Automatic internet security event response system
By introducing traffic monitoring, feature dimensionality reduction, resource monitoring and security prediction modules into the Internet security incident response system, the problems of high false alarm rate, high false alarm rate and undynamic response strategies in the existing systems are solved, and more efficient and reliable security incident response is achieved.
Patent Information
- Application Number
- CN202411692571.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-25
- Publication Date
- 2025-03-25
AI Technical Summary
When the existing Internet security incident response system detects data transmission, the false alarm rate is high and the missed alarm rate is high, and the response strategy is difficult to dynamically adapt to the changes in the attacker's strategy, resulting in system instability.
An automated Internet security incident response system is designed to monitor traffic transmission data in real time through the traffic monitoring module, and the transmission threat determination module performs feature dimensionality reduction and threat identification of data. The resource monitoring module monitors application resources and performs data aggregation. The security response module conducts security prediction and response based on threat degree and popular data domains.
Through feature dimensionality reduction, improve threat identification efficiency, reduce false alarms and missed response rates, combine resource monitoring data to improve the pertinence and dynamic nature of response strategies, and enhance the safety and reliability of the system.
Smart Images
Figure CN119696833A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the technical field of security response, and more specifically, to an automated Internet security incident response system. Background Art
[0002] Automated Internet security incident response is a mechanism that uses technical means to quickly detect, analyze, and respond to Internet security threats. It dynamically analyzes potential security risks by real-time monitoring of network traffic, logs, and system status, combined with machine learning algorithms and threat intelligence libraries, and automatically executes response operations based on preset security policies, such as traffic restrictions, abnormal access blocking, or critical service isolation. The core goal of the response system is to shorten the incident response time and reduce the need for human intervention, thereby reducing the workload of the security team, while maximizing the protection of system continuity and data security.
[0003] In the existing technology, although modern threat detection algorithms can significantly improve detection capabilities, false positives and false negatives are still key issues. When the response system monitors traffic transmission data, the traffic transmission data is complex, large and high-dimensional, resulting in low detection accuracy and high false positives. False positives may cause unnecessary business interruptions or waste of resources, while false negatives mean that potential threats may not be discovered and handled in a timely manner. In addition, the Internet environment is changing rapidly, and attackers' strategies and tools are constantly upgraded. If the response strategy of the response system is too static, it is easy to be bypassed by attackers; if it is too dynamic, the system may be unstable due to frequent rule updates. Therefore, how to effectively combine traffic transmission data and other monitoring data to formulate efficient response strategies to improve the security and reliability of the response system is a difficult problem faced by the industry. Summary of the invention
[0004] The present application provides an automated Internet security incident response system that can effectively combine traffic transmission data and other monitoring data to formulate efficient response strategies to improve the security and reliability of the response system.
[0005] The present application provides an automated Internet security incident response system, the response system comprising: Traffic monitoring module, used to monitor the traffic transmission data of the target Internet in real time; A transmission threat determination module is used to perform feature dimension reduction on the traffic transmission data to obtain core traffic transmission data of the target Internet, perform threat identification on the transmission process of the target Internet based on the core traffic transmission data, and obtain the traffic transmission threat degree of the target Internet; A resource monitoring module is used to monitor various application resources in the target Internet, thereby obtaining resource monitoring data of the target Internet, determining relevant difference values between various application resources through the resource monitoring data, and performing data aggregation on the resource monitoring data based on all relevant difference values to obtain a hot data domain when the target Internet performs resource monitoring; The security response module is used to use the traffic transmission threat level and the hot data domain to make a security prediction, obtain the security factor of the target Internet, and control the target Internet to perform a security response according to the security factor.
[0006] In this embodiment, a network protocol analysis tool is used to monitor the traffic transmission data of the target Internet in real time.
[0007] In this embodiment, the feature dimension reduction is performed on the traffic transmission data to obtain the core traffic transmission data of the target Internet, which specifically includes: constructing a traffic correlation matrix according to the traffic transmission data; Performing eigenvalue decomposition on the flow correlation matrix to obtain a plurality of flow eigenvectors and flow eigenvalues corresponding to each flow eigenvector; Each traffic feature vector is screened according to the corresponding traffic feature value and the preset dimension to obtain multiple core traffic feature vectors; The core traffic transmission data of the target Internet is determined through all core traffic feature vectors.
[0008] In this embodiment, threat identification is performed on the transmission process of the target Internet based on the core traffic transmission data to obtain the traffic transmission threat level of the target Internet, specifically including: Determine the traffic distribution center and traffic fluctuation through the core traffic transmission data; Determining a transmission anomaly value of each data point in the core traffic transmission data according to the traffic distribution center and the traffic fluctuation degree; The traffic transmission threat level of the target Internet is determined according to the transmission anomaly values of all data points in the core traffic transmission data.
[0009] In this embodiment, Prometheus is used to monitor various application resources in the target Internet.
[0010] In this embodiment, determining the relevant difference values between various application resources through the resource monitoring data specifically includes: Obtaining monitoring data corresponding to each application resource in the resource monitoring data; Determine the data differences between various application resources based on the corresponding monitoring data; The relevant difference values between the application resources are determined based on the data differences between the application resources.
[0011] In this embodiment, the resource monitoring data is aggregated based on all relevant difference values, and the hot data domains obtained when the target Internet performs resource monitoring specifically include: Clustering each application resource using a clustering algorithm based on all relevant difference values, thereby obtaining multiple application resource classes; Extracting monitoring data corresponding to each application resource class from the resource monitoring data; Each application resource class is screened according to the corresponding monitoring data, and then the popular data domains when the target Internet is monitoring resources are obtained.
[0012] In this embodiment, each application resource class is screened according to the corresponding monitoring data, and the hot data domains obtained when the target Internet performs resource monitoring specifically include: The information entropy of each application resource class is determined according to the corresponding monitoring data, and then the monitoring data corresponding to the application resource class with the largest information entropy is used as the hot data domain when the target Internet performs resource monitoring.
[0013] In this embodiment, using the traffic transmission threat level and the hot data domain for security prediction is to input the traffic transmission threat level as a prediction weight and the hot data domain as input data into a machine learning-based model for security prediction.
[0014] In this embodiment, controlling the target Internet to perform a security response according to the security factor specifically includes: Classifying the threat level of the security incidents of the target Internet according to the security factor, thereby obtaining the threat level of the security incidents of the target Internet; A security response strategy for the target Internet is determined according to the threat level.
[0015] The technical solution provided by the embodiments disclosed in this application has the following beneficial effects: The traffic monitoring module monitors the traffic transmission data of the target Internet in real time; the transmission threat determination module performs feature dimension reduction on the traffic transmission data to obtain the core traffic transmission data of the target Internet, and identifies threats to the transmission process of the target Internet based on the core traffic transmission data to obtain the traffic transmission threat level of the target Internet; the resource monitoring module monitors various application resources in the target Internet to obtain resource monitoring data of the target Internet, determines the relevant difference values between various application resources through the resource monitoring data, and performs data aggregation on the resource monitoring data based on all the relevant difference values to obtain the popular data domain when the target Internet performs resource monitoring; the security response module uses the traffic transmission threat level and the popular data domain to perform security prediction to obtain the security factor of the target Internet, and controls the target Internet to perform security response according to the security factor.
[0016] It can be seen that in this application, firstly, redundant data can be reduced through feature dimensionality reduction, and only core features that play an important role in traffic analysis and threat identification are retained, thereby making the process of threat identification based on the reduced data more efficient, and the accuracy of threat detection can be improved based on the traffic transmission threat level, reducing the false alarm rate and missed alarm rate, and enhancing the ability to capture real attack behaviors; then, through monitoring and correlation analysis of various application resources in the target Internet, it can help identify the most critical and relevant resource data, and cluster the data through clustering algorithms and other methods, and the obtained popular data domain is the most representative resource data that best reflects the health status of the system; finally, by combining the traffic transmission threat level and the popular data domain for security prediction, the safety factor is obtained, and the system can automatically evaluate the security status of the target Internet and automatically select corresponding security response measures, thereby improving the security and reliability of the response system.
[0017] To sum up, the technical solution adopted in this application can effectively combine traffic transmission data and other monitoring data to formulate an efficient response strategy to improve the security and reliability of the response system. BRIEF DESCRIPTION OF THE DRAWINGS
[0018] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.
[0019] Figure 1 It is a module structure diagram of an automated Internet security incident response system provided according to the present application; Figure 2It is a schematic diagram of a flow chart for determining the traffic transmission threat level of a target Internet according to the present application; Figure 3 It is a flowchart of determining hot data domains when monitoring resources on the target Internet according to the application. DETAILED DESCRIPTION
[0020] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0021] The embodiment of the present application provides an automated Internet security incident response system, the core of which is to monitor the traffic transmission data of the target Internet in real time through a traffic monitoring module; the transmission threat determination module performs feature dimension reduction on the traffic transmission data to obtain the core traffic transmission data of the target Internet, and identifies threats to the transmission process of the target Internet based on the core traffic transmission data to obtain the traffic transmission threat degree of the target Internet; the resource monitoring module monitors various application resources in the target Internet to obtain the resource monitoring data of the target Internet, determines the relevant difference values between various application resources through the resource monitoring data, and performs data aggregation on the resource monitoring data based on all relevant difference values to obtain the hot data domain when the target Internet performs resource monitoring; the security response module uses the traffic transmission threat degree and the hot data domain to perform security prediction, obtains the safety factor of the target Internet, and controls the target Internet to perform security response according to the safety factor. The present application adopts the above-mentioned technical solution to effectively combine traffic transmission data and other monitoring data to formulate an efficient response strategy to improve the security and reliability of the response system.
[0022] In order to better understand the above technical solution, the above technical solution will be described in detail below in conjunction with the accompanying drawings and specific implementation methods. Figure 1 As shown, this figure is a module structure diagram of an automated Internet security incident response system according to this embodiment of the present application. The response system includes: a traffic monitoring module 100, a transmission threat determination module 200, a resource monitoring module 300 and a security response module 400, which are described as follows: The traffic monitoring module 100 is used to monitor the traffic transmission data of the target Internet in real time.
[0023] In the specific implementation, a network protocol analysis tool is used to monitor the traffic transmission data of the target Internet in real time. It should be noted that the network protocol analysis tool is a powerful network traffic monitoring tool that can capture and analyze network data packets in real time to help identify potential security threats or performance issues. When monitoring the traffic transmission of the target Internet in real time, the traffic transmission data of the target Internet can be obtained through the network protocol analysis tool.
[0024] The transmission threat determination module 200 is used to perform feature dimension reduction on the traffic transmission data to obtain the core traffic transmission data of the target Internet, identify threats to the transmission process of the target Internet based on the core traffic transmission data, and obtain the traffic transmission threat level of the target Internet.
[0025] In this embodiment, the feature dimension reduction is performed on the traffic transmission data to obtain the core traffic transmission data of the target Internet, which can be specifically performed in the following manner, namely: constructing a traffic correlation matrix according to the traffic transmission data; Performing eigenvalue decomposition on the flow correlation matrix to obtain a plurality of flow eigenvectors and flow eigenvalues corresponding to each flow eigenvector; Each traffic feature vector is screened according to the corresponding traffic feature value and the preset dimension to obtain multiple core traffic feature vectors; The core traffic transmission data of the target Internet is determined through all core traffic feature vectors.
[0026] In the specific implementation, first, a traffic correlation matrix can be constructed according to the traffic transmission data, that is, multiple features of network traffic (such as IP address, port number, protocol type, traffic size, transmission rate, etc.) are extracted from the traffic transmission data, and these features are formed into a data matrix, in which each row represents a data point (such as a data packet) and each column represents a feature, so that the data matrix can be used as a traffic correlation matrix; then, the traffic correlation matrix can be eigenvalue decomposed, and through the eigenvalue decomposition, multiple traffic feature vectors can be obtained, each traffic feature vector corresponds to a traffic eigenvalue, wherein the traffic eigenvalue represents the importance of the corresponding traffic feature vector, that is, the contribution of the traffic feature vector to the traffic transmission data. The larger the traffic eigenvalue, the better the traffic feature vector can represent the variance of the traffic transmission data.
[0027] In addition, in the specific implementation, each traffic feature vector can be screened according to the corresponding traffic characteristic value and the preset dimension to obtain multiple core traffic feature vectors, that is, the traffic characteristic value is sorted, and the traffic feature vector with a larger traffic characteristic value is selected as the core traffic feature vector. The core traffic feature vector can retain the main information of the traffic transmission data to the greatest extent. In actual implementation, it can be selected according to the preset dimension size. For example, if the preset dimension is 5, the 5 traffic feature vectors with the largest traffic characteristic values are selected as the core traffic feature vectors; then, the core traffic transmission data of the target Internet can be determined through all the core traffic feature vectors, that is, by multiplying the screened core feature vector with the original traffic feature matrix (usually using matrix multiplication or other transformation methods), the original traffic data can be mapped to the reduced-dimensional core space, thereby obtaining the core traffic transmission data of the target Internet. The core traffic transmission data contains the most important information about traffic transmission and can efficiently perform threat identification and subsequent analysis.
[0028] Preferably, in this embodiment, the target Internet's transmission process is subjected to threat identification based on the core traffic transmission data to obtain the target Internet's traffic transmission threat level, and the target Internet's traffic transmission threat level is obtained. Figure 2 As described above, the figure is a schematic diagram of a process for determining the traffic transmission threat level of the target Internet in some embodiments of the present application. In this embodiment, determining the traffic transmission threat level of the target Internet can be implemented by the following steps: First, in step S21, the flow distribution center and flow fluctuation are determined through the core flow transmission data; Then, in step S22, a transmission abnormal value of each data point in the core traffic transmission data is determined according to the traffic distribution center and the traffic fluctuation degree; Finally, in step S23, the traffic transmission threat level of the target Internet is determined based on the transmission anomaly values of all data points in the core traffic transmission data.
[0029] In specific implementation, first, the traffic distribution center and traffic fluctuation are determined through the core traffic transmission data. The traffic distribution center refers to the center point of the overall distribution of the core traffic transmission data, and the traffic fluctuation indicates the overall fluctuation degree of the core traffic transmission data. The mean of all data points in the core traffic transmission data can be used as the traffic distribution center, and the standard deviation of all data points in the core traffic transmission data can be used as the traffic fluctuation degree; then, the transmission anomaly value of each data point in the core traffic transmission data can be determined based on the traffic distribution center and the traffic fluctuation degree. The transmission anomaly value indicates the abnormal degree of traffic transmission corresponding to the data point. In actual implementation, the transmission anomaly value can be determined according to the following formula: in, represents the transmission outlier of data point x, Indicates the flow fluctuation. represents the flow distribution center, represents the Euler number, Represents pi. The transmission anomaly value of each data point in the core traffic transmission data can be obtained in the above manner. Finally, the traffic transmission threat degree of the target Internet is determined according to the transmission anomaly values of all data points in the core traffic transmission data. The standard deviation of the transmission anomaly values of all data points in the core traffic transmission data is used as the traffic transmission threat degree of the target Internet. The traffic transmission threat degree indicates the threat degree of traffic transmission to the security of the target Internet.
[0030] It should be noted that feature dimensionality reduction can reduce redundant data and retain only the core features that are important for traffic analysis and threat identification, making the process of threat identification based on the reduced data more efficient. In addition, the accuracy of threat detection can be improved based on the threat degree of traffic transmission, reducing the false alarm rate and missed alarm rate, and enhancing the ability to capture real attack behaviors.
[0031] The resource monitoring module 300 is used to monitor various application resources in the target Internet, and then obtain resource monitoring data of the target Internet. The relevant difference values between various application resources are determined through the resource monitoring data, and the resource monitoring data are aggregated based on all relevant difference values to obtain the popular data domain when the target Internet is performing resource monitoring.
[0032] In this embodiment, Prometheus is used to monitor various application resources in the target Internet and thus obtain resource monitoring data of the target Internet; it should be noted that Prometheus is an open source monitoring system and time series database, and Prometheus monitors applications and resources by capturing indicator data; in the target Internet, application resources include CPU, memory, disk, bandwidth, etc., and resource monitoring data includes the usage of various application resources.
[0033] In this embodiment, the relevant difference values between various application resources can be determined by the resource monitoring data in the following manner, namely: Obtaining monitoring data corresponding to each application resource in the resource monitoring data; Determine the data differences between various application resources based on the corresponding monitoring data; The relevant difference values between the application resources are determined based on the data differences between the application resources.
[0034] In specific implementation, first, the corresponding monitoring data of each application resource in the resource monitoring data can be obtained by traversal; then, the data difference between each application resource can be determined based on the corresponding monitoring data, and the Euclidean distance between each application resource can be calculated based on the corresponding monitoring data, and the Euclidean distance is used as the data difference, and the data difference indicates the degree of difference in data between each application resource; finally, the relevant difference value between each application resource is determined based on the data difference between each application resource, and the relevant difference value indicates the degree of difference between the application resources. In actual implementation, the relevant difference value can be determined according to the following formula: Among them, represents the relevant difference value between application resource a and application resource b, represents the data difference between application resource a and application resource b, k represents a transformation parameter, and the transformation parameter is a constant set according to historical experience. The relevant difference values between various application resources can be obtained through the above method.
[0035] Preferably, in this embodiment, the resource monitoring data is aggregated based on all relevant difference values to obtain the hot data domain when the target Internet is performing resource monitoring, and the reference Figure 3 The figure is a schematic diagram of a process for determining a hot data domain when a target Internet is monitored for resources in some embodiments of the present application. In this embodiment, determining a hot data domain when a target Internet is monitored for resources can be implemented by the following steps: First, in step S31, clustering algorithms are used to cluster various application resources based on all relevant difference values, thereby obtaining multiple application resource classes; Then, in step S32, the monitoring data corresponding to each application resource class is extracted from the resource monitoring data; Finally, in step S33, each application resource class is screened according to the corresponding monitoring data, thereby obtaining the hot data domain when the target Internet is performing resource monitoring.
[0036] In the specific implementation, first, a clustering algorithm is used to cluster each application resource based on all relevant difference values, that is, all calculated relevant difference values are used as input, and a clustering algorithm is used to group each application resource, so as to obtain multiple application resource classes. The clustering algorithm used in this application is the K-means clustering algorithm. Other clustering algorithms can also be used in actual implementation, which is not limited here; then, the monitoring data corresponding to each application resource class can be extracted from the resource monitoring data by traversal, that is, the corresponding monitoring data of each application resource in the application resource class in the resource monitoring data is used as the monitoring data corresponding to the application resource class; finally, each application resource class can be screened according to the corresponding monitoring data, and then a hot data domain when the target Internet is monitoring resources is obtained. The hot data domain contains monitoring data that can directly affect the security of the target Internet. Through continuous monitoring of the hot data domain, the health status of the resources can be grasped in real time to prevent potential risks.
[0037] In this embodiment, each application resource class is screened according to the corresponding monitoring data, and then the hot data domain when the target Internet is monitored for resources can be obtained in the following manner, namely: The information entropy of each application resource class is determined according to the corresponding monitoring data, and then the monitoring data corresponding to the application resource class with the largest information entropy is used as the hot data domain when the target Internet performs resource monitoring.
[0038] It should be noted that, based on the information entropy of each application resource class calculated, the application resource class with the largest information entropy (i.e., the most complex data fluctuation) is selected. The monitoring data of this application resource class represents the most active and most drastically changing part of the system, and its changes have the greatest impact on the system. Therefore, the monitoring data of this application resource class is further monitored and responded to as a hot data domain.
[0039] In addition, it should be noted that through monitoring and correlation analysis of various application resources in the target Internet, it can help identify the most critical and relevant resource data, and cluster the data through clustering algorithms and other methods. The hot data domains obtained are the most representative resource data that best reflects the health status of the system. This can focus on the most critical resource monitoring, avoid the processing of redundant data during the monitoring process, reduce the burden of computing and storage, and thus improve system efficiency.
[0040] The security response module 400 is used to perform security prediction using the traffic transmission threat level and the hot data domain to obtain a security factor of the target Internet, and control the target Internet to perform a security response according to the security factor.
[0041] In this embodiment, using the traffic transmission threat level and the hot data domain for security prediction is to input the traffic transmission threat level as a prediction weight and the hot data domain as input data into a machine learning-based model for security prediction.
[0042] In the specific implementation, first, a model based on machine learning is selected. The model selected in this application is a convolutional neural network model. Other models can also be selected in actual implementation, and there is no limitation here. The model can predict the security status of the target Internet, including whether there is a potential risk of network attack or system failure; then, the traffic transmission threat degree can be used as a prediction weight and the popular data domain can be used as input data into the machine learning-based model for security prediction, so that the safety factor of the target Internet can be obtained. The safety factor indicates the current security level of the target Internet. The higher the safety factor, the safer the target Internet.
[0043] In this embodiment, the following methods may be used to control the target Internet to perform a security response according to the security factor, namely: Classifying the threat level of the security incidents of the target Internet according to the security factor, thereby obtaining the threat level of the security incidents of the target Internet; A security response strategy for the target Internet is determined according to the threat level.
[0044] In the specific implementation, first, a threat level table of safety factors can be set according to historical experiments. In the threat level table, multiple threat levels are defined, for example: Security Level 1 (Low Risk): When the security factor is higher than the set threshold, it means that the target Internet is in a relatively safe state and there are no major security threats.
[0045] Security Level 2 (Medium Risk): When the security factor is in the middle range, it means there is a certain risk, which may be a potential attack or system abnormality.
[0046] Security Level 3 (High Risk): When the security factor is lower than the set critical value, it means that the target Internet is in a high-risk state and there are serious security incidents or attack activities.
[0047] Then, the threat level of the security incidents of the target Internet can be classified according to the security factor, and then the threat level of the security incidents of the target Internet can be obtained; Finally, the threat level can be used to determine the target Internet's security response strategy, such as: Security Level 1: No complex security response is required, just continue monitoring.
[0048] Security Level 2: Requires enhanced monitoring, updated firewall rules, and checks for unusual activities.
[0049] Security Level 3: Security response mechanisms need to be initiated immediately, such as isolating the attacked system, performing deep security checks, and launching an intrusion detection system (IDS).
[0050] It should be noted that by combining the traffic transmission threat level and popular data domains to make security predictions and obtain a safety factor, the system can automatically evaluate the security status of the target Internet and automatically select corresponding security response measures, thereby improving the security and reliability of the response system.
[0051] It can be seen that in this application, firstly, redundant data can be reduced through feature dimensionality reduction, and only core features that play an important role in traffic analysis and threat identification are retained, thereby making the process of threat identification based on the reduced data more efficient, and the accuracy of threat detection can be improved based on the traffic transmission threat level, reducing the false alarm rate and missed alarm rate, and enhancing the ability to capture real attack behaviors; then, through monitoring and correlation analysis of various application resources in the target Internet, it can help identify the most critical and relevant resource data, and cluster the data through clustering algorithms and other methods, and the obtained popular data domain is the most representative resource data that best reflects the health status of the system; finally, by combining the traffic transmission threat level and the popular data domain for security prediction, the safety factor is obtained, and the system can automatically evaluate the security status of the target Internet and automatically select corresponding security response measures, thereby improving the security and reliability of the response system.
[0052] To sum up, the technical solution adopted in this application can effectively combine traffic transmission data and other monitoring data to formulate an efficient response strategy to improve the security and reliability of the response system.
[0053] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0054] A person skilled in the art may understand that all or part of the steps in the various methods of the above embodiments may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, the storage medium including a read-only memory (ROM), a random access memory (RAM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), a one-time programmable read-only memory (OTPROM), an electronically-erasable programmable read-only memory (EEPROM), a compact disc (CD-ROM) or other optical disc storage, magnetic disk storage, magnetic tape storage, or any other computer-readable medium that can be used to carry or store data.
[0055] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.
Claims
1. An automated Internet security incident response system, characterized in that: The response system includes: Traffic monitoring module, used to monitor the traffic transmission data of the target Internet in real time; A transmission threat determination module is used to perform feature dimension reduction on the traffic transmission data to obtain core traffic transmission data of the target Internet, perform threat identification on the transmission process of the target Internet based on the core traffic transmission data, and obtain the traffic transmission threat degree of the target Internet; A resource monitoring module is used to monitor various application resources in the target Internet, thereby obtaining resource monitoring data of the target Internet, determining relevant difference values between various application resources through the resource monitoring data, and performing data aggregation on the resource monitoring data based on all relevant difference values to obtain a hot data domain when the target Internet performs resource monitoring; The security response module is used to use the traffic transmission threat level and the hot data domain to make a security prediction, obtain the security factor of the target Internet, and control the target Internet to perform a security response according to the security factor.
2. An automated Internet security incident response system as claimed in claim 1, characterized in that: Use network protocol analysis tools to monitor the target Internet traffic transmission data in real time.
3. An automated Internet security incident response system as claimed in claim 1, characterized in that: The feature dimension reduction is performed on the traffic transmission data to obtain the core traffic transmission data of the target Internet, which specifically includes: constructing a traffic correlation matrix according to the traffic transmission data; Performing eigenvalue decomposition on the flow correlation matrix to obtain a plurality of flow eigenvectors and flow eigenvalues corresponding to each flow eigenvector; Each traffic feature vector is screened according to the corresponding traffic feature value and the preset dimension to obtain multiple core traffic feature vectors; The core traffic transmission data of the target Internet is determined through all core traffic feature vectors.
4. An automated Internet security incident response system as claimed in claim 1, characterized in that: According to the core traffic transmission data, the target Internet's transmission process is subjected to threat identification, and the traffic transmission threat level of the target Internet is obtained, specifically including: Determine the traffic distribution center and traffic fluctuation through the core traffic transmission data; Determining a transmission anomaly value of each data point in the core traffic transmission data according to the traffic distribution center and the traffic fluctuation degree; The traffic transmission threat level of the target Internet is determined according to the transmission anomaly values of all data points in the core traffic transmission data.
5. The automated Internet security incident response system according to claim 1, characterized in that: Use Prometheus to monitor various application resources in the target Internet.
6. An automated Internet security incident response system as claimed in claim 1, characterized in that: Determining the relevant difference values between various application resources through the resource monitoring data specifically includes: Obtaining monitoring data corresponding to each application resource in the resource monitoring data; Determine the data differences between various application resources based on the corresponding monitoring data; The relevant difference values between the application resources are determined based on the data differences between the application resources.
7. An automated Internet security incident response system as claimed in claim 1, characterized in that: The resource monitoring data is aggregated based on all relevant difference values, and the hot data domains obtained when the target Internet performs resource monitoring specifically include: Clustering each application resource using a clustering algorithm based on all relevant difference values, thereby obtaining multiple application resource classes; Extracting monitoring data corresponding to each application resource class from the resource monitoring data; Each application resource class is screened according to the corresponding monitoring data, and then the popular data domains when the target Internet is monitoring resources are obtained.
8. An automated Internet security incident response system as claimed in claim 7, characterized in that: Filter each application resource class according to the corresponding monitoring data, and then obtain the hot data domains when monitoring resources on the target Internet, including: The information entropy of each application resource class is determined according to the corresponding monitoring data, and then the monitoring data corresponding to the application resource class with the largest information entropy is used as the hot data domain when the target Internet performs resource monitoring.
9. An automated Internet security incident response system as claimed in claim 1, characterized in that: Using the traffic transmission threat level and the hot data domain to perform security prediction is to input the traffic transmission threat level as a prediction weight and the hot data domain as input data into a machine learning-based model to perform security prediction.
10. An automated Internet security incident response system as claimed in claim 1, characterized in that: Controlling the target Internet to perform security response according to the security factor specifically includes: Classifying the threat level of the security incidents of the target Internet according to the security factor, thereby obtaining the threat level of the security incidents of the target Internet; A security response strategy for the target Internet is determined according to the threat level.