Network security system based on virtual environment

Abstract

The present application provides a kind of network security system based on virtual environment, and the pseudo database constructed with general honeypot has significant difference.In the network security system provided by the present application, the original data is classified according to the relevance (i.e., sensitivity) of the log record before the attacker, and different intensities of noise are introduced to different dimensions of data with different sensitivities in different ways, so that the different dimensions of data in a data string in the finally formed pseudo database have different camouflage effects, which not only ensures that the sensitive dimension part is completely hidden to ensure data security, but also ensures that the insensitive dimension part is more confusing to network attackers due to the weak noise.

Description

Technical Field

[0001] The invention relates to a network security system based on a virtual environment. Background Art

[0002] With the development of information technology, cyber attacks have become increasingly complex and diverse. Traditional network security defense mechanisms have been unable to effectively deal with the endless stream of new cyber attacks.

[0003] Therefore, strategies that employ active defense and lure attackers into traps have attracted widespread attention. However, active defense in network security is often greatly limited by the environment, and attackers' attack methods are often difficult to predict. Therefore, a relatively complete active defense mechanism for network security has not yet been formed. Summary of the Invention

[0004] The present invention provides a network security system based on a virtual environment, which effectively solves the problems existing in the prior art mentioned above.

[0005] Specifically, the present invention provides a network security system based on a virtual environment, which includes a monitoring module, an analysis module, and a decision module, wherein: the monitoring module is used to monitor the sudden traffic changes of the original database, and query from the log of the original database multiple moments when sudden traffic changes occurred in history and the data segments attacked at each moment of the multiple moments, each of the data segments includes multiple dimensions; the analysis module takes all attacked data segments as the data set, classifies each dimension as the root node, and classifies the multiple moments as leaf nodes, constructs a dimension decision tree, and calculates the gain coefficient of each dimension, wherein the dimensions with gain coefficients greater than the correlation threshold constitute a high-correlation dimension set, and the dimensions with gain coefficients not greater than the correlation threshold constitute a low-correlation dimension set; the decision module performs high-intensity noise processing on the dimensional data in the high-correlation dimension set to form high-intensity pseudo data, and performs low-intensity noise processing on the dimensional data in the low-correlation dimension set to form low-intensity pseudo data, and merges the high-intensity pseudo data and the low-intensity pseudo data into a pseudo database, which replaces the original database to lure attackers.

[0006] Optionally, the multiple dimensions include four dimensions: commodity category, transaction amount, transaction date, and product price.

[0007] Preferably, the multiple dimensions are W1, W2, ..., W N These N dimensions, where N ≥ 2, set the integer i from 1 to N, then any dimension W i The corresponding gain coefficient is H i , thus constructing the gain coefficient sequence H1, H2, ..., H N, set the relevance threshold MinH. Among the gain coefficient sequences H1, H2, …, H N , there are N' gain coefficients greater than the relevance threshold MinH, denoted as H 1’ , …, H N’ , where 1 ≤ N' < N, and the corresponding dimensions are W 1’ , …, W N’ , among the gain coefficient sequences H1, H2, …, H N , there are N" = N - N' gain coefficients not greater than the relevance threshold MinH, denoted as H 1” , …, H N” . Then the corresponding dimensions are W 1” , …, W N” . The N dimensions are divided into two parts, that is, the high-relevance dimension set W' composed of dimensions W 1’ , …, W N’ , and the low-relevance dimension set W" composed of dimensions W 1” , …, W N” .

[0008] Preferably, the high-intensity noise addition process is Laplace noise processing.

[0009] Preferably, the low-intensity noise addition process is uniform noise processing.

[0010] Generally speaking, the present invention provides a network security system based on a virtual environment. The constructed pseudo-database has a significant difference from a general honeypot. In the network security system provided by the present invention, by using the previous log records of the attacker, the original data is classified according to the relevance (i.e., sensitivity), and different intensities of noise are introduced into different data dimensions with different sensitivities in different ways, so that the data in different dimensions within a data string in the finally formed pseudo-database have different camouflage effects. This not only ensures that the sensitive dimension part is completely hidden to ensure data security, but also ensures that the insensitive dimension part causes greater confusion to network attackers due to the weak noise. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will discuss the drawings required to be used in the description of the embodiments or the prior art. Obviously, the technical solutions described in conjunction with the drawings are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other embodiments and their drawings can be obtained according to the embodiments shown in these drawings.

[0012] Figure 1 Shows the basic operation flowchart of the network security system based on a virtual environment according to the present invention.

[0013] Figure 2 An exemplary example of a data collection in a system according to the present invention is shown.

[0014] Figure 3 Another exemplary example of a data collection in a system according to the present invention is shown. DETAILED DESCRIPTION

[0015] The following will clearly and completely describe the technical solutions of various embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. Based on the embodiments described in the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0016] Hereinafter, the basic operation of the network security system based on the virtual environment according to the present invention will be described in detail. Figure 1 The basic operation flow chart of the network security system based on the virtual environment according to the present invention is shown.

[0017] In summary, the present invention provides a virtual environment-based network security system designed to identify, analyze, and respond to potential network attacks by luring attackers into a virtual "trap" environment. This effectively distracts attackers while ensuring users and critical data remain intact, improving overall network security.

[0018] When attackers attack a database, sudden traffic changes often occur. Due to network attacks, the access traffic to the database fluctuates dramatically in a short period of time and deviates from the normal level.

[0019] When a cyber attacker attacks a database in different time periods, the time periods themselves reflect the attacker's interest in certain dimensions of the data. Databases are updated in real time, and the data appearing in certain time periods is specific to certain dimensions, implicitly reflecting the attacker's interest in these dimensions. Therefore, this invention can investigate which dimensions of data the attacker is interested in by exploring the correlation between dimensions and time periods.

[0020] The monitoring module in the system can monitor sudden traffic changes in the original database. The monitoring module can use a monitoring tool such as Prometheus, Grafana, Zabbix or New Relic to monitor the database traffic in real time.

[0021] Through the monitoring module, you can query the database logs to find multiple moments in history when sudden traffic changes occurred and the data segments that were attacked at each moment.

[0022] Each data segment contains multiple dimensions. For example, in a commodity transaction database, each data segment may contain four dimensions: commodity category, transaction amount, transaction date, and product price.

[0023] Next, the system starts the analysis module. In this module, all attacked data segments are used as the data set, each dimension is used as the root node, and the time is used as the leaf node. A dimension decision tree is constructed to calculate the gain coefficient for each dimension. The following is a presentation of the relevant program:

[0024] import pandas as pd

[0025] from sklearn.model_selection import train_test_split

[0026] from sklearn.tree import DecisionTreeClassifier

[0027] from sklearn import tree

[0028] import matplotlib.pyplot as plt

[0029] data = pd.read_csv('data.csv')# Import data

[0030] X = data[['age', 'income', 'purchasing_power']] # Features

[0031] y = data['target_label']# target label

[0032] X_train, X_test, y_train, y_test = train_test_split(X, y, test_size= 0.2, random_state=42)

[0033] # Create a decision tree model

[0034] clf = DecisionTreeClassifier()

[0035] clf.fit(X_train, y_train)# Training model

[0036] # Make predictions

[0037] predictions = clf.predict(X_test)

[0038] # Visualize the decision tree

[0039] plt.figure(figsize=(12,8))

[0040] tree.plot_tree(clf, filled=True, feature_names=X.columns, class_names=['Class1', 'Class2'])

[0041] plt.show()

[0042] The gain coefficient of each dimension represents the degree of correlation between that dimension and the time classification. Therefore, by sorting each dimension in the multiple dimensions from high to low according to the gain coefficient, a gain coefficient sequence is obtained.

[0043] Specifically, set the multiple dimensions as W1, W2, …, W N These N dimensions, where N ≥ 2, set the integer i to take values from 1 to N, then for any dimension W i the corresponding gain coefficient is H i , thus constructing a gain coefficient sequence H1, H2, …, H N .

[0044] Next, set a correlation threshold MinH. Among all the gain coefficients in the gain coefficient sequence H1, H2, …, H N that are greater than the correlation threshold MinH, there are N' ones, denoted as H 1’ , …, H N’ , where 1 ≤ N' < N, and the corresponding dimensions are W 1’ , …, W N’ .

[0045] Correspondingly, among the gain coefficients in the gain coefficient sequence H1, H2, …, H N that are not greater than the correlation threshold MinH, there are N'' = N - N' ones, denoted as H 1” , …, H N” . Then the corresponding dimensions are W 1” , …, W N” .

[0046] Thus, the above N dimensions can be divided into two parts, that is, a high - correlation dimension set W' (gain coefficient greater than MinH), namely, W 1’ , …, W N’ , and a low - correlation dimension set W'' (gain coefficient not greater than MinH), namely, W 1” , …, W N” . a

[0047] It should be noted that the decision tree here examines the correlation problem between the attacker's time habits and dimension habits. If the gain coefficient of a certain dimension is large, it means that the dimension has a great correlation with the attacker's time habits, and it also indicates that the attacker is more interested in this dimension. Therefore, this dimension can be defined as "high - sensitive". On the contrary, if the gain coefficient of a certain dimension is small, it proves that this dimension does not match the attacker's time habits well, which also means that the attacker is not interested in this dimension, and then this dimension can be defined as "low - sensitive".

[0048] The data set can also be divided into two data subsets based on the two dimension sets mentioned above. In the data set, the set of data corresponding to each dimension in the high-correlation dimension set W' becomes the high-correlation data subset, and the set of data corresponding to each dimension in the low-correlation dimension set W" becomes the low-correlation data subset.

[0049] Figure 2 An exemplary example of a data set in a system according to the present invention is shown. Figure 2 As shown in the table, through the decision tree calculation, the two dimensions "category" and "transaction amount" are classified into the high-correlation dimension set, and "transaction date" and "transaction price" are classified into the low-correlation dimension set. Figure 2 In the data set shown, the 12 data corresponding to the two dimensions of "category" and "transaction amount" form a highly correlated data subset, while the 12 data corresponding to the two dimensions of "transaction date" and "transaction price" form a low-correlation data subset. Figure 2 In the example, the 12 data that form the low correlation subset are double underlined, while the other "category" and "transaction amount" data are not underlined. It should be noted that this is just an example. In the actual database, the data is often not as Figure 2 For example, some data strings only have category, transaction amount, transaction date, but lack transaction price, while some data strings may lack transaction amount, and some data strings may lack transaction date. Figure 3 As shown, in Figure 3 In the table shown, the first data segment lacks transaction date data, the fourth and sixth data segments lack transaction amount data, and the third data segment lacks transaction price data. Figure 2 The neat data shown is abnormal, and Figure 3 The data shown are the normal data in the database, because in the process of collecting each data segment, data omissions or incomplete data collection due to objective conditions are common and even inevitable phenomena.

[0050] The so-called "high correlation" and "low correlation" actually correspond to the dimensions that are most relevant to the attacker's attack time, which means that the attacker targets the data in the database that he is most interested in. The attacker often chooses to attack the database at a time he deems appropriate. Therefore, the information gain of the decision tree can also be used to infer the dimension data that he is most interested in.

[0051] It should be noted here that the data in reality often does not have Figure 2The data listed in the figure are so neat. Some data strings may have only three dimensions, and some data strings may have four dimensions. In other words, different data strings have different dimensions, and each data string will have different degrees of dimension loss. When an attacker attacks the data, the gain coefficient of the fewer dimensions in the attack data appears to be relatively low when the decision tree is calculated. Then such dimensions will fall into the category of low-correlation dimensions.

[0052] The high-correlation data set and the low-correlation data set enter the decision module separately. In the following, the decision module will perform noise processing on the data subsets with different correlation levels, and finally form pseudo data.

[0053] The decision module applies different levels of noise to data with different degrees of relevance. Highly correlated data is relatively sensitive, so high-intensity distortion noise is added to create high-intensity pseudo-data, completely differentiating it from the original data. Low-correlation data, on the other hand, is relatively insensitive, so interference noise can be added. This less intense noise creates low-intensity pseudo-data, effectively creating a more realistic match with the original data.

[0054] In other words, when constructing fake data, two aspects need to be considered. The so-called "fake" data is "fake" after all, so it is impossible to show its true face to the public. Highly correlated sensitive data naturally needs to be hidden. On the other hand, in order to attract attackers, it is necessary to introduce low-correlation data as much as possible with relatively low noise, so that it is relatively closer to the real data, but also seemingly true, in order to confuse attackers.

[0055] For example, for highly correlated data, Laplace noise processing can be considered. During the introduction of Laplace noise, random variables that follow the Laplace distribution are generated, which is usually used for differential privacy.

[0056] More specifically, for example, the dimension "transaction amount" forms highly relevant data, and the relevant operating procedures can be formed as follows:

[0057] import numpy as np

[0058] import pandas as pd

[0059] # Sample transaction amount data

[0060] transaction_amounts = pd.DataFrame({

[0061] 'transaction_id': range(1, 11),

[0062] 'amount': [100, 150, 200, 250, 300, 350, 400, 450, 500, 550]

[0063] })

[0064] # Define the generating function of Laplace noise

[0065] def add_laplace_noise(data, scale):

[0066] """

[0067] Adding Laplace noise to the data

[0068] :param data: original data

[0069] :param scale: The scale of the Laplace noise (i.e. 1 / b)

[0070] :return: Data after adding noise

[0071] """

[0072] noise = np.random.laplace(0, scale, size=data.shape)

[0073] return data + noise

[0074] # Set the noise scale (can be adjusted as needed)

[0075] scale = 50 # The noise amplitude introduced for each transaction amount

[0076] # Add Laplace noise to transaction amount data

[0077] transaction_amounts['amount_noisy'] = add_laplace_noise(transaction_amounts['amount'].values, scale)

[0078] # Output results

[0079] print("Original transaction amount data:")

[0080] print(transaction_amounts[['transaction_id', 'amount']])

[0081] print("\nTransaction amount data after adding noise:")

[0082] print(transaction_amounts[['transaction_id', 'amount_noisy']])

[0083] As mentioned in the example above, because the "transaction amount" is identified as highly relevant or highly sensitive data through decision tree analysis, the pseudo-data formed by the "transaction amount" is severely distorted, thus effectively avoiding the attacker's prying eyes.

[0084] Continuing with the previous example, for low-correlation data, uniform noise can be considered. Compared to Laplace noise, uniform noise is relatively mild. It is a type of random noise that is uniformly distributed within a specific range. It is used to enhance data privacy and protect sensitive information.

[0085] Continuing with the previous example, let's take a more specific example. For example, if the dimension "transaction price" forms low-correlation data, and uniform noise is introduced into the "transaction price" as low-correlation data, the relevant operation program can be formed as follows:

[0086] import numpy as np

[0087] import pandas as pd

[0088] # Sample transaction price data

[0089] transaction_prices = pd.DataFrame({

[0090] 'transaction_id': range(1, 11),

[0091] 'price': [100.0, 150.0, 200.0, 250.0, 300.0, 350.0, 400.0, 450.0,500.0, 550.0]

[0092] })

[0093] # Define the generating function of uniform noise

[0094] def add_uniform_noise(data, noise_range):

[0095] """

[0096] Add uniform noise to the data

[0097] :param data: original data

[0098] :param noise_range: The range of uniform noise to generate (inclusive of minimum and maximum values)

[0099] :return: Data after adding noise

[0100] """

[0101] # Generate uniform noise within the specified range

[0102] noise = np.random.uniform(noise_range[0], noise_range[1], size=data.shape)

[0103] return data + noise

[0104] # Set the noise range

[0105] noise_range = (-5.0, 5.0) # Set the range of uniform noise, such as [-5, 5]

[0106] # Add uniform noise to transaction price data

[0107] transaction_prices['price_noisy'] =

[0108] add_uniform_noise(transaction_prices['price'].values, noise_range)

[0109] # Output results

[0110] print("Original transaction price data:")

[0111] print(transaction_prices[['transaction_id', 'price']])

[0112] print("\nTransaction price data after adding noise:")

[0113] print(transaction_prices[['transaction_id', 'price_noisy']])

[0114] Subsequently, the decision module merges the high-intensity pseudo data and the low-intensity pseudo data into a pseudo database, which can replace the original database to lure attackers.

[0115] This pseudo-database can be used to confuse cyber attackers. The pseudo-database constructed by the network security system provided by the present invention differs significantly from conventional honeypots. In the network security system provided by the present invention, the original data is classified by relevance (i.e., sensitivity) using the attacker's previous log records. Different noise intensities are introduced into data dimensions with different sensitivities in different ways. This results in the resulting pseudo-database having different camouflage effects for different dimensions within a data string. This ensures that sensitive dimensions are completely hidden to ensure data security, while also ensuring that insensitive dimensions, due to the reduced noise intensity, are more confusing to cyber attackers.

[0116] The above description is merely an exemplary embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A network security system based on a virtual environment, characterized in that: The system includes a monitoring module, an analysis module, and a decision-making module, among which: The monitoring module is used to monitor sudden traffic changes of the original database, query the logs of the original database to find multiple moments when sudden traffic changes occurred in history and the data segments attacked at each of the multiple moments, each of the data segments including multiple dimensions; The analysis module uses all attacked data segments as the data set, classifies each dimension as a root node, and classifies the multiple moments as leaf nodes to construct a dimension decision tree, and calculates the gain coefficient of each dimension, wherein the dimensions with gain coefficients greater than the correlation threshold constitute a high-correlation dimension set, and the dimensions with gain coefficients not greater than the correlation threshold constitute a low-correlation dimension set; The decision module performs high-intensity noise processing on the dimensional data in the high-correlation dimension set to form high-intensity pseudo data, and performs low-intensity noise processing on the dimensional data in the low-correlation dimension set to form low-intensity pseudo data. The high-intensity pseudo data and the low-intensity pseudo data are merged into a pseudo database, which replaces the original database to lure attackers.

2. The system according to claim 1, wherein: The multiple dimensions include four dimensions: commodity category, transaction amount, transaction date, and product price.

3. The system according to claim 1, wherein: The multiple dimensions are W1, W2, ..., W N These N dimensions, where N ≥ 2, set the integer i from 1 to N, then any dimension W i The corresponding gain coefficient is H i , thus constructing the gain coefficient sequence H1, H2, ..., H N , Set the relevance threshold MinH. Among all the gain coefficients H1, H2, …, H N that are greater than the relevance threshold MinH, there are N' ones, denoted as H 1’ , …, H N’ , where 1 ≤ N' < N, and the corresponding dimensions are W 1’ , …, W N’ . In the gain coefficient sequence H1, H2, ..., H N There are N"=N-N' gain coefficients that are not greater than the correlation threshold MinH, counted as H 1” ,…,H N”， Then the corresponding dimension is W 1” ,…,W N” , The N dimensions are divided into two parts, namely, the W dimension 1’ ,…,W N’ The highly correlated dimension set W', and the dimension W 1” ,…,W N” The low-correlation dimension set W is composed of .

4. The system according to claim 1, wherein: The high-intensity noise addition process is Laplace noise processing.

5. The system according to claim 1, wherein: The low-intensity noise addition process is a uniform noise process.

Images