Network security detection method based on big data

Abstract

The invention discloses a network security detection method based on big data, and relates to the technical field of network security detection, a big data acquisition module is utilized to acquire network flow data, security event data and system security state data of a current detection period, and a network flow anomaly degree measuring unit is utilized to measure the network flow anomaly degree. The method comprises the following steps: firstly, calculating and outputting an abnormal traffic detection index YL, calculating and outputting a threat evaluation value WW, introducing the abnormal traffic detection index YL and the threat evaluation value WW into a unit for comprehensively evaluating the overall security condition of the network, calculating and outputting a security situation index AQ, carrying out detection analysis, and carrying out security response and disposal by a response and disposal module aiming at the security situation index AQ. According to the invention, by collecting and analyzing multi-dimensional data of network traffic, security events and system states and applying advanced algorithms and models, comprehensive security detection is carried out on the network, and comprehensive and dynamic evaluation of network security is realized.

Description

Technical Field

[0001] The present invention relates to the technical field of network security detection, and in particular to a network security detection method based on big data. Background Art

[0002] With the rapid development and widespread application of information technology, the Internet has penetrated into all aspects of social life, including government, business, education, medical, and financial industries. However, with the popularization of the Internet, network security issues have become increasingly prominent, including hacker attacks, virus transmission, and data leakage, which pose serious threats to individuals, businesses, and even national security. These threats may not only lead to property losses, but also affect social stability and national security. Therefore, it is particularly important to develop an effective network security detection method.

[0003] At present, existing technologies often rely on a single detection method, which makes it difficult to capture subtle changes and potential threats in network traffic. Existing technologies also lack the ability to comprehensively evaluate network security and are unable to integrate multiple security factors for unified analysis. In addition, many existing technologies use static thresholds to determine whether the network is secure, which is often not flexible and accurate enough in practical applications. As a result, existing technologies often lack a circular feedback mechanism and are unable to continuously optimize and improve based on detection results. In addition, existing technologies have limitations in processing and analyzing big data and are unable to fully utilize the advantages of big data to improve detection accuracy and efficiency. Summary of the invention

[0004] The purpose of the present invention is to provide a network security detection method based on big data, which solves the problems raised in the above-mentioned background technology.

[0005] To achieve the above-mentioned purpose, the present invention provides the following technical solutions, including a big data collection module, a big data calculation and evaluation module, and a response and disposal module. The big data calculation and evaluation module includes a unit for measuring the degree of abnormality of network traffic, a unit for evaluating the degree of threat faced by the current network, and a unit for comprehensively evaluating the overall security status of the network; The specific detection steps are as follows: Step 1: Using the big data acquisition module, collect network traffic data, security event data and system security status data of the current detection period; Step II: using the unit for measuring the degree of abnormality of network traffic, firstly calculate and output an abnormal traffic detection index YL; Step III, introducing the abnormal traffic detection index YL into the unit for evaluating the threat level of the current network, and calculating and outputting the threat assessment value WW; Step III: introduce the abnormal traffic detection index YL and the threat assessment value WW into the comprehensive evaluation network overall security status unit, and calculate and output the security situation index AQ for detection and analysis; Step IIIII: the response and disposal module makes a security response and disposal according to the security situation index AQ.

[0006] Optionally, the equipment used by the big data acquisition module includes a network traffic analyzer, a SIEM system, and a security monitoring device; The equipment used by the big data computing and evaluation module includes a server; The equipment used by the response and disposal module includes a security patch management system and anti-malware tools.

[0007] Optionally, the calculation formula for measuring the network traffic anomaly degree unit is as follows: ; in: YL is the abnormal traffic detection index; L in is the inbound traffic, L in Refers to the amount of data entering the network per unit time; L out is the outbound traffic, L out Refers to the amount of data leaving the network per unit time; L avg is the average flow rate, L avg Refers to the average data traffic of the network during the current detection period; L peak is the peak flow rate, L peak Refers to the maximum data flow generated by the network during the current detection period.

[0008] Optionally, the average flow rate L avg The calculation formula is as follows: L avg =(L1+L2+L3+......+L n ) / n; n is the current cycle period, reflecting the amount of time in the current detection cycle; L1 is the first period to detect data traffic, L2 is the second period to detect data traffic, L3 is the third period to detect data traffic, L n Detect data traffic for the nth time period; And any detection cycle is the average flow L of the current detection cycle avg Perform real-time update calculations.

[0009] Optionally, the calculation formula for the unit for evaluating the threat level faced by the current network is as follows: ; in: WW is the threat assessment value; EX is the malicious behavior count, which reflects the number of malicious behaviors detected. Malicious behaviors include virus propagation, phishing attacks, DDoS attacks, SQL injections, and cross-site scripting attacks (XSS); ZX is the total behavior count, ZX reflects the number of all behaviors detected; WX is the number of new threats. WX reflects the number of new threat types that appear in the current detection cycle. Threat types include viruses, Trojans, worms, ransomware, and spyware. LWX is the number of historical threats. LWX reflects the number of threat types that have existed in previous detection cycles.

[0010] Optionally, the virus propagation: the virus propagates through the network and infects files and programs in the system; Phishing attacks: using fake websites and emails to trick users into revealing sensitive information; The DDoS attack is a distributed denial of service attack that paralyzes the target system through a large number of requests. The SQL injection: exploits website vulnerabilities to send malicious SQL statements to the database to obtain and tamper with data; The cross-site scripting attack (XSS) injects malicious scripts into the target website to steal user information and perform other malicious operations.

[0011] Optionally, the calculation formula for the comprehensive evaluation unit of the overall network security status is as follows: ; BDL=BD / ZBD; EZL=CZL / EX; WW avg =(WW1+WW2+WW3+……+WW m ) / m; in: AQ is the security situation index; BDL is the patch application rate; BD is the number of systems with applied patches, and ZBD is the total number of systems; FE is the anti-malware amount; EZL is the efficiency of malicious behavior; CZL is the number of successfully executed malicious actions; WW avg is the threat assessment average; m is the total number of historical detection cycles; WW1 is the threat assessment value of the first detection cycle, WW2 is the threat assessment value of the second detection cycle, and WW3 is the threat assessment value of the third detection cycle. m is the threat assessment value of the mth detection cycle, and when entering the next detection cycle, the current threat assessment value WW is the threat assessment value WW of the mth detection cycle m ; L in，max The maximum inbound traffic is the maximum inbound data traffic of the network in the current detection cycle.

[0012] Optionally, the detection analysis based on the security situation index AQ is as follows: If the security situation index AQ is higher than the average security situation index AQ avg , it reflects that the current network faces high security risks, and there are a lot of malicious behaviors and abnormal traffic, and network security measures should be strengthened; If the security situation index AQ is lower than the average security situation index AQ avg , it reflects that the current network status is relatively stable, there are few malicious behaviors and abnormal traffic, and the current network security measures should be maintained.

[0013] Optionally, the security situation average index AQ avg The calculation formula is as follows: AQ avg =(AQ1+AQ2+AQ3+......+AQ m ) / m; AQ1 is the security situation index of the first detection cycle, AQ2 is the security situation index of the second detection cycle, and AQ3 is the security situation index of the third detection cycle. m is the security situation index of the mth detection cycle, and when entering the next detection cycle, the current security situation index AQ is the security situation index AQ of the mth detection cycle m .

[0014] Compared with the prior art, the present invention has the following beneficial effects: 1. The present invention can comprehensively and dynamically evaluate the security status of the network by measuring the network traffic anomaly degree unit, evaluating the current network threat degree unit and comprehensively evaluating the overall network security status unit. The abnormal traffic detection index YL can capture the abnormal changes in network traffic, the threat assessment value WW can evaluate the threat degree faced by the current network, and the security situation index AQ can comprehensively consider multiple factors to give the overall security situation of the network. The dynamic threshold setting is adopted, including the average traffic L avgAnd the threat assessment value WW can automatically adjust the threshold according to the actual situation of network traffic and threat assessment results, so as to improve the accuracy and flexibility of detection.

[0015] 2. The present invention uses the security situation index AQ as a benchmark for determining the cyclic impact of detection, thereby realizing a cyclic feedback mechanism, and continuously optimizing the calculation parameters and algorithms of the abnormal traffic detection index YL and the threat assessment value WW according to the detection results, thereby improving the accuracy and efficiency of detection.

[0016] 3. The present invention makes full use of the advantages of big data technology, improves the accuracy and efficiency of detection by collecting and analyzing multi-dimensional data, and at the same time, improves the intelligence level of detection by continuously learning and optimizing algorithm models. It also combines big data technology with the latest research results in the field of network security detection, is innovative and practical, and can significantly improve network security and reduce security risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 This is a method flow chart of the network security detection method based on big data; Figure 2 This is a schematic diagram of the structure of the big data calculation and evaluation module of the present invention; Figure 3 It is a schematic diagram of the structure of malicious behavior in the present invention; Figure 4 It is a structural schematic diagram of the threat type in the present invention. DETAILED DESCRIPTION

[0018] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0019] This network security detection method based on big data is different from the existing network security detection methods. The existing network security detection methods often rely on a single detection method and tool, which makes it difficult to comprehensively and accurately evaluate the security status of the network. This algorithm unit collects and analyzes multi-dimensional data on network traffic, security events, and system status, and uses advanced algorithms and models to conduct comprehensive security detection on the network, thereby achieving a comprehensive and dynamic evaluation of network security.

[0020] For example, see Figures 1 to 4, This implementation provides a network security detection method based on big data, including a big data acquisition module, a big data calculation and evaluation module, and a response and disposal module. The big data calculation and evaluation module includes a unit for measuring the degree of abnormality of network traffic, a unit for evaluating the degree of threat faced by the current network, and a unit for comprehensively evaluating the overall security status of the network; The specific detection steps are as follows: Step 1: Use the big data collection module to collect network traffic data, security event data and system security status data of the current detection period; Step II: using the unit for measuring the abnormality of network traffic, first calculate and output the abnormal traffic detection index YL; Step III, introduce the abnormal traffic detection index YL into the unit for evaluating the threat level of the current network, and calculate and output the threat assessment value WW; Step III: introduce the abnormal traffic detection index YL and the threat assessment value WW into the comprehensive evaluation unit of the overall network security status, and calculate and output the security situation index AQ for detection and analysis; Step IIIII: The response and disposal module makes security response and disposal according to the security situation index AQ; The equipment used in the big data collection module includes network traffic analyzers, SIEM systems, and security monitoring equipment; The equipment used in the big data computing and evaluation module includes servers; The equipment used in the response and disposal module includes security patch management system and anti-malware tools.

[0021] In this embodiment, the system cooperates with the three algorithm units and combines the three operation results of YL, WW and AQ to form the core part of the network security detection method based on big data, which provides strong support and guarantee for network security. Specifically, YL is the abnormal traffic detection index, which can reflect the fluctuation and abnormal changes of network traffic. When the network traffic is abnormal, the value of YL will significantly deviate from the normal range, thereby reminding to take timely measures to investigate and respond. WW is the threat assessment value, which can more comprehensively evaluate the current security status of the network, including whether there are potential threats, the type and number of threats, which is of great significance for formulating targeted network security defense strategies. AQ is the security situation index, which can comprehensively reflect the security situation of the network, including the security of the system, the effectiveness of defense measures and the severity of potential threats. This is of great guiding significance for formulating a comprehensive network security protection plan, optimizing network security strategies and improving network security defense capabilities. The calculation results of AQ can also affect the calculations fed back to YL and WW, so that the three algorithms and their parameters of the system have significant beneficial effects on network security detection. They can not only improve the sensitivity and accuracy of detection, but also comprehensively evaluate the network security status and optimize detection strategies and methods.

[0022] See also Figures 1 to 4 ,The calculation formula for measuring the unit of network traffic anomaly degree is as follows: ; in: YL is the abnormal traffic detection index; L in is the inbound traffic, L in Refers to the amount of data entering the network per unit time; L out is the outbound traffic, L out Refers to the amount of data leaving the network per unit time; L avg is the average flow rate, L avg Refers to the average data traffic of the network during the current detection period; L peak is the peak flow rate, L peak Refers to the maximum data flow generated by the network during the current detection cycle; Average flow rate L avg The calculation formula is as follows: L avg =(L1+L2+L3+......+L n ) / n; n is the current cycle period, reflecting the amount of time in the current detection cycle; L1 is the first period to detect data traffic, L2 is the second period to detect data traffic, L3 is the third period to detect data traffic, L n Detect data traffic for the nth time period; And any detection cycle is the average flow L of the current detection cycle avg Perform real-time update calculations.

[0023] In this embodiment: First, in this algorithm unit, " The calculation part aims to reflect the balance and volatility of network traffic by in With outbound traffic L out Adding and then subtracting can capture the asymmetry and degree of change of traffic. This calculation part is the core of the calculation formula for measuring the degree of abnormality of network traffic. It is used to measure the degree of abnormality of network traffic. When the traffic shows significant imbalance and volatility, the value of this part will increase, thereby increasing the value of the abnormal traffic detection index YL, indicating the existence of abnormal traffic. Specifically, the inbound traffic L in this algorithm unit is in With outbound traffic L out It is the basis for calculating the abnormal traffic detection index YL. They directly reflect the inflow and outflow of network traffic. By calculating the difference between the two, it is possible to preliminarily determine whether there is an abnormality in network traffic. in The outbound traffic L out If it remains the same or decreases slightly, it means that the network is under external attack and there is a risk of data leakage; The average flow rate L avg As an important parameter in the calculation of abnormal traffic detection index YL, it represents the normal level of network traffic and is compared with the average traffic L avg By comparing the current flow rate with the normal range, it can more accurately determine whether the current flow rate has deviated from the normal range, thereby discovering flow anomalies in a timely manner; “ The calculation part is used to measure the difference between the peak value and the average value of network traffic, that is, the fluctuation range of traffic. By introducing this calculation part, the abnormal traffic detection index YL can more comprehensively evaluate the abnormal degree of network traffic. When the difference between the peak traffic and the average traffic is large, it indicates that the network is experiencing a traffic peak and abnormal fluctuations, which will also increase the value of the abnormal traffic detection index YL. peak It reflects the highest level of network traffic, which is of great significance for evaluating the volatility and stability of network traffic. In the calculation of the abnormal traffic detection index YL, the peak traffic L is considered. peak With the average flow L avg The difference can further determine the degree and nature of flow anomaly; The abnormal traffic detection index YL calculated by this algorithm unit can more accurately capture subtle changes in network traffic by comprehensively considering multiple traffic parameters, thereby improving the sensitivity of detection. The abnormal traffic detection index YL not only considers the absolute value of the traffic, but also the volatility and stability of the traffic, so that it can more comprehensively evaluate the overall situation of the network traffic. In addition, the calculation formula of the abnormal traffic detection index YL is relatively simple and does not involve complex mathematical operations, making it easier to understand and operate in practical applications.

[0024] See also Figures 1 to 4 , the calculation formula for evaluating the threat level of the current network is as follows: ; in: WW is the threat assessment value; EX is the malicious behavior count, which reflects the number of malicious behaviors detected. Malicious behaviors include virus propagation, phishing attacks, DDoS attacks, SQL injections, and cross-site scripting attacks (XSS); ZX is the total behavior count, ZX reflects the number of all behaviors detected; WX is the number of new threats. WX reflects the number of new threat types that appear in the current detection cycle. Threat types include viruses, Trojans, worms, ransomware, and spyware. LWX is the number of historical threats. LWX reflects the number of threat types that have existed in previous detection cycles.

[0025] In this embodiment, first, The calculation part combines the value of the abnormal traffic detection index YL, the ratio of the total behavior count ZX to the malicious behavior count EX, and the inbound traffic L in With the average flow L avg The ratio of the total behavior count ZX to the malicious behavior count EX provides the proportion of malicious behavior in the total behavior, and the inbound traffic L in With the average flow L avg The ratio reflects the relative size of the traffic. These factors together determine the value of the threat assessment value WW, which helps to understand the current threat level. “ The calculation part is used to measure the difference between new threats and historical threats, that is, the degree of change in threat types. By introducing this calculation part, the threat assessment value WW can more sensitively capture the change in threat types. When the number of new threats increases / decreases significantly, the value of this part will increase, thereby increasing the value of the threat assessment value WW, indicating the existence of new threat types; This algorithm unit can more accurately assess the threat level faced by the network by comprehensively considering multiple threat parameters, providing strong support for network security decision-making. The threat assessment value WW can dynamically adjust the assessment criteria and continuously update the assessment results according to the emergence of new threats and the evolution trend of historical threats, making the assessment more in line with the actual situation. In addition, the evaluation results of the threat assessment value WW can directly guide the formulation and implementation of network security defense strategies, making defense measures more targeted and effective.

[0026] See also Figures 1 to 4 , the calculation formula for the comprehensive evaluation unit of the overall network security status is as follows: ; BDL=BD / ZBD; EZL=CZL / EX; WW avg =(WW1+WW2+WW3+……+WW m ) / m; in: AQ is the security situation index; BDL is the patch application rate; BD is the number of systems with applied patches, and ZBD is the total number of systems; FE is the anti-malware amount; EZL is the efficiency of malicious behavior; CZL is the number of successfully executed malicious actions; WW avg is the threat assessment average; m is the total number of historical detection cycles; WW1 is the threat assessment value of the first detection cycle, WW2 is the threat assessment value of the second detection cycle, and WW3 is the threat assessment value of the third detection cycle. m is the threat assessment value of the mth detection cycle, and when entering the next detection cycle, the current threat assessment value WW is the threat assessment value WW of the mth detection cycle m ; L in，max The maximum inbound traffic is the maximum inbound data traffic of the network in the current detection cycle.

[0027] In this embodiment, the algorithm unit first " "The calculation part combines the value of threat assessment value WW, patch application rate BDL, and the ratio of malicious behavior efficiency EXL to anti-malware quantity FE to comprehensively evaluate the overall security status of the network. By introducing these calculation parts, the security situation index AQ can more comprehensively reflect the security situation of the network. The value of threat assessment value WW reflects the current threat level, the patch application rate BDL provides a direct indicator of system security, and the ratio of malicious behavior efficiency EXL to anti-malware quantity FE reflects the performance of anti-malware. These factors jointly determine the value of security situation index AQ, thereby helping to understand the overall security status of the network; “ The calculation part is used to measure the change of threat assessment value WW and inbound traffic L in With the maximum inbound flow L in，max The ratio of the value of the security situation index AQ to the value of the threat assessment value L increases, thereby reflecting the dynamic changes in network security. By introducing this calculation part, the security situation index AQ can more sensitively capture the dynamic changes in network security. When the threat assessment value increases / decreases significantly, the value of this part will increase, thereby increasing the value of the security situation index AQ to indicate that the security situation of the network is changing. At the same time, the inbound traffic L in With the maximum inbound flow L in，max The ratio also provides relative information about the traffic size, which helps to further evaluate the security of the network; Specifically, the patch application rate BDL in this algorithm unit reflects the timeliness and effectiveness of the system patch. A high patch application rate BDL means that the system can repair known vulnerabilities in a timely manner and reduce the risk of attacks. The anti-malware volume FE measures the ability of anti-malware tools in detecting and removing malware. Anti-malware tools with high anti-malware volume FE can more effectively protect network security. The malicious behavior efficiency EXL reflects the propagation speed and impact range of malicious behavior in the network. By monitoring the changes in the malicious behavior efficiency EXL, the spread of malicious behavior can be discovered and curbed in a timely manner. The security situation index AQ output by this algorithm unit can comprehensively evaluate the overall security status of the network by comprehensively considering multiple security parameters, providing comprehensive information support for network security decision-making, and the security situation index AQ introduces the threat assessment average value WW avg and the maximum inbound flow L in，max , realizing a circular feedback mechanism, and then being able to continuously optimize the strategies and methods of network security detection according to historical data and current traffic changes; The calculation result of the security situation index AQ can directly reflect the security situation of the network and provide strong support for emergency response. When the network security situation changes, measures can be taken quickly to deal with potential threats and reduce security risks. In summary, the unit for measuring the degree of abnormality of network traffic, the unit for assessing the degree of threat faced by the current network, and the unit for comprehensively assessing the overall security status of the network and their parameters have significant beneficial effects on network security detection. They can not only improve the sensitivity and accuracy of detection, but also comprehensively assess the network security status and optimize detection strategies and methods.

[0028] See also Figures 1 to 4 , the detection analysis based on the security situation index AQ is as follows: If the security situation index AQ is higher than the average security situation index AQ avg , it reflects that the current network faces high security risks, and there are a lot of malicious behaviors and abnormal traffic, and network security measures should be strengthened; If the security situation index AQ is lower than the average security situation index AQ avg , it reflects that the current network status is relatively stable, there are few malicious behaviors and abnormal traffic, and the current network security measures should be maintained; Security Situation Average Index AQ avg The calculation formula is as follows: ; AQ1 is the security situation index of the first detection cycle, AQ2 is the security situation index of the second detection cycle, and AQ3 is the security situation index of the third detection cycle. m is the security situation index of the mth detection cycle, and when entering the next detection cycle, the current security situation index AQ is the security situation index AQ of the mth detection cycle m .

[0029] In this embodiment, when the security situation index AQ is higher than the security situation average index AQ avg When the value is 0.004, it means that the network faces a high security risk. At this time, by evaluating the overall network security status unit for the loop feedback of the unit measuring the abnormal degree of network traffic, the judgment threshold of abnormal traffic in the unit measuring the abnormal degree of network traffic can be lowered, making the system more sensitive to abnormal traffic. In this way, even a small abnormal traffic fluctuation will be detected in time, thereby improving the accuracy of detection. When the security situation index AQ is lower than the average security situation index AQ avg When the network security status is relatively good, at this time, by increasing the judgment threshold of abnormal traffic in the unit measuring the abnormal degree of network traffic, it is possible to reduce the false alarms caused by traffic fluctuations. At the same time, because the system is more tolerant of abnormal traffic, it can also avoid missing potential threats due to setting too low a threshold. The threat assessment value WW in the unit for assessing the current threat level faced by the network is an important indicator reflecting the severity of the threat currently faced by the network. Through the cyclic feedback of the unit for comprehensively assessing the overall network security status to the unit for measuring the abnormality level of network traffic, the algorithm for assessing the threat assessment in the unit for assessing the current threat level faced by the network can be adjusted according to the level of the security situation index AQ. Specifically, when the security situation index AQ is high, the weight of the malicious behavior count can be increased to more accurately assess the severity of the current threat. When the security situation index AQ is low, the algorithm can be adjusted to pay more attention to the types of threats that will have a significant impact on the network. According to the judgment result of the security situation index AQ and the cyclic feedback mechanism of the unit for comprehensively assessing the overall network security status to the unit for measuring the abnormality level of network traffic, a more reasonable response strategy can also be formulated. The patch application rate BDL and anti-malware quantity FE in the unit for comprehensively evaluating the overall network security status are important indicators for measuring the overall network security level. Through the loop feedback mechanism of the unit for comprehensively evaluating the overall network security status to the unit for measuring the degree of abnormality of network traffic, patch management and anti-malware efficiency can be strengthened according to the judgment result of the security situation index AQ. Specifically, when the security situation index AQ is high, the assessment of patch application can be increased to ensure that the vulnerabilities in the system are repaired in time. At the same time, the update frequency and detection efficiency of anti-malware can be improved to better cope with new threats and challenges. In summary, the unit for measuring the degree of abnormality of network traffic, the unit for assessing the degree of threat faced by the current network, and the unit for comprehensively assessing the overall security status of the network each have unique beneficial effects, and the cyclical influence of the unit for comprehensively assessing the overall security status of the network on the unit for measuring the degree of abnormality of network traffic also brings significant advantages. These formulas together constitute the core part of the network security detection method based on big data, providing strong support and guarantee for network security, and using the average security situation index AQ avg The detection method as a judgment standard and the circular feedback mechanism of the unit for comprehensively evaluating the overall network security status to the unit for measuring the degree of network traffic anomaly can produce many beneficial effects, including improving the accuracy and sensitivity of detection, optimizing threat assessment and response strategies, and improving the overall network security level. These effects will help to better respond to network security challenges and threats and ensure the safe and stable operation of the network.

[0030] For example 2, please refer to Figures 1 to 4 ,Virus transmission: Viruses spread through the network and infect files and programs in the system; Phishing attacks: using fake websites and emails to trick users into revealing sensitive information; DDoS attack: Distributed denial of service attack, which paralyzes the target system through a large number of requests; SQL injection: Exploiting website vulnerabilities to send malicious SQL statements to the database to obtain and tamper with data; Cross-site scripting (XSS): Injecting malicious scripts into the target website to steal user information and perform other malicious operations.

[0031] In this embodiment, the accumulation of malicious behavior counts EX by the unit for evaluating the current threat level faced by the network includes accumulation of virus propagation, phishing attacks, DDoS attacks, SQL injections, and cross-site scripting attacks (XSS), thereby more comprehensively introducing malicious behaviors that may affect network security, thereby improving the management and detection of network security.

[0032] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations can be made to the embodiments without departing from the principles and spirit of the present invention, and the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A network security detection method based on big data, characterized in that: It includes a big data collection module, a big data calculation and evaluation module, and a response and disposal module. The big data calculation and evaluation module includes a unit for measuring the degree of abnormality of network traffic, a unit for evaluating the degree of threat faced by the current network, and a unit for comprehensively evaluating the overall security status of the network; The specific detection steps are as follows: Step 1: Using the big data acquisition module, collect network traffic data, security event data and system security status data of the current detection period; Step II: using the unit for measuring the degree of abnormality of network traffic, firstly calculate and output an abnormal traffic detection index YL; Step III, introducing the abnormal traffic detection index YL into the unit for evaluating the threat level of the current network, and calculating and outputting the threat assessment value WW; Step III: introduce the abnormal traffic detection index YL and the threat assessment value WW into the comprehensive evaluation unit for the overall security status of the network, and calculate and output the security situation index AQ for detection and analysis; Step IIIII: the response and disposal module makes a security response and disposal according to the security situation index AQ.

2. A network security detection method based on big data according to claim 1, characterized in that: The equipment used by the big data acquisition module includes network traffic analyzers, SIEM systems, and security monitoring equipment; The equipment used by the big data computing and evaluation module includes a server; The equipment used by the response and disposal module includes a security patch management system and anti-malware tools.

3. A network security detection method based on big data according to claim 2, characterized in that: The calculation formula for measuring the unit of abnormal degree of network traffic is as follows: ； in: YL is the abnormal traffic detection index; L in is the inbound traffic, L in Refers to the amount of data entering the network per unit time; L out is the outbound traffic, L out Refers to the amount of data leaving the network per unit time; L avg is the average flow rate, L avg Refers to the average data traffic of the network during the current detection period; L peak is the peak flow rate, L peak Refers to the maximum data flow generated by the network during the current detection period.

4. A network security detection method based on big data according to claim 3, characterized in that: The average flow rate L avg The calculation formula is as follows: <h2 style=";text-align:left;direction:ltr">L<h2 style=";text-align:left;direction:ltr"> avg <h2 style=";text-align:left;direction:ltr"> =(L1+L2+L3+......+L<h2 style=";text-align:left;direction:ltr"> n <h2 style=";text-align:left;direction:ltr"> ) / n; n is the current cycle period, reflecting the amount of time in the current detection cycle; L1 is the first period to detect data traffic, L2 is the second period to detect data traffic, L3 is the third period to detect data traffic, L n Detect data traffic for the nth time period; And any detection cycle is the average flow L of the current detection cycle avg Perform real-time update calculations.

5. A network security detection method based on big data according to claim 4, characterized in that: The calculation formula for evaluating the threat level unit facing the current network is as follows: ； in: WW is the threat assessment value; EX is the malicious behavior count, which reflects the number of malicious behaviors detected. Malicious behaviors include virus propagation, phishing attacks, DDoS attacks, SQL injections, and cross-site scripting attacks (XSS); ZX is the total behavior count, ZX reflects the number of all behaviors detected; WX is the number of new threats. WX reflects the number of new threat types that appear in the current detection cycle. Threat types include viruses, Trojans, worms, ransomware, and spyware. LWX is the number of historical threats. LWX reflects the number of threat types that have existed in previous detection cycles.

6. A network security detection method based on big data according to claim 5, characterized in that: The virus spreads: the virus spreads through the network and infects the files and programs in the system; Phishing attacks: using fake websites and emails to trick users into revealing sensitive information; The DDoS attack is a distributed denial of service attack that paralyzes the target system through a large number of requests. The SQL injection: exploits website vulnerabilities to send malicious SQL statements to the database to obtain and tamper with data; The cross-site scripting attack (XSS) described above: injects malicious scripts into the target website to steal user information and perform other malicious operations; The calculation formula for the comprehensive evaluation unit of the overall network security status is as follows: ； BDL=BD / ZBD; EZL=CZL / EX; WW avg =(WW1+WW2+WW3+......+WW m ) / m; in: AQ is the security situation index; BDL is the patch application rate; BD is the number of systems with applied patches, and ZBD is the total number of systems; FE is the anti-malware amount; EZL is the efficiency of malicious behavior; CZL is the number of successfully executed malicious actions; WW avg is the threat assessment average; m is the total number of historical detection cycles; WW1 is the threat assessment value of the first detection cycle, WW2 is the threat assessment value of the second detection cycle, and WW3 is the threat assessment value of the third detection cycle. m is the threat assessment value of the mth detection cycle, and when entering the next detection cycle, the current threat assessment value WW is the threat assessment value WW of the mth detection cycle m ; L in，max The maximum inbound traffic is the maximum inbound data traffic of the network in the current detection cycle.

7. A network security detection method based on big data according to claim 6, characterized in that: The detection analysis based on the security situation index AQ is as follows: If the security situation index AQ is higher than the average security situation index AQ avg , it reflects that the current network faces high security risks, and there are a lot of malicious behaviors and abnormal traffic, and network security measures should be strengthened; If the security situation index AQ is lower than the average security situation index AQ avg , it reflects that the current network status is relatively stable, there are few malicious behaviors and abnormal traffic, and the current network security measures should be maintained.

8. A network security detection method based on big data according to claim 7, characterized in that: The average security index AQ avg The calculation formula is as follows: so avg =(AQ1+AQ2+AQ3+......+AQ m ) / m; AQ1 is the security situation index of the first detection cycle, AQ2 is the security situation index of the second detection cycle, and AQ3 is the security situation index of the third detection cycle. m is the security situation index of the mth detection cycle, and when entering the next detection cycle, the current security situation index AQ is the security situation index AQ of the mth detection cycle m .

Images