I needs to take temporary blocking measures due to resource constraints to prevent it from affecting the performance of the entire network. By analyzing the resource status and priority of different nodes, a corresponding blocking strategy is formulated. For example, for nodes E and F with the highest priority, if an abnormality occurs, automatic traffic redirection or resource restriction strategies can be adopted, while for nodes with lower priority, more moderate measures such as reducing network load can be taken.

[0104] A secure information transmission link structure model is constructed based on the abnormal transmission node blocking strategy and the information transmission topology structure model. In this embodiment, a secure information transmission link structure model is constructed based on the formulated node blocking strategy and the information transmission topology structure model of the subject to be constructed. Assume that in the original network topology, the connection path between node J and node K is marked as a high-risk area. Through simulation and modeling technology, a new topology structure model is constructed, taking into account the improved path after the abnormal node blocking strategy. For example, the high-risk path of node J and node K is replaced with a backup path to ensure the security and reliability of data transmission. Finally, the generated secure information transmission link structure model will show the improved network structure to ensure the stability and security of information transmission.

[0105] The above process of obtaining abnormal node priority data may specifically include:

[0106] According to the abnormal mode impact assessment data, the abnormal mode node impact feature extraction is performed to obtain the abnormal mode node impact data; in this embodiment, the impact feature of each abnormal mode is extracted from the abnormal mode impact assessment data through, for example, a feature selection algorithm. These features can be indicators such as the severity of the node impact, the frequency of abnormal occurrence, etc. Each node is then scored according to the weights of different features. The weight can be determined based on the importance of the feature or expert knowledge. Features of different dimensions are standardized so that they can be compared on the same scale. For example, the node impact score is normalized to between 0 and 1. Combine multiple features to calculate the comprehensive impact score. The weighted average method or comprehensive model can be used to obtain the final score. Ultimately, the generated abnormal mode node impact data can provide a key information basis for subsequent steps.

[0107] According to the abnormal mode node influence data, the abnormal node link data is evaluated for the abnormal node influence priority, thereby obtaining the abnormal node influence priority data; in this embodiment, the obtained abnormal mode node influence data is used to calculate the priority of each abnormal node in the network. Assume that in a network with multiple nodes, it is found that both node B and node C have abnormal modes. The priority of each node is evaluated according to its influence feature data, which includes a comprehensive evaluation of the node's influence, the severity of the abnormal mode, and the importance of the node to quantify the priority of the node. For example, the impact of node B's abnormal mode on network performance is 0.8, and that of node C is 0.6. Therefore, the abnormal node priority of node B will be higher than that of node C.

[0108] The abnormal node connection priority is evaluated for the abnormal node link data through the information transmission topology structure model, so as to obtain the abnormal node connection priority data; in this embodiment, in order to further analyze the impact of abnormal nodes, the information transmission topology structure model is used to calculate the connection priority of abnormal nodes. For example, it is assumed that node B is connected to node D and node E in the network topology. According to the connection quality and abnormal mode influence data in the topology model, the connection priority of node B is calculated. Assuming that the connection stability between node B and node D is poor, and the influence of node D is also high, the connection priority between node B and node D will be higher.

[0109] The node priority weighted average is performed on the abnormal node impact priority data and the abnormal node connection priority data to obtain the abnormal node priority data. In this embodiment, the obtained abnormal node impact priority data and abnormal node connection priority data are weighted averaged. It includes setting different weight coefficients, and then weighting these two priority data according to the weight coefficients to obtain the final abnormal node priority data. The purpose is to comprehensively consider the degree of influence and connection priority of the node in order to more accurately evaluate the overall priority of each abnormal node. Assume that in a network monitoring system, there are multiple abnormal modes such as traffic surge or node failure. First, extract the impact characteristics (such as impact degree and frequency) of each mode on different nodes. Then, evaluate the impact priority of these abnormal modes on the link. The connection priority of the node is calculated by the graph model, and finally, the two priority data are weighted averaged to generate the final priority of each node for subsequent processing and decision-making.

[0110] By integrating the abnormal node link data, the abnormal patterns existing in the network can be fully identified. This helps to understand the scope and nature of the abnormality. The integrated data provides a clearer abnormal transmission pattern, which helps to accurately locate the problem in the network and reduce the possibility of false positives and false negatives. The abnormal transmission pattern data obtained will become the basis for subsequent analysis and decision-making, and improve the abnormal handling ability of the overall system. By evaluating the impact of abnormal patterns, the specific impact of abnormal transmission patterns on the information transmission of the subject to be constructed can be understood, thereby providing a basis for formulating corresponding countermeasures. The evaluation data can help the subject to be constructed determine which transmission mode anomalies have the greatest impact on the system, thereby optimizing resource allocation and prioritizing the resolution of key issues. By evaluating the impact of abnormal patterns, the subject to be constructed can take measures to reduce the negative impact on system stability and improve the reliability and performance of the overall system. By assigning priorities to abnormal nodes, it is possible to clarify which nodes and links need to be handled first, ensuring the rapid repair or maintenance of key nodes. Priority data helps network administrators quickly respond to problems with high-impact nodes, improve the efficiency of problem solving, and reduce system downtime. Through priority allocation, more precise maintenance strategies can be formulated to reduce interference with normal operations and ensure the normal operation of the system. Extracting the resource allocation characteristics of transmission nodes helps to understand the resource usage of each node, thereby optimizing resource allocation and improving transmission efficiency. Resource allocation data provides managers with detailed information about resource usage, which helps to make more reasonable resource allocation decisions. Reasonable resource allocation can improve the overall performance of the system, reduce transmission bottlenecks, and improve the stability and speed of information transmission. By analyzing the resource allocation of transmission nodes and the priority of abnormal nodes, a more effective node blocking strategy can be formulated to improve the effect of abnormal handling. Node blocking strategy helps to isolate and handle abnormal nodes, prevent the spread of abnormal situations, and protect the overall security of the network. Appropriate blocking strategy can reduce the interference of abnormalities on normal business and ensure the normal operation of the system. The constructed secure information transmission link structure model can provide a reliable framework for ensuring the security of information transmission. By combining blocking strategy and topology, the design of network links can be optimized to improve the stability and security of transmission. This model helps to improve the system's ability to respond to abnormal situations, enhance the system's resilience and robustness, and reduce potential security threats.

[0111] By extracting the impact characteristics of abnormal mode nodes, we can deeply analyze the impact range and nature of abnormal nodes, so as to more accurately identify key nodes. Calculating the impact priority of abnormal nodes helps to focus on the nodes that have the most serious impact on the system, thereby optimizing resource allocation and response measures. Using the information transmission topology model to evaluate the priority of abnormal nodes helps to identify critical nodes and enhance the efficiency of network interruption recovery. By weighted averaging the priority data of abnormal nodes, we can comprehensively consider the impact and connection status of the nodes, provide a comprehensive priority ranking, and optimize abnormal handling decisions.

[0112] Step 106: construct a security situation awareness platform based on the security information transmission link structure model and the abnormal information transmission detection model to obtain the information transmission security situation awareness platform of the subject to be constructed.

[0113] In this embodiment, the security information transmission link structure model and the abnormal information transmission detection model are integrated to build a security situation awareness platform for the subject to be built. Platforms (such as Splunk, ELK Stack) can be used for integration to achieve real-time monitoring, alarm and data visualization functions, and display network security status and abnormal detection results. The data and reports of the security situation awareness platform are uploaded to the information transmission management system of the subject to be built to ensure that the security team can obtain the latest security information in a timely manner, configure the automated alarm and reporting system, perform security situation awareness tasks and respond to potential threats.

[0114] Embodiment 2

[0115] Figure 2 This is a schematic diagram of a device for building a data security situation awareness platform provided in Example 2 of this application. Figure 2 As shown, the device for constructing a data security situation awareness platform specifically includes: an information transmission topology structure module 201, an abnormal information transmission analysis module 202, an abnormal information transmission detection model construction module 203, an abnormal node link integration module 204, a blocking strategy analysis module 205, and a security situation awareness platform construction module 206.

[0116] The information transmission topology structure module is used to obtain the network communication data of the subject to be constructed, and determine the information transmission data and the information transmission topology structure model of the subject to be constructed according to the network communication data;

[0117] The abnormal information transmission analysis module is used to perform abnormal analysis on the information transmission data to obtain abnormal information transmission data, and perform abnormal network communication correction on the abnormal information transmission data according to the network communication data to obtain non-safe information transmission data;

[0118] The abnormal information transmission detection model building module is used to build an abnormal information transmission detection model based on the non-safe information transmission data, and perform information transmission anomaly detection on the information transmission data through the abnormal information transmission detection model to obtain real-time abnormal information transmission data;

[0119] The abnormal node link integration module is used to divide the information transmission topology structure model into abnormal information transmission nodes according to the real-time abnormal information transmission data to obtain abnormal information transmission node data, and to integrate the abnormal node links according to the abnormal information transmission node data to obtain abnormal node link data;

[0120] The blocking strategy analysis module is used to analyze the blocking strategy of abnormal transmission nodes according to the abnormal node link data and information transmission data, obtain the blocking strategy of abnormal transmission nodes, and build a safe information transmission link structure model according to the blocking strategy of abnormal transmission nodes and the information transmission topology structure model;

[0121] The security situation awareness platform construction module is used to construct the security situation awareness platform based on the security information transmission link structure model and the abnormal information transmission detection model to obtain the information transmission security situation awareness platform of the subject to be constructed.

[0122] Embodiment 3

[0123] Figure 3 A schematic diagram of the structure of an electronic device provided in Embodiment 3 of the present application is shown in FIG. Figure 3 As shown, the electronic device includes a processor 310, a memory 320, an input device 330 and an output device 340; the number of the processor 310 in the electronic device can be one or more. Figure 3 A processor 310 is taken as an example; the processor 310, the memory 320, the input device 330 and the output device 340 in the electronic device can be connected via a bus or other means. Figure 3 The example of connecting through bus is taken in the following.

[0124] The memory 320, as a computer-readable storage medium, can be used to store software programs, computer executable programs and modules, such as program instructions / modules corresponding to the method for building a data security situation awareness platform in the embodiment of the present invention. The processor 310 executes various functional applications and data processing of the electronic device by running the software programs, instructions and modules stored in the memory 320, that is, implements the method for building the data security situation awareness platform described above. The memory 320 may mainly include a program storage area and a data storage area.

Claims

1. A method for building a data security situation awareness platform, characterized in that: The method comprises: Acquire network communication data of the subject to be constructed, and determine information transmission data and an information transmission topology structure model of the subject to be constructed according to the network communication data; Performing abnormal analysis on the information transmission data to obtain abnormal information transmission data, and performing abnormal network communication correction on the abnormal information transmission data according to the network communication data to obtain non-safe information transmission data; Building an abnormal information transmission detection model according to the non-safe information transmission data, and performing information transmission anomaly detection on the information transmission data through the abnormal information transmission detection model to obtain real-time abnormal information transmission data; According to the real-time abnormal information transmission data, the information transmission topology structure model is divided into abnormal information transmission nodes to obtain abnormal information transmission node data, and according to the abnormal information transmission node data, abnormal node link integration is performed to obtain abnormal node link data; An abnormal transmission node blocking strategy is analyzed according to the abnormal node link data and the information transmission data to obtain an abnormal transmission node blocking strategy, and a secure information transmission link structure model is constructed according to the abnormal transmission node blocking strategy and the information transmission topology structure model; A security situation awareness platform is constructed based on the security information transmission link structure model and the abnormal information transmission detection model to obtain the information transmission security situation awareness platform of the subject to be constructed.

2. The method according to claim 1, characterized in that The step of acquiring network communication data of the subject to be constructed, and determining information transmission data and an information transmission topology structure model of the subject to be constructed according to the network communication data, includes: Acquire the network communication data of the subject to be constructed, and extract the enterprise information transmission characteristics of the network communication data to obtain the information transmission data with the construction subject; Dividing the information transmission data into information transmission nodes to obtain information storage node data and information relay node data; Performing information transmission node connection analysis on the information relay node data to obtain information transmission node connection data; Performing node connection association on the information storage node data and the information transmission node connection data to obtain information transmission node connection data, and performing topological structure analysis based on the information transmission node connection data to obtain an information transmission topological structure; A node security protocol is selected for the information transmission topology structure according to the information storage node data and the information relay node data to obtain an information transmission topology structure model.

3. The method according to claim 2, characterized in that The performing information transmission node connection analysis on the information relay node data to obtain information transmission node connection data includes: Perform node transmission frequency statistics according to the information transmission data to obtain high-frequency transmission node data and low-frequency transmission node data; Perform node intersection calculation on high-frequency transmission node data and information relay node data to obtain core relay node data; perform node intersection calculation on low-frequency transmission node data and information relay node data to obtain edge relay node data; Integrating the node connection relationships of the core relay node data and the edge relay node data according to the information transmission data to obtain core relay node connection data and edge relay node connection data; Performing node connection similarity calculation on the core relay node connection data and the edge relay node connection data to obtain relay node connection similarity data; The core relay node connection data and the edge relay node connection data are clustered into node connection network clusters according to the relay node connection similarity data to obtain information transmission node connection data.

4. The method according to claim 1, characterized in that The performing abnormal analysis on the information transmission data to obtain abnormal information transmission data includes: Extracting transmission frequency characteristics and data packet transmission characteristics from the information transmission data to obtain information transmission frequency data and data packet transmission data; Performing frequency domain conversion according to the information transmission frequency data to obtain an information transmission spectrum, and performing periodic information transmission statistics on the information transmission spectrum to obtain information transmission period data; Calculating the transmission packet loss rate according to the data packet transmission data to obtain the data packet transmission packet loss rate data, and clustering the data packet transmission data with high packet loss rate according to the data packet transmission packet loss rate data to obtain the high packet loss rate information transmission data; Performing non-periodic transmission clustering on the information transmission data according to the information transmission periodic data to obtain non-periodic information transmission data; An information transmission intersection operation is performed on the high packet loss rate information transmission data and the non-periodic information transmission data to obtain abnormal information transmission data.

5. The method according to claim 1, characterized in that The performing abnormal network communication correction on the abnormal information transmission data according to the network communication data to obtain the non-safe information transmission data includes: Extracting communication delay features according to the network communication data to obtain network communication delay data; Performing sliding window network congestion time statistics on the network communication delay data to obtain network congestion time data; Performing time series correlation on the network congestion time data and the abnormal information transmission data to obtain network congestion transmission data; The abnormal information transmission data is subjected to abnormal network communication correction according to the network congestion transmission data to obtain non-safe information transmission data.

6. The method according to claim 1, characterized in that The step of dividing the information transmission topology structure model into abnormal information transmission nodes according to the real-time abnormal information transmission data to obtain abnormal information transmission node data, and integrating abnormal node links according to the abnormal information transmission node data to obtain abnormal node link data includes: Extract transmission terminal node features from real-time abnormal information transmission data to obtain abnormal transmission terminal node data; According to the abnormal transmission terminal node data, the information transmission topology structure model is divided into terminal connection nodes to obtain normal terminal connection node data; Extract information transmission encryption public key features from abnormal transmission terminal node data to obtain abnormal terminal transmission encryption public key data; According to the information transmission encryption public key architecture, the encryption public key data transmitted by the abnormal terminal is divided into encryption public key associated nodes to obtain the abnormal terminal key associated node data; Perform node intersection operation on abnormal terminal connection node data and abnormal terminal key associated node data to obtain abnormal information transmission node data; The abnormal transmission terminal node data and the abnormal information transmission node data are integrated with node links to obtain abnormal node link data.

7. The method according to claim 1, characterized in that The abnormal transmission node blocking strategy analysis is performed according to the abnormal node link data and the information transmission data to obtain the abnormal transmission node blocking strategy, and the safe information transmission link structure model is constructed according to the abnormal transmission node blocking strategy and the information transmission topology structure model, including: Abnormal mode integration is performed according to abnormal node link data to obtain abnormal transmission mode data; Performing abnormal mode impact assessment on abnormal transmission mode data according to enterprise information transmission data to obtain abnormal mode impact assessment data; According to the abnormal mode impact assessment data, abnormal node priority is assigned to abnormal node link data to obtain abnormal node priority data; Extracting transmission node resource allocation features from information transmission data to obtain transmission node resource allocation data; Perform node blocking strategy analysis based on transmission node resource allocation data and abnormal node priority data to obtain abnormal transmission node blocking strategy; A secure information transmission link structure model is constructed based on the abnormal transmission node blocking strategy and the information transmission topology structure model.

8. The method according to claim 7, characterized in that The step of assigning abnormal node priorities to abnormal node link data according to the abnormal mode impact assessment data to obtain abnormal node priority data includes: Extract the abnormal mode node impact feature according to the abnormal mode impact assessment data to obtain the abnormal mode node impact data; According to the abnormal mode node influence degree data, abnormal node influence priority evaluation is performed on abnormal node link data to obtain abnormal node influence priority data; The abnormal node connection priority data is evaluated on the abnormal node link data through the information transmission topology structure model to obtain the abnormal node connection priority data; The abnormal node impact priority data and the abnormal node connection priority data are weighted averaged to obtain the abnormal node priority data.

9. A device for constructing a data security situation awareness platform, characterized in that: The device comprises: An information transmission topology structure module is used to obtain network communication data of the subject to be constructed, and determine the information transmission data and information transmission topology structure model of the subject to be constructed according to the network communication data; an abnormal information transmission analysis module, used to perform abnormal analysis on the information transmission data to obtain abnormal information transmission data, and perform abnormal network communication correction on the abnormal information transmission data according to the network communication data to obtain non-safe information transmission data; An abnormal information transmission detection model building module is used to build an abnormal information transmission detection model according to the non-safe information transmission data, and perform information transmission anomaly detection on the information transmission data through the abnormal information transmission detection model to obtain real-time abnormal information transmission data; An abnormal node link integration module is used to divide the information transmission topology structure model into abnormal information transmission nodes according to the real-time abnormal information transmission data to obtain abnormal information transmission node data, and to integrate abnormal node links according to the abnormal information transmission node data to obtain abnormal node link data; A blocking strategy analysis module, used to perform abnormal transmission node blocking strategy analysis based on the abnormal node link data and the information transmission data, obtain the abnormal transmission node blocking strategy, and construct a secure information transmission link structure model based on the abnormal transmission node blocking strategy and the information transmission topology structure model; The security situation awareness platform construction module is used to construct the security situation awareness platform based on the security information transmission link structure model and the abnormal information transmission detection model to obtain the information transmission security situation awareness platform of the subject to be constructed.

10. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method for building a data security situation awareness platform as described in any one of claims 1-8.

Images