Situation data information processing method based on computer network security

Abstract

The invention discloses a situation data information processing method based on computer network security, which relates to the technical field of data information processing, and comprises the following steps: S1, data acquisition; data from various sources, including data of system logs, network traffic, user behaviors, security equipment and the like, are collected, and comprehensiveness and real-time performance of the data are ensured; s2, collecting network security countermeasures; the method comprises the following steps of: acquiring various network security cases with threats and anomalies as well as countermeasures under various conditions, and acquiring various network security cases with threats and anomalies as well as the countermeasures under the various conditions, so that the method has the beneficial effects that various abnormal data and countermeasures in the network can be acquired through network security countermeasure acquisition; through data cleaning and preprocessing, the collected repeated and invalid data can be processed, and the collected information is ensured to be effective information, so that the information processing efficiency is improved, and through the collected countermeasures, countermeasures can be conveniently carried out when an abnormity occurs.

Description

Technical Field

[0001] The present invention relates to the technical field of data information processing, and in particular to a situation data information processing method based on computer network security. Background Art

[0002] More new technologies related to big data are still developing rapidly. They will be mainly reflected in human social activities, data information security, production industries, etc., and will better serve the society and have a far-reaching impact. With the development of network technology, the use of the network for information processing has become normalized, and the data transmitted in the network has increased exponentially. In order to ensure the safe transmission and processing of data, network security technology has also been continuously developed. The main technology nowadays is firewall technology, whose main function is to timely discover and deal with security risks and data transmission problems that may exist during the operation of computer networks. The processing measures include isolation and protection. At the same time, it can record and detect various operations in computer network security. The purpose is to ensure the security of computer network operation, protect the integrity of user data and information, and provide a better and safer computer network experience. With the widespread dissemination of information, security and privacy have also become the focus of people's attention. This is an inevitable existence under information sharing.

[0003] At present, computer networks generate a large amount of data when they are in use. Often, an abnormality in one data will cause the leakage of the entire network security information. In the existing technology, when calculating, processing and analyzing computer network security data, it is difficult to perform batch information processing when a large amount of data information appears, which will lead to a large amount of repeated and invalid information in the collected information, and the degree of intelligence and work efficiency are low. In addition, when an abnormality occurs in computer network security, it is often impossible to operate through effective countermeasures. For this reason, we propose a situation data information processing method based on computer network security. Summary of the invention

[0004] In view of the deficiencies in the prior art, the present invention provides a situation data information processing method based on computer network security, which solves the problem raised in the above background technology that when a large amount of data information appears, it is difficult to perform batch information processing on the data, which will then lead to a large amount of repeated and invalid information in the collected information, and the degree of intelligence and work efficiency are low. In addition, when anomalies occur in computer network security, it is often impossible to operate through effective countermeasures.

[0005] To achieve the above purpose, the present invention is implemented by the following technical scheme: a situation data information processing method based on computer network security, comprising the following steps:

[0006] S1: Data collection;

[0007] Collect data from various sources, including system logs, network traffic, user behavior, security equipment, etc., to ensure the comprehensiveness and real-time nature of the data;

[0008] S2: Collection of cybersecurity countermeasures;

[0009] Collect various cybersecurity cases involving threats and anomalies, as well as response measures in various situations;

[0010] S3: data cleaning and preprocessing;

[0011] Clean and pre-process the collected data by removing duplicate data, irrelevant data, and erroneous data, filling in missing data, processing abnormal data, formatting data, and denoising data to ensure data accuracy and reliability, and provide high-quality data sets for subsequent analysis;

[0012] S4: Data storage management;

[0013] The cleaned and pre-processed data is stored and managed uniformly to ensure data security and accessibility;

[0014] S5: Data analysis and mining;

[0015] By adopting data analysis and mining technology, through statistics, machine learning, data mining, cluster analysis, association analysis and sequence analysis, the data is deeply analyzed to find the laws, trends, patterns and anomalies in the data, so as to easily find potential security threats and attack behaviors;

[0016] S6: Threat detection response;

[0017] Based on data analysis results, identify and detect potential network security vulnerabilities to issue warnings and take countermeasures;

[0018] S7: Situation Assessment and Forecasting;

[0019] S8: Early warning and response;

[0020] S9: Continuous monitoring and improvement;

[0021] S10: Feedback and optimization.

[0022] Preferably, the S7 situation assessment and prediction assesses and predicts the situation of computer network security based on the results of data analysis and mining;

[0023] The S8 early warning and response is to warn and respond to possible security threats based on the results of evaluation and prediction.

[0024] Preferably, the S9 continuously monitors and improves the processed data in real time, so as to facilitate timely discovery of new threats and anomalies, and then continuously optimize data processing methods and strategies.

[0025] Preferably, the S10 feedback and optimization provides feedback and optimization to the entire data processing process to improve the effect and efficiency of data processing.

[0026] Preferably, the S1 data collection can be obtained through web crawlers, API interfaces, data import, etc.

[0027] Preferably, the data storage of the S4 data storage management can use storage solutions such as database or data warehouse.

[0028] Preferably, the S7 situation assessment and prediction can use machine learning and artificial intelligence technology to predict future security situations through support vector machines, neural networks and other technologies.

[0029] Preferably, the S8 early warning and response can adopt real-time monitoring, alarm, emergency response and other means to timely discover and handle safety issues.

[0030] Preferably, the S10 feedback and optimization can be achieved by using artificial intelligence algorithms to continuously improve and adjust data processing methods and strategies.

[0031] The present invention provides a situation data information processing method based on computer network security, which has the following beneficial effects:

[0032] The situation data information processing method based on computer network security can collect various abnormal data and countermeasures appearing in the network through network security countermeasure collection, and can process the collected duplicate and invalid data through data cleaning and preprocessing to ensure that the collected information is valid information, thereby improving the efficiency of information processing, and also facilitating response when abnormalities occur through the collected countermeasures. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 It is a schematic diagram of the processing method of the present invention;

[0034] Figure 2 It is a situation assessment and prediction flow chart of the present invention;

[0035] Figure 3 It is a continuous monitoring and improvement flow chart of the present invention. DETAILED DESCRIPTION

[0036] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments.

[0037] See also Figures 1 to 3 The present invention provides a technical solution: a situation data information processing method based on computer network security, comprising the following steps:

[0038] S1: Data collection;

[0039] Collect data from various sources, including system logs, network traffic, user behavior, security equipment, etc., to ensure the comprehensiveness and real-time nature of the data;

[0040] S1 data collection can be obtained through web crawlers, API interfaces, data import, etc.

[0041] S2: Collection of cybersecurity countermeasures;

[0042] Collect various cybersecurity cases involving threats and anomalies, as well as response measures in various situations;

[0043] Threats and abnormal network security cases include: email passwords being cracked, network attacks, core systems being attacked due to inadequate security precautions, computers being controlled due to abnormal emails with Trojans, etc., as well as the response measures for the above cases.

[0044] S3: data cleaning and preprocessing;

[0045] Clean and pre-process the collected data by removing duplicate data, irrelevant data, and erroneous data, filling in missing data, processing abnormal data, formatting data, and denoising data to ensure data accuracy and reliability, and provide high-quality data sets for subsequent analysis;

[0046] Data cleaning is a process of repairing, correcting and organizing raw data before data analysis or machine learning, with the aim of ensuring the quality of the data. The importance of data cleaning lies in the fact that high-quality data is essential for accurate analysis and machine learning models. If there are errors, inconsistencies or missing values ​​in the data, the analysis results and models may be affected. Data cleaning involves many aspects, including fixing spelling errors, outliers and duplicate data, dealing with data consistency issues such as date format, unit and label matching, and dealing with missing values, which can be compensated by deletion or filling methods. In addition, data cleaning also includes transforming the data to suit the needs of analysis and modeling, such as normalization, normalization or logarithmic transformation. Data cleaning is usually an iterative process that requires multiple reviews and improvements to meet analysis or modeling needs.

[0047] S4: Data storage management;

[0048] The cleaned and pre-processed data is stored and managed uniformly to ensure data security and accessibility;

[0049] The data storage managed by S4 can use storage solutions such as database or data warehouse.

[0050] S5: Data analysis and mining;

[0051] By adopting data analysis and mining technology, through statistics, machine learning, data mining, cluster analysis, association analysis and sequence analysis, the data is deeply analyzed to find the laws, trends, patterns and anomalies in the data, so as to easily find potential security threats and attack behaviors;

[0052] Statistics includes the use of descriptive statistical methods, such as mean, median, variance, etc., to describe the basic characteristics and distribution of data; the use of inferential statistical methods, such as hypothesis testing, regression analysis, etc., to explore the correlation and trend between data;

[0053] Machine learning includes using supervised learning algorithms, such as support vector machines (SVM), decision trees, random forests, etc., to classify and predict known security events; and using unsupervised learning algorithms, such as cluster analysis and dimensionality reduction techniques, to discover hidden patterns and structures in data.

[0054] Data mining includes using association analysis technology to discover the correlation and dependency between different security events; using sequence analysis technology to discover the temporal relationship and evolution trend of security events.

[0055] Cluster analysis involves clustering network security data to cluster similar security events or behaviors into classes; by analyzing the characteristics and differences between different classes, potential security threats and abnormal behaviors can be discovered.

[0056] S6: Threat detection response;

[0057] Based on data analysis results, identify and detect potential network security vulnerabilities to issue warnings and take countermeasures;

[0058] How to identify and detect potential network security includes: 1). Network vulnerability scanning: Use professional vulnerability scanning tools (such as Nessus, OpenVAS, etc.) to conduct a comprehensive scan of the network to identify possible security vulnerabilities and weaknesses;

[0059] 2). Strengthen system security settings: Ensure that all systems have the latest security patches and updates installed, and harden the operating system and applications according to standard security configuration requirements, and shut down unnecessary services and ports to reduce the attack surface.

[0060] 3). Firewall settings: Configure the firewall to restrict network traffic and add appropriate policies and rules to the firewall to protect the network from unauthorized access and malicious attacks.

[0061] 4). Intrusion Detection System (IDS): Deploy an intrusion detection system to monitor network traffic and promptly detect and prevent potential intrusions.

[0062] 5). Network traffic analysis: Use network traffic analysis tools (such as Wireshark, tcpdump, etc.) to monitor and analyze network traffic and identify abnormal activities and potential security threats.

[0063] S7: Situation Assessment and Forecasting;

[0064] S7 Situation Assessment and Prediction: Evaluate and predict the situation of computer network security based on the results of data analysis and mining;

[0065] S7 situation assessment and prediction can use machine learning and artificial intelligence technologies to predict future security situations through support vector machines, neural networks and other technologies.

[0066] S8: Early warning and response;

[0067] S8 Early warning and response: Early warning and response to possible security threats based on the results of assessment and prediction;

[0068] S8 early warning and response can use real-time monitoring, alarms, emergency response and other means to promptly discover and handle safety issues.

[0069] S9: Continuous monitoring and improvement;

[0070] S9 Continuous Monitoring and Improvement Continuous real-time monitoring of processed data facilitates timely detection of new threats and anomalies, and then continuously optimizes data processing methods and strategies.

[0071] S10: Feedback and optimization;

[0072] S10 Feedback and Optimization provides feedback and optimization for the entire data processing process to improve the effect and efficiency of data processing;

[0073] S10 feedback and optimization can be achieved by adopting artificial intelligence algorithms to continuously improve and adjust data processing methods and strategies.

[0074] In summary, when the situation data information processing method based on computer network security is used, firstly, data from various sources are collected through web crawlers, API interfaces, data import, etc., including system logs, network traffic, user behavior, security equipment and other data, to ensure the comprehensiveness and real-time nature of the data. Subsequently, various threat and abnormal network security cases, as well as countermeasures in various situations, are collected through network security response measures. Then, the collected data is cleaned and preprocessed, and duplicate data, irrelevant data, and erroneous data are removed. Data missing data is filled, abnormal data is processed, and data is formatted and denoised to ensure data accuracy and reliability, providing a high-quality data set for subsequent analysis. Finally, the cleaned and preprocessed data is uniformly stored and managed through a database to ensure data security and accessibility. After the data is stored, data analysis and mining techniques are adopted, and statistics, machine learning, and numerical simulation are performed. In-depth analysis of data is carried out through methods such as data mining, cluster analysis, association analysis and sequence analysis to discover laws, trends, patterns and anomalies in the data, so as to easily discover potential security threats and attack behaviors. Then, based on the results of data analysis, potential network security is identified and detected to issue warnings and take countermeasures. Subsequently, based on the results of data analysis and mining, machine learning and artificial intelligence technologies are used to evaluate and predict the security situation of computer network security through support vector machines, neural networks and other technologies. According to the results of evaluation and prediction, security issues are discovered and handled in a timely manner through real-time monitoring, alarms, emergency response and other means, and possible security threats are warned and responded to. Subsequently, the processed data is continuously monitored in real time, so as to facilitate the timely discovery of new threats and anomalies, and then continuously optimize data processing methods and strategies. Finally, the entire data processing process is fed back and optimized through the use of artificial intelligence algorithms to improve the effect and efficiency of data processing.

[0075] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A situation data information processing method based on computer network security, characterized in that: The following steps are involved: S1: Data collection; Collect data from various sources, including system logs, network traffic, user behavior, security equipment, etc., to ensure the comprehensiveness and real-time nature of the data; S2: Collection of cybersecurity countermeasures; Collect various cybersecurity cases involving threats and anomalies, as well as response measures in various situations; S3: data cleaning and preprocessing; Clean and pre-process the collected data by removing duplicate data, irrelevant data, and erroneous data, filling in missing data, processing abnormal data, formatting data, and denoising data to ensure data accuracy and reliability, and provide high-quality data sets for subsequent analysis; S4: Data storage management; The cleaned and pre-processed data is uniformly stored and managed. The storage device used for storage and management has a security firewall to ensure data security and accessibility; S5: Data analysis and mining; By adopting data analysis and mining technology, through statistics, machine learning, data mining, cluster analysis, association analysis and sequence analysis, the data is deeply analyzed to find the laws, trends, patterns and anomalies in the data, so as to easily find potential security threats and attack behaviors; S6: Threat detection response; Based on data analysis results, identify and detect potential network security vulnerabilities to issue warnings and take countermeasures; S7: Situation Assessment and Forecasting; S8: Early warning and response; S9: Continuous monitoring and improvement; S10: Feedback and optimization.

2. A situation data information processing method based on computer network security according to claim 1, characterized in that: The S7 situation assessment and prediction evaluates and predicts the situation of computer network security based on the results of data analysis and mining; The S8 early warning and response is to warn and respond to possible security threats based on the results of evaluation and prediction.

3. The method for processing situation data information based on computer network security according to claim 1, characterized in that: The S9 continuous monitoring and improvement performs continuous real-time monitoring on the processed data, thereby facilitating timely discovery of new threats and anomalies, and then continuously optimizing data processing methods and strategies.

4. A situation data information processing method based on computer network security according to claim 1, characterized in that: The S10 feedback and optimization provides feedback and optimization to the entire data processing process to improve the effect and efficiency of data processing.

5. The method for processing situation data information based on computer network security according to claim 1, characterized in that: The S1 data collection can be obtained through web crawlers, API interfaces, data import, etc.

6. A situation data information processing method based on computer network security according to claim 1, characterized in that: The data storage of the S4 data storage management may use storage solutions such as a database or a data warehouse.

7. A situation data information processing method based on computer network security according to claim 1, characterized in that: The S7 situation assessment and prediction can use machine learning and artificial intelligence technology to predict future security situations through support vector machines, neural networks and other technologies.

8. A situation data information processing method based on computer network security according to claim 1, characterized in that: The S8 early warning and response can adopt real-time monitoring, alarm, emergency response and other means to timely discover and handle safety issues.

9. A situation data information processing method based on computer network security according to claim 1, characterized in that: The S10 feedback and optimization can be achieved by using artificial intelligence algorithms to continuously improve and adjust data processing methods and strategies.

Images