Network security attack type and threat level prediction method based on machine learning

Abstract

The invention discloses a network security attack type and threat level prediction method based on machine learning, and relates to the field of network security, and the method comprises the following steps: obtaining intrusion analysis data; an intrusion analysis module is arranged, historical intrusion analysis data and corresponding network attack types are obtained, and feature data corresponding to different network attack types are analyzed; performing analysis training on the feature data through a deep learning algorithm, and identifying a corresponding deep learning model; comparing the obtained intrusion analysis data with each piece of feature data to obtain similarity data, sorting the similarity data, selecting the corresponding feature data, inputting the selected feature data into a deep learning model, and outputting a corresponding network attack type; setting threat level coefficients according to different network attack types; setting threat comprehensive data according to the similarity data of the feature data corresponding to the network attack type and the threat level coefficient; obtaining a predicted threat level according to the threat comprehensive data; according to the invention, the efficiency in the threat level prediction process is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a method for predicting network security attack types and threat levels based on machine learning. Background Art

[0002] With the rapid development of the Internet, more and more companies choose to conduct business through the Internet, which brings convenience to both companies and people's lives. However, with the increasing popularity of Internet applications, network security issues have gradually attracted attention. Network security issues are not only related to the safety of individual companies, but also to people's livelihood and even national security. Therefore, network security issues have now become one of the most important development and research directions in the Internet field.

[0003] At present, in order to improve the efficiency of exception handling in network security and further ensure network security, a variety of machine learning algorithms are used for model training, and the algorithm with the highest feature prediction accuracy among various machine learning algorithms is used to predict the attack type and threat level, thereby ensuring the accuracy of the prediction results; however, by performing feature prediction on various machine learning algorithms and obtaining the algorithm with the highest feature accuracy, the efficiency of threat prediction is reduced to a certain extent in the implementation process, and a single network attack algorithm cannot effectively identify the logical connection between multiple single attack events; therefore, how to improve the efficiency of network security attack type identification and threat level prediction is a problem we need to solve. To this end, a network security attack type and threat level prediction method based on machine learning is provided. Summary of the invention

[0004] In order to solve the above technical problems, the purpose of the present invention is to provide a network security attack type and threat level prediction method based on machine learning.

[0005] The object of the present invention can be achieved by the following technical solution: A method for predicting network security attack types and threat levels based on machine learning, comprising the following steps:

[0006] Step S1: Setting an intrusion detection module, detecting the network traffic data, network operation data and system log data of the network through the intrusion detection module, and obtaining intrusion analysis data;

[0007] Step S2: Setting an intrusion analysis module, obtaining historical intrusion analysis data and corresponding network attack types, and obtaining feature data of historical intrusion analysis data corresponding to different types of network attack types;

[0008] Step S3: setting the obtained feature data as a training set and a validation set, training them through a deep learning algorithm, and obtaining a deep learning model for identifying network attack types;

[0009] Step S4: Analyze and process the obtained intrusion analysis data to obtain a real-time dynamic curve, and compare and analyze the obtained real-time dynamic curve with the characteristic data corresponding to each network attack type to obtain corresponding similarity data;

[0010] Step S5: setting a threat level coefficient according to the threat level of the corresponding network attack type; analyzing and processing the obtained similarity data and the corresponding threat level coefficient to obtain comprehensive threat data;

[0011] Step S6: Setting the threat level interval, obtaining the predicted threat level according to the threat level interval to which the threat comprehensive data belongs, setting a visual display according to the predicted threat level, and having corresponding staff take corresponding measures.

[0012] Furthermore, the process of setting up an intrusion detection module and detecting the network traffic data, network operation data and system log data of the network through the intrusion detection module and obtaining the intrusion analysis data includes:

[0013] An intrusion detection module is provided, wherein the intrusion detection module monitors the network operation status in real time and obtains intrusion analysis data corresponding to the network operation status;

[0014] The intrusion monitoring system stores network nodes that analyze and process data information of the network, and monitors the data during the operation of each network node; the intrusion monitoring system sets corresponding data monitoring cycles according to different data information types, and obtains network traffic data, network operation data and system log data within the corresponding data monitoring cycle; the system log data includes the corresponding abnormal logins and the number of abnormal data.

[0015] Furthermore, the process of setting up an intrusion analysis module, obtaining historical intrusion analysis data and corresponding network attack types, and obtaining feature data of historical intrusion analysis data corresponding to different types of network attack types includes:

[0016] An intrusion analysis module is set up, in which historical intrusion analysis data of corresponding network nodes are stored, wherein the historical intrusion analysis data include historical network traffic data, historical network operation data and historical system log data corresponding to different network attack types. The historical intrusion analysis data of corresponding network attack types are analyzed and processed through feature engineering to obtain dynamic curves and abnormal threshold data of historical network traffic data, historical network operation data and historical system log data under corresponding network attack types, and the obtained dynamic curves and abnormal threshold data are respectively set as corresponding feature data.

[0017] Furthermore, the process of setting the obtained feature data as a training set and a validation set, training the obtained feature data through a deep learning algorithm, and obtaining a deep learning model for identifying network attack types includes:

[0018] The obtained feature data and their corresponding network attack types are set as training set and validation set respectively, and the obtained feature data are input into the deep learning model for analysis and training to obtain the predicted attack type output by the corresponding feature data; the feature data corresponding to the validation set is input into the deep learning model to output the corresponding predicted attack type, and the obtained predicted attack type is compared with the corresponding network attack type in the validation set to obtain the matching consistency rate between the predicted attack type and the network attack type corresponding to the feature data in the validation set, and a matching consistency rate threshold is set. When the matching consistency rate is greater than the matching consistency rate threshold, the training of the deep learning model is completed.

[0019] Further, the obtained intrusion analysis data is analyzed and processed to obtain a real-time dynamic curve, and the obtained real-time dynamic curve is compared and analyzed with the characteristic data corresponding to each network attack type to obtain the corresponding similarity data:

[0020] Obtain network traffic data, network operation data and system log data within each data monitoring period; obtain the real-time dynamic curve of the corresponding intrusion analysis data according to the data monitoring period, compare the obtained real-time dynamic curve with the dynamic curve in the characteristic data, and obtain dynamic similarity; obtain network traffic data, network operation data and system log data within the data monitoring period and compare them with the abnormal data threshold in the characteristic data corresponding to the network attack type; obtain the data with the minimum abnormal data threshold, obtain the difference between the two, and set the threshold similarity according to the difference between the two;

[0021] The intrusion analysis module is provided with a proportion coefficient for the obtained dynamic similarity and threshold similarity, and the obtained dynamic similarity and threshold similarity are multiplied by the corresponding proportion coefficient, and the obtained products are added to obtain the corresponding similarity data.

[0022] Furthermore, the process of setting the threat level coefficient according to the threat level of the corresponding network attack type includes:

[0023] The intrusion analysis module is provided with a threat assessment algorithm, which is used to obtain the occurrence ratio and successful interception ratio of the corresponding network attack type in the network, and set the threat level coefficient of the corresponding network attack type according to the occurrence ratio and the successful interception ratio; an assessment period is provided, during which the occurrence ratio and the successful interception ratio of the network attack type are analyzed by the threat assessment algorithm, and the threat level coefficient of the corresponding network attack type is updated.

[0024] Furthermore, the process of analyzing and processing the obtained similarity data and the corresponding threat level coefficient to obtain comprehensive threat data includes:

[0025] The similarity data obtained by comparing the intrusion analysis data with the corresponding feature data are sorted in descending order, and the top N corresponding feature data are obtained according to the sorting result. The obtained feature data are input into the deep learning model, and the predicted network attack type of the corresponding feature data is obtained through deep learning model analysis and processing;

[0026] The intrusion analysis module obtains similarity data and threat level coefficients of feature data corresponding to the predicted network attack type, wherein corresponding weight factors are set for the similarity data and threat level coefficient respectively; obtains the corresponding threat level coefficient according to the predicted network attack type, multiplies the similarity data and threat level coefficient corresponding to the predicted network attack type by the corresponding weight factors respectively, performs addition operation on the obtained products, and records the obtained results as threat comprehensive data.

[0027] Furthermore, the process of setting the threat level interval, obtaining the predicted threat level according to the threat level interval to which the threat comprehensive data belongs, setting a visual display according to the predicted threat level, and having corresponding staff take corresponding measures includes:

[0028] The intrusion analysis module is provided with threat level intervals, which are respectively a normal data interval, an abnormal data interval, a threat interval and a severe threat interval. The threat levels are set to level 1, level 2, level 3 and level 4 from low to high according to the threat level intervals; the threat comprehensive data obtained by the corresponding network node is compared with the threat level interval, the corresponding threat level interval to which the corresponding threat comprehensive data belongs is obtained, the predicted threat level is judged according to the threat level interval to which it belongs, and prediction information is generated, the prediction information includes the corresponding network node location, intrusion analysis data and predicted threat level included in the warning information;

[0029] The intrusion analysis module is provided with an operation status monitoring diagram of all network nodes, and the operation status monitoring diagram is visually displayed according to the predicted threat level of the corresponding network node; green, yellow, orange and red are set to correspond to threat levels one, two, three and four respectively; the color of the corresponding network node in the operation status monitoring diagram is set according to the predicted threat level, and the staff obtains the prediction information of the corresponding network node according to the visual display of the operation status monitoring diagram, so as to process the network node in time.

[0030] Compared with the prior art, the beneficial effects of the present invention are as follows: by analyzing and processing the corresponding historical intrusion analysis data in the network nodes, the corresponding characteristic data is obtained, the data in the operation process of each network node is monitored, the intrusion analysis data is obtained, the intrusion analysis data is compared and analyzed with the characteristic data, the similarity data is obtained, the network attack type corresponding to the corresponding characteristic data is obtained according to the sorting result, the threat level coefficient is set for the processing difficulty of the network attack type, and the predicted threat level of the corresponding network attack type is obtained according to the threat level coefficient and similarity data of the corresponding network attack type, thereby improving the efficiency of network attack type prediction to a certain extent;

[0031] In addition, the operation status of network nodes is visualized through the operation monitoring diagram, which makes it convenient for staff to handle the problem to a certain extent. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 A flowchart of a method for predicting network security attack types and threat levels based on machine learning provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0033] like Figure 1 As shown, the network security attack type and threat level prediction method based on machine learning includes the following steps:

[0034] Step S1: Setting an intrusion detection module, detecting the network traffic data, network operation data and system log data of the network through the intrusion detection module, and obtaining intrusion analysis data;

[0035] Step S2: Setting an intrusion analysis module, obtaining historical intrusion analysis data and corresponding network attack types, and obtaining feature data of historical intrusion analysis data corresponding to different types of network attack types;

[0036] Step S3: setting the obtained feature data as a training set and a validation set, training them through a deep learning algorithm, and obtaining a deep learning model for identifying network attack types;

[0037] Step S4: Analyze and process the obtained intrusion analysis data to obtain a real-time dynamic curve, and compare and analyze the obtained real-time dynamic curve with the characteristic data corresponding to each network attack type to obtain corresponding similarity data;

[0038] Step S5: setting a threat level coefficient according to the threat level of the corresponding network attack type; analyzing and processing the obtained similarity data and the corresponding threat level coefficient to obtain comprehensive threat data;

[0039] Step S6: Setting the threat level interval, obtaining the predicted threat level according to the threat level interval to which the threat comprehensive data belongs, setting a visual display according to the predicted threat level, and having corresponding staff take corresponding measures.

[0040] It should be further explained that, in the specific implementation process, the intrusion detection module is set up, and the network flow data, network operation data and system log data of the network are detected by the intrusion detection module, and the process of obtaining the intrusion analysis data includes:

[0041] An intrusion detection module is provided, wherein the intrusion detection module monitors the network operation status in real time and obtains intrusion analysis data corresponding to the network operation status;

[0042] The intrusion monitoring system stores network nodes that analyze and process data information of the network, and monitors the data during the operation of each network node; the intrusion monitoring system sets corresponding data monitoring cycles according to different data information types, and obtains network traffic data, network operation data and system log data within the corresponding data monitoring cycle; the system log data includes the corresponding abnormal logins and the number of abnormal data.

[0043] It should be further explained that, in the specific implementation process, the process of setting up an intrusion analysis module, obtaining historical intrusion analysis data and corresponding network attack types, and obtaining feature data of historical intrusion analysis data corresponding to different types of network attack types includes:

[0044] An intrusion analysis module is set up, in which historical intrusion analysis data of corresponding network nodes are stored, wherein the historical intrusion analysis data include historical network traffic data, historical network operation data and historical system log data corresponding to different network attack types. The historical intrusion analysis data of corresponding network attack types are analyzed and processed through feature engineering to obtain dynamic curves and abnormal threshold data of historical network traffic data, historical network operation data and historical system log data under corresponding network attack types, and the obtained dynamic curves and abnormal threshold data are respectively set as corresponding feature data.

[0045] It should be further explained that, in the specific implementation process, the process of setting the obtained feature data as a training set and a validation set, training them through a deep learning algorithm, and obtaining a deep learning model for identifying network attack types includes:

[0046] The obtained feature data and their corresponding network attack types are set as training set and validation set respectively, and the obtained feature data are input into the deep learning model for analysis and training to obtain the predicted attack type output by the corresponding feature data; the feature data corresponding to the validation set is input into the deep learning model to output the corresponding predicted attack type, and the obtained predicted attack type is compared with the corresponding network attack type in the validation set to obtain the matching consistency rate between the predicted attack type and the network attack type corresponding to the feature data in the validation set, and a matching consistency rate threshold is set. When the matching consistency rate is greater than the matching consistency rate threshold, the training of the deep learning model is completed.

[0047] It should be further explained that, in the specific implementation process, the obtained intrusion analysis data is analyzed and processed to obtain a real-time dynamic curve, and the obtained real-time dynamic curve is compared and analyzed with the characteristic data corresponding to each network attack type to obtain the corresponding similarity data:

[0048] Obtain network traffic data, network operation data and system log data within each data monitoring period; obtain the real-time dynamic curve of the corresponding intrusion analysis data according to the data monitoring period, compare the obtained real-time dynamic curve with the dynamic curve in the characteristic data, and obtain dynamic similarity; obtain network traffic data, network operation data and system log data within the data monitoring period and compare them with the abnormal data threshold in the characteristic data corresponding to the network attack type; obtain the data with the minimum abnormal data threshold, obtain the difference between the two, and set the threshold similarity according to the difference between the two;

[0049] The intrusion analysis module is provided with a proportion coefficient for the obtained dynamic similarity and threshold similarity, and the obtained dynamic similarity and threshold similarity are multiplied by the corresponding proportion coefficient, and the obtained products are added to obtain the corresponding similarity data.

[0050] It should be further explained that, in the specific implementation process, the process of setting the threat level coefficient according to the threat level of the corresponding network attack type includes:

[0051] The intrusion analysis module is provided with a threat assessment algorithm, which is used to obtain the occurrence ratio and successful interception ratio of the corresponding network attack type in the network, and set the threat level coefficient of the corresponding network attack type according to the occurrence ratio and the successful interception ratio; an assessment period is provided, during which the occurrence ratio and the successful interception ratio of the network attack type are analyzed by the threat assessment algorithm, and the threat level coefficient of the corresponding network attack type is updated.

[0052] It should be further explained that, in the specific implementation process, the process of analyzing and processing the obtained similarity data and the corresponding threat level coefficient to obtain the threat comprehensive data includes:

[0053] The similarity data obtained by comparing the intrusion analysis data with the corresponding feature data are sorted in descending order, and the top N corresponding feature data are obtained according to the sorting result. The obtained feature data are input into the deep learning model, and the predicted network attack type of the corresponding feature data is obtained through deep learning model analysis and processing;

[0054] The intrusion analysis module obtains similarity data and threat level coefficients of feature data corresponding to the predicted network attack type, wherein corresponding weight factors are set for the similarity data and threat level coefficient respectively; obtains the corresponding threat level coefficient according to the predicted network attack type, multiplies the similarity data and threat level coefficient corresponding to the predicted network attack type by the corresponding weight factors respectively, performs addition operation on the obtained products, and records the obtained results as threat comprehensive data.

[0055] It should be further explained that, in the specific implementation process, the process of setting the threat level interval, obtaining the predicted threat level according to the threat level interval to which the threat comprehensive data belongs, setting the visual display according to the predicted threat level, and the corresponding staff taking corresponding measures includes:

[0056] The intrusion analysis module is provided with threat level intervals, which are respectively a normal data interval, an abnormal data interval, a threat interval and a severe threat interval. The threat levels are set to level 1, level 2, level 3 and level 4 from low to high according to the threat level intervals; the threat comprehensive data obtained by the corresponding network node is compared with the threat level interval, the corresponding threat level interval to which the corresponding threat comprehensive data belongs is obtained, the predicted threat level is judged according to the threat level interval to which it belongs, and prediction information is generated, the prediction information includes the corresponding network node location, intrusion analysis data and predicted threat level included in the warning information;

[0057] The intrusion analysis module is provided with an operation status monitoring diagram of all network nodes, and the operation status monitoring diagram is visually displayed according to the predicted threat level of the corresponding network node; green, yellow, orange and red are set to correspond to threat levels one, two, three and four respectively; the color of the corresponding network node in the operation status monitoring diagram is set according to the predicted threat level, and the staff obtains the prediction information of the corresponding network node according to the visual display of the operation status monitoring diagram, so as to process the network node in time.

[0058] The above embodiments are only used to illustrate the technical method of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. A network security attack type and threat level prediction method based on machine learning, characterized in that: The following steps are involved: Step S1: Setting an intrusion detection module, detecting the network traffic data, network operation data and system log data of the network through the intrusion detection module, and obtaining intrusion analysis data; Step S2: Setting an intrusion analysis module, obtaining historical intrusion analysis data and corresponding network attack types, and obtaining feature data of historical intrusion analysis data corresponding to different types of network attack types; Step S3: setting the obtained feature data as a training set and a validation set, training them through a deep learning algorithm, and obtaining a deep learning model for identifying network attack types; Step S4: Analyze and process the obtained intrusion analysis data to obtain a real-time dynamic curve, and compare and analyze the obtained real-time dynamic curve with the characteristic data corresponding to each network attack type to obtain corresponding similarity data; Step S5: setting a threat level coefficient according to the threat level of the corresponding network attack type; analyzing and processing the obtained similarity data and the corresponding threat level coefficient to obtain comprehensive threat data; Step S6: Setting the threat level interval, obtaining the predicted threat level according to the threat level interval to which the threat comprehensive data belongs, setting a visual display according to the predicted threat level, and having corresponding staff take corresponding measures.

2. The method for predicting network security attack types and threat levels based on machine learning according to claim 1, characterized in that: The process of setting up an intrusion detection module, detecting the network traffic data, network operation data and system log data of the network through the intrusion detection module, and obtaining intrusion analysis data includes: An intrusion detection module is provided, wherein the intrusion detection module monitors the network operation status in real time and obtains intrusion analysis data corresponding to the network operation status; The intrusion monitoring system stores network nodes that analyze and process data information of the network, and monitors the data during the operation of each network node; the intrusion monitoring system sets corresponding data monitoring cycles according to different data information types, and obtains network traffic data, network operation data and system log data within the corresponding data monitoring cycle; the system log data includes the corresponding abnormal logins and the number of abnormal data.

3. The method for predicting network security attack types and threat levels based on machine learning according to claim 2, characterized in that: The process of setting up an intrusion analysis module, obtaining historical intrusion analysis data and corresponding network attack types, and obtaining feature data of historical intrusion analysis data corresponding to different types of network attack types includes: An intrusion analysis module is set up, in which historical intrusion analysis data of corresponding network nodes are stored, wherein the historical intrusion analysis data include historical network traffic data, historical network operation data and historical system log data corresponding to different network attack types. The historical intrusion analysis data of corresponding network attack types are analyzed and processed through feature engineering to obtain dynamic curves and abnormal threshold data of historical network traffic data, historical network operation data and historical system log data under corresponding network attack types, and the obtained dynamic curves and abnormal threshold data are respectively set as corresponding feature data.

4. The method for predicting network security attack types and threat levels based on machine learning according to claim 3 is characterized in that: The process of setting the obtained feature data as a training set and a validation set, training the obtained feature data through a deep learning algorithm, and obtaining a deep learning model for identifying network attack types includes: The obtained feature data and their corresponding network attack types are set as training set and validation set respectively, and the obtained feature data are input into the deep learning model for analysis and training to obtain the predicted attack type output by the corresponding feature data; the feature data corresponding to the validation set is input into the deep learning model to output the corresponding predicted attack type, and the obtained predicted attack type is compared with the corresponding network attack type in the validation set to obtain the matching consistency rate between the predicted attack type and the network attack type corresponding to the feature data in the validation set, and a matching consistency rate threshold is set. When the matching consistency rate is greater than the matching consistency rate threshold, the training of the deep learning model is completed.

5. The method for predicting network security attack types and threat levels based on machine learning according to claim 4 is characterized in that: The process of analyzing and processing the obtained intrusion analysis data to obtain a real-time dynamic curve, comparing and analyzing the obtained real-time dynamic curve with the characteristic data corresponding to each network attack type, and obtaining the corresponding similarity data: Obtain network traffic data, network operation data and system log data within each data monitoring period; obtain the real-time dynamic curve of the corresponding intrusion analysis data according to the data monitoring period, compare the obtained real-time dynamic curve with the dynamic curve in the characteristic data to obtain dynamic similarity; obtain network traffic data, network operation data and system log data within the data monitoring period and compare them with the abnormal data threshold in the characteristic data corresponding to the network attack type; Get the data with the smallest threshold value of abnormal data, get the difference between the two, and set the threshold similarity according to the difference between the two; The intrusion analysis module is provided with a proportion coefficient for the obtained dynamic similarity and threshold similarity, and the obtained dynamic similarity and threshold similarity are multiplied by the corresponding proportion coefficient, and the obtained products are added to obtain the corresponding similarity data.

6. The method for predicting network security attack types and threat levels based on machine learning according to claim 5, characterized in that: The process of setting the threat level coefficient according to the threat level of the corresponding network attack type includes: The intrusion analysis module is provided with a threat assessment algorithm, which is used to obtain the occurrence ratio and successful interception ratio of the corresponding network attack type in the network, and set the threat level coefficient of the corresponding network attack type according to the occurrence ratio and the successful interception ratio; an assessment period is provided, during which the occurrence ratio and the successful interception ratio of the network attack type are analyzed by the threat assessment algorithm, and the threat level coefficient of the corresponding network attack type is updated.

7. The method for predicting network security attack types and threat levels based on machine learning according to claim 6, characterized in that: The process of analyzing and processing the obtained similarity data and the corresponding threat level coefficient to obtain comprehensive threat data includes: The similarity data obtained by comparing the intrusion analysis data with the corresponding feature data are sorted in descending order, and the top N corresponding feature data are obtained according to the sorting result. The obtained feature data are input into the deep learning model, and the predicted network attack type of the corresponding feature data is obtained through deep learning model analysis and processing; The intrusion analysis module obtains similarity data and threat level coefficients of feature data corresponding to the predicted network attack type, wherein corresponding weight factors are set for the similarity data and threat level coefficient respectively; obtains the corresponding threat level coefficient according to the predicted network attack type, multiplies the similarity data and threat level coefficient corresponding to the predicted network attack type by the corresponding weight factors respectively, performs addition operation on the obtained products, and records the obtained results as threat comprehensive data.

8. The method for predicting network security attack types and threat levels based on machine learning according to claim 7, characterized in that: The process of setting the threat level interval, obtaining the predicted threat level according to the threat level interval to which the threat comprehensive data belongs, setting the visual display according to the predicted threat level, and having the corresponding staff take corresponding measures includes: The intrusion analysis module is provided with threat level intervals, which are respectively a normal data interval, an abnormal data interval, a threat interval and a severe threat interval. The threat levels are set to level 1, level 2, level 3 and level 4 from low to high according to the threat level intervals; the threat comprehensive data obtained by the corresponding network node is compared with the threat level interval, the corresponding threat level interval to which the corresponding threat comprehensive data belongs is obtained, the predicted threat level is judged according to the threat level interval to which it belongs, and prediction information is generated, the prediction information includes the corresponding network node location, intrusion analysis data and predicted threat level included in the warning information; The intrusion analysis module is provided with an operation status monitoring diagram of all network nodes, and the operation status monitoring diagram is visually displayed according to the predicted threat level of the corresponding network node; green, yellow, orange and red are set to correspond to threat levels one, two, three and four respectively; the color of the corresponding network node in the operation status monitoring diagram is set according to the predicted threat level, and the staff obtains the prediction information of the corresponding network node according to the visual display of the operation status monitoring diagram, so as to process the network node in time.

Images