Security prediction method and device based on node relation chain, equipment and storage medium

Abstract

The invention discloses a security prediction method and device based on a node relation chain, equipment and a storage medium, belongs to the technical field of network security, and is used for improving the security of data transmission. The method comprises: according to a target node of a target path, determining an association node intercommunicated with the target node in networking, the target path being used for forwarding data; determining the associated node interacting with other nodes except the associated node in the network as an object node; and performing security prediction on a relation chain comprising the target node and the object node to determine the security of forwarding data through the target path.

Description

Technical Field

[0001] The present application belongs to the field of network security technology, and specifically relates to a security prediction method, device, equipment and storage medium based on a node relationship chain. Background Art

[0002] In the era of cloud-network integration, flexible and agile network service capabilities directly affect the competitiveness of operators. SR (Segment Routing) is a type of source routing technology, and SRv6 is the application of SR technology in IPv6 networks. The emergence of SRv6 is a huge innovation. It combines SDN technology to enable programmable networks, which provides innovative soil for network infrastructure services and value-added network services in the cloud-network era. When IPv6 nodes in SRv6 networks obtain traffic, message and other data, network security assessment and message forwarding to more matching nodes are the future development trends.

[0003] However, current network security mainly relies on network firewalls and network security strategies for passive security defense. Given the complex relationships between current network applications and the multiple layers of dependency, it is difficult to troubleshoot network security issues, it is difficult to fully predict hidden network security issues, and it is impossible to reliably guarantee the secure forwarding of data. Summary of the invention

[0004] The embodiments of the present application provide a node relationship chain-based security prediction method, apparatus, device and storage medium, which can solve the problem that it is difficult to comprehensively predict hidden network security issues and cannot reliably guarantee the secure forwarding of data.

[0005] In a first aspect, an embodiment of the present application provides a security prediction method based on a node relationship chain, the method comprising: determining, based on a target node of a target path, an associated node in a network that is interoperable with the target node, the target path being used to forward data; determining the associated node that interacts with other nodes in the network except the associated node as an object node; and performing security prediction on a relationship chain including the target node and the object node to determine the security of forwarding data through the target path.

[0006] In the second aspect, an embodiment of the present application provides a security prediction method device based on a node relationship chain, the device comprising: a first determination module, used to determine, based on the target node of the target path, an associated node in the network that is interconnected with the target node, and the target path is used to forward data; a second determination module, used to determine the associated node that interacts with other nodes in the network except the associated node as an object node; a prediction module, used to perform security prediction on the relationship chain including the target node and the object node to determine the security of forwarding data through the target path.

[0007] In a third aspect, an embodiment of the present application provides an electronic device, which includes a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the method described in the first aspect.

[0008] In a fourth aspect, an embodiment of the present application provides a readable storage medium, on which a program or instruction is stored, and when the program or instruction is executed by a processor, the steps of the method described in the first aspect are implemented.

[0009] In an embodiment of the present application, by determining, based on the target node of the target path, an associated node in the network that is interoperable with the target node, the target path is used to forward data; the associated node that interacts with other nodes in the network except the associated node is determined as an object node; and a security prediction is performed on the relationship chain including the target node and the object node to determine the security of forwarding data through the target path. This enables a comprehensive security prediction of the network and improves the security of the networking path used to transmit data. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 It is a flowchart of a security prediction method based on a node relationship chain provided in an embodiment of the present application; Figure 2 It is a structural schematic diagram of a safety prediction device based on a node relationship chain provided in an embodiment of the present application; Figure 3 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0011] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0012] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0013] In conjunction with the accompanying drawings, a node relationship chain-based security prediction method, device, equipment and storage medium provided by the embodiment of the present application are described in detail through specific embodiments and their application scenarios.

[0014] Figure 1 An embodiment of the present application provides a security prediction method based on a node relationship chain, which can be performed by an electronic device, and the electronic device can include: a server and / or a terminal device. In other words, the method can be performed by software or hardware installed in the electronic device, and the method includes the following steps: Step 102: According to the target node of the target path, determine the associated node in the network that is interoperable with the target node.

[0015] In the embodiment of the present application, the networking is Srv6 networking. In this networking, it is first necessary to determine the target path for forwarding messages, wireless sensor data and other data, and determine the associated node in the networking that is interoperable with the target node according to the target node of the target path.

[0016] In one implementation, before determining the associated nodes in the network that are interconnected with the target node based on the target path, it also includes: performing indestructibility calculations on each first path between nodes in the network to obtain a path indestructibility index of each first path; and determining the target path from each first path based on the path indestructibility index of each first path.

[0017] In an embodiment of the present application, a scheduling program is provided, and the scheduling program is deployed in all nodes in the network. The scheduling program consists of route matching and system indestructibility algorithms. Through the scheduling program, in the Srv6 network, the collected data needs to be indestructible for the first path between each node in the network before entering the first node for forwarding, and the path indestructibility index of each of the first paths is obtained; route matching is performed according to the path indestructibility index of each of the first paths, and the optimal target path is determined from each of the first paths. The Srv6 header information of the target path is set to 8, which represents the highest sending priority, and 15 is the lowest. Thus, a method for determining the priority of sending data.

[0018] In one implementation, the performing indestructibility calculation on each first path between nodes in the network to obtain a path indestructibility index of each first path includes: Calculate the node indestructibility index of each node in the network; and obtain the path indestructibility index of each first path according to the indestructibility index of each node in the network.

[0019] In the embodiments of the present application, the indestructibility index is an important basis for indestructibility optimization. The command information system structure indestructibility evaluation index is a comprehensive reflection of the system structure heterogeneity, network correlation, dynamic adaptability and inherent protection. It is also the result of the emergence of the system as a whole and a new feature in the system evolution process. Its evaluation concept is transformed from the traditional reductionist assumption of separable independent indicators to the overall related network indicators of complex network theory. In order to reflect the system's indestructibility from four aspects: spatial scale, time scale, overall protection and command effectiveness, this application proposes four indestructibility evaluation indicators: connectivity, timeliness protection and command chain integrity.

[0020] In an embodiment of the present application, in order to perform indestructibility calculation on each first path between nodes in the networking, it is necessary to calculate the node indestructibility index of each node in the networking, and then obtain the path indestructibility index of each first path based on the indestructibility index of each node in the networking.

[0021] In one implementation, each node in the network includes a node to be calculated, and calculating the node indestructibility index of each node in the network includes: obtaining a second path in the first path whose length is less than or equal to a preset length; determining a first value of the node to be calculated based on the degree value of the node to be calculated, a path set including the node to be calculated in the second path, and any second path in the path set, wherein the first value represents the sum of the proportions of the node to be calculated in each of the second paths; and determining the node indestructibility index of the node to be calculated based on the first value.

[0022] Specifically, all second paths whose lengths do not exceed a preset length k (k>1) are obtained from the network, and the sum of the proportions of the degree of the node v to be calculated in each path is recorded as the first value T(v), and its value is determined by the following formula.

[0023]

[0024] Where: Indicates the degree value of the node to be calculated; represents a set of paths with nodes s and t as endpoints and passing through the node v to be calculated; i represents any second path in the path set.

[0025] In one implementation, determining the node indestructibility index of the node to be calculated based on the first value includes: determining the second value of the node to be calculated based on the first value, the number of second paths in the path set whose length does not exceed a preset threshold, the number of shortest paths from the starting node to the tail node, and the number of shortest paths including the node to be calculated, wherein at least one first path including the starting node and the tail node includes the node to be calculated; determining the node indestructibility index of the node to be calculated based on the first value, the second value, and the clustering coefficient of the node to be calculated.

[0026] The second value of the node to be calculated is determined according to the first value, the number of second paths whose lengths do not exceed the preset threshold in the path set, the number of shortest paths from the start node to the end node, and the number of shortest paths including the node to be calculated. The specific formula is as follows:

[0027] in, Ck (v) represents the second value, which is the local betweenness centrality index value, p(v) represents the number of all second paths in the network that pass through the node v to be calculated and whose length does not exceed the preset threshold, represents the number of shortest paths from node s to node t, Represents the number of shortest paths from node s to node t through the node v to be calculated.

[0028] According to the first value, the second value, and the clustering coefficient of the node to be calculated, the node invulnerability index of the node to be calculated can be determined. Specifically, the calculation formula is as follows:

[0029] The node anti-destruction index is defined as the correlation between the destruction of the node to be calculated in the network and the destruction of the entire network, which is recorded as S(v). The larger the value, the easier it is for the destruction of the node to lead to the destruction of the entire network. Indicates the clustering coefficient of the node v to be calculated; is the second value of the node v to be calculated (local betweenness centrality index).

[0030] The accuracy of the node invulnerability index is directly related to the value of the longest distance constraint k. In the local range of betweenness centrality, the maximum distance constraint k increases with the size of the network. However, the real network has a small-world property. Through experimental analysis and theoretical basis, when the network size is large, k = 6 is a value that can obtain more accurate calculation results. As the value of k increases, the local range determined by the maximum distance constraint will also increase. When it increases to a certain threshold, the calculation of the local betweenness centrality of the node will degenerate into the calculation of the global betweenness centrality. The local shortest path solution range for the local center point will also be converted into the calculation of the global shortest path of the network. The node invulnerability index reflects the strength of the attack resistance of a single node in the network. On this basis, the network invulnerability metric can be defined to measure the anti-attack capability of the entire industrial control circuit topology.

[0031] After the target path (secure transmission path) is matched and before data transmission, in order to prevent possible undiscovered security risks, the log hierarchical mining method is used to search for messages associated with the forwarded messages and perform security predictions. If the predicted trend increases, the security is high, avoiding the possibility of hidden network attack Trojans and ransomware viruses.

[0032] In order to prevent various disasters and abnormal message data from awakening potential virus programs hidden in network nodes when forwarding, hierarchical association matching is performed on historical data of the same protocol type and business weight of the forwarded message to find out which nodes have an association with the data to be forwarded.

[0033] After obtaining the target path, the correlation analysis can be performed between all the target nodes of the target path and the non-passing but intercommunication nodes to determine the associated nodes in the network that are intercommunication with the target node. In this way, the invulnerability evaluation can be performed on all the first paths between the destination nodes before the data to be forwarded enters the first node for forwarding in the Srv6 network. The scheduler is deployed in all nodes in the network. The scheduler consists of route matching and system invulnerability algorithms. Route matching is performed based on the path invulnerability value to determine the optimal path.

[0034] Step 104: Determine the associated node that interacts with other nodes in the network except the associated node as the target node.

[0035] Specifically, an associated node that interacts with other nodes in the network except the associated node may be determined as an object node.

[0036] In one implementation, the associated node that interacts with other nodes in the network except the associated node is determined as an object node, including: marking the target node and the associated node for security based on their business weights, node indestructibility indicators, and historical attack times; and determining, based on the security marking, the nodes among the associated nodes that interact with the other nodes in terms of hardware environment and network application environment as object nodes.

[0037] Specifically, the initial security mark of the node can be made through the business weight of each target node and the associated node, the node anti-destruction index and the number of historical attacks. The service association matching is carried out in order according to the initial security mark. The matching rule is that all the nodes in the network that have hardware and network application environment exchanges with other nodes in the current non-message forwarding path are regarded as object nodes, and the relationship chain is formed to the maximum extent. The data of these object nodes records the resource information between the server and the database, the middleware, the server CPU, the memory, the disk, and the process in different time dimensions.

[0038] Step 106: Perform security prediction on the relationship chain including the target node and the object node to determine the security of forwarding data through the target path.

[0039] Specifically, after obtaining the object node and the target node, a relationship chain may be formed, and then a security prediction may be performed on the relationship chain to determine the security of forwarding data through the target path. An increasing prediction trend indicates high security.

[0040] The node relationship chain-based security prediction method provided in the embodiment of the present application determines, based on the target node of the target path, the associated nodes in the network that are interoperable with the target node, and the target path is used to forward data; the associated nodes that interact with other nodes in the network except the associated nodes are determined as object nodes; and a security prediction is performed on the relationship chain including the target node and the object node to determine the security of forwarding data through the target path. This method can perform a comprehensive security prediction on the network, improve the security of the networking path used to transmit data, and solve the problem that it is difficult to comprehensively predict hidden network security issues and cannot reliably guarantee the secure forwarding of data.

[0041] In one implementation, the performing security prediction on the relationship chain including the target node and the object node includes: performing security prediction on the relationship chain using a Markov chain security prediction model.

[0042] Specifically, the security of the relationship chain including the target node and the object node can be predicted by the Markov chain security prediction model. The larger the prediction value, the higher the security. The formula of the Markov chain security prediction model is as follows: X(k+1)=X(k)×P Among them, X(k) represents the state vector of the trend analysis and prediction object at time t=k, P represents the one-step transition probability matrix, and X(k+1) represents the state vector of the trend analysis and prediction object at time t=k+1.

[0043] Probability of safety trend within the forwarding message data range [0.3, 0.7]; probability of safety trend turning from high to low within the data retrieval range of this forwarding message [0.6, 0.4]; probability of safety trend turning from low to high within the data retrieval range of this forwarding message [0.3, 0.7]; probability of safety trend turning from high to low within the data retrieval range of the next forwarding message: 39%; 0.3x0.6+0.3x0.7=0.39; probability of safety trend turning from low to high within the data retrieval range of the next forwarding message: 61%; 0.3x0.4+7x0.7=0.61.

[0044] The embodiments of the present application highlight the status of the method for optimizing path network security in the SRv6 network in combination with the SRv6 message environment, and approach the computational complexity problem of massive forwarding data through log analysis to improve processing timeliness and accuracy.

[0045] The security prediction method based on the node relationship chain provided in the embodiment of the present application performs an anti-destruction assessment on all paths between the destination nodes for the collected wireless sensor data in the Srv6 network before entering the first node for forwarding. The scheduler is deployed on all nodes in the network. The scheduler consists of route matching and system anti-destruction algorithms. Route matching is performed based on the path anti-destruction value, and the optimal path Srv6 header information is set to 8, which represents the highest sending priority, and 15 is the lowest. This is a method for determining the priority of sending protocol messages. Secondly, after the secure transmission path is matched and before data transmission, in order to prevent possible undiscovered security risks, a log hierarchical mining method is used to search for messages associated with the forwarded messages and perform security predictions. If the predicted trend increases, the security is high, avoiding the possibility of hidden network attacks such as Trojans and ransomware.

[0046] It should be noted that the node relationship chain-based security prediction method provided in the embodiment of the present application can be executed by a node relationship chain-based security prediction device, or a control module in the node relationship chain-based security prediction device for executing the node relationship chain-based security prediction method. In the embodiment of the present application, the node relationship chain-based security prediction device is used as an example to execute the node relationship chain-based security prediction method to illustrate the node relationship chain-based security prediction device provided in the embodiment of the present application.

[0047] Figure 2 Schematic diagram of the structure of a security prediction device based on a node relationship chain according to an embodiment of the present application. Figure 2 As shown, the safety prediction device 200 based on the node relationship chain includes: a first determination module 210, a second determination module 220 and a prediction module 230.

[0048] The first determination module 210 is used to determine the associated nodes in the network that are interconnected with the target node based on the target node of the target path, and the target path is used to forward data; the second determination module 220 is used to determine the associated nodes that interact with other nodes in the network except the associated nodes as object nodes; the prediction module 230 is used to perform security prediction on the relationship chain including the target node and the object node to determine the security of forwarding data through the target path.

[0049] In one implementation, the second determination module 230 is used to perform security marking on the target node and the associated node based on their business weights, node indestructibility indicators, and historical attack times; based on the security markings, the nodes among the associated nodes that have hardware environments and network application environments that interact with the other nodes are determined as object nodes.

[0050] In one implementation, the first determination module 220 is also used to perform security marking on the target node and the associated node based on their business weights, node indestructibility indicators, and historical attack times; based on the security marking, the nodes among the associated nodes that have hardware environments and network application environments that interact with the other nodes are determined as object nodes.

[0051] In one implementation, the first determination module 220 is used to calculate the node survivability index of each node in the network; and obtain the path survivability index of each first path according to the survivability index of each node in the network.

[0052] In one implementation, each node in the network includes a node to be calculated, and the first determination module 220 is used to obtain a second path in the first path whose length is less than or equal to a preset length; determine the first value of the node to be calculated based on the degree value of the node to be calculated, the path set including the node to be calculated in the second path, and any second path in the path set, the first value represents the sum of the proportions of the node to be calculated in each of the second paths; and determine the node indestructibility index of the node to be calculated based on the first value.

[0053] In one implementation, the first determination module 220 is used to determine the second value of the node to be calculated based on the first value, the number of second paths in the path set whose length does not exceed a preset threshold, the number of shortest paths from the starting node to the tail node, and the number of shortest paths including the node to be calculated, wherein at least one first path including the starting node and the tail node includes the node to be calculated; and determine the node indestructibility index of the node to be calculated based on the first value, the second value, and the clustering coefficient of the node to be calculated.

[0054] In one implementation, the prediction module 230 is used to perform security prediction on the relationship chain through a Markov chain security prediction model.

[0055] The node relationship chain-based security prediction device in the embodiment of the present application can be a device, or a component, integrated circuit, or chip in a terminal. The device can be a mobile electronic device or a non-mobile electronic device. Exemplarily, the mobile electronic device can be a mobile phone, a tablet computer, a laptop computer, a PDA, an in-vehicle electronic device, a wearable device, an ultra-mobile personal computer (UMPC), a netbook, or a personal digital assistant (PDA), etc. The non-mobile electronic device can be a server, a network attached storage (NAS), a personal computer (PC), a television (TV), a teller machine or a self-service machine, etc., which is not specifically limited in the embodiment of the present application.

[0056] The node relationship chain-based security prediction device in the embodiment of the present application may be a device having an operating system. The operating system may be an Android operating system, an iOS operating system, or other possible operating systems, which are not specifically limited in the embodiment of the present application.

[0057] The node relationship chain-based security prediction device provided in the embodiment of the present application can achieve Figure 1 To avoid repetition, the various processes implemented by the method embodiment are not described here.

[0058] like Figure 3 As shown, an embodiment of the present application further provides an electronic device 300, including a processor 301 and a memory 302, wherein the memory 302 stores a program or instruction that can be run on the processor 301, and when the program or instruction is executed by the processor 301, it is implemented as follows: according to the target node of the target path, determining the associated nodes in the network that are interoperable with the target node, and the target path is used to forward data; determining the associated nodes that interact with other nodes in the network except the associated nodes as object nodes; and performing security prediction on the relationship chain including the target node and the object node to determine the security of forwarding data through the target path.

[0059] In one implementation, the target node and the associated node are security marked according to their business weights, node indestructibility indicators, and historical attack times; based on the security marks, the nodes among the associated nodes that have hardware environments and network application environments that interact with the other nodes are determined as object nodes.

[0060] In one implementation, before determining, based on the target node of the target path, the associated nodes in the network that are interconnected with the target node, an indestructibility calculation is performed on each first path between the nodes in the network to obtain a path indestructibility index of each first path; and based on the path indestructibility index of each first path, a target path is determined from each first path.

[0061] In one implementation, a node survivability index of each node in the network is calculated; and a path survivability index of each first path is obtained according to the survivability index of each node in the network.

[0062] In one implementation, each node in the network includes a node to be calculated, and a second path in the first path whose length is less than or equal to a preset length is obtained; a first value of the node to be calculated is determined based on the degree value of the node to be calculated, a path set including the node to be calculated in the second path, and any second path in the path set, wherein the first value represents the sum of the proportions of the node to be calculated in each of the second paths; and a node indestructibility index of the node to be calculated is determined based on the first value.

[0063] In one implementation, the second value of the node to be calculated is determined based on the first value, the number of second paths in the path set whose length does not exceed a preset threshold, the number of shortest paths from the starting node to the tail node, and the number of shortest paths including the node to be calculated, wherein at least one first path including the starting node and the tail node includes the node to be calculated; and the node indestructibility index of the node to be calculated is determined based on the first value, the second value, and the clustering coefficient of the node to be calculated.

[0064] In one implementation, the security of the relationship chain is predicted using a Markov chain security prediction model.

[0065] The specific execution steps can refer to the various steps of the above-mentioned node relationship chain-based security prediction method implementation example, and can achieve the same technical effect. To avoid repetition, they will not be repeated here.

[0066] It should be noted that the electronic devices in the embodiments of the present application include: servers, terminals or other devices except terminals.

[0067] The above electronic device structure does not constitute a limitation on the electronic device. The electronic device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. For example, the input unit may include a graphics processing unit (GPU) and a microphone, and the display unit may be configured with a display panel in the form of a liquid crystal display, an organic light-emitting diode, etc. The user input unit includes a touch panel and at least one of other input devices. The touch panel is also called a touch screen. Other input devices may include, but are not limited to, a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, and a joystick, which will not be repeated here.

[0068] The memory can be used to store software programs and various data. The memory may mainly include a first storage area for storing programs or instructions and a second storage area for storing data, wherein the first storage area may store an operating system, an application program or instructions required for at least one function (such as a sound playback function, an image playback function, etc.), etc. In addition, the memory may include a volatile memory or a non-volatile memory, or the memory may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. Volatile memory can be random access memory (RAM), static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory (DRRAM).

[0069] The processor may include one or more processing units; optionally, the processor integrates an application processor and a modem processor, wherein the application processor mainly processes operations related to the operating system, user interface, and application programs, and the modem processor mainly processes wireless communication signals, such as a baseband processor. It is understandable that the modem processor may not be integrated into the processor.

[0070] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, each process of the above-mentioned node relationship chain-based security prediction method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0071] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as ROM, RAM, magnetic disk or optical disk.

[0072] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0073] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0074] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A security prediction method based on node relationship chain, characterized in that: include: Determining, according to a target node of a target path, an associated node in a network that is interoperable with the target node, wherein the target path is used to forward data; Determine the associated node that interacts with other nodes in the network except the associated node as a target node; A security prediction is performed on a relationship chain including the target node and the object node to determine the security of forwarding data through the target path.

2. The method according to claim 1, characterized in that: The step of determining the associated node that interacts with other nodes in the network except the associated node as the object node includes: Marking the target node and the associated node for security based on their service weights, node invulnerability indicators, and historical attack times; According to the security mark, the nodes among the associated nodes that have hardware environments and network application environments that interact with the other nodes are determined as object nodes.

3. The method according to claim 1, characterized in that Before determining, according to the target node of the target path, an associated node in the network that is intercommunication with the target node, the method further includes: Performing invulnerability calculation on each first path between nodes in the network to obtain a path invulnerability index of each first path; A target path is determined from each of the first paths according to a path survivability index of each of the first paths.

4. The method according to claim 3, characterized in that The performing indestructibility calculation on each first path between nodes in the network to obtain a path indestructibility index of each first path includes: Calculating a node invulnerability index of each node in the network; According to the invulnerability index of each node in the network, the path invulnerability index of each first path is obtained.

5. The method according to claim 4, characterized in that Each node in the network includes a node to be calculated, and calculating the node invulnerability index of each node in the network includes: Acquire a second path in the first path whose length is less than or equal to a preset length; Determine a first value of the node to be calculated according to the degree value of the node to be calculated, a path set including the node to be calculated in the second path, and any second path in the path set, where the first value represents the sum of the proportions of the node to be calculated in each of the second paths; A node indestructibility index of the node to be calculated is determined according to the first value.

6. The method according to claim 5, characterized in that The determining, according to the first value, a node invulnerability index of the node to be calculated includes: Determine the second value of the node to be calculated according to the first value, the number of second paths in the path set whose length does not exceed a preset threshold, the number of shortest paths from the start node to the tail node, and the number of shortest paths including the node to be calculated, wherein at least one first path including the start node and the tail node includes the node to be calculated; A node indestructibility index of the node to be calculated is determined according to the first value, the second value, and the clustering coefficient of the node to be calculated.

7. The method according to claim 1, characterized in that The performing security prediction on the relationship chain including the target node and the object node includes: The security of the relationship chain is predicted by using a Markov chain security prediction model.

8. A safety prediction device based on a node relationship chain, characterized in that: include: A first determination module, configured to determine, according to a target node of a target path, an associated node in the network that is interoperable with the target node, wherein the target path is used to forward data; A second determining module, configured to determine the associated node that interacts with other nodes in the network except the associated node as an object node; The prediction module is used to perform security prediction on the relationship chain including the target node and the object node to determine the security of forwarding data through the target path.

9. An electronic device, characterized in that: It includes a processor, a memory, and a program or instruction stored in the memory and executable on the processor. When the program or instruction is executed by the processor, the steps of the security prediction method based on the node relationship chain as described in any one of claims 1 to 7 are implemented.

10. A readable storage medium, characterized in that: The readable storage medium stores a program or instruction, and when the program or instruction is executed by the processor, the steps of the security prediction method based on the node relationship chain as described in any one of claims 1 to 7 are implemented.

Images