Network configuration security checking system

Abstract

The invention relates to the technical field of network security check, in particular to a network configuration security check system which comprises a configuration time analysis module, a configuration interaction analysis module, a behavior deviation analysis module and a security early warning generation module. According to the invention, by tracking the time change of the network configuration in real time, the timestamp and the change interval of each configuration can be accurately recorded, the prediction of a potential configuration change mode is supported, the monitoring of network behaviors is enhanced, unexpected change and configuration errors can be quickly identified, and the response speed and accuracy of network security are greatly improved; by analyzing the mutual influence among the parameters and constructing the interactive network diagram, the dependency relationship and potential conflicts among the configurations can be systematically identified, the prevention, analysis and classification of operation behaviors of a network administrator and the identification and correction of unconventional operations before a problem occurs are realized, and the initiative and defense capability of network security management are further enhanced.

Description

Technical Field

[0001] The present invention relates to the technical field of network security verification, and in particular to a network configuration security verification system. Background Art

[0002] The network security verification technology field involves the use of automated or semi-automated tools and processes to evaluate and monitor the security of network configurations, policies, and devices, focusing on detecting and preventing security vulnerabilities, improper configurations, and potential intrusion threats in the network. The verification process includes reviewing the configuration files of network devices to check whether they comply with best security practices and compliance requirements. Technical means usually include the use of configuration management tools, vulnerability scanning software, and compliance checking tools, etc., aiming to improve the overall security of the network and reduce the risk of data leakage, intrusion, and other security incidents.

[0003] Among them, the network configuration security verification system focuses on detecting and correcting security issues in network devices and their configurations through automated tools to ensure the integrity and security of the network. Its purpose is to provide an effective means to identify configuration errors, settings that do not comply with security policies, and potential security threats. By comparing the existing network configuration with preset security standards or best practices, it helps network administrators to discover and solve problems in a timely manner, thereby preventing possible security vulnerabilities from being exploited and protecting the network from attacks.

[0004] Existing technologies use automated tools to evaluate network configurations, focusing mainly on late-stage problem discovery and lacking the ability to monitor and prevent configuration errors in real time, which can easily lead to long-term exposure of security vulnerabilities and increase the risk of network attacks. Existing technologies often neglect monitoring the behavior of network administrators and fail to effectively identify security threats caused by operational errors. For example, minor configuration errors or security policies that are not updated in a timely manner are ignored without activating any warnings, providing attackers with opportunities to exploit. The deficiencies of existing technologies in terms of prevention, real-time, and behavioral analysis indicate that it is necessary to introduce more advanced analysis mechanisms and early warning systems to improve the efficiency and effectiveness of network security management. Summary of the invention

[0005] The purpose of the present invention is to solve the shortcomings in the prior art and to propose a network configuration security verification system.

[0006] In order to achieve the above object, the present invention adopts the following technical solution: A network configuration security verification system includes: The configuration time analysis module collects network configuration data, determines the timestamp of each configuration, records the time of each configuration change, calculates the time interval of configuration changes based on the record results, performs statistical analysis on the time interval data, and generates configuration time analysis results; The configuration interaction analysis module receives the configuration time analysis results, compares the time points of different configuration changes, identifies the parameter modification frequency, analyzes the mutual influence between parameters, constructs a parameter interaction network diagram based on the analysis results, extracts key configuration change nodes, identifies potential network configuration conflicts, and generates interaction analysis results; The behavior deviation analysis module analyzes the network administrator's configuration operation records, tracks the operation sequence, checks the abnormal behavior in the operation, classifies and organizes the behavior according to the inspection results, identifies the error pattern, extracts the abnormal configuration operation, and generates the behavior deviation assessment results; The security warning generation module integrates the interaction analysis results and the behavior deviation assessment results, evaluates potential network configuration risks, implements dynamic security warnings, publishes security warning information in real time, and generates network configuration security warning records.

[0007] As a further solution of the present invention, the step of recording the configuration change time is: Through the network management protocol, the current network configuration data, including all configuration files and status information, is synchronously collected from the target device, data is captured, and the original network configuration data set is generated; Based on the original network configuration data set, time marking is performed to generate a network configuration data set with a timestamp; Analyze the network configuration data set with timestamps, record the change time of each configuration by comparing the differences in consecutive data snapshots, record each configuration change event, and output the configuration change record.

[0008] As a further solution of the present invention, the steps of obtaining the configuration time analysis result are: Based on the configuration change record, extract the timestamp of each change, calculate the time interval between two adjacent changes, and obtain a preliminary time interval data set; A deep statistical analysis of the preliminary time interval data set was performed using the formula,

[0009] Calculate the standard deviation SD and generate statistical analysis results, where Represents each data point, is the mean value of the data, is the total number of data points; Based on the statistical analysis results, data visualization processing is performed to intuitively display the distribution and abnormal values ​​of time intervals and generate configuration time analysis results.

[0010] As a further solution of the present invention, the analysis steps of the mutual influence between the parameters are: Calling the configuration time analysis result, extracting the time of each configuration change, and generating a configuration change time point list; Based on the configuration change time point list, statistically analyze the time intervals, identify the parameter modification frequency, and generate a parameter modification frequency analysis result; Modify the frequency analysis results according to the parameters, using the formula,

[0011] Calculate the time difference between parameters Configuration change frequency , analyze the mutual influence degree between the difference parameters and generate the mutual influence analysis results between the parameters, where Represents a point in time, An index representing a time point. Represents the total number of time points.

[0012] As a further solution of the present invention, the step of obtaining the interaction analysis result is: Based on the analysis results of the mutual influence between the parameters, a network diagram is constructed with the parameters as nodes and the mutual influence as connecting edges to generate a parameter interaction network diagram; By analyzing the parameter interaction network diagram, key nodes that affect network configuration are identified, the most active and sensitive parameters in configuration changes are recorded, and a list of key configuration change nodes is generated; The key configuration change node list and parameter interaction network diagram are used to analyze potential network configuration conflict points and generate interaction analysis results.

[0013] As a further solution of the present invention, the abnormal behavior inspection steps are: Collect the configuration operation records of network administrators, organize key data, including operation type, timestamp and executor information, and generate operation record sets; Based on the operation record set, sequence analysis is performed to identify operation dependencies and execution flow, using the formula,

[0014] Calculate the strength of relationships between operations , and obtain the tracking sequence, where Represents the total number of operation records. Representative The characteristic value of the operation, is a small constant; The tracking sequence is analyzed to identify the operation behaviors that deviate from the normal ones, and the impact of the abnormal behaviors is analyzed to generate abnormal operation behavior records.

[0015] As a further solution of the present invention, the steps for obtaining the behavior deviation assessment result are: Based on the abnormal operation behavior records, classify the data, separate normal and abnormal operations, analyze the frequency and characteristics of each operation, and generate preliminary classification results; Based on the preliminary classification results, analyze the co-occurrence patterns of abnormal operations, identify error patterns, including authority abuse and configuration errors, and generate error pattern identification records; Based on the error pattern recognition records, key abnormal configuration operations are extracted, the impact of the operations on system security is analyzed, the risk level of the behavior is evaluated, practical corrective measures are proposed, and behavioral deviation assessment results are generated.

[0016] As a further solution of the present invention, the steps of obtaining the network configuration security warning record are: Based on the interaction analysis results and behavior deviation assessment results, data fusion is performed, cross-validation analysis is performed on multiple feature parameters, deviation assessment is performed, and a comprehensive safety risk index is obtained; Based on the comprehensive safety risk index, the formula is adopted:

[0017] Calculating risk scores , generate dynamic security warning results, where Representative The risk factor of each risk factor is Representative The severity parameter of each risk factor, Representative The variance of each risk factor; Based on the dynamic security warning results, security warning information is released in real time, and each warning generation and release log is recorded, including timestamp, associated risk factors and warning intensity information, to build a network configuration security warning record.

[0018] Compared with the prior art, the advantages and positive effects of the present invention are: In the present invention, by real-time tracking of the time changes of network configuration, the timestamp and change interval of each configuration can be accurately recorded, support is supported for predicting potential configuration change patterns, and monitoring of network behavior is enhanced. Unexpected changes and configuration errors can be quickly identified, and the response speed and accuracy of network security can be greatly improved. By analyzing the mutual influence between parameters and constructing an interactive network diagram, the dependencies and potential conflicts between configurations can be systematically identified, and prevention can be achieved before problems occur. The operational behaviors of network administrators can be analyzed and classified, and unconventional operations can be identified and corrected, further enhancing the initiative and defense capabilities of network security management. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 is a system flow chart of the present invention; Figure 2 A flow chart for recording configuration change time of the present invention; Figure 3 A flow chart for obtaining the time analysis results of the configuration of the present invention; Figure 4 It is a flow chart of the analysis of the mutual influence between the parameters of the present invention; Figure 5 A flowchart for obtaining the interaction analysis results of the present invention; Figure 6 is a flow chart for checking abnormal behavior of the present invention; Figure 7 A flowchart for obtaining the behavior deviation evaluation results of the present invention; Figure 8 A flowchart for obtaining network configuration security warning records according to the present invention. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0021] In the description of the present invention, it should be understood that the terms "length", "width", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, in the description of the present invention, "multiple" means two or more, unless otherwise clearly and specifically defined.

[0022] See also Figure 1 , a network configuration security verification system comprises: The configuration time analysis module collects network configuration data, determines the timestamp of each configuration, records the time of each configuration change, calculates the time interval of configuration changes based on the record results, performs statistical analysis on the time interval data, and generates configuration time analysis results; The configuration interaction analysis module receives the configuration time analysis results, compares the time points of different configuration changes, identifies the parameter modification frequency, analyzes the mutual influence between parameters, builds a parameter interaction network diagram based on the analysis results, extracts key configuration change nodes, identifies potential network configuration conflicts, and generates interaction analysis results; The behavior deviation analysis module analyzes the network administrator's configuration operation records, tracks the operation sequence, checks the abnormal behavior in the operation, classifies and organizes the behavior according to the inspection results, identifies the error pattern, extracts the abnormal configuration operation, and generates the behavior deviation assessment results; The security warning generation module integrates the interaction analysis results and behavior deviation assessment results, evaluates potential network configuration risks, implements dynamic security warnings, publishes security warning information in real time, and generates network configuration security warning records.

[0023] The configuration time analysis results include timestamp set, interval distribution and change frequency; the interaction analysis results include parameter relationship diagram, node interaction analysis results and conflict point analysis results; the behavior deviation assessment results include behavior category, error frequency and abnormal operation set; the network configuration security warning record includes risk level, warning strategy and notification details.

[0024] See also Figure 2 , the steps to record the configuration change time are: Through the network management protocol, the current network configuration data, including all configuration files and status information, is synchronously collected from the target device, data is captured, and the original network configuration data set is generated; Through network management protocols such as SNMP or API, the current configuration data is synchronously captured from various network devices, covering the full configuration files and real-time status information of the devices. The process establishes a communication session with the device, sends a configuration data request, and receives the returned data. Specifically, in order to process data from different devices, the system must be able to recognize and parse configuration files in various formats, such as INI, XML, or JSON. At the same time, in order to ensure the integrity and accuracy of the data, a strict error detection and correction mechanism is implemented in the capture process, and each step of the operation and possible anomalies are recorded for subsequent analysis and fault diagnosis. In addition, the original data set is preliminarily cleaned and formatted to remove invalid or redundant configuration information, laying the foundation for the next step of data processing and analysis.

[0025] Based on the original network configuration data set, time marking is performed to generate a network configuration data set with a timestamp; The original network configuration dataset is timestamped using the formula: ,in, stands for Coordinated Universal Time, The delay time obtained from the Network Time Protocol (NTP) server is used to correct for possible time differences. For example, if (Coordinated Universal Time), and seconds (delay time), then the timestamp of the configuration data Calculated as This result demonstrates accurate time stamping of configuration data, providing a precise time reference for subsequent data processing and analysis.

[0026] Analyze the network configuration data set with timestamps, record the change time of each configuration by comparing the differences in consecutive data snapshots, record each configuration change event, and output the configuration change record; After a detailed analysis of the timestamped network configuration data set, the system compares the differences in the continuous data snapshots to accurately record the change time of each configuration. The process includes reviewing each configuration data item by item, marking the configuration items that have changed, and using the database's transaction log function to record the changes. The database automatically captures the changes and their timestamps when the data changes by setting triggers, ensuring that all configuration changes are recorded and traceable in real time. For data storage and query, index optimization technology and data partitioning strategies are used to improve data processing efficiency and reduce query time, which not only makes it easier for network administrators to track historical configuration changes, but also supports future network optimization and security auditing work.

[0027] See also Figure 3 , the steps to obtain the configuration time analysis results are: Based on the configuration change records, extract the timestamp of each change, calculate the time interval between two adjacent changes, and obtain a preliminary time interval dataset; In the data preprocessing stage, configuration change records are first exported from the database through a specific script. The records contain the exact timestamp of each change. Subsequently, the script automatically calculates the time interval between two adjacent changes, and the time interval is calculated in seconds. For example, if the timestamp of the first change record is 12:00:00 and the timestamp of the next change is 12:05:00, the time interval is 300 seconds. The calculation process involves traversing all records. Scripts written in Python can process tens of thousands of records to ensure the efficiency and accuracy of the calculation. It not only provides the basic data required for subsequent analysis, but also ensures the consistency and reliability of the data, laying a solid foundation for in-depth statistical analysis.

[0028] A deep statistical analysis of the preliminary time interval data set was performed using the formula,

[0029] Calculate the standard deviation SD and generate statistical analysis results, where Represents each data point, is the mean value of the data, is the total number of data points; There is a data set {2, 4, 4, 4, 5, 5, 7, 9}, the average , the total number of data points , the standard deviation is calculated as follows:

[0030]

[0031] It shows that most of the data points are within ±2.14 of the mean value 5.

[0032] Based on the statistical analysis results, data visualization is performed to intuitively display the distribution and abnormal values ​​of time intervals and generate configuration time analysis results; After obtaining detailed statistical analysis results, in order to better understand and convey information, data visualization processing is performed, such as using Python's matplotlib library to draw histograms and box plots based on the results of statistical analysis. The histogram shows the frequency distribution of configuration change time intervals, helping to identify the most frequent time intervals; while the box plot provides the median, quartiles, and possible outliers, intuitively showing the central trend and degree of dispersion of the data. Visualization processing not only enables network administrators to quickly capture the time pattern of configuration changes, but also facilitates data presentation in reporting and decision-making processes, effectively supporting network management and optimization decisions.

[0033] See also Figure 4 , the analysis steps of the mutual influence between parameters are: Call the configuration time analysis results, extract the time of each configuration change, and generate a list of configuration change time points; The generation of the configuration change time point list depends on the actual timestamp of each configuration change extracted from the device configuration database. First, the system administrator or automated script will regularly export data from the configuration files of the core network devices. The data includes the timestamps and key configuration items of the configuration files. Then, the exported data is transmitted to the central database for storage and management. The records in the database reflect the time of each specific configuration change. Next, the database is queried to extract the timestamp of each configuration change and summarize the timestamps into a list. Each timestamp is a calibrated server time to ensure the consistency and accuracy of time records.

[0034] Based on the configuration change time point list, perform statistical analysis on the time intervals, identify the parameter modification frequency, and generate parameter modification frequency analysis results; To extract the time interval from the list of configuration change time points, first read the list containing all configuration change timestamps. The list is generated by the aforementioned process and contains all relevant data extracted from the device configuration database. Then collect all calculated time interval data and calculate the mean, median, standard deviation and other statistical parameters of the time interval. The statistical results provide a quantitative description of the frequency of device configuration changes. Finally, through the statistical analysis results, the network management team can identify the existing configuration update patterns, such as the concentration of configuration changes within a specific time window, thereby providing data support for further optimizing the configuration management strategy.

[0035] Modify the frequency analysis results according to the parameters, using the formula,

[0036] Calculate the time difference between parameters Configuration change frequency , analyze the mutual influence degree between the difference parameters and generate the mutual influence analysis results between the parameters, where Represents a point in time, An index representing a time point. represents the total number of time points; Configuration time point , then the time interval The sample data is , assuming , then after the sum operation , put it into the formula and get , indicating that there is an average configuration change every 2 days. The result shows the frequency of configuration changes and has important guiding significance for the maintenance and update cycle of the equipment.

[0037] See also Figure 5 , the steps to obtain the interaction analysis results are: Based on the analysis results of mutual influence between parameters, a network diagram is constructed with parameters as nodes and mutual influence as connecting edges to generate a parameter interaction network diagram; To integrate the data on the mutual influence between parameters, first, the network administrator extracts the configuration change records of all relevant parameters from the database. Each parameter is regarded as an independent node, and the interaction between parameters is represented by edges. The weight of the edge is determined according to the influence between the parameters. The process ensures the accuracy of the graph, so that each node and edge has a correct correspondence in a practical sense. The final generated network graph not only provides technicians with an intuitive display of parameter impact, but also facilitates further analysis and monitoring.

[0038] By analyzing the parameter interaction network diagram, we can identify the key nodes that affect the network configuration, record the most active and sensitive parameters in the configuration change, and generate a list of key configuration change nodes. In the step of identifying key configuration change nodes, the core theory of network analysis is used. First, each node in the network is defined, and then the degree centrality, closeness centrality, and betweenness centrality of these nodes are calculated to determine which nodes occupy a core position in the entire network. Core nodes are often the most frequent or most sensitive parameters in network configuration. By identifying key nodes, network administrators can monitor and maintain the network more effectively and prevent network failures caused by improper configuration of key parameters.

[0039] Analyze potential network configuration conflict points and generate interaction analysis results using the key configuration change node list and parameter interaction network diagram; Combined with the list of key configuration change nodes and the parameter interaction network diagram, in-depth configuration conflict detection is performed on the identified key nodes. This includes comparing the configuration requirements of key nodes one by one, checking and recording any possible configuration contradictions or conflict points. In addition, the analysis also involves predicting how conflicts affect the overall performance and stability of the network. With this approach, the network team can not only foresee potential problems, but also develop effective solutions to improve the operational efficiency and reliability of the network. The process is completely based on data obtained from the network diagram and actual configuration, ensuring the practicality and accuracy of the results.

[0040] See also Figure 6 , the steps to check abnormal behavior are: Collect the configuration operation records of network administrators, organize key data, including operation type, timestamp and executor information, and generate operation record sets; In the process of collecting the configuration operation records of network administrators, we first set specific indicators for data collection, including the specific type of operation (such as system settings, security updates, permission adjustments, etc.), the timestamp of the operation, and the identity information of the operator. The data is automatically recorded and synchronized through the network operation log system. Subsequently, the operation records are queried and screened to exclude data that is not fully recorded due to permission restrictions, ensuring that each record reflects real and effective operations. In addition, the operation records are formatted to unify data from different sources into a standard format, such as converting timestamps to UTC format and encoding operator names to eliminate the sensitivity of personal information. The processed data set will provide a clear and consistent input source for subsequent data analysis, ensuring the accuracy of data analysis and the reliability of operation tracking.

[0041] Based on the operation record set, perform sequence analysis to identify operation dependencies and execution flow, using formulas,

[0042] Calculate the strength of relationships between operations , and obtain the tracking sequence, where Represents the total number of operation records. Representative The characteristic value of the operation, is a small constant; Now there are 100 valid operation records, namely .

[0043] Representative The characteristic value of an operation is used to analyze the increase in network load. If an operation increases the network load by 20 units, then .

[0044] is a small constant used to ensure the validity of logarithmic calculation. Here we take .

[0045] Compute the logarithmic part of each operation:

[0046] The logarithmic value is:

[0047] Take the absolute value of the logarithm and take the square root:

[0048] Add up the calculation results of all operations. Here, each operation is simplified to 20 units of network load, so:

[0049] Calculate the final result :

[0050] result It shows that the dependence of the operation sequence obtained from the log data analysis is relatively high, suggesting that further analysis of possible abnormal operation behaviors is needed. This value reflects the complexity and interdependence of the operation sequence in the mathematical model, which is the basis for subsequent analysis.

[0051] Analyze and track sequences, identify operational behaviors that deviate from the norm, analyze the impact of abnormal behaviors, and generate records of abnormal operational behaviors; In the analysis of abnormal operation behavior, the system first uses a multi-dimensional analysis method to detect abnormal patterns based on the tracked operation sequence. Specifically, the frequent patterns of operation types, executors and their execution time are statistically analyzed. For example, abnormally frequent configuration changes in a specific time period are discovered through frequent item set mining technology. In addition, through time series analysis, abnormal shortening or lengthening of the time interval between operations is identified, indicating that the operator quickly changed the system settings without sufficient review or there is an abnormal delay between operations. After completing the preliminary statistics and pattern recognition of the data, the suspected abnormal operations are recorded in detail, and the timeline and frequency distribution of the operation sequence are displayed using graphical tools, so that network administrators can intuitively see potential security risks or configuration errors. The abnormal behavior report finally generated lists all potential risk operations and their possible consequences in detail, providing an important basis for subsequent security audits and risk assessments.

[0052] See also Figure 7 , the steps to obtain the behavior deviation assessment results are: Based on the abnormal operation behavior records, classify the data, separate normal and abnormal operations, analyze the frequency and characteristics of each operation, and generate preliminary classification results; In the classification of abnormal operation behaviors, relevant data is automatically extracted from the network operation log through data collection, including the type of operation, execution time, executor information, etc. Data mining algorithms, such as K-means clustering, are used to classify operation behaviors according to operation type and frequency. By calculating the distance between each data point, the data is divided into two categories: "normal operation" and "abnormal operation". Each type of operation will be further analyzed to confirm its pattern and characteristics. The classification process depends not only on the accuracy of the algorithm itself, but also on the quality of the input data and the thoroughness of preprocessing, such as outlier processing and data standardization, to ensure the reliability and practicality of the final classification results.

[0053] Based on the preliminary classification results, analyze the co-occurrence patterns of abnormal operations, identify error patterns, including permission abuse and configuration errors, and generate error pattern identification records; After determining the preliminary operation classification, association rule mining technology is used to conduct a deeper analysis of abnormal operations. The Apriori algorithm is applied in the process to reveal potential error patterns by identifying the co-occurrence relationship between various operations. For example, if there is a change in security settings after multiple unauthorized access attempts, this pattern will be marked as a potential security risk. The analysis process includes setting appropriate support and confidence thresholds to ensure the accuracy of the results, so that managers can develop effective response strategies for these error patterns.

[0054] Based on the error pattern recognition records, extract key abnormal configuration operations, analyze the impact of operations on system security, evaluate the risk level of the behavior, propose practical corrective measures, and generate behavior deviation assessment results; After identifying and analyzing the error patterns, the next step is to extract specific abnormal configuration operations and conduct a detailed behavioral deviation assessment. The process uses a decision tree to analyze various abnormal operations, which takes into account the risk level, frequency of occurrence, and potential negative impact of the operation. By building a decision tree model, the consequences of each operation can be evaluated based on historical data and the impact of similar events, so as to develop corresponding mitigation measures for each risk type. This assessment report will eventually describe each identified abnormal operation in detail, provide countermeasures and correction suggestions, and help network administrators understand potential security threats and take appropriate preventive or corrective measures.

[0055] See also Figure 8 , the steps to obtain the network configuration security warning record are: Based on the results of interaction analysis and behavior deviation assessment, data fusion is performed, cross-validation analysis is conducted on multiple feature parameters, deviation assessment is performed, and comprehensive safety risk indicators are obtained; Based on the interaction analysis results and behavior deviation assessment results, the multiple characteristic parameters contained therein are screened and data integrated, and indicators such as delay peak, packet loss rate, and traffic anomaly in the interaction analysis results are extracted. They are normalized according to the normal range value and historical fluctuation of each parameter to ensure data standardization. Subsequently, the mean, variance, skewness and other statistics of each parameter are calculated in the normalized results, and the deviation assessment matrix is ​​generated using the statistics, and the outliers are marked. On the basis of the deviation assessment matrix, according to the statistical characteristics of the behavior deviation, the interaction parameters and the behavior deviation distribution data are integrated, and the Euclidean distance method is used to calculate the deviation measurement of each parameter in the multidimensional space to generate the relevant deviation score matrix. Subsequently, the high deviation items of the deviation score matrix are screened according to multiple dimensions (such as time window, data flow type, node location), and finally the weighted calculation of each deviation score is used to obtain the comprehensive indicator value of security risk, which directly reflects the potential risk intensity and range in the network configuration.

[0056] Based on the comprehensive safety risk index, the formula is adopted.

[0057] Calculating risk scores , generate dynamic security warning results, where Representative The risk factor of each risk factor is Representative The severity parameter of each risk factor, Representative The variance of each risk factor; The risk factor of a certain network configuration event monitored is 5; The severity parameter of the ith risk factor is obtained through multiple measurements and is used to characterize the severity of the factor in the risk composition. For example, for a high-risk event, its severity is 4 (1-5 indicates increasing severity); is the variance of the ith risk factor, which is obtained by statistically analyzing the variance of historical data of similar risk factors. For example, if the historical variance of an event is 9, the values ​​of each parameter are substituted into the formula:

[0058] The final calculated risk score is 6.67, which shows that the risk of this specific risk factor is more significant in the overall risk and is one of the triggering conditions for dynamic safety warnings.

[0059] Based on dynamic security warning results, security warning information is released in real time, and each warning generation and release log is recorded, including timestamp, associated risk factors and warning intensity information, to build network configuration security warning records; Based on the dynamic security warning results, the results are published to the monitoring system and detailed records are made in the system. First, the set trigger threshold is used to determine whether the release conditions are met. If the conditions are met, the main risk factors, risk levels, trigger time and other information in the warning information are extracted and attached to the log record template in a table form. Subsequently, the detailed attributes of each risk factor are recorded, such as its risk value, severity and associated network configuration items. The changing trend is analyzed by comparing the trigger frequencies of different configuration items. After the trigger conditions are met, a warning log entry is generated and saved in the monitoring system database. In addition, the log record will mark the warning intensity level, processing time limit and recommended response measures of the risk factor, and finally form a complete network configuration security warning record in the system to ensure the historical traceability of all security event information and the integrity of real-time monitoring.

[0060] The above are only preferred embodiments of the present invention and are not intended to limit the present invention in other forms. Any technician familiar with the profession may use the technical contents disclosed above to change or modify them into equivalent embodiments with equivalent changes and apply them to other fields. However, any simple modification, equivalent change and modification made to the above embodiments based on the technical essence of the present invention without departing from the technical solution of the present invention still falls within the protection scope of the technical solution of the present invention.

Claims

1. A network configuration security verification system, characterized in that: The system comprises: The configuration time analysis module collects network configuration data, determines the timestamp of each configuration, records the time of each configuration change, calculates the time interval of configuration changes based on the record results, performs statistical analysis on the time interval data, and generates configuration time analysis results; The configuration interaction analysis module receives the configuration time analysis results, compares the time points of different configuration changes, identifies the parameter modification frequency, analyzes the mutual influence between parameters, constructs a parameter interaction network diagram based on the analysis results, extracts key configuration change nodes, identifies potential network configuration conflicts, and generates interaction analysis results; The behavior deviation analysis module analyzes the network administrator's configuration operation records, tracks the operation sequence, checks the abnormal behavior in the operation, classifies and organizes the behavior according to the inspection results, identifies the error pattern, extracts the abnormal configuration operation, and generates the behavior deviation assessment results; The security warning generation module integrates the interaction analysis results and the behavior deviation assessment results, evaluates potential network configuration risks, implements dynamic security warnings, publishes security warning information in real time, and generates network configuration security warning records.

2. The network configuration security verification system according to claim 1, characterized in that: The steps for recording the configuration change time are as follows: Through the network management protocol, the current network configuration data, including all configuration files and status information, is synchronously collected from the target device, data is captured, and the original network configuration data set is generated; Based on the original network configuration data set, time marking is performed to generate a network configuration data set with a timestamp; Analyze the network configuration data set with timestamps, record the change time of each configuration by comparing the differences in consecutive data snapshots, record each configuration change event, and output the configuration change record.

3. The network configuration security verification system according to claim 2, characterized in that: The steps for obtaining the configuration time analysis result are: Based on the configuration change record, extract the timestamp of each change, calculate the time interval between two adjacent changes, and obtain a preliminary time interval data set; A deep statistical analysis of the preliminary time interval data set was performed using the formula, Calculate the standard deviation SD and generate statistical analysis results, where Represents each data point, is the mean value of the data, is the total number of data points; Based on the statistical analysis results, data visualization processing is performed to intuitively display the distribution and abnormal values ​​of time intervals and generate configuration time analysis results.

4. The network configuration security verification system according to claim 3, characterized in that: The analysis steps of the mutual influence between the parameters are as follows: Calling the configuration time analysis result, extracting the time of each configuration change, and generating a configuration change time point list; Based on the configuration change time point list, statistically analyze the time intervals, identify the parameter modification frequency, and generate a parameter modification frequency analysis result; Modify the frequency analysis results according to the parameters, using the formula, Calculate the time difference between parameters Configuration change frequency , analyze the mutual influence degree between the difference parameters and generate the mutual influence analysis results between the parameters, where Represents a point in time, An index representing a time point. Represents the total number of time points.

5. The network configuration security verification system according to claim 4, characterized in that: The steps for obtaining the interaction analysis results are: Based on the analysis results of the mutual influence between the parameters, a network diagram is constructed with the parameters as nodes and the mutual influence as connecting edges to generate a parameter interaction network diagram; By analyzing the parameter interaction network diagram, key nodes that affect network configuration are identified, the most active and sensitive parameters in configuration changes are recorded, and a list of key configuration change nodes is generated; The key configuration change node list and parameter interaction network diagram are used to analyze potential network configuration conflict points and generate interaction analysis results.

6. The network configuration security verification system according to claim 5, characterized in that: The steps for checking the abnormal behavior are: Collect the configuration operation records of network administrators, organize key data, including operation type, timestamp and executor information, and generate operation record sets; Based on the operation record set, sequence analysis is performed to identify operation dependencies and execution flow, using the formula, Calculate the strength of relationships between operations , and obtain the tracking sequence, where Represents the total number of operation records. Representative The characteristic value of the operation, is a small constant; The tracking sequence is analyzed to identify the operation behaviors that deviate from the normal ones, and the impact of the abnormal behaviors is analyzed to generate abnormal operation behavior records.

7. The network configuration security verification system according to claim 6, characterized in that: The steps for obtaining the behavior deviation assessment result are as follows: Based on the abnormal operation behavior records, classify the data, separate normal and abnormal operations, analyze the frequency and characteristics of each operation, and generate preliminary classification results; Based on the preliminary classification results, analyze the co-occurrence patterns of abnormal operations, identify error patterns, including authority abuse and configuration errors, and generate error pattern identification records; Based on the error pattern recognition records, key abnormal configuration operations are extracted, the impact of the operations on system security is analyzed, the risk level of the behavior is evaluated, practical corrective measures are proposed, and behavioral deviation assessment results are generated.

8. The network configuration security verification system according to claim 7, characterized in that: The steps for obtaining the network configuration security warning record are: Based on the interaction analysis results and behavior deviation assessment results, data fusion is performed, cross-validation analysis is performed on multiple feature parameters, deviation assessment is performed, and a comprehensive safety risk index is obtained; Based on the comprehensive safety risk index, the formula is adopted: Calculating risk scores , generate dynamic security warning results, where Representative The risk factor of each risk factor is Representative The severity parameter of each risk factor, Representative The variance of each risk factor; Based on the dynamic security warning results, security warning information is released in real time, and each warning generation and release log is recorded, including timestamp, associated risk factors and warning intensity information, to build a network configuration security warning record.

Images