Network security system based on virtual environment

Abstract

The invention provides a network security system based on a virtual environment, and a pseudo database constructed by the network security system is greatly different from a common honeypot. In the network security system provided by the invention, original data is subjected to relevancy (namely sensitivity) classification by utilizing previous log records of an attacker, and noise with different intensities is introduced into data dimensions with different sensitivities in different modes, so that the data dimensions with different sensitivities can be classified. Therefore, the data of different dimensions in one data string in the finally formed pseudo database has different disguise effects, the sensitive dimension part is ensured to be completely hidden so as to ensure the data security, and the insensitive dimension part is ensured to cause greater confusion to a network attacker due to low noise.

Description

Technical Field

[0001] The invention relates to a network security system based on a virtual environment. Background Art

[0002] With the development of information technology, network attacks have become more complex and diverse. Traditional network security defense mechanisms have been unable to effectively deal with the endless stream of new network attacks.

[0003] Therefore, the strategy of adopting active defense and guiding attackers into traps has attracted widespread attention. However, active defense in network security is often greatly limited by the environment, and the attacker's attack methods are often difficult to predict. Therefore, a relatively complete active defense mechanism for network security has not yet been formed. Summary of the invention

[0004] The present invention provides a network security system based on a virtual environment, which effectively solves the problems existing in the prior art mentioned above.

[0005] Specifically, the present invention provides a network security system based on a virtual environment, which includes a monitoring module, an analysis module, and a decision module, wherein: the monitoring module is used to monitor the sudden traffic changes of the original database, and query from the log of the original database multiple moments when sudden traffic changes occurred in history and the data segments attacked at each moment in the multiple moments, each of the data segments includes multiple dimensions; the analysis module takes all the attacked data segments as the total data set, classifies each dimension as a root node, and classifies the multiple moments as leaf nodes, constructs a dimension decision tree, and calculates the gain coefficient of each dimension, wherein the dimensions with gain coefficients greater than a correlation threshold constitute a high-correlation dimension set, and the dimensions with gain coefficients not greater than the correlation threshold constitute a low-correlation dimension set; the decision module performs high-intensity noise processing on the dimensional data in the high-correlation dimension set to form high-intensity pseudo data, and performs low-intensity noise processing on the dimensional data in the low-correlation dimension set to form low-intensity pseudo data, and merges the high-intensity pseudo data and the low-intensity pseudo data into a pseudo database, which replaces the original database to lure attackers.

[0006] Optionally, the multiple dimensions include four dimensions: commodity category, transaction amount, transaction date, and product price.

[0007] Preferably, the multiple dimensions are W1, W2, ..., W N These N dimensions, where N ≥ 2, set the integer i from 1 to N, then any dimension W i The corresponding gain factor is H i , thus constructing the gain coefficient sequence H1, H2, ..., H N, set the relevance threshold MinH. Among the gain coefficient sequences H1, H2, …, H N , there are N' gain coefficients greater than the relevance threshold MinH, denoted as H 1’ , …, H N’ , where 1 ≤ N' < N, and the corresponding dimensions are W 1’ , …, W N’ . Among the gain coefficient sequences H1, H2, …, H N , there are N'' = N - N' gain coefficients not greater than the relevance threshold MinH, denoted as H 1” , …, H N” . Then the corresponding dimensions are W 1” , …, W N” . The N dimensions are divided into two parts, that is, the high - relevance dimension set W' composed of dimensions W 1’ , …, W N’ , and the low - relevance dimension set W'' composed of dimensions W 1” , …, W N” .

[0008] Preferably, the high - intensity noise addition process is Laplace noise addition process.

[0009] Preferably, the low - intensity noise addition process is uniform noise addition process.

[0010] Generally speaking, the present invention provides a network security system based on a virtual environment. The constructed pseudo - database has a significant difference from a general honeypot. In the network security system provided by the present invention, by using the attacker's previous log records, the original data is classified according to relevance (i.e., sensitivity), and different - intensity noises are introduced into data dimensions with different sensitivities in different ways, so that the data in different dimensions within a data string in the finally formed pseudo - database have different camouflage effects. This not only ensures that the sensitive dimension part is completely hidden to ensure data security, but also ensures that the insensitive dimension part causes greater confusion to network attackers due to the weak noise. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will discuss the drawings required for the description of the embodiments or the prior art. Obviously, the technical solutions described in conjunction with the drawings are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other embodiments and their drawings can be obtained according to these embodiments shown in the drawings.

[0012] Figure 1 Shows the basic operation flowchart of the network security system based on a virtual environment according to the present invention.

[0013] Figure 2 An illustrative example of a data collection in a system according to the present invention is shown.

[0014] Figure 3 Another exemplary example of a data collection in a system according to the present invention is shown. DETAILED DESCRIPTION

[0015] The technical solutions of various embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments described in the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0016] Hereinafter, the basic operation of the network security system based on the virtual environment according to the present invention will be described in detail. Figure 1 The basic operation flow chart of the network security system based on the virtual environment according to the present invention is shown.

[0017] In summary, the present invention provides a network security system based on a virtual environment, which aims to identify, analyze and respond to potential network attacks by guiding attackers into a virtual "trap" environment, effectively distracting the attackers' attention and improving the overall network security without threatening users and important data.

[0018] When attackers attack a database, sudden traffic changes often occur. Due to network attacks, the access traffic to the database fluctuates dramatically in a short period of time and deviates from normal levels.

[0019] When a network attacker attacks a database in different time periods, the time period itself reflects the attacker's interest in certain dimensions of the data. The database is updated in real time. In the data, the data that appears in certain time periods is specific to certain dimensions, which can implicitly reflect that the attacker is more interested in these dimensions. Therefore, the present invention can study which dimensions of data the attacker is interested in by exploring the correlation between dimensions and time periods.

[0020] The monitoring module in the system can monitor the sudden traffic changes in the original database. The monitoring tool used by the monitoring module can be, for example, Prometheus, Grafana, Zabbix or New Relic, so as to monitor the traffic of the database in real time.

[0021] Through the monitoring module, you can query the database logs to find out the multiple times when sudden traffic changes occurred in history and the data segments that were attacked at each time.

[0022] Each data segment contains multiple dimensions. For example, in a commodity transaction database, each data segment may contain four dimensions: commodity category, transaction amount, transaction date, and product price.

[0023] Next, the system starts the analysis module. In the analysis module, all attacked data segments are used as the data set, each dimension is used as the root node classification, and the time is used as the leaf node classification. A dimension decision tree is constructed to calculate the gain coefficient of the dimension. The following is the relevant program presentation: import pandas as pd from sklearn.model_selection import train_test_split from sklearn.tree import DecisionTreeClassifier from sklearn import tree import matplotlib.pyplot as plt data = pd.read_csv('data.csv') # Import data X = data[['age', 'income', 'purchasing_power']] # Features y = data['target_label'] # target label X_train, X_test, y_train, y_test = train_test_split(X, y, test_size= 0.2, random_state=42) # Create a decision tree model clf = DecisionTreeClassifier() clf.fit(X_train, y_train) # training model # Make predictions predictions = clf.predict(X_test) # Visualize the decision tree plt.figure(figsize=(12,8)) tree.plot_tree(clf, filled=True, feature_names=X.columns, class_names=['Class1', 'Class2']) plt.show() The gain coefficient of each dimension represents the correlation between the dimension and the moment classification. Therefore, each dimension in the multiple dimensions is sorted from high to low according to the gain coefficient, and a gain coefficient sequence is obtained.

[0024] Specifically, the multiple dimensions are set to W1, W2, ..., W N These N dimensions, where N ≥ 2, set the integer i from 1 to N, then any dimension W i The corresponding gain factor is H i , thus constructing the gain coefficient sequence H1, H2, ..., HN 。

[0025] Next, set the relevance threshold MinH. Among all the gain coefficients H1, H2, …, H N that are greater than the relevance threshold MinH, there are N' ones, denoted as H 1’ , …, H N’ , where 1 ≤ N' < N, and the corresponding dimensions are W 1’ , …, W N’ .

[0026] Correspondingly, among the gain coefficients H1, H2, …, H N that are not greater than the relevance threshold MinH, there are N'' = N - N' ones, denoted as H 1” , …, H N” . Then the corresponding dimensions are W 1” , …, W N” .

[0027] Thus, the above N dimensions can be divided into two parts, that is, the high-relevance dimension set W' (the gain coefficient is greater than MinH), namely, W 1’ , …, W N’ , and the low-relevance dimension set W'' (the gain coefficient is not greater than MinH), namely, W 1” , …, W N” .

[0028] It should be noted that the decision tree here examines the correlation problem between the attacker's time habit and dimension habit. If the gain coefficient of a certain dimension is large, it means that the dimension has a great correlation with the attacker's time habit, and it also indicates that the attacker is more interested in this dimension. Therefore, this dimension can be defined as "highly sensitive". On the contrary, if the gain coefficient of a certain dimension is small, it proves that this dimension does not match the attacker's time habit very well, which also means that the attacker is not interested in this dimension. Then this dimension can be defined as "low sensitive".

[0029] In the total data set, two data subsets can also be divided according to the above two dimension sets. In the total data set, the set of data corresponding to each dimension in the high-relevance dimension set W' becomes the high-relevance data subset, and the set of data corresponding to each dimension in the low-relevance dimension set W'' becomes the low-relevance data subset.

[0030] Figure 2 shows an exemplary example of the total data set in the system according to the present invention. As Figure 2 shown in the list, through decision tree calculation, the two dimensions of "category" and "transaction amount" are classified into the high-relevance dimension set, and "transaction date" and "transaction price" are classified into the low-relevance dimension set. Then Figure 2 In the data set shown, the 12 data corresponding to the two dimensions of "category" and "transaction amount" form a highly relevant data subset, while the 12 data corresponding to the two dimensions of "transaction date" and "transaction price" form a low-relevance data subset. Figure 2 In the example, the 12 data that form the low-correlation subset are marked with double underlines, while the other "category" and "transaction amount" data are not underlined. It should be noted that this is just an example. In actual databases, data is often not as Figure 2 For example, some data strings only have category, transaction amount, transaction date, but lack transaction price, while some data strings may lack transaction amount, and some data strings lack transaction date. Figure 3 As shown, in Figure 3 In the table shown, the first data segment lacks transaction date data, the fourth and sixth data segments lack transaction amount data, and the third data segment lacks transaction price data. Figure 2 The neat data shown is abnormal. Figure 3 The data shown are the normal data in the database, because in the process of collecting each data segment, data omissions or incomplete data collection due to objective conditions are common and even inevitable phenomena.

[0031] The so-called "high correlation" and "low correlation" actually correspond to the dimensions that are most relevant to the attacker's attack time, which means that the attacker targets the data in the database that he is most interested in. The attacker often chooses to attack the database at a time he thinks is appropriate. Therefore, based on the information gain of the decision tree, the dimensional data that he is most interested in can be inferred.

[0032] It should be noted here that real data often does not have Figure 2 The data listed in the figure are so neat, some data strings may have only three dimensions, and some data strings may have four dimensions. In other words, different data strings have different dimensions, and each data string will have different degrees of dimensionality loss. When an attacker attacks the data, the gain coefficient of the fewer dimensions in the attack data appears to be relatively low when the decision tree is calculated. Then such dimensions will fall into the category of low-correlation dimensions.

[0033] The high correlation data set and the low correlation data set enter the decision module respectively. In the following, the decision module will perform noise processing on the data subsets with different correlations, and finally form pseudo data.

[0034] The decision module will have different degrees of noise addition for data with different relevance. On the one hand, for data with high relevance, it is relatively sensitive, so high-intensity distortion noise is added for high-intensity noise addition processing to form high-intensity pseudo data, which is completely different from the original data. For data with low relevance, it is relatively insensitive, so disturbing noise can be added. This type of noise is not strong, forming low-intensity pseudo data, effectively forming a fidelity with the original data.

[0035] In other words, when constructing pseudo data, two aspects need to be considered. The so-called "pseudo" data is "pseudo" after all, so it is impossible to show its true face. Highly relevant sensitive data naturally needs to be hidden. On the other hand, in order to attract attackers, it is necessary to introduce low-relevance data as much as possible with relatively low noise, so that it is relatively closer to the real data, but it is also plausible to confuse attackers.

[0036] For example, for highly correlated data, Laplace noise processing can be considered. In the process of introducing Laplace noise, random variables that follow the Laplace distribution are generated, which is usually used for differential privacy.

[0037] More specifically, for example, the dimension of "transaction amount" forms highly relevant data, and the relevant operating procedures can be formed as follows: import numpy as np import pandas as pd # Sample transaction amount data transaction_amounts = pd.DataFrame({ 'transaction_id': range(1, 11), 'amount': [100, 150, 200, 250, 300, 350, 400, 450, 500, 550] }) # Define the generating function of Laplace noise def add_laplace_noise(data, scale): """ Adding Laplace noise to the data :param data: original data :param scale: The scale of the Laplace noise (i.e. 1 / b) :return: data after adding noise """ noise = np.random.laplace(0, scale, size=data.shape) return data + noise # Set the noise scale (can be adjusted as needed) scale = 50 # The noise amplitude introduced for each transaction amount # Add Laplace noise to transaction amount data transaction_amounts['amount_noisy'] = add_laplace_noise(transaction_amounts['amount'].values, scale) # Output results print("Original transaction amount data:") print(transaction_amounts[['transaction_id', 'amount']]) print("\nTransaction amount data after adding noise:") print(transaction_amounts[['transaction_id', 'amount_noisy']]) As mentioned in the example above, since the "transaction amount" is identified as highly relevant or highly sensitive data through decision tree analysis, the pseudo data formed by the "transaction amount" is seriously distorted, thereby effectively avoiding the attacker's snooping.

[0038] Continuing with the above example, for low-correlation data, uniform noise processing can be considered. Compared with Laplace noise, uniform noise is relatively mild. This noise is a type of random noise that is uniformly distributed within a specific range. It is used to enhance data privacy and protect sensitive information.

[0039] Continuing with the above example, more specifically, for example, the dimension of "transaction price" forms low-correlation data. For the "transaction price" as low-correlation data, uniform noise is introduced. The relevant operating procedures can be formed as follows: import numpy as np import pandas as pd # Sample transaction price data transaction_prices = pd.DataFrame({ 'transaction_id': range(1, 11), 'price': [100.0, 150.0, 200.0, 250.0, 300.0, 350.0, 400.0, 450.0,500.0, 550.0] }) # Define the generating function of uniform noise def add_uniform_noise(data, noise_range): """ Add uniform noise to the data :param data: original data :param noise_range: The range to generate uniform noise (inclusive of min and max values) :return: data after adding noise """ # Generate uniform noise within the specified range noise = np.random.uniform(noise_range[0], noise_range[1], size=data.shape) return data + noise # Set the noise range noise_range = (-5.0, 5.0) # Set the range of uniform noise, such as [-5, 5] # Add uniform noise to transaction price data transaction_prices['price_noisy'] = add_uniform_noise(transaction_prices['price'].values, noise_range) # Output results print("Original transaction price data:") print(transaction_prices[['transaction_id', 'price']]) print("\nTransaction price data after adding noise:") print(transaction_prices[['transaction_id', 'price_noisy']]) Subsequently, the decision module merges the high-intensity pseudo data and the low-intensity pseudo data into a pseudo database, which can replace the original database to lure attackers.

[0040] The pseudo database can be used to confuse network attackers. The pseudo database constructed by the network security system provided by the present invention is significantly different from a general honeypot. In the network security system provided by the present invention, the original data is classified by relevance (i.e., sensitivity) using the attacker's previous log records, and different intensities of noise are introduced to data dimensions with different sensitivities in different ways, so that the data of different dimensions in a data string in the final pseudo database have different camouflage effects, which ensures that the sensitive dimension part is completely hidden to ensure data security, and ensures that the insensitive dimension part is more confusing to network attackers because the noise is not strong.

[0041] The above description is only an exemplary embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A network security system based on a virtual environment, characterized in that: The system includes a monitoring module, an analysis module, and a decision-making module, among which: The monitoring module is used to monitor the sudden traffic changes of the original database, query the multiple moments when sudden traffic changes occurred in history and the data segments attacked at each moment in the multiple moments from the logs of the original database, and each of the data segments includes multiple dimensions; The analysis module uses all attacked data segments as the data set, each dimension as the root node classification, and the multiple moments as the leaf node classification, to construct a dimension decision tree, and calculate the gain coefficient of each dimension, wherein the dimensions whose gain coefficients are greater than the correlation threshold constitute a high-correlation dimension set, and the dimensions whose gain coefficients are not greater than the correlation threshold constitute a low-correlation dimension set; The decision module performs high-intensity noise processing on the dimensional data in the high-correlation dimension set to form high-intensity pseudo data, and performs low-intensity noise processing on the dimensional data in the low-correlation dimension set to form low-intensity pseudo data, and merges the high-intensity pseudo data and the low-intensity pseudo data into a pseudo database, which replaces the original database to lure attackers.

2. The system according to claim 1, characterized in that The multiple dimensions include four dimensions: commodity category, transaction amount, transaction date, and product price.

3. The system according to claim 1, characterized in that The multiple dimensions are W1, W2, ..., W N These N dimensions, where N ≥ 2, set the integer i from 1 to N, then any dimension W i The corresponding gain factor is H i , thus constructing the gain coefficient sequence H1, H2, ..., H N , Set the relevance threshold MinH. Among all the gain coefficients H1, H2, …, H N that are greater than the relevance threshold MinH, there are N' ones, denoted as H 1’ , …, H N’ , where 1 ≤ N' < N, and the corresponding dimensions are W 1’ , …, W N’ . In the gain coefficient sequence H1, H2, ..., H N There are N”=N-N' gain coefficients that are not greater than the correlation threshold MinH, counted as H 1” ,…,H N” Then the corresponding dimension is W 1” , …, W N” , The N dimensions are divided into two parts, namely, the dimension W 1’ , …, W N’ The highly correlated dimension set W' is composed of dimensions W 1” , …, W N” The low-correlation dimension set W is composed of.

4. The system according to claim 1, characterized in that The high-intensity noise addition process is Laplace noise processing.

5. The system according to claim 1, characterized in that The low-intensity noise adding process is a uniform noise adding process.

Images