Network security situation awareness system supported by computer technology

Abstract

The invention discloses a network security situation awareness system supported by computer technology, and relates to the technical field of network security, the network security situation awareness system comprises a data acquisition module, a quality evaluation module, a threat analysis module, a situation prediction module, an interaction analysis module and a system management module, the method has the advantages that the accuracy, integrity, timeliness and correlation of the data are comprehensively evaluated by establishing a dynamic data quality evaluation index system, and the data acquisition and processing frequency is adjusted according to the evaluation result, so that the data quality and the response speed of the system are improved, and the system is ensured to be capable of accurately evaluating the data quality according to the change of the data quality. The data processing flow is flexibly optimized, and the accuracy and timeliness of the data are improved, so that the overall network security situation awareness effect is enhanced.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security situation awareness system supported by computer technology. Background Art

[0002] With the rapid development of computer technology, network security issues have become increasingly prominent, and network attack methods have been constantly updated, posing a huge threat to the information security of enterprises and individuals. Traditional network security protection methods often focus on static defense, such as firewalls, intrusion detection systems, etc. These methods are often difficult to respond to new network attacks in a timely and effective manner;

[0003] In the current network security situation, data collection and processing are the basis for building a security defense system. However, the data sources in the network are wide, the data types are diverse, and the data quality is uneven, which brings great challenges to the accurate perception of network security situation. If the data quality is not high, it will lead to a decrease in the accuracy of security analysis results and may even mislead security decisions. For this reason, we propose a network security situation awareness system supported by computer technology. Summary of the invention

[0004] The purpose of the present invention is to provide a network security situation awareness system supported by computer technology.

[0005] In order to solve the problems raised in the above background technology, the present invention provides the following technical solutions: a network security situation awareness system supported by computer technology, comprising the following modules:

[0006] The data collection module is responsible for collecting network security data from various data sources in the network and includes a verification mechanism to ensure the legitimacy of the data source;

[0007] The quality assessment module establishes a dynamic data quality assessment indicator system to assess the quality of data collected by the data acquisition module;

[0008] Threat analysis module, which builds threat rule database and normal network behavior model, and uses statistical analysis method to judge the network behavior status;

[0009] Situation prediction module: analyzes historical network security data, builds a situation prediction model, integrates real-time data into the model, updates model parameters, and triggers warning information based on analysis results;

[0010] Interaction analysis module, which analyzes user interaction behaviors and system-to-system interaction behaviors and evaluates the effectiveness of security policies;

[0011] System management module manages user data and system parameters, and records system operation log data.

[0012] As a further solution of the present invention: in the data acquisition module, the network security data includes network traffic data, log file data and device vulnerability data. The data acquisition module includes a data encryption and verification unit. The data encryption and verification unit is used to encrypt the data in real time and verify the legitimacy of the data source. The legitimacy of the data source is verified using digital certificate technology.

[0013] As a further solution of the present invention: the quality assessment module includes a comprehensive quality assessment unit, which is used to comprehensively assess the accuracy, completeness, timeliness and relevance of data quality. The specific formula is as follows:

[0014] Q=ω1·A+ω2·C+ω3·T+ω4·R

[0015] Among them, Q represents the comprehensive score of data quality, A represents the accuracy score of data quality, C represents the integrity score of data quality, T represents the timeliness score of data quality, R represents the relevance score of data quality, the value range of A, C, T, and R is 0-1, ω1, ω2, ω3, and ω4 represent the weight coefficients of weights A, C, T, and R respectively, ω1:ω2:ω3:ω4=4:3:2:1, ω1+ω2+ω3+ω4=1, A is obtained according to the proportion of data that conforms to the actual situation, C is obtained according to the proportion of data completeness to all data that should be collected, T is obtained through the interval between data generation time and current time, and R is obtained according to the degree of correlation between data and current security events. When Q≥0.8, it is evaluated as high-quality data and the data is transmitted to subsequent modules. When 0.4≤Q<0.8, it is evaluated as medium-quality data and the corresponding repair process is executed according to the data problem. When Q≤0.4, it is evaluated as low-quality data and the data is isolated. The data acquisition equipment is detected and repaired and the data is collected again.

[0016] As a further solution of the present invention: the quality assessment module further includes a data acquisition and processing frequency adjustment unit, which is used to adjust the data acquisition and processing frequency according to the data quality comprehensive assessment score Q. The specific formula is as follows:

[0017] P1=P0·0.8+k·Q

[0018] Among them, k is the adjustment coefficient, P1 is the adjusted data acquisition and processing frequency, P0 is the preset data acquisition and processing frequency, and the larger the Q value, the faster the frequency of data acquisition and processing.

[0019] As a further solution of the present invention: the threat analysis module includes a rule construction unit, a model construction unit and a statistical analysis unit. The rule construction unit is used to collect network threats known to the industry, construct threat detection rules, and collect the latest security threat intelligence every 15 days to update the threat detection rules. The model construction unit is used to construct a normal network behavior model. The specific method of model construction is to collect high-quality data on network traffic size and user operation behavior in the quality assessment module, and use the mean and standard deviation method to construct a traffic size model. The mean is set in a way that the network traffic size data is grouped every hour, and the probability distribution fitting method is used to construct a user operation behavior model. The statistical analysis unit is used to perform statistical analysis on network traffic data and user behavior, and compare them with the normal network behavior model to determine the abnormal network behavior state.

[0020] As a further solution of the present invention: the situation prediction module includes a historical data processing unit, a situation prediction model construction unit, a data fusion unit and an early warning unit. The historical data processing unit is used to classify and organize the collected historical data, and use association rule mining technology to mine the laws and trends of security incidents. The situation prediction model construction unit is used to extract features for situation prediction from historical data and real-time data, and construct a situation prediction model based on a convolutional neural network. The data fusion unit is used to receive high-quality data evaluated by a quality assessment module in real time, and integrate the characteristic values ​​of the data into the parameter update process of the situation prediction model. The early warning unit is used to trigger early warning information according to the prediction results of the situation prediction model.

[0021] As a further solution of the present invention: the warning unit is provided with four warning levels: level one warning, level two warning, level three warning and level four warning. The warning level is determined by a formula, and the specific formula is as follows:

[0022]

[0023] Among them, R represents the risk score, S represents the severity score, I represents the impact score, and P represents the probability score, S∈[1,2,3], I∈[1,2,3], P∈[1,2,3], represents the weight, and W represents the threat intelligence coefficient, H represents the historical data coefficient, and D represents the time sensitivity coefficient. The value ranges of W, H, and D are all 0-1. and Represent the weights of threat intelligence coefficient and historical data coefficient respectively, represents the weight of the time-sensitive coefficient, When R≥4, a first-level warning is triggered, the emergency response mechanism is activated, and a professional team is organized to carry out emergency disposal. When 3≤R<4, a second-level warning is triggered, network security monitoring is strengthened, and the system is backed up. When 2≤R<3, a third-level warning is triggered to improve the network security protection level. When R<2, a fourth-level warning is triggered, and a warning notification is issued to remind relevant personnel.

[0024] As a further solution of the present invention: the interaction analysis module includes a user interaction analysis unit, a system interaction analysis unit and a security policy evaluation unit. The user interaction analysis unit is used to collect the user's historical operation behavior data, the system interaction analysis unit is used to analyze the communication protocol between systems in the network and the traffic pattern of the interaction between systems, and the security policy evaluation unit is used to verify the effectiveness of the security policy by simulating attacks, vulnerability scanning and actual security incident handling.

[0025] As a further solution of the present invention: the system management module includes a user management unit, a configuration management unit and a log management unit. The user management unit is used to create and delete user accounts, store user account data, and allocate different system function permissions and data access permissions according to the user's role and responsibilities. The user management unit will monitor the user's operation speed within ten minutes in real time. If the error value between the user's operation speed within ten minutes and the monthly average operation speed reaches 50%, additional face verification will be performed. The configuration management unit is used to set and adjust various parameters of the system, and back up the system configuration file every week and verify the integrity of the system. The log management unit is used to collect and store the operation logs generated by each module of the system, and use log data anonymization technology to anonymize sensitive fields in the log. Using the above technical solution, compared with the prior art, the beneficial effects of the present invention are:

[0026] 1. The present invention establishes a dynamic data quality assessment index system to comprehensively assess the accuracy, completeness, timeliness and relevance of data, and adjusts the frequency of data collection and processing according to the assessment results, thereby improving the quality of data and the response speed of the system, ensuring that the system can flexibly optimize the data processing process according to changes in data quality, improve the accuracy and timeliness of data, and thus enhance the overall network security situation awareness effect;

[0027] 2. The present invention combines the threat analysis module and the situation prediction module to construct a comprehensive threat detection rule and situation prediction model, and dynamically updates it according to real-time data, so as to timely identify potential network threats and trigger different levels of early warning responses according to risk scores, so as to ensure that when a network security incident occurs, corresponding emergency measures can be taken quickly to effectively reduce losses;

[0028] 3. The present invention can evaluate the effectiveness of security policies by deeply analyzing user interaction behaviors and system interaction behaviors in the interaction analysis module, so that the system can continuously optimize and adjust security policies, improve defense capabilities, reduce the probability of security incidents, and thus improve the overall security of the network environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 Schematic diagram of the perception system flow in an embodiment of the present invention. DETAILED DESCRIPTION

[0030] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0031] Embodiment 1:

[0032] Please see attached Figure 1 The present invention provides a network security situation awareness system supported by computer technology, comprising the following modules:

[0033] The data collection module is responsible for collecting network security data from various data sources in the network and includes a verification mechanism to ensure the legitimacy of the data source;

[0034] The quality assessment module establishes a dynamic data quality assessment indicator system to assess the quality of data collected by the data acquisition module;

[0035] Threat analysis module, which builds threat rule database and normal network behavior model, and uses statistical analysis method to judge the network behavior status;

[0036] Situation prediction module: analyzes historical network security data, builds a situation prediction model, integrates real-time data into the model, updates model parameters, and triggers warning information based on analysis results;

[0037] Interaction analysis module, which analyzes user interaction behaviors and system-to-system interaction behaviors and evaluates the effectiveness of security policies;

[0038] System management module, manages user data and system parameters, and records system operation log data;

[0039] In the data collection module, network security data includes network traffic data, log file data and device vulnerability data. The data collection module includes a data encryption and verification unit, which is used to encrypt data in real time and verify the legitimacy of the data source. The digital certificate technology is used to verify the legitimacy of the data source.

[0040] The quality assessment module includes a comprehensive quality assessment unit, which is used to comprehensively assess the accuracy, completeness, timeliness and relevance of data quality. The specific formula is as follows:

[0041] Q=ω1·A+ω2·C+ω3·T+ω4·R

[0042] Wherein, Q represents the comprehensive score of data quality, A represents the accuracy score of data quality, C represents the integrity score of data quality, T represents the timeliness score of data quality, R represents the relevance score of data quality, the value range of A, C, T, and R is 0-1, ω1, ω2, ω3, and ω4 represent the weight coefficients of weights A, C, T, and R respectively, ω1:ω2:ω3:ω4=4:3:2:1, ω1+ω2+ω3+ω4=1, A is obtained according to the proportion of data that conforms to the actual situation, C is obtained according to the proportion of data completeness to all data that should be collected, T is obtained through the interval between the data generation time and the current time, and R is obtained according to the degree of correlation between the data and the current security event. When Q≥0.8, it is evaluated as high-quality data and the data is transmitted to the subsequent modules. When 0.4≤Q<0.8, it is evaluated as medium-quality data and the corresponding repair process is executed according to the data problem. When Q≤0.4, it is evaluated as low-quality data and the data is isolated, the data collection equipment is detected and repaired, and the data is collected again.

[0043] The quality assessment module also includes a data collection and processing frequency adjustment unit, which is used to adjust the data collection and processing frequency according to the data quality comprehensive assessment score Q. The specific formula is as follows:

[0044] P1=P0·0.8+k·Q

[0045] Among them, k is the adjustment coefficient, P1 is the adjusted data acquisition and processing frequency, P0 is the preset data acquisition and processing frequency, and the larger the Q value, the faster the frequency of data acquisition and processing.

[0046] Specific workflow: In the network security protection of a large enterprise, we use the dynamic data quality evaluation index system of this system. Taking the server log data of the enterprise's internal network as an example, in terms of accuracy, if the error rate of the log record is less than 5%, the accuracy score A = 0.9, in terms of completeness, if the completeness of the key information to be collected reaches 90%, C = 0.9, in terms of timeliness, if the interval from data generation to processing is within 10 minutes, T = 0.9, in terms of relevance, if it is highly correlated with the current security audit, R = 0.8, assuming that the weight coefficients are 0.4, 0.3, 0.2, and 0.1 respectively, the comprehensive score Q = 0.88, which is judged to be high-quality data. At the same time, the adjustment coefficient k is calculated according to the formula to increase the frequency of data collection and processing by 30%. After a week of operation, it is found that due to the improvement of data quality, the accuracy of the system's network attack detection has increased from the original 80% to 92%, and the average response time has been reduced from 5 seconds to 3 seconds.

[0047] Furthermore, by establishing a dynamic data quality assessment indicator system, a comprehensive assessment of the accuracy, completeness, timeliness and relevance of the data is conducted, and the data collection and processing frequency is adjusted according to the assessment results, thereby improving the data quality and the system's response speed, ensuring that the system can flexibly optimize the data processing process according to changes in data quality, improve the accuracy and timeliness of the data, and thus enhance the overall network security situation awareness effect.

[0048] Embodiment 2:

[0049] Based on the first embodiment, the threat analysis module includes a rule construction unit, a model construction unit and a statistical analysis unit. The rule construction unit is used to collect network threats known to the industry, construct threat detection rules, and collect the latest security threat intelligence every 15 days to update the threat detection rules. The model construction unit is used to construct a normal network behavior model. The specific method of model construction is to collect high-quality data on network traffic size and user operation behavior in the quality assessment module, and use the mean and standard deviation method to construct a traffic size model. The mean setting method is to group the network traffic size data according to each hour, and use the probability distribution fitting method to construct a user operation behavior model. The statistical analysis unit is used to perform statistical analysis on network traffic data and user behavior, and compare them with the normal network behavior model to determine the abnormal network behavior state;

[0050] The situation prediction module includes a historical data processing unit, a situation prediction model construction unit, a data fusion unit and an early warning unit. The historical data processing unit is used to classify and organize the collected historical data, and use association rule mining technology to mine the laws and trends of security incidents. The situation prediction model construction unit is used to extract features for situation prediction from historical data and real-time data, and build a situation prediction model based on a convolutional neural network. The data fusion unit is used to receive high-quality data evaluated by the quality assessment module in real time, and integrate the feature values ​​of the data into the parameter update process of the situation prediction model. The early warning unit is used to trigger early warning information according to the prediction results of the situation prediction model;

[0051] The warning unit has four warning levels: level 1 warning, level 2 warning, level 3 warning and level 4 warning. The warning level is determined by a formula. The specific formula is as follows:

[0052]

[0053] Among them, R represents the risk score, S represents the severity score, I represents the impact score, and P represents the probability score, S∈[1,2,3], I∈[1,2,3], P∈[1,2,3], represents the weight, and W represents the threat intelligence coefficient, H represents the historical data coefficient, and D represents the time sensitivity coefficient. The value ranges of W, H, and D are all 0-1. and Represent the weights of threat intelligence coefficient and historical data coefficient respectively, represents the weight of the time-sensitive coefficient, When R≥4, a first-level warning is triggered, the emergency response mechanism is activated, and a professional team is organized to carry out emergency disposal. When 3≤R<4, a second-level warning is triggered, network security monitoring is strengthened, and the system is backed up. When 2≤R<3, a third-level warning is triggered to improve the network security protection level. When R<2, a fourth-level warning is triggered, and a warning notification is issued to remind relevant personnel.

[0054] Specific workflow: In the network of a certain financial institution, the threat analysis module collects about 200 industry threat information update rules every month. From the high-quality network traffic data obtained by the quality assessment module, it is analyzed that the average normal traffic size is 100Mbps and the standard deviation is 10Mbps. When it is detected that the network traffic of a branch suddenly reaches 150Mbps and does not conform to the user operation behavior model, it is judged as abnormal. The situation prediction model combines historical data and real-time data. For example, 3 of the 5 similar traffic anomalies in the past year were attacks. The possibility of this threat is predicted. In the risk score calculation, the severity score S=3 (involving fund transactions), the impact range score I=3 (multiple departments), and the probability score P=3 (based on the model). Combined with the threat intelligence coefficient, etc., a level 1 warning is triggered. The emergency team responded within 10 minutes and successfully prevented an attack that could cause losses.

[0055] Furthermore, by combining the threat analysis module and the situation prediction module, we build comprehensive threat detection rules and situation prediction models, and dynamically update them based on real-time data. This allows us to identify potential network threats in a timely manner and trigger different levels of early warning responses based on risk scores, ensuring that when a network security incident occurs, we can quickly take appropriate emergency measures to effectively reduce losses.

[0056] Embodiment three:

[0057] Based on the second embodiment, the interaction analysis module includes a user interaction analysis unit, an inter-system interaction analysis unit and a security policy evaluation unit. The user interaction analysis unit is used to collect historical operation behavior data of users. The inter-system interaction analysis unit is used to analyze the communication protocol between systems in the network and the traffic pattern of the interaction between systems. The security policy evaluation unit is used to verify the effectiveness of the security policy by simulating attacks, vulnerability scanning and actual security incident handling methods.

[0058] The system management module includes a user management unit, a configuration management unit and a log management unit. The user management unit is used to create and delete user accounts, store user account data, and assign different system function permissions and data access permissions according to the user's role and responsibilities. The user management unit will monitor the user's operation speed in real time within ten minutes. If the error value between the user's operation speed within ten minutes and the monthly average operation speed reaches 50%, additional face verification will be performed. The configuration management unit is used to set and adjust various parameters of the system, back up the system configuration file every week and verify the integrity of the system. The log management unit is used to collect and store the operation logs generated by each module of the system, and use log data anonymization technology to anonymize sensitive fields in the log.

[0059] Specific workflow: In a network system of an e-commerce platform, the interaction analysis module collected 100,000 user login, ordering and other operation behavior data in the past month. At the same time, the communication protocol and traffic pattern of the interaction between systems were analyzed, and it was found that the peak interaction traffic between systems during peak periods was 500Mbps. In a simulated attack test, it was found that there were 3 exploitable vulnerabilities under the original security policy. After evaluating the effectiveness of the security policy through interactive analysis, the access control policy was adjusted, such as limiting the number of logins from the same IP. After that, the attack was simulated again, and it was found that the exploitable vulnerabilities were reduced to 0. After one month of actual operation, the incidence of security incidents was reduced from 5% to 1%, which effectively improved the overall security of the network and protected user information and transaction security.

[0060] Furthermore, by conducting in-depth analysis of user interaction behaviors and system-to-system interaction behaviors in the interaction analysis module, the effectiveness of security policies can be evaluated, allowing the system to continuously optimize and adjust security policies, improve defense capabilities, reduce the probability of security incidents, and thereby improve the overall security of the network environment.

[0061] The above shows and describes the basic principles, main features and advantages of the present invention. It should be understood by those skilled in the art that the present invention is not limited to the above embodiments. The above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention to be protected. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A network security situation awareness system supported by computer technology, characterized in that: Includes the following modules: The data collection module is responsible for collecting network security data from various data sources in the network and includes a verification mechanism to ensure the legitimacy of the data source; The quality assessment module establishes a dynamic data quality assessment indicator system to assess the quality of data collected by the data acquisition module; Threat analysis module, which builds threat rule database and normal network behavior model, and uses statistical analysis method to judge the network behavior status; Situation prediction module: analyzes historical network security data, builds a situation prediction model, integrates real-time data into the model, updates model parameters, and triggers warning information based on analysis results; Interaction analysis module, which analyzes user interaction behaviors and system-to-system interaction behaviors and evaluates the effectiveness of security policies; System management module manages user data and system parameters, and records system operation log data.

2. According to the computer technology-supported network security situation awareness system of claim 1, it is characterized by: In the data acquisition module, network security data includes network traffic data, log file data and device vulnerability data. The data acquisition module includes a data encryption and verification unit, which is used to encrypt data in real time and verify the legitimacy of the data source. The legitimacy of the data source is verified using digital certificate technology.

3. According to the computer technology-supported network security situation awareness system of claim 1, it is characterized by: The quality assessment module includes a comprehensive quality assessment unit, which is used to comprehensively assess the accuracy, completeness, timeliness and relevance of data quality. The specific formula is as follows: Q=ω1·A+ω2·C+ω3·T+ω4·R Among them, Q represents the comprehensive score of data quality, A represents the accuracy score of data quality, C represents the integrity score of data quality, T represents the timeliness score of data quality, R represents the relevance score of data quality, the value range of A, C, T, and R is 0-1, ω1, ω2, ω3, and ω4 represent the weight coefficients of weights A, C, T, and R respectively, ω1:ω2:ω3:ω4=4:3:2:1, ω1+ω2+ω3+ω4=1, A is obtained according to the proportion of data that conforms to the actual situation, C is obtained according to the proportion of data completeness to all data that should be collected, T is obtained through the interval between data generation time and current time, and R is obtained according to the degree of correlation between data and current security events. When Q≥0.8, it is evaluated as high-quality data and the data is transmitted to subsequent modules. When 0.4≤Q<0.8, it is evaluated as medium-quality data and the corresponding repair process is executed according to the data problem. When Q≤0.4, it is evaluated as low-quality data and the data is isolated. The data acquisition equipment is detected and repaired and the data is collected again.

4. A network security situation awareness system supported by computer technology according to claim 3, characterized in that: The quality assessment module further includes a data acquisition and processing frequency adjustment unit, which is used to adjust the data acquisition and processing frequency according to the data quality comprehensive assessment score Q. The specific formula is as follows: P1=P0·(0.8+k·Q) Among them, k is the adjustment coefficient, P1 is the adjusted data acquisition and processing frequency, P0 is the preset data acquisition and processing frequency, and the larger the Q value, the faster the frequency of data acquisition and processing.

5. The network security situation awareness system supported by computer technology according to claim 3 is characterized by: The threat analysis module includes a rule construction unit, a model construction unit and a statistical analysis unit. The rule construction unit is used to collect network threats known to the industry, construct threat detection rules, and collect the latest security threat intelligence every 15 days to update the threat detection rules. The model construction unit is used to construct a normal network behavior model. The specific method of model construction is to collect high-quality data on network traffic size and user operation behavior in the quality assessment module, and use the mean and standard deviation method to construct a traffic size model. The mean is set in a way that the network traffic size data is grouped every hour, and the probability distribution fitting method is used to construct a user operation behavior model. The statistical analysis unit is used to perform statistical analysis on network traffic data and user behavior, and compare them with the normal network behavior model to determine the abnormal network behavior state.

6. The network security situation awareness system supported by computer technology according to claim 3 is characterized by: The situation prediction module includes a historical data processing unit, a situation prediction model construction unit, a data fusion unit and an early warning unit. The historical data processing unit is used to classify and organize the collected historical data, and use association rule mining technology to mine the laws and trends of security incidents. The situation prediction model construction unit is used to extract features for situation prediction from historical data and real-time data, and build a situation prediction model based on a convolutional neural network. The data fusion unit is used to receive high-quality data evaluated by a quality assessment module in real time, and integrate the characteristic values ​​of the data into the parameter update process of the situation prediction model. The early warning unit is used to trigger early warning information according to the prediction results of the situation prediction model.

7. The network security situation awareness system supported by computer technology according to claim 1 is characterized by: The warning unit is provided with four warning levels: level one warning, level two warning, level three warning and level four warning. The warning level is determined by a formula, and the specific formula is as follows: Among them, R represents the risk score, S represents the severity score, I represents the impact score, and P represents the probability score, S∈[1,2,3], I∈[1,2,3], P∈[1,2,3], represents the weight, and W represents the threat intelligence coefficient, H represents the historical data coefficient, and D represents the time sensitivity coefficient. The value ranges of W, H, and D are all 0-1. and Represent the weights of threat intelligence coefficient and historical data coefficient respectively, represents the weight of the time-sensitive coefficient, When R≥4, a first-level warning is triggered, the emergency response mechanism is activated, and a professional team is organized to carry out emergency disposal. When 3≤R<4, a second-level warning is triggered, network security monitoring is strengthened, and the system is backed up. When 2≤R<3, a third-level warning is triggered to improve the network security protection level. When R<2, a fourth-level warning is triggered, and a warning notification is issued to remind relevant personnel.

8. The network security situation awareness system supported by computer technology according to claim 1 is characterized by: The interaction analysis module includes a user interaction analysis unit, an inter-system interaction analysis unit and a security policy evaluation unit. The user interaction analysis unit is used to collect the user's historical operation behavior data. The inter-system interaction analysis unit is used to analyze the communication protocol between systems in the network and the traffic pattern of the interaction between systems. The security policy evaluation unit is used to verify the effectiveness of the security policy by simulating attacks, vulnerability scanning and actual security incident handling.

9. The network security situation awareness system supported by computer technology according to claim 1 is characterized by: The system management module includes a user management unit, a configuration management unit and a log management unit. The user management unit is used to create and delete user accounts, store user account data, and allocate different system function permissions and data access permissions according to the user's role and responsibilities. The user management unit will monitor the user's operation speed within ten minutes in real time. If the error value between the user's operation speed within ten minutes and the monthly average operation speed reaches 50%, additional face verification will be performed. The configuration management unit is used to set and adjust various parameters of the system, and back up the system configuration file every week and verify the integrity of the system. The log management unit is used to collect and store the operation logs generated by each module of the system, and use log data anonymization technology to anonymize sensitive fields in the log.

Images