Security situation awareness system based on multi-source security data fusion analysis

Abstract

The invention relates to the technical field of network security, in particular to a security situation awareness system based on multi-source security data fusion analysis. The method comprises the following steps: calculating a data packet security coefficient based on a length number distribution index and a length throughput distribution index, judging whether a network in a statistical period meets a security analysis condition or not based on the data packet security coefficient, and obtaining IP flow record data corresponding to the network meeting the security analysis condition, performing security analysis on the IP flow record data to obtain a network security coefficient, judging whether the network in the statistical time period meets a security situation prediction condition based on the network security coefficient, and performing prediction analysis on the network meeting the security situation prediction condition through an analytic hierarchy process to obtain a network security situation prediction coefficient. And generating a network security early warning signal based on the network security situation prediction coefficient. According to the invention, potential network security threats can be found and reported in time, and the timeliness and accuracy of network threat identification are improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a security situation awareness system based on multi-source security data fusion analysis. Background Art

[0002] With the rapid development of information technology, the network environment is becoming increasingly complex, and network security threats are becoming more diverse, complex, and hidden. Traditional network security protection methods, such as firewalls, intrusion detection systems, and antivirus software, are no longer able to effectively respond to these new threats. Therefore, there is an urgent need for a system that can perceive network security situations in real time and comprehensively, so as to detect and respond to various network security threats in a timely manner.

[0003] Some existing network security situation awareness systems often require a lot of manual participation, resulting in high resource consumption and low real-time performance, which makes the system unable to cope with rapidly changing network security threats.

[0004] Therefore, there is an urgent need for a security situation awareness system based on multi-source security data fusion analysis to solve the above problems. Summary of the invention

[0005] The purpose of the present invention is to provide a security situation awareness system based on multi-source security data fusion analysis to solve the technical problem that the existing network security situation awareness system is not timely and accurate enough in perceiving network threats.

[0006] The purpose of the present invention can be achieved through the following technical solutions: A security situation awareness system based on multi-source security data fusion analysis, the system includes a network data packet analysis module, an IP flow record data analysis module, a security situation prediction module and a network security early warning module; The network data packet analysis module is used to perform statistical analysis on the network data packets within the statistical time period, obtain the length number distribution index of the preset message and the length throughput distribution index of the preset message, calculate the data packet security factor based on the length number distribution index and the length throughput distribution index, and judge whether the network within the statistical period meets the security analysis conditions based on the data packet security factor, wherein the statistical period includes several statistical time periods; The IP flow record data analysis module is used to obtain the IP flow record data corresponding to the network that meets the security analysis conditions, perform security analysis on the IP flow record data, obtain the network security coefficient, and judge whether the network within the statistical time period meets the security situation prediction conditions based on the network security coefficient; The security situation prediction module is used to perform prediction analysis on the network that meets the security situation prediction conditions through the hierarchical analysis method to obtain the network security situation prediction coefficient; The network security early warning module is used to generate a network security early warning signal based on the network security situation prediction coefficient.

[0007] Further, statistical analysis is performed on the network data packets within the statistical time period to obtain the length number distribution index of the preset message and the length throughput distribution index of the preset message, which specifically includes the following process: Perform statistical analysis on the network data packets within the statistical time period to obtain the total number of messages N passing through the link within the statistical time period, obtain the average message length L of the preset message passing through the link within the statistical time period, and calculate the number n of the preset messages in the network data packets within the statistical time period based on the transmission average message length L; The ratio of the number n of the preset messages to the total number N of messages passing through the link is calculated, and the ratio is recorded as the length number distribution index of the preset messages; Perform statistical analysis on the network data packets within the statistical time period to obtain the link traffic V and the preset message throughput v within the statistical time period; The ratio of the throughput v of the preset message in the statistical time period to the flow V of the link passing in the statistical time period is calculated, and the ratio is recorded as the length throughput distribution index of the preset message.

[0008] Furthermore, the calculation of the data packet safety factor based on the length number distribution index and the length throughput distribution index specifically includes the following process: Several statistical time periods are combined into a statistical cycle. The execution time of the statistical time period is taken as the X-axis, and the length number distribution index and the length throughput distribution index are taken as the Y-axis. Two rectangular coordinate systems are established to generate curves of two statistical cycles. The areas of the figures enclosed by the two curves and the coordinate axes in the statistical cycle are calculated respectively, and the sum of the two areas is recorded as the data packet safety factor.

[0009] Furthermore, judging whether the network in the statistical period meets the security analysis conditions based on the data packet security factor specifically includes the following process: Loading a data packet security factor threshold, where the data packet security factor threshold is stored in the system and its value is set by the system, determines whether the data packet security factor exceeds the data packet security factor threshold, if so, determines that the network within the statistical period meets the security analysis conditions, if not, determines that the network within the statistical period does not meet the security analysis conditions.

[0010] Furthermore, the security analysis of the IP flow record data to obtain the network security coefficient specifically includes the following process: Obtaining the duration A of each flow based on the IP flow record data, wherein each unidirectional IP flow record is regarded as a separate IP activity, and the duration of a separate IP activity is recorded as the duration A of each flow; Based on the IP flow record data, obtain the number of peer IP addresses B for each flow and the number of address segments C to which the peer IP addresses in each flow belong; Based on the IP flow record data, obtain the number of application categories D to which each flow belongs; Obtain the flow number E of each flow based on the IP flow record data; Substitute the duration A of each flow, the number of peer IP addresses B of each flow, the number of address segments C to which the peer IP addresses in each flow belong, the number of application categories D to which each flow belongs, and the number of flows E of each flow into the network security coefficient calculation formula to calculate the network security coefficient WLA. The calculation formula is as follows: ; in, The value of is 2.72, The duration threshold preset by the system. , , and is the weight coefficient, whose value is set by the system. is the total number of IP addresses that can communicate in the network. is the number of address blocks in the network associated with the observed IP, is the number of all application categories in the network, is the maximum number of flows for each flow in the network.

[0011] Furthermore, judging whether the network in the statistical time period meets the security situation prediction conditions based on the network security coefficient specifically includes the following process: Load the network security coefficient threshold, where the network security coefficient threshold is stored in the system and its value is set by the system. Determine whether the network security coefficient exceeds the network security coefficient threshold. If so, determine that the network within the statistical time period does not meet the security situation prediction conditions. If not, determine that the network within the statistical time period meets the security situation prediction conditions.

[0012] Furthermore, the prediction analysis of the network that meets the security situation prediction conditions is carried out through the hierarchical analysis method, and the network security situation prediction coefficient is obtained, which specifically includes the following processes: Step 1: Establish a hierarchical model with layers, where the layers include the target layer, the criterion layer and the measure layer; Step 2: Construct a judgment matrix: determine the number of relevant influencing factors at each level , build a set of network security risk factors , ,in, is the vulnerability rate subset existing in the system or software, is the network communication line stability rate subset, is the network attack rate subset, is the failure rate subset of network devices, from the set Take out two subsets in the same level and compare them, using It represents the ratio of importance, and assigns the corresponding importance according to the preset ratio, and combines the importance of each layer to form a judgment matrix; Step 3: Calculate the maximum eigenvalue of the judgment matrix : ; in, is the matrix obtained by normalizing each column vector of the judgment matrix. The value of is 1,2...m, For the matrix The elements of are added row by row to obtain the vector and then normalized into a matrix. For the matrix Add the elements of column by column to obtain the vector and then normalize the matrix; Step 4: Check the consistency of the judgment matrix: When the judgment matrix has only one non-zero eigenvalue, it means that the matrix is ​​completely consistent. If the matrix V has more than one eigenvalue, the consistency index can be used : in, represents the order of the judgment matrix, The smaller the value of, the better the consistency, and vice versa, the greater the degree of deviation; Will The value is recorded as the network security situation prediction coefficient.

[0013] Furthermore, generating a network security early warning signal based on the network security situation prediction coefficient specifically includes the following process: Load the network security situation prediction coefficient threshold, where the network security situation prediction coefficient is stored in the system and its value is set by the system. Determine whether the network security situation prediction coefficient exceeds the network security situation prediction coefficient threshold. If so, do not generate a warning signal; if not, generate a warning signal.

[0014] Compared with the existing solutions, the present invention achieves the following beneficial effects: Real-time monitoring and early warning: By integrating multi-source security data, the system can realize real-time monitoring and early warning of network security situation. It can timely detect and report potential network security threats, improve the timeliness and accuracy of network threat identification, and provide administrators with timely decision-making support.

[0015] Intelligent analysis and response: Analyze and mine network security data to build an intelligent security model. The system can automatically identify abnormal behaviors and take corresponding response measures to improve the automation and intelligence level of the system.

[0016] Comprehensive visualization: Using visualization and interactive technology, all kinds of data collected by the system are presented in intuitive charts. Administrators can intuitively understand the network status and security situation through the interface, making it easier to make decisions and operations. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0018] Figure 1 It is a system block diagram of a security situation awareness system based on multi-source security data fusion analysis according to an embodiment of the present invention; Figure 2 This is a workflow diagram of a first security situation awareness system based on multi-source security data fusion analysis according to an embodiment of the present invention; Figure 3 This is a workflow diagram of a second security situation awareness system based on multi-source security data fusion analysis according to an embodiment of the present invention; Figure 4 This is a workflow diagram of a third security situation awareness system based on multi-source security data fusion analysis in an embodiment of the present invention. DETAILED DESCRIPTION

[0019] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0020] In addition, the described features, structures or characteristics may be combined in one or more example embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the example embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced while omitting one or more of the specific details, or other methods, components, steps, etc. may be adopted. In other cases, well-known structures, methods, implementations or operations are not shown or described in detail to avoid obscuring various aspects of the present disclosure.

[0021] This embodiment provides a security situation awareness system based on multi-source security data fusion analysis. Figure 1 is a system block diagram of a security situation awareness system based on multi-source security data fusion analysis according to an embodiment of the present invention. Figure 1 As shown, the system includes a network data packet analysis module, an IP flow record data analysis module, a security situation prediction module and a network security early warning module; The network data packet analysis module is used to perform statistical analysis on the network data packets within the statistical time period, obtain the length number distribution index of the preset message and the length throughput distribution index of the preset message, calculate the data packet security factor based on the length number distribution index and the length throughput distribution index, and judge whether the network within the statistical period meets the security analysis conditions based on the data packet security factor, wherein the statistical period includes several statistical time periods; The IP flow record data analysis module is used to obtain the IP flow record data corresponding to the network that meets the security analysis conditions, perform security analysis on the IP flow record data, obtain the network security coefficient, and judge whether the network within the statistical time period meets the security situation prediction conditions based on the network security coefficient; The security situation prediction module is used to perform prediction analysis on the network that meets the security situation prediction conditions through the hierarchical analysis method to obtain the network security situation prediction coefficient; The network security early warning module is used to generate a network security early warning signal based on the network security situation prediction coefficient.

[0022] In summary, the present invention performs statistical analysis on network data packets within a statistical time period, obtains a length number distribution index of a preset message and a length throughput distribution index of a preset message, calculates a data packet safety factor based on the length number distribution index and the length throughput distribution index, judges whether the network within the statistical period meets the security analysis condition based on the data packet safety factor, obtains the IP flow record data corresponding to the network that meets the security analysis condition, performs security analysis on the IP flow record data, obtains a network security factor, judges whether the network within the statistical time period meets the security situation prediction condition based on the network security factor, performs predictive analysis on the network that meets the security situation prediction condition through the hierarchical analysis method, obtains a network security situation prediction factor, and generates a network security early warning signal based on the network security situation prediction factor. The present invention can timely discover and report potential network security threats, and improve the timeliness and accuracy of network threat identification.

[0023] In some embodiments, Figure 2 This is a workflow diagram of the first security situation awareness system based on multi-source security data fusion analysis in an embodiment of the present invention. Figure 2As shown, performing statistical analysis on network data packets within a statistical time period to obtain a length number distribution index of a preset message specifically includes the following steps: Step S201: Statistically analyzing the network data packets within the statistical time period, obtaining the total number N of messages passing through the link within the statistical time period, obtaining the average message length L of the preset message passing through the link within the statistical time period, and calculating the number n of the preset messages in the network data packets within the statistical time period based on the transmission average message length L; Step S202: Calculate the ratio of the number n of preset messages to the total number N of messages passing through the link, and record the ratio as the length number distribution index of the preset messages.

[0024] In some embodiments, Figure 3 is a workflow diagram of a second security situation awareness system based on multi-source security data fusion analysis according to an embodiment of the present invention, such as Figure 3 As shown, statistical analysis of network data packets within a statistical time period to obtain a length throughput distribution index of a preset message specifically includes the following steps: Step S301: Statistically analyzing the network data packets within the statistical time period to obtain the traffic V passing through the link within the statistical time period and the traffic v of the preset message within the statistical time period; Step S302: Calculate the ratio of the throughput v of the preset message in the statistical time period to the traffic V passing through the link in the statistical time period, and record the ratio as the length throughput distribution index of the preset message.

[0025] In some embodiments, calculating the data packet safety factor based on the length number distribution index and the length throughput distribution index specifically includes the following process: Several statistical time periods are combined into a statistical cycle. The execution time of the statistical time period is taken as the X-axis, and the length number distribution index and the length throughput distribution index are taken as the Y-axis. Two rectangular coordinate systems are established to generate curves of two statistical cycles. The areas of the figures enclosed by the two curves and the coordinate axes in the statistical cycle are calculated respectively, and the sum of the two areas is recorded as the data packet safety factor.

[0026] In some embodiments, judging whether a network within a statistical period meets the security analysis condition based on the data packet security factor specifically includes the following process: Loading a data packet security factor threshold, where the data packet security factor threshold is stored in the system and its value is set by the system, determines whether the data packet security factor exceeds the data packet security factor threshold, if so, determines that the network within the statistical period meets the security analysis conditions, if not, determines that the network within the statistical period does not meet the security analysis conditions.

[0027] In some embodiments, Figure 4: is a workflow diagram of a third security situation awareness system based on multi-source security data fusion analysis according to an embodiment of the present invention. Figure 4 As shown in the figure, the security analysis of IP flow record data to obtain the network security coefficient specifically includes the following steps: Step S401: Obtain the duration A of each flow based on the IP flow record data, wherein each unidirectional IP flow record is regarded as a separate IP activity, and the duration of a separate IP activity is recorded as the duration A of each flow; Step S402: based on the IP flow record data, obtain the number B of peer IPs of each flow and the number C of address segments to which the peer IPs in each flow belong; Step S403: obtaining the number of application categories D to which each flow belongs based on the IP flow record data, and obtaining the number of flows E of each flow based on the IP flow record data; Step S404: Substitute the duration A of each flow, the number B of the peer IP of each flow, the number C of address segments to which the peer IP in each flow belongs, the number D of application categories to which each flow belongs, and the number E of flows of each flow into the network security coefficient calculation formula to calculate the network security coefficient WLA, which is as follows: ; in, The value of is 2.72, The duration threshold preset by the system. , , and is the weight coefficient, whose value is set by the system. is the total number of IP addresses that can communicate in the network. is the number of address blocks in the network associated with the observed IP, is the number of all application categories in the network, is the maximum number of flows for each flow in the network.

[0028] In some embodiments, judging whether the network within the statistical time period meets the security situation prediction condition based on the network security coefficient specifically includes the following process: Load the network security coefficient threshold, where the network security coefficient threshold is stored in the system and its value is set by the system. Determine whether the network security coefficient exceeds the network security coefficient threshold. If so, determine that the network within the statistical time period does not meet the security situation prediction conditions. If not, determine that the network within the statistical time period meets the security situation prediction conditions.

[0029] In some embodiments, performing a prediction analysis on a network that meets the security situation prediction conditions by using the hierarchical analysis method to obtain a network security situation prediction coefficient specifically includes the following process: Step 1: Establish a hierarchical model with layers, where the layers include the target layer, the criterion layer and the measure layer; Step 2: Construct a judgment matrix: determine the number of relevant influencing factors at each level , build a set of network security risk factors , ,in, is the vulnerability rate subset existing in the system or software, is the network communication line stability rate subset, is the network attack rate subset, is the failure rate subset of network devices, from the set Take out two subsets in the same level and compare them, using It represents the ratio of importance, and assigns the corresponding importance according to the preset ratio, and combines the importance of each layer to form a judgment matrix; Step 3: Calculate the maximum eigenvalue of the judgment matrix : ; in, is the matrix obtained by normalizing each column vector of the judgment matrix. The value of is 1,2...m, For the matrix The elements of are added row by row to obtain the vector and then normalized into a matrix. For the matrix Add the elements of column by column to obtain the vector and then normalize the matrix; Step 4: Check the consistency of the judgment matrix: When the judgment matrix has only one non-zero eigenvalue, it means that the matrix is ​​completely consistent. If the matrix V has more than one eigenvalue, the consistency index can be used : in, represents the order of the judgment matrix, The smaller the value of, the better the consistency, and vice versa, the greater the degree of deviation; Will The value is recorded as the network security situation prediction coefficient.

[0030] Furthermore, generating a network security early warning signal based on the network security situation prediction coefficient specifically includes the following process: Load the network security situation prediction coefficient threshold, where the network security situation prediction coefficient is stored in the system and its value is set by the system. Determine whether the network security situation prediction coefficient exceeds the network security situation prediction coefficient threshold. If so, do not generate a warning signal; if not, generate a warning signal.

[0031] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0032] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0033] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0034] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only some logical function divisions. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0035] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0036] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A security situation awareness system based on multi-source security data fusion analysis, characterized in that: The system includes a network data packet analysis module, an IP flow record data analysis module, a security situation prediction module, and a network security early warning module; The network data packet analysis module is used to perform statistical analysis on the network data packets within the statistical time period, obtain the length number distribution index of the preset message and the length throughput distribution index of the preset message, calculate the data packet security factor based on the length number distribution index and the length throughput distribution index, and judge whether the network within the statistical period meets the security analysis conditions based on the data packet security factor, wherein the statistical period includes several statistical time periods; The IP flow record data analysis module is used to obtain the IP flow record data corresponding to the network that meets the security analysis conditions, perform security analysis on the IP flow record data, obtain the network security coefficient, and judge whether the network within the statistical time period meets the security situation prediction conditions based on the network security coefficient; The security situation prediction module is used to perform prediction analysis on the network that meets the security situation prediction conditions through the hierarchical analysis method to obtain the network security situation prediction coefficient; The network security early warning module is used to generate a network security early warning signal based on the network security situation prediction coefficient.

2. A security situation awareness system based on multi-source security data fusion analysis according to claim 1, characterized in that: Statistical analysis is performed on the network data packets within the statistical time period to obtain the length number distribution index of the preset message and the length throughput distribution index of the preset message. The process includes: Perform statistical analysis on the network data packets within the statistical time period to obtain the total number of messages N passing through the link within the statistical time period, obtain the average message length L of the preset message passing through the link within the statistical time period, and calculate the number n of the preset messages in the network data packets within the statistical time period based on the transmission average message length L; The ratio of the number n of the preset messages to the total number N of messages passing through the link is calculated, and the ratio is recorded as the length number distribution index of the preset messages; Perform statistical analysis on the network data packets within the statistical time period to obtain the link traffic V and the preset message throughput v within the statistical time period; The ratio of the throughput v of the preset message in the statistical time period to the flow V of the link passing in the statistical time period is calculated, and the ratio is recorded as the length throughput distribution index of the preset message.

3. The security situation awareness system based on multi-source security data fusion analysis according to claim 1 is characterized in that: The specific process of calculating the data packet safety factor based on the length number distribution index and the length throughput distribution index is as follows: Several statistical time periods are combined into a statistical cycle. The execution time of the statistical time period is taken as the X-axis, and the length number distribution index and the length throughput distribution index are taken as the Y-axis. Two rectangular coordinate systems are established to generate curves of two statistical cycles. The areas of the figures enclosed by the two curves and the coordinate axes in the statistical cycle are calculated respectively, and the sum of the two areas is recorded as the data packet safety factor.

4. The security situation awareness system based on multi-source security data fusion analysis according to claim 1 is characterized in that: Judging whether the network meets the security analysis conditions within the statistical period based on the data packet security factor specifically includes the following processes: Loading a data packet security factor threshold, where the data packet security factor threshold is stored in the system and its value is set by the system, determines whether the data packet security factor exceeds the data packet security factor threshold, if so, determines that the network within the statistical period meets the security analysis conditions, if not, determines that the network within the statistical period does not meet the security analysis conditions.

5. The security situation awareness system based on multi-source security data fusion analysis according to claim 1 is characterized in that: Perform security analysis on IP flow record data to obtain specific network security coefficients. The process includes: Obtaining the duration A of each flow based on the IP flow record data, wherein each unidirectional IP flow record is regarded as a separate IP activity, and the duration of a separate IP activity is recorded as the duration A of each flow; Based on the IP flow record data, obtain the number of peer IP addresses B for each flow and the number of address segments C to which the peer IP addresses in each flow belong; Based on the IP flow record data, obtain the number of application categories D to which each flow belongs; Obtain the flow number E of each flow based on the IP flow record data; Substitute the duration A of each flow, the number of peer IP addresses B of each flow, the number of address segments C to which the peer IP addresses in each flow belong, the number of application categories D to which each flow belongs, and the number of flows E of each flow into the network security coefficient calculation formula to calculate the network security coefficient WLA. The calculation formula is as follows: ； in, The value of is 2.72, The duration threshold preset by the system. , , and is the weight coefficient, whose value is set by the system. is the total number of IP addresses that can communicate in the network. is the number of address blocks in the network associated with the observed IP, is the number of all application categories in the network, is the maximum number of flows for each flow in the network.

6. The security situation awareness system based on multi-source security data fusion analysis according to claim 1 is characterized in that: Determine whether the network meets the security situation prediction conditions within the statistical time period based on the network security coefficient. The process includes: Load the network security coefficient threshold, where the network security coefficient threshold is stored in the system and its value is set by the system. Determine whether the network security coefficient exceeds the network security coefficient threshold. If so, determine that the network within the statistical time period does not meet the security situation prediction conditions. If not, determine that the network within the statistical time period meets the security situation prediction conditions.

7. The security situation awareness system based on multi-source security data fusion analysis according to claim 1 is characterized in that: The network that meets the security situation prediction conditions is predicted and analyzed by the hierarchical analysis method, and the network security situation prediction coefficient is obtained, which specifically includes the following processes: Step 1: Establish a hierarchical model with layers, where the layers include the target layer, the criterion layer and the measure layer; Step 2: Construct a judgment matrix: determine the number of relevant influencing factors at each level , build a collection of network security risk factors , ,in, is the vulnerability rate subset existing in the system or software, is the network communication line stability rate subset, is the network attack rate subset, is the failure rate subset of network devices, from the set Take out two subsets in the same level and compare them, using It represents the ratio of importance, and assigns the corresponding importance according to the preset ratio, and combines the importance of each layer to form a judgment matrix; Step 3: Calculate the maximum eigenvalue of the judgment matrix : ； in, is the matrix obtained by normalizing each column vector of the judgment matrix. The value of is 1,2...m, For the matrix The elements of are added row by row to obtain the vector and then normalized into a matrix. For the matrix Add the elements of column by column to obtain the vector and then normalize the matrix; Step 4: Check the consistency of the judgment matrix: When the judgment matrix has only one non-zero eigenvalue, it means that the matrix is ​​completely consistent. If the matrix V has more than one eigenvalue, the consistency index can be used : in, represents the order of the judgment matrix, The smaller the value of, the better the consistency, and vice versa, the greater the degree of deviation; Will The value is recorded as the network security situation prediction coefficient.

8. The security situation awareness system based on multi-source security data fusion analysis according to claim 1 is characterized in that: Generate network security early warning signals based on network security situation prediction coefficients The process includes: Load the network security situation prediction coefficient threshold, where the network security situation prediction coefficient is stored in the system and its value is set by the system. Determine whether the network security situation prediction coefficient exceeds the network security situation prediction coefficient threshold. If so, do not generate a warning signal; if not, generate a warning signal.

Images