Network security dynamic defense method and system based on big data

Abstract

The invention relates to a network security dynamic defense method and system based on big data, and relates to the technical field of big data, and the method comprises the steps: constructing a multi-dimensional feature vector based on network flow data, system logs and user behavior data collected in real time; calculating a dynamic threat evaluation index based on the multi-dimensional feature vector; generating an adaptive response function according to the dynamic threat evaluation index; determining a defense strength dynamic adjustment function based on the adaptive response function, and executing multi-level linkage defense based on the defense strength dynamic adjustment function; the defense effect of the multi-level linkage defense is evaluated through the defense effectiveness evaluation model, and a corresponding evaluation result is obtained; and according to an evaluation result, continuously optimizing the executed multi-level linkage defense. According to the invention, the dynamic and defense effects of network defense can be improved.

Description

Technical Field

[0001] The present invention relates to the field of big data technology, and in particular to a big data-based network security dynamic defense method, system, electronic device and non-transitory computer-readable storage medium. Background Art

[0002] Nowadays, with the increasing complexity of network attacks and the continuous evolution of attack methods, the importance of network security protection has become increasingly prominent. At present, the mainstream network security protection methods mainly include static defense and rule-based intrusion detection systems (IDS). These methods identify potential security threats by monitoring and analyzing network traffic, combining pre-defined rules and threat signature libraries. In addition, some defense systems also use firewalls, sandbox technology, and security information and event management (SIEM) platforms for comprehensive security protection to improve the detection capabilities of known threats.

[0003] However, static defense methods are difficult to deal with unknown attacks or advanced persistent threats (APTs), which often use zero-day vulnerabilities or complex multi-stage attack strategies to bypass rule detection. Secondly, rule-based methods rely too much on the timely update of feature libraries, and their response speed often lags behind in the face of rapidly changing threat situations. In addition, since the construction of feature libraries requires a lot of manual participation, it is difficult to quickly adapt to new attack scenarios, and the defense capability is restricted. In actual applications, when faced with high-frequency and diverse attack behaviors, existing systems are prone to fail to achieve effective protection due to the lack of dynamic adjustment capabilities. Summary of the invention

[0004] In response to the technical problems existing in the prior art, the present invention provides a big data-based network security dynamic defense method, system, electronic device and non-transitory computer-readable storage medium that can enhance the dynamic nature and defense effect of network defense.

[0005] The technical solution of the present invention to solve the above technical problems is as follows:

[0006] The present invention provides a network security dynamic defense method based on big data, the method comprising:

[0007] Construct multi-dimensional feature vectors based on real-time collected network traffic data, system logs and user behavior data;

[0008] Calculating a dynamic threat assessment index based on the multidimensional feature vector;

[0009] generating an adaptive response function according to the dynamic threat assessment index;

[0010] Determining a defense strength dynamic adjustment function based on the adaptive response function, and performing multi-level linkage defense based on the defense strength dynamic adjustment function;

[0011] Through the defense effectiveness evaluation model, the defense effect of the multi-level linkage defense is evaluated to obtain the corresponding evaluation result;

[0012] Based on the evaluation results, the executed multi-level linkage defense is continuously optimized.

[0013] Optionally, the calculating a dynamic threat assessment index based on the multidimensional feature vector includes:

[0014] Obtaining the weight and risk level of each feature from the multidimensional feature vector;

[0015] Obtain multiple attack similarity indicators;

[0016] Obtain the time decay factor and observation period relevant to the assessment;

[0017] According to the first adjustment coefficient, the second adjustment coefficient, the third adjustment coefficient and the fourth adjustment coefficient, the weight and the danger level of each feature, each attack similarity index, the time attenuation factor and the observation period are processed to calculate the dynamic threat assessment index.

[0018] Optionally, the dynamic threat assessment index is expressed as:

[0019]

[0020] Where DTI is the dynamic threat assessment index, ω i is the weight of the i-th feature, V i is the risk of the ith feature, S j is the j-th attack similarity index, t is the time decay factor, T is the observation period, α, β, γ, and λ are the first adjustment coefficient, the second adjustment coefficient, the third adjustment coefficient, and the fourth adjustment coefficient, respectively.

[0021] Optionally, generating an adaptive response function according to the dynamic threat assessment index includes:

[0022] Get dynamic threat assessment index and priority for each type of threat in the network;

[0023] Obtain historical response results for each successful response to each type of described threat;

[0024] Obtaining a nonlinear adjustment index, a learning rate, and a system resource constraint factor for generating the adaptive response function;

[0025] The adaptive response function is generated according to the dynamic threat assessment index and priority of each type of threat, the historical response effect of each successful response to each type of threat, the nonlinear adjustment index, the learning rate and the system resource constraint factor.

[0026] Optionally, the adaptive response function is expressed as:

[0027]

[0028] Among them, ARF is the adaptive response function, DTI k is the dynamic threat assessment index of the k-th threat, P k is the priority of the threat, R i is the i-th historical response effect, m is the nonlinear adjustment index, η is the learning rate, and Ω is the system resource constraint factor.

[0029] Optionally, determining the defense strength dynamic adjustment function based on the adaptive response function includes:

[0030] Obtaining a time window function for characterizing the time dependency of defense strength;

[0031] Get a defense measure set including multiple defense measures;

[0032] Each of the defense measures is processed according to the measure cost coefficient, the adaptive function is processed according to the sensitivity parameter, and combined with the time window function to obtain the defense strength dynamic adjustment function.

[0033] Optionally, the defense effectiveness evaluation model is used to evaluate the defense effect of the multi-level linkage defense to obtain corresponding evaluation results, including:

[0034] Obtain the number of events experienced during the defense effectiveness evaluation period;

[0035] Obtain the balance factor used to control the weight between defense effect and loss, as well as the effectiveness attenuation coefficient focusing on long-term defense effect;

[0036] Obtain the loss caused by the current incident and the maximum acceptable loss;

[0037] The evaluation result is determined according to the number of events, the balance factor, the efficiency attenuation coefficient, the loss caused by the current event and the maximum acceptable loss.

[0038] Optionally, the continuously optimizing the executed multi-level linkage defense according to the evaluation result includes:

[0039] Adaptively adjusting the calculation parameters in the dynamic threat assessment index, the adaptive response function, the defense strength dynamic adjustment function, and the defense effectiveness evaluation model to obtain optimized dynamic threat assessment index, adaptive response function, defense strength dynamic adjustment function, and defense effectiveness evaluation model;

[0040] Optimizing the weight of each feature based on a machine learning algorithm to obtain optimized features;

[0041] The defense strategy threshold is dynamically updated according to the optimized dynamic threat assessment index, adaptive response function, defense strength dynamic adjustment function and defense effectiveness evaluation model, as well as the optimized features.

[0042] Optionally, the method further includes:

[0043] Updating the threat knowledge base based on the evaluation result to obtain an updated threat knowledge base;

[0044] Updating the defense strategy library based on the updated threat knowledge base to obtain an updated defense strategy library;

[0045] According to the updated threat knowledge base and the updated defense strategy library, the system response mechanism and resource scheduling strategy are optimized.

[0046] The present invention also provides a network security dynamic defense system based on big data, the system comprising:

[0047] The data acquisition module is used to construct a multi-dimensional feature vector based on the real-time collected network traffic data, system logs and user behavior data;

[0048] A threat assessment module, used to calculate a dynamic threat assessment index based on the multidimensional feature vector;

[0049] A threat response module, used to generate an adaptive response function according to the dynamic threat assessment index;

[0050] A network defense module, used to determine a defense strength dynamic adjustment function based on the adaptive response function, and to perform multi-level linkage defense based on the defense strength dynamic adjustment function;

[0051] A defense evaluation module is used to evaluate the defense effect of the multi-level linkage defense through a defense effectiveness evaluation model to obtain a corresponding evaluation result;

[0052] The defense optimization module is used to continuously optimize the executed multi-level linkage defense according to the evaluation result.

[0053] In addition, to achieve the above-mentioned purpose, the present invention also proposes an electronic device, comprising: a memory for storing computer software programs; a processor for reading and executing the computer software programs, thereby realizing a dynamic network security defense method based on big data as described above.

[0054] In addition, to achieve the above-mentioned purpose, the present invention also proposes a non-transitory computer-readable storage medium, in which a computer software program is stored. When the computer software program is executed by a processor, it implements a big data-based network security dynamic defense method as described above.

[0055] The beneficial effects of the present invention are:

[0056] (1) Based on the dynamic threat index (DTI), the present invention can comprehensively consider the multi-dimensional characteristics, time decay and similarity of attacks, so that when facing unknown or new attacks, it can dynamically adjust the defense strategy, timely identify and respond to complex attacks such as advanced persistent threats (APT), enhance the system's ability to identify variant attacks, complex attacks and advanced persistent threats, and significantly improve the security of the system.

[0057] (2) The present invention generates defense strategies through adaptive response functions (ARFs), which can be dynamically adjusted according to threat assessment results and historical response effects. By weighing threat priorities, resource constraints, and historical response effects, the system can generate the best defense strategy instead of relying on a fixed rule base, thereby reducing human intervention. The defense strategy can be adjusted in real time according to changes in the attack situation, improving defense efficiency and response speed.

[0058] (3) The defense intensity dynamic adjustment function (DDAF) designed by the present invention takes into account factors such as time window, measure cost and defense sensitivity, and realizes multi-level linkage defense. This mechanism continuously optimizes the strength and countermeasures of each level of defense to ensure that the defense system can provide timely and accurate protection when facing multiple attack methods. It can improve the flexibility and anti-attack capability of the defense system, while optimizing the use of defense resources and avoiding unnecessary waste of resources.

[0059] In summary, the present invention provides a flexible, efficient and intelligent network security protection method through dynamic threat assessment, multi-dimensional data analysis, adaptive defense strategy generation and multi-level linkage defense mechanism. Its beneficial effects are mainly reflected in: improving the detection and defense capabilities of unknown attacks and advanced threats; optimizing resource management to ensure defense efficiency; and achieving continuous self-optimization and resilience of the system. It makes network security protection more intelligent and dynamic, and can maintain efficient protection capabilities when dealing with complex and continuously evolving network threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 A flowchart of a network security dynamic defense method based on big data provided by the present invention;

[0061] Figure 2 A schematic diagram of the structure of a network security dynamic defense system based on big data provided by the present invention;

[0062] Figure 3 A schematic diagram of the hardware structure of a possible electronic device provided by the present invention;

[0063] Figure 4 A schematic diagram of the hardware structure of a possible computer-readable storage medium provided by the present invention. DETAILED DESCRIPTION

[0064] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0065] In the description of the present invention, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0066] In the description of the present invention, the term "for example" is used to mean "used as an example, illustration or explanation". Any embodiment described as "for example" in the present invention is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is given to enable any technician in the field to implement and use the present invention. In the following description, details are listed for the purpose of explanation. It should be understood that a person of ordinary skill in the art can recognize that the present invention can be implemented without using these specific details. In other examples, well-known structures and processes will not be elaborated in detail to avoid obscuring the description of the present invention with unnecessary details. Therefore, the present invention is not intended to be limited to the embodiments shown, but is consistent with the widest scope consistent with the principles and features disclosed in the present invention.

[0067] See also Figure 1 , provides a flowchart of a network security dynamic defense method based on big data of the present invention, comprising the following steps:

[0068] Step 201: construct a multi-dimensional feature vector based on real-time collected network traffic data, system logs and user behavior data.

[0069] First, the system can collect data from three main sources in real time:

[0070] Network traffic data: includes information about all data packets generated during network communications, such as source IP, destination IP, protocol type, port number, transport layer protocol, packet size, traffic direction, etc. These data help the system understand the characteristics of network traffic and possible abnormal traffic.

[0071] System log: refers to the log files generated by the operating system, application, security system, etc., including system events (such as startup, shutdown, abnormal conditions), file access, user login, service status, etc. System logs provide important clues for analyzing internal system behavior and potential security risks.

[0072] User behavior data: includes user behavior logs in the system, such as login time, resources accessed, commands entered, operations performed, etc. These data reflect the normal behavior patterns of users and can be used to identify abnormal activities that are inconsistent with normal behavior.

[0073] After collecting the above data, it is necessary to clean, standardize and extract features from the data to ensure that the generated feature vector can effectively represent the current network environment and can be used by threat assessment models (such as DTI). Useless information or noise, such as duplicate, missing or irregularly formatted data, can be removed to ensure data quality. Data after cleaning is more reliable and can help with subsequent modeling and analysis.

[0074] Then, various types of data (such as network traffic, log information, and user behavior) are converted into a unified standard format to eliminate the impact of dimensions. For example, timestamps can be converted into time intervals, and the size of data packets can be standardized to a certain range.

[0075] Then, by analyzing the raw data, we extract the key features that represent the current system status. Common features include:

[0076] Network traffic characteristics: such as traffic rate, protocol distribution, packet size distribution, traffic peak, etc. These characteristics can help detect abnormal traffic in the network and identify whether there are DDoS attacks, port scans, and other behaviors.

[0077] System log characteristics: such as the frequency of system events, the ratio of error logs, the number of user logins and logouts, the frequency of access to specific resources, etc. These characteristics help determine whether the system has security incidents such as unauthorized access, privilege escalation, and vulnerability exploitation.

[0078] User behavior characteristics: such as the regularity of user login time, the types of resources accessed, the frequency and type of operations, etc. These characteristics are used to build a baseline model of normal user behavior and then identify abnormal user behavior (such as brute force cracking, account hijacking, etc.).

[0079] After data cleaning, standardization and feature extraction, a set of representative features is obtained, which constitute a multidimensional feature vector. Assuming that n features are currently collected (for example, the rate of network traffic, the frequency of user behavior, etc.), the feature vector F can be expressed as: F = {f1, f2, ..., f n}.

[0080] Among them, f1,f2,...,f n They represent features extracted from different data sources (network traffic, system logs, user behavior). These features may be discrete values ​​(such as the frequency of occurrence of a specific protocol type) or continuous values ​​(such as traffic rate, time difference, etc.).

[0081] Each feature represents a certain aspect of the data, and there may be certain correlations between the features. For example, the size of network traffic and system load may be correlated, and abnormal user behavior may affect specific events in the system log.

[0082] In some embodiments, the generated multi-dimensional feature vector can be used as the basic input for subsequent dynamic threat assessment (DTI) and defense strategy generation, which can help the system identify threats and respond adaptively. Specific functions include:

[0083] Threat detection: By comparing the feature vectors collected in real time with existing threat patterns, the system can detect potential threats in a timely manner. For example, if the network traffic characteristics are abnormal, or if there are multiple incorrect accesses in the system log, the system can determine whether there is an attack.

[0084] Model training and optimization: In dynamic threat assessment, feature vectors are used to build threat assessment models (such as DTI). As new data is added, the model can be continuously updated to improve the accuracy and response speed of threat detection.

[0085] Response and optimization: Through the adaptive response function (ARF) and the dynamic adjustment function of defense intensity (DDAF), the change of feature vector can affect the adjustment of defense strategy. For example, if the user behavior is abnormal, the system may increase the priority of certain defense measures.

[0086] Multi-dimensional analysis: Different data sources and features provide different perspectives on network security events, helping the system to analyze from multiple dimensions and ensure a more comprehensive defense mechanism.

[0087] Network traffic, system logs, and user behavior change over time. Therefore, the multidimensional feature vector needs to be dynamically updated based on new data to reflect the latest network security situation. This update process may include: As new attack methods or security requirements emerge, the dimension of the feature vector may need to be expanded. Certain features may become more important at certain points in time and need to be adjusted based on actual conditions. The system can dynamically adjust the feature extraction strategy and data collection method based on feedback from the Defense Effectiveness Evaluation Model (DEM) to further improve the intelligence level of the system.

[0088] The present invention constructs a multidimensional feature vector based on real-time collection of network traffic, system logs and user behavior data, and forms a high-dimensional feature set through data cleaning, standardization and feature extraction. These features provide important data support for subsequent threat assessment, attack detection, response decision-making and defense strategy optimization. By continuously updating and optimizing these feature vectors, the system can more accurately identify security threats, implement more efficient defense measures, and ultimately improve the real-time and intelligent level of network security protection.

[0089] Step 202: Calculate a dynamic threat assessment index based on the multi-dimensional feature vector.

[0090] In some embodiments, step 202 may include:

[0091] Obtaining the weight and risk level of each feature from the multidimensional feature vector;

[0092] Obtain multiple attack similarity indicators;

[0093] Obtain the time decay factor and observation period relevant to the assessment;

[0094] According to the first adjustment coefficient, the second adjustment coefficient, the third adjustment coefficient and the fourth adjustment coefficient, the weight and the danger level of each feature, each attack similarity index, the time attenuation factor and the observation period are processed to calculate the dynamic threat assessment index.

[0095] In some embodiments, the dynamic threat assessment index may be expressed as:

[0096]

[0097] Where DTI is the dynamic threat assessment index, ω i is the weight of the i-th feature, V i is the risk of the ith feature, S j is the j-th attack similarity index, t is the time decay factor, T is the observation period, α, β, γ, and λ are the first adjustment coefficient, the second adjustment coefficient, the third adjustment coefficient, and the fourth adjustment coefficient, respectively.

[0098] In specific implementation, DTI is a dynamic threat assessment index, which indicates the overall severity of threats in the current network environment and is the basis for defense system decision-making;

[0099] ω i is the weight of the ith feature, indicating the degree of influence of the feature on the overall threat assessment. Different features may have different importance for the threat assessment, so it is necessary to assign appropriate weights to each feature;

[0100] V i is the danger level of the ith feature, indicating the correlation or degree of danger between the feature and the potential threat. Features may come from network traffic, user behavior, system logs, etc. Features with higher danger levels indicate that the behavior or event may cause greater security risks;

[0101] S j is the jth attack similarity index, which indicates the similarity between the current threat and the known attack. The attack similarity can be calculated by comparing the historical attack patterns and the threat features in the feature library. The higher the similarity, the more likely the threat is a known attack type;

[0102] t is the time decay factor. The older the data, the lower its weight, indicating the timeliness of the data. As time goes by, the impact of old data will gradually weaken. Therefore, the time decay factor is used to simulate the mechanism of reducing the impact of old data on threat assessment.

[0103] T is the observation period, which represents the time window considered when calculating the threat assessment. Generally speaking, the system defines the observation period based on the actual frequency of threat occurrence;

[0104] α, β, γ, and λ are the first adjustment coefficient, the second adjustment coefficient, the third adjustment coefficient, and the fourth adjustment coefficient, respectively. Among them, the first adjustment coefficient is used to adjust the overall scale of the formula and affect the range of the entire threat assessment index. The second adjustment coefficient is used to adjust the influence of the similarity product term so that the weight of the similarity index in the threat assessment is properly adjusted. The third adjustment coefficient is used to adjust the influence of the time decay term to ensure that the system can respond appropriately to the threat assessment based on the timeliness of the data. The fourth adjustment coefficient controls the rate of time decay and determines the rate at which the threat index decays over time.

[0105] ω i ·V i This section reflects the importance of each feature in threat assessment. Each threat source is determined by multiple features, such as the frequency of network traffic, the time distribution of abnormal access, the pattern of user behavior, etc. For different features, the system will assign weights according to their impact on potential threats. i At the same time, Vi Indicates the criticality of the feature. A higher criticality means that the feature is more closely related to known threats, so it contributes more to threat assessment. i Represents a specific traffic pattern in the network (such as port scanning), while ω i It represents the contribution of the feature to the overall threat, and the result of this item indicates the comprehensive danger of the feature.

[0106] This part calculates the combined impact of all attack similarity indicators by multiplying them. j is the similarity index of the jth attack, indicating the similarity between the current threat and the known attacks. log(S j ) uses a logarithmic function to emphasize that attack types with higher similarity will have a more significant impact on threat assessment.

[0107] As an example only, if S j Indicates the feature matching degree between the current attack and a known attack, and the matching degree is 0.8, then log(S j ) is log(0.8), which indicates the matching degree between the current threat and the known threat. A higher similarity indicates that the attack is more likely to be a known threat and the system needs to pay more attention.

[0108] The time decay factor is used to simulate the phenomenon that data gradually loses its validity over time. t is the time, T is the observation period, and λ is the adjustment coefficient, which determines the speed of time decay. As the data ages, the threat assessment will weaken its impact by using older, outdated threat data. This time decay mechanism ensures that the network security system responds to new attacks in a timely manner without reducing the detection effect due to over-reliance on historical data.

[0109] As an example, assume that the threat occurred in the past two days. If λ is 1 and the observation period T is 7 days, then the time decay factor is Indicates that the impact of the data from the past two days will be weakened by this factor compared to the real-time data.

[0110] α, β, γ, and λ can be adjusted according to actual needs to balance the impact of different parts on threat assessment. For example, α can determine the amplitude of the entire assessment index, β is used to control the contribution of similarity to the assessment results, and γ adjusts the impact of time decay on the assessment results. λ is used to accurately control the decay rate to ensure that the threat assessment can reflect the latest data and attack situation in a timely manner. As an example, in a specific network environment, it may be necessary to increase the weight of β to strengthen the impact of attack similarity, while reducing α so that the impact of feature weights on threat assessment is relatively mild. These adjustments help the system dynamically optimize defense strategies based on actual threat scenarios.

[0111] The purpose of designing the DTI formula is to form a comprehensive assessment model that can flexibly respond to the threats in the current network environment by combining multiple dynamic factors (such as characteristic danger, attack similarity, time decay, etc.).

[0112] ω i ·V i This section highlights the importance of each feature in the current threat assessment, ensuring that high-risk features can effectively influence defense strategies.

[0113] S j Partly through the dynamic calculation of attack similarities, we ensure that the system can identify and respond to known threats, avoid over-reliance on the rule base, and improve the protection against unknown attacks.

[0114] The time decay factor ensures the system's sensitivity to the latest threats and prevents outdated data from leading to incorrect defense decisions.

[0115] In summary, the DTI formula can accurately reflect the comprehensive assessment of threats in the current network environment, provide real-time and dynamic decision-making basis for the defense system, and ensure that network protection measures can always cope with evolving attack threats.

[0116] Step 203: Generate an adaptive response function according to the dynamic threat assessment index.

[0117] In some embodiments, step 203 may include:

[0118] Get dynamic threat assessment index and priority for each type of threat in the network;

[0119] Obtain historical response results for each successful response to each type of described threat;

[0120] Obtaining a nonlinear adjustment index, a learning rate, and a system resource constraint factor for generating the adaptive response function;

[0121] The adaptive response function is generated according to the dynamic threat assessment index and priority of each type of threat, the historical response effect of each successful response to each type of threat, the nonlinear adjustment index, the learning rate and the system resource constraint factor.

[0122] In some embodiments, the adaptive response function may be expressed as:

[0123]

[0124] Among them, ARF is the adaptive response function, DTI k is the dynamic threat assessment index of the k-th threat, P k is the priority of the threat, Ri is the i-th historical response effect, m is the nonlinear adjustment index, η is the learning rate, and Ω is the system resource constraint factor.

[0125] In the specific implementation, ARF is an adaptive response function, DTI k is the dynamic threat assessment index of the k-th threat, P k is the priority of the threat, R i is the i-th historical response effect, m is the nonlinear adjustment index, which controls the sensitivity of the response function, η is the learning rate, which indicates the sensitivity of the system to the historical response, and Ω is the system resource constraint factor, which ensures that the response is reasonably allocated under resource constraints.

[0126] This part reflects the weighted sum of the comprehensive assessment index and priority of various types of threats, combining the dynamic threat assessment index (DTI) of different types of threats. k ) and threat priority (P k ).

[0127] DTI k It is the dynamic threat assessment index of the k-th threat, indicating the severity, risk level and potential harm of the threat, which is usually obtained by the aforementioned threat assessment formula. k is the priority of the k-th threat, reflecting the importance of the threat relative to other threats. Priority is usually the result of comprehensive consideration of factors such as threat type, potential impact of the attack, and attack source. Generally, threats with higher priorities will occupy more system resources.

[0128] Through the DTI assessment index of different threats k With its priority P k By summing the products of the above, the system can comprehensively consider the strength of the defense response based on the severity and priority of each threat when facing multiple threats.

[0129] This term introduces m, the nonlinear adjustment index, which is used to nonlinearly adjust the weighted sum of threat assessment results. By adjusting the value of m, the sensitivity of the defense response to the threat assessment results can be controlled.

[0130] m controls the sensitivity of the response function. When m>1, the impact of the comprehensive threat assessment value on the response intensity will be amplified, and vice versa when m<1, it will have an inhibitory effect. By adjusting this index, the defense system can respond more strongly to high-priority threats and less strongly to low-priority threats.

[0131] As an example only, if m=2, then DTI k and P kThe weighted sum of will be squared, which means that the system will significantly increase the response to high-risk, high-priority threats. On the contrary, if m is less than 1, the response to threat assessment will be more conservative.

[0132] This item represents the system's adaptability to historical response effects and reflects how the system adjusts the current defense strategy based on past defense responses.

[0133] R i It represents the historical response effect of the i-th time, which is the evaluation result of the past response of the defense system. It usually reflects the feedback of the system effect after each defense response, such as the success rate of blocking attacks, false alarm rate, etc.

[0134] η is the learning rate, which indicates the system's sensitivity to historical responses. The larger η is, the more the system tends to adjust the current defense strategy based on historical responses. A small learning rate means that the system relies more on the assessment of current threats rather than historical data.

[0135] Through the accumulated R i The system can determine the effectiveness of certain defense measures and make adjustments in subsequent threat responses. For example, if the defense measures for a certain type of attack were effective in the past, the system may increase the response strength when facing similar attacks in the future; conversely, if a certain defense response was unsuccessful in the past, the system may reduce the intensity of the response or optimize the response strategy.

[0136] As an example only, if R i It represents the success rate of responses to a certain type of attack in the past five times. This item optimizes defense decisions by accumulating historical feedback and adapting to different attack modes.

[0137] Ω represents the system resource constraint factor, which ensures that the response strength of the defense strategy meets the system resource constraints and avoids excessive consumption of system resources. This factor usually considers the system's computing power, bandwidth, storage capacity and other resource constraints.

[0138] Ω ensures that defense responses are distributed appropriately when system resources are limited. An overly strong response may exhaust system resources, resulting in insufficient defense against other threats, or cause the system to fall into a state of resource saturation, thus affecting the overall defense effect.

[0139] As an example only, if the system has limited available resources (such as bandwidth, computing power, etc.), Ω may be reduced, resulting in responses to certain high-priority threats being scaled back to avoid overloading the system.

[0140] By integrating threat assessment index, historical response effect, nonlinear adjustment index and resource constraint factor, ARF provides a flexible way to dynamically adjust the defense response strength according to real-time threats, system historical feedback and resource status. Specifically:

[0141] By DTI k and P k The system can reasonably prioritize different threats and ensure the strongest response to the most serious threats. The introduction of m enables the system to flexibly adjust the response sensitivity to threat assessment and enhance the ability to respond to specific threats. i ) and the adjustment of η, the system can adjust the strategy according to the past performance of the defense measures to further improve the defense efficiency. Ω ensures that the defense response does not exceed the resource limit of the system and guarantees the sustainability of the defense measures.

[0142] In summary, the ARF of the present invention enables the network security system to make the most appropriate defense response in real time and dynamically according to the current threat situation, historical feedback and system resources, ensuring the efficiency of the defense strategy and the stability of the system.

[0143] Step 204: Determine a defense strength dynamic adjustment function based on the adaptive response function, and perform multi-level linkage defense based on the defense strength dynamic adjustment function.

[0144] In some embodiments, step 204 may include:

[0145] Obtaining a time window function for characterizing the time dependency of defense strength;

[0146] Get a defense measure set including multiple defense measures;

[0147] Each of the defense measures is processed according to the measure cost coefficient, the adaptive function is processed according to the sensitivity parameter, and combined with the time window function to obtain the defense strength dynamic adjustment function.

[0148] In some embodiments, the defense strength dynamic adjustment function can be expressed as:

[0149]

[0150] Among them, DDAF is the dynamic adjustment function of defense strength, θ is the time window function, which represents the time dependence of defense strength, and M i is the i-th item in the set of defense measures, C i is the measure cost coefficient, ψ is the sensitivity parameter that controls the degree of responsiveness of defense adjustment to threat assessment, and ARF is the adaptive response function, which serves as the core input for defense intensity adjustment.

[0151] The part ∫(ARF·θ)dt describes the variation of defense strength over time, where θ represents the time window function, which is used to capture the time dependence of defense strength.

[0152] θ is a time window function, which indicates the change of defense strength over time. It usually reflects the ability of the defense system to adapt to threat assessment and response strength over time. In practical applications, the time window function can be modeled in linear, exponential, decaying and other ways. The introduction of the time window function can help the system gradually adjust the defense strength in the face of continuous threats to ensure the efficiency of system resource utilization and the continuity of defense response.

[0153] For example, the intensity of a certain threat may gradually weaken over a certain period of time. At this time, the time window function θ may show a decay trend to reduce the defense intensity. When the threat continues to increase, the time window function may gradually increase the defense response intensity.

[0154] ARF is an adaptive response function, which is multiplied by the time window function θ as a time-dependent adjustment factor, indicating that the defense strength depends not only on the current threat assessment (provided by ARF), but also on the response changes of the defense system in the time dimension.

[0155] The integral operation means that over a period of time, the defense system continuously adjusts the defense strength according to the time window function θ to ensure the balance and adaptability of the defense over time. For example, the system may increase the defense strength over a certain period of time to cope with the growth of threats, and then gradually reduce the defense strength as the threats weaken.

[0156] This part combines different defense measures and their cost coefficients to dynamically adjust the defense strength according to the sensitivity of the defense.

[0157] M i It represents the i-th item in the set of defense measures, which can be firewall, intrusion detection, sandbox technology, content filtering, etc. Each defense measure has its specific implementation method and strategy.

[0158] C i is the cost coefficient of the i-th defense measure, which usually indicates the resource consumption, computing cost or other operating cost required to implement the defense measure. The cost coefficient reflects the implementation cost of the defense measure. A higher cost coefficient means that the measure may require a larger resource investment. The system will consider the reasonable allocation of resources during the defense process to avoid resource waste.

[0159] For example, some defense measures may be very accurate but require a lot of computing resources or bandwidth. At this time, the system needs to evaluate its cost-effectiveness to determine whether it is worth investing resources.

[0160] tanh(ψ·ARF) is a hyperbolic tangent function (tanh) that is used to adjust the sensitivity of the defense response. By introducing the tanh function, the system can introduce nonlinear effects when adjusting the defense strength. ψ is a sensitivity parameter that controls the sensitivity of the defense system to changes in the threat assessment (ARF).

[0161] If the ψ value is large, it means that the system is more sensitive to changes in the ARF value. The larger the ARF (i.e., the stronger the threat), the more obvious the response of the defense measures, and vice versa. By adjusting ψ, the system can flexibly adjust the strength of the defense measures according to the current threat intensity.

[0162] tanh(ψ·ARF) combines ARF and ψ to adjust the defense strength of the system in a nonlinear response. The characteristic of the hyperbolic tangent function (tanh) is that when the ARF value is large, the improvement of defense strength will tend to be stable to avoid overreaction; when the ARF value is small, the defense strength will increase rapidly, helping the system to deal with weaker but potential threats.

[0163] Just as an example, when ARF is high, it means that the current threat is very serious. At this time, ψ will ensure that the response of the defense measures is enhanced. Conversely, when the threat is low, the output of tanh(ψ·ARF) is small, and the system will moderately reduce the defense intensity to save resources and avoid excessive resource consumption.

[0164] By combining the above factors, the DDAF model makes the defense intensity adjustment more flexible and dynamic. Specifically, by introducing the time window function, the system can dynamically adjust the defense intensity according to the persistence of the threat to avoid overreaction or waste of resources. i , C i ,The system considers the cost and effect of different defense measures, ensuring that defense decisions are not only effective but also use resources reasonably.,By ψ adjusting the sensitivity of the defense response, the system can make fine-grained adjustments based on the intensity of the threat and the historical response effect,,ensuring the efficiency and adaptability of the defense system.

[0165] Overall, the DDAF formula effectively and dynamically adjusts the defense strength through two main parts: the time window function and the defense measures and cost coefficient adjustment:

[0166] The time window function (θ) ensures that the defense response gradually adapts to the threat situation over time, effectively avoiding excessive resource consumption and unnecessary overreaction. The combination of defense measures and cost coefficients allows the system to consider the resource consumption of each defense measure when adjusting the defense strength and allocate resources reasonably. Nonlinear regulation (through tanh(ψ·ARF)) ensures that the defense measures respond in a refined manner according to the changes in threat intensity, thereby improving the defense effect. The introduction of the sensitivity parameter (ψ) enables the defense system to flexibly adjust the defense strength according to the threat assessment results, ensuring an effective response to different threats.

[0167] In summary, the DDAF of the present invention provides an efficient and flexible dynamic defense adjustment mechanism, which can automatically adjust the defense strength according to real-time threats and system status, thereby optimizing network security protection.

[0168] Step 205: Evaluate the defense effect of the multi-level linkage defense through a defense effectiveness evaluation model to obtain a corresponding evaluation result.

[0169] In some embodiments, step 205 may include:

[0170] Obtain the number of events experienced during the defense effectiveness evaluation period;

[0171] Obtain the balance factor used to control the weight between defense effect and loss, as well as the effectiveness attenuation coefficient focusing on long-term defense effect;

[0172] Obtain the loss caused by the current incident and the maximum acceptable loss;

[0173] The evaluation result is determined according to the number of events, the balance factor, the efficiency attenuation coefficient, the loss caused by the current event and the maximum acceptable loss.

[0174] In some embodiments, the defense effectiveness evaluation model can be expressed as:

[0175]

[0176] Among them, DEM is the defense effectiveness evaluation model, N is the number of events in the evaluation period, is a balance factor that controls the weight between defense effect and loss, L i is the loss caused by the current event, L max is the maximum acceptable loss, and ρ is the effectiveness attenuation coefficient, which reflects the focus on long-term defense effects.

[0177] N represents the number of events experienced by the defense system during the defense evaluation period. An "event" can be a network attack, abnormal behavior, or security vulnerability. This item calculates the total number of various threats or attack events encountered by the defense system within a certain period of time. By considering multiple events, the evaluation model can integrate the defense effects of all events. The more events there are, the more representative and reliable the overall evaluation effect is.

[0178] Is a balancing factor that controls the weight between defense effect and loss. Defense effect and loss are usually correlated, but in some cases, the severity of certain losses may require more attention. The introduction of this factor allows the system to weight the contribution of defense effect and loss according to the actual situation.

[0179] By adjusting The system can pay more attention to the defensive effect (when Larger) or loss (when For example, when the defense effect is good, the impact of the loss can be appropriately reduced, while when the loss is large, the attention to the loss can be increased.

[0180] generally, The value range is from 0 to 1. If If it is close to 1, it means that the weight of the defense effect is larger; if it is close to 0, the weight of the loss is larger.

[0181] This section measures the ratio between the defense response rate (ARF) and the threat assessment index (DTI). The ARF represents the response of the defense system based on the threat assessment and resource availability, while the DTI is the overall assessment index of the threat. By calculating the ratio of the two, it reflects the effectiveness and rationality of the defense system's response.

[0182] If the defense response is high relative to the threat assessment (ARF is large, DTI is small), the ratio will be large, indicating that the defense response is more effective against the threat. Conversely, if the defense response is weak or the threat assessment is high, the system response may be insufficient, resulting in a small ratio.

[0183] This part takes the logarithm of the comparison value to ensure that the measurement of defense effect is smoother within a certain range. As the ratio increases, the improvement in defense effect gradually decreases, thus avoiding over-response. At a smaller ratio, the improvement in defense effect is more significant, ensuring a timely response to minor threats.

[0184] This part measures the loss caused by the current event (Li ) and the maximum acceptable loss of the system (L max ) between them. L i Indicates the loss caused by a specific event, while L max It is the maximum acceptable loss defined during system design.

[0185] L i It is the loss caused by a specific incident, which may include financial loss, data leakage, reputation damage and other factors.

[0186] L max It is the maximum loss threshold that the system can bear when facing losses. If this threshold is exceeded, the system may face irreversible consequences.

[0187] Indicates the proportion of the loss of the current event to the maximum acceptable loss. If the loss is very small (L i If the loss is close to the maximum acceptable loss (L i Close to L max ), the value is close to 0, indicating that the defense has failed to effectively mitigate the loss.

[0188] ρ is the effectiveness attenuation coefficient, which is used to control the attenuation of the long-term defense effect. This coefficient is introduced to reflect the emphasis on long-term defense effect in the model, that is, whether the defense system can still maintain its effectiveness when facing long-term and continuous threats.

[0189] A larger ρ value indicates that the system is more sensitive to the long-term defense effect and pays more attention to the effectiveness of continuous defense. A smaller ρ value indicates that the system pays less attention to the long-term defense effect and may rely more on short-term defense response.

[0190] By introducing ρ, the model can distinguish between defense strategies that are effective in the short term and those that are effective in the long term. Over a long period of time, the defense system may need to be adjusted according to changes in the threat situation, and ρ can help evaluate the effectiveness of long-term defense strategies.

[0191] The two parts of the formula and A comprehensive measure reflecting the effectiveness of defense: on the one hand, it considers the effectiveness of the defense response relative to the threat assessment, and on the other hand, it focuses on the ratio of the loss caused by the current incident to the maximum acceptable loss.

[0192] As a balancing factor, the relative importance between defense effect and loss is adjusted. If the system attaches more importance to defense effect, then If it is close to 1, then the focus is more on loss control.

[0193] pass The system assesses the losses caused by the current incident and ensures that the defense system minimizes the impact on normal operations while limiting the losses.

[0194] By introducing ρ, the system can effectively balance the long-term and short-term defense effects when evaluating defense effectiveness. The system's emphasis on long-term effects can ensure that it remains effective under continuous threats.

[0195] Ultimately, the DEM result is an overall effectiveness indicator of the defense system during the evaluation period. This evaluation result provides data support for subsequent defense strategy optimization, adjustment, and resource allocation.

[0196] Through the DEM model, the defense system can be based on defense response (ARF), threat assessment (DTI), loss (L i ) and the maximum acceptable loss (L max ) and other factors to comprehensively evaluate the defense effect, and optimize and adjust the strategy based on the evaluation results. DEM not only focuses on the current defense effect, but also makes reasonable adjustments based on the long-term defense effectiveness attenuation, thereby improving the flexibility and effectiveness of the overall defense system.

[0197] Step 206: Continuously optimize the executed multi-level linkage defense according to the evaluation result.

[0198] In some embodiments, step 206 may include:

[0199] Adaptively adjusting the calculation parameters in the dynamic threat assessment index, the adaptive response function, the defense strength dynamic adjustment function, and the defense effectiveness evaluation model to obtain optimized dynamic threat assessment index, adaptive response function, defense strength dynamic adjustment function, and defense effectiveness evaluation model;

[0200] Optimizing the weight of each feature based on a machine learning algorithm to obtain optimized features;

[0201] The defense strategy threshold is dynamically updated according to the optimized dynamic threat assessment index, adaptive response function, defense strength dynamic adjustment function and defense effectiveness evaluation model, as well as the optimized features.

[0202] In the specific implementation, in this solution, the process of adaptive adjustment and machine learning optimization is the core part of improving the system's defense capabilities and response efficiency. By optimizing the calculation parameters in the dynamic threat assessment index (DTI), adaptive response function (ARF), defense intensity dynamic adjustment function (DDAF) and defense effectiveness evaluation model (DEM), the system can continuously adjust its defense strategy according to changes in the network environment, thereby improving the defense effect. The following is a detailed explanation of the process:

[0203] During system operation, the network environment and attack situation are constantly changing. Therefore, the original calculation parameters need to be dynamically adjusted according to the actual situation to ensure the continued effectiveness of the defense system. Specifically, the system will adaptively adjust the following four important calculation parameters:

[0204] The adjustment coefficients (α, β, γ, λ) in the DTI formula control the degree of influence of different factors in threat assessment. In actual operation, the attack mode and system status will change continuously, so these coefficients should be dynamically adjusted according to real-time information such as historical attack data, current network traffic, system load, etc. For example, if a certain feature has a greater impact on threat assessment, the corresponding weight coefficient (α, β, γ) can be increased, so that the role of this feature in threat assessment is more prominent.

[0205] In some embodiments, these coefficients can be dynamically adjusted based on the accuracy of each threat assessment through real-time monitoring and feedback mechanisms. For example, the system can adjust the coefficients through regression analysis of historical data or optimization algorithms to improve the accuracy of the assessment.

[0206] ARF contains multiple parameters, such as nonlinear adjustment index (m), learning rate (η), and resource constraint factor (Ω). These parameters directly affect the formulation of defense strategies. For example, the learning rate η controls the sensitivity of the system to historical responses. If the attack situation changes rapidly, the system may need a higher learning rate to quickly adjust the response strategy. Online learning or reinforcement learning algorithms can be used to analyze the historical response effects (R i ) feedback, so that the response function can respond more accurately to different types of threats.

[0207] The time window function (θ), sensitivity parameter (ψ), and measure cost coefficient (C i ) will affect the adjustment effect of defense measures. For example, if network attacks occur frequently, the sensitivity parameter ψ may need to be increased to make the system respond to threats more quickly and sensitively. By analyzing the historical defense effects, these parameters can be adjusted through machine learning methods to improve the adaptability and effectiveness of the defense strategy. Adaptive optimization algorithms, such as genetic algorithms and particle swarm optimization, can be used to optimize these parameters.

[0208] Balance Factor in DEM Efficiency reduction coefficient (ρ), loss ratio Parameters such as ρ and ρ will affect the evaluation results of defense effectiveness. These parameters need to be adjusted dynamically according to changes in the network environment and attack patterns. These parameters can be adjusted based on historical defense effectiveness feedback. For example, if the defense system has not been seriously attacked for a long time, the effectiveness attenuation coefficient (ρ) can be appropriately reduced to improve the defense capability against future attacks.

[0209] In the present invention, optimizing the weights of features through machine learning algorithms is an important means to improve threat assessment and defense effectiveness. Machine learning can automatically analyze the impact of different features and optimize their weights based on real-time data.

[0210] By analyzing the data collected in real time, machine learning algorithms can identify which features (such as network traffic, system logs, user behavior, etc.) have a strong correlation with security threats and which features contribute more to the accuracy of threat assessment. The system can dynamically adjust the weight of each feature so that important features receive more attention in the assessment and improve the defense effect.

[0211] The labeled attack and normal data sets can be used to automatically optimize feature weights through training algorithms such as decision trees, support vector machines, neural networks, etc. Machine learning models can be trained based on historical data sets to learn which features have higher importance in threat assessment.

[0212] When there is no labeled data, clustering algorithms (such as K-means, DBSCAN, etc.) or dimensionality reduction algorithms (such as PCA) can be used to identify the intrinsic structure of the data and automatically discover and adjust feature weights. Based on the feedback from the network defense system, the system can use reinforcement learning to adjust feature weights and defense strategies to maximize the defense effect.

[0213] After the threat assessment and defense response mechanisms are improved through adaptive adjustment and machine learning optimization, the system will dynamically update the threshold of the defense strategy based on the new dynamic threat assessment index, optimized response function, and defense strength adjustment function to ensure that the system can cope with the ever-changing attack situation.

[0214] The thresholds in the defense strategy determine the intensity and time of the system's response to different types of threats. For example, some high-threat-level attacks may require immediate and strong defense measures, while low-threat-level attacks can be responded to moderately. The optimized dynamic threat assessment index and adaptive response function can help determine reasonable thresholds to ensure efficient allocation of resources.

[0215] Based on the optimized threat assessment results and response strategies, the system will adjust the defense strategy threshold in real time. For example, when a new attack occurs, the system automatically calculates the most suitable defense threshold by evaluating its threat index, similarity index and historical response effect, so as to adjust the defense measures more accurately.

[0216] When new attack patterns emerge, the system can automatically adjust defense behavior through dynamically updated defense policy thresholds. For example, if a zero-day attack or APT attack is identified, the system will increase the threshold for that attack category to make the defense policy more stringent; if it is a known attack with a good response history, the threshold can be lowered to reduce resource waste.

[0217] In summary, the present invention can continuously optimize the performance of the network defense system by adaptively adjusting calculation parameters, optimizing feature weights based on machine learning, and dynamically updating defense strategy thresholds. The system adjusts threat assessment models and defense mechanisms based on real-time data and feedback, thereby improving the ability to respond to unknown attacks and rapidly changing threats, ensuring that network security protection is always in the best state.

[0218] In some embodiments, the method of the present application may further include:

[0219] Updating the threat knowledge base based on the evaluation result to obtain an updated threat knowledge base;

[0220] Updating the defense strategy library based on the updated threat knowledge base to obtain an updated defense strategy library;

[0221] According to the updated threat knowledge base and the updated defense strategy library, the system response mechanism and resource scheduling strategy are optimized.

[0222] In specific implementation, the threat knowledge base can contain information about various known threats, such as attack types, attack methods, attack targets, attacker behavior patterns, etc. As new threats continue to emerge, the threat knowledge base needs to be dynamically updated based on the latest assessment results. The specific process is as follows:

[0223] Through real-time calculations of models such as the Dynamic Threat Index (DTI), Adaptive Response Function (ARF), and Defense Strength Dynamic Adjustment Function (DDAF), the threat level and attack type in the current network environment can be obtained. The evaluation results can include the characteristics of the threat (such as attack source, attack method, attack intensity, attack target) and its potential impact on the system.

[0224] When the system identifies a new attack or an unknown attack pattern, the evaluation results will be fed back to the threat knowledge base. Through machine learning and other technologies, the system can extract and analyze these new attack features and update the threat data in the knowledge base in a timely manner.

[0225] Through historical attack events and feedback evaluation results, the system can optimize the description and classification of known threats. For example, if the characteristic pattern of a certain attack changes, the system can adjust the identification or definition of the attack type in the knowledge base.

[0226] The system integrates new attack patterns, variants, or the evolution of known attacks into the threat knowledge base through automated learning mechanisms (such as incremental learning and reinforcement learning). This keeps the threat knowledge base up to date and ensures that the defense system can identify and defend against new attacks in a timely manner.

[0227] The updated threat knowledge base not only contains the latest attack information, but also has higher accuracy and identification capabilities, enabling the system to better analyze and respond to new and known threats.

[0228] The defense strategy library stores defense strategies for different threats. For different types of attacks, the defense strategy library provides a variety of defense methods and emergency response measures. The update of the defense strategy library is based on the new information in the threat knowledge base. The specific process is as follows:

[0229] Mapping of threat types and defense strategies: Each new threat type or threat feature will be mapped to a corresponding defense strategy. By analyzing the data in the threat assessment results, the defense strategy library can dynamically adjust existing strategies, add new strategies, or optimize existing strategies.

[0230] Optimization of defense strategies: For example, if the threat knowledge base updates a new variant of a certain attack, the defense strategy library will update the defense measures according to the characteristics of the new variant. For example, if the system finds that a certain attack is carried out through a specific protocol, the defense strategy library will provide a corresponding protocol shielding strategy.

[0231] Machine learning algorithms can automatically optimize defense strategies based on new attack signatures and their threat assessment results. For example, if historical data shows that a certain defense strategy is ineffective against a specific attack, the system can automatically adjust or replace the strategy.

[0232] After the threat knowledge base is updated, the defense strategy library will automatically adjust the defense measures based on the latest data in the threat knowledge base to ensure the effectiveness and pertinence of the defense measures. The updated defense strategy library can cope with a wider range of attack scenarios and reduce false positives and false negatives.

[0233] The update of threat knowledge base and defense strategy base provides the basis for system optimization response mechanism and resource scheduling. System response mechanism and resource scheduling strategy need to be dynamically adjusted according to the effectiveness of defense measures, urgency of attack and available resources. The specific steps are as follows:

[0234] Adjustment of response priorities: Based on new threat types and updates to defense strategies, the system will re-evaluate the priorities of different threats. The system will determine the attack types to be responded to first based on the dynamic threat index (DTI) of each threat and the countermeasures in the defense strategy library. For example, high-risk APT attacks or zero-day attacks will be responded to first.

[0235] Real-time response adjustment: The updated threat knowledge base provides more accurate threat identification information, and the defense strategy library provides more targeted defense measures. The system can dynamically adjust the response intensity and strategy based on the real-time threat assessment results. For example, when the system finds that the attack mode has changed, the defense measures will be automatically adjusted to minimize the losses caused by the attack.

[0236] Resource allocation and scheduling: Resource scheduling strategies need to ensure that limited computing resources, bandwidth, and storage resources can be reasonably allocated among multiple defense tasks. When facing multiple concurrent threats, the system will optimize resource allocation based on the attack assessment in the threat knowledge base and the requirements of defense measures in the defense strategy library. For example, the system may allocate more resources to high-priority attack response tasks to ensure that the system can respond to threats in the most effective way.

[0237] Dynamic resource scheduling: During the defense process, the system may need to dynamically adjust resource allocation based on the intensity and complexity of the attack. For example, when defending against complex intrusions, more computing resources may be needed for data analysis, while when defending against simple denial of service attacks, fewer resources may be needed. The system will optimize resource scheduling based on the threat level and defense effect.

[0238] In summary, the present invention updates the threat knowledge base and the defense strategy library, and based on these updates optimizes the response mechanism and resource scheduling strategy of the system, so that the entire system can achieve automatic adaptation and real-time optimization. The update of the threat knowledge base ensures the system's ability to identify new attacks, and the update of the defense strategy library ensures that the system's strategy for dealing with threats is more accurate and efficient. The optimized response mechanism and resource scheduling strategy ensure that the system can reasonably allocate computing resources and improve defense effectiveness while providing efficient defense, ultimately achieving dynamic, intelligent, and automated defense capabilities.

[0239] See also Figure 2 , Figure 2 A schematic diagram of the structure of a network security dynamic defense system based on big data provided by the present invention.

[0240] like Figure 2 As shown, a network security dynamic defense system based on big data proposed in an embodiment of the present invention includes:

[0241] The data acquisition module 301 is used to construct a multi-dimensional feature vector based on the real-time collected network traffic data, system logs and user behavior data;

[0242] A threat assessment module 302, configured to calculate a dynamic threat assessment index based on the multi-dimensional feature vector;

[0243] A threat response module 303, configured to generate an adaptive response function according to the dynamic threat assessment index;

[0244] A network defense module 304, configured to determine a defense strength dynamic adjustment function based on the adaptive response function, and to perform multi-level linkage defense based on the defense strength dynamic adjustment function;

[0245] The defense evaluation module 305 is used to evaluate the defense effect of the multi-level linkage defense through a defense effectiveness evaluation model to obtain a corresponding evaluation result;

[0246] The defense optimization module 306 is used to continuously optimize the executed multi-level linkage defense according to the evaluation result.

[0247] See also Figure 3 , Figure 3 Schematic diagram of an electronic device provided by an embodiment of the present invention. Figure 3 As shown, an embodiment of the present invention provides an electronic device 400, including a memory 410, a processor 420, and a computer program 411 stored in the memory 410 and executable on the processor 420. When the processor 420 executes the computer program 411, the following steps are implemented:

[0248] Construct multi-dimensional feature vectors based on real-time collected network traffic data, system logs and user behavior data;

[0249] Calculating a dynamic threat assessment index based on the multidimensional feature vector;

[0250] generating an adaptive response function according to the dynamic threat assessment index;

[0251] Determining a defense strength dynamic adjustment function based on the adaptive response function, and performing multi-level linkage defense based on the defense strength dynamic adjustment function;

[0252] Through the defense effectiveness evaluation model, the defense effect of the multi-level linkage defense is evaluated to obtain the corresponding evaluation result;

[0253] Based on the evaluation results, the executed multi-level linkage defense is continuously optimized.

[0254] See also Figure 4 , Figure 4A schematic diagram of an embodiment of a computer-readable storage medium provided in an embodiment of the present invention. Figure 4 As shown, this embodiment provides a computer-readable storage medium 500, on which a computer program 411 is stored. When the computer program 411 is executed by a processor, the following steps are implemented:

[0255] Construct multi-dimensional feature vectors based on real-time collected network traffic data, system logs and user behavior data;

[0256] Calculating a dynamic threat assessment index based on the multidimensional feature vector;

[0257] generating an adaptive response function according to the dynamic threat assessment index;

[0258] Determining a defense strength dynamic adjustment function based on the adaptive response function, and performing multi-level linkage defense based on the defense strength dynamic adjustment function;

[0259] Through the defense effectiveness evaluation model, the defense effect of the multi-level linkage defense is evaluated to obtain the corresponding evaluation result;

[0260] Based on the evaluation results, the executed multi-level linkage defense is continuously optimized.

[0261] It should be noted that in the above embodiments, the description of each embodiment has its own emphasis, and for parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0262] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0263] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded computer, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1A system that specifies the functions of a box or multiple boxes.

[0264] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction system, which is implemented in the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0265] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0266] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0267] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A network security dynamic defense method based on big data, characterized in that: The method comprises: Construct multi-dimensional feature vectors based on real-time collected network traffic data, system logs and user behavior data; Calculating a dynamic threat assessment index based on the multidimensional feature vector; generating an adaptive response function according to the dynamic threat assessment index; Determining a defense strength dynamic adjustment function based on the adaptive response function, and performing multi-level linkage defense based on the defense strength dynamic adjustment function; Through the defense effectiveness evaluation model, the defense effect of the multi-level linkage defense is evaluated to obtain the corresponding evaluation result; Based on the evaluation results, the executed multi-level linkage defense is continuously optimized.

2. The network security dynamic defense method based on big data according to claim 1 is characterized in that: The step of calculating a dynamic threat assessment index based on the multidimensional feature vector includes: Obtaining the weight and risk level of each feature from the multidimensional feature vector; Obtain multiple attack similarity indicators; Obtain the time decay factor and observation period relevant to the assessment; According to the first adjustment coefficient, the second adjustment coefficient, the third adjustment coefficient and the fourth adjustment coefficient, the weight and the danger level of each feature, each attack similarity index, the time attenuation factor and the observation period are processed to calculate the dynamic threat assessment index.

3. The network security dynamic defense method based on big data according to claim 2 is characterized in that: The dynamic threat assessment index is expressed as: Where DTI is the dynamic threat assessment index, ω i is the weight of the i-th feature, V i is the risk of the ith feature, S j is the j-th attack similarity index, t is the time decay factor, T is the observation period, α, β, γ, and λ are the first adjustment coefficient, the second adjustment coefficient, the third adjustment coefficient, and the fourth adjustment coefficient, respectively.

4. The network security dynamic defense method based on big data according to claim 3 is characterized in that: Generating an adaptive response function according to the dynamic threat assessment index includes: Get dynamic threat assessment index and priority for each type of threat in the network; Obtain historical response results for each successful response to each type of described threat; Obtaining a nonlinear adjustment index, a learning rate, and a system resource constraint factor for generating the adaptive response function; The adaptive response function is generated according to the dynamic threat assessment index and priority of each type of threat, the historical response effect of each successful response to each type of threat, the nonlinear adjustment index, the learning rate and the system resource constraint factor.

5. The network security dynamic defense method based on big data according to claim 4 is characterized in that: The adaptive response function is expressed as: Among them, ARF is the adaptive response function, DTI k is the dynamic threat assessment index of the k-th threat, P k is the priority of the threat, R i is the i-th historical response effect, m is the nonlinear adjustment index, η is the learning rate, and Ω is the system resource constraint factor.

6. The network security dynamic defense method based on big data according to claim 5 is characterized in that: The determining of the defense strength dynamic adjustment function based on the adaptive response function includes: Obtaining a time window function for characterizing the time dependency of defense strength; Get a defense measure set including multiple defense measures; Each of the defense measures is processed according to the measure cost coefficient, the adaptive function is processed according to the sensitivity parameter, and combined with the time window function to obtain the defense strength dynamic adjustment function.

7. The network security dynamic defense method based on big data according to claim 6 is characterized in that: The defense effectiveness evaluation model is used to evaluate the defense effect of the multi-level linkage defense to obtain corresponding evaluation results, including: Obtain the number of events experienced during the defense effectiveness evaluation period; Obtain the balance factor used to control the weight between defense effect and loss, as well as the effectiveness attenuation coefficient focusing on long-term defense effect; Obtain the loss caused by the current incident and the maximum acceptable loss; The evaluation result is determined according to the number of events, the balance factor, the efficiency attenuation coefficient, the loss caused by the current event and the maximum acceptable loss.

8. The network security dynamic defense method based on big data according to claim 7 is characterized in that: The continuously optimizing the executed multi-level linkage defense according to the evaluation result includes: Adaptively adjusting the calculation parameters in the dynamic threat assessment index, the adaptive response function, the defense strength dynamic adjustment function, and the defense effectiveness evaluation model to obtain optimized dynamic threat assessment index, adaptive response function, defense strength dynamic adjustment function, and defense effectiveness evaluation model; Optimizing the weight of each feature based on a machine learning algorithm to obtain optimized features; The defense strategy threshold is dynamically updated according to the optimized dynamic threat assessment index, adaptive response function, defense strength dynamic adjustment function and defense effectiveness evaluation model, as well as the optimized features.

9. The network security dynamic defense method based on big data according to claim 8 is characterized in that: The method further comprises: Updating the threat knowledge base based on the evaluation result to obtain an updated threat knowledge base; Updating the defense strategy library based on the updated threat knowledge base to obtain an updated defense strategy library; According to the updated threat knowledge base and the updated defense strategy library, the system response mechanism and resource scheduling strategy are optimized.

10. A network security dynamic defense system based on big data, characterized in that: The system comprises: The data acquisition module is used to construct a multi-dimensional feature vector based on the real-time collected network traffic data, system logs and user behavior data; A threat assessment module, used to calculate a dynamic threat assessment index based on the multidimensional feature vector; A threat response module, used to generate an adaptive response function according to the dynamic threat assessment index; A network defense module, used to determine a defense strength dynamic adjustment function based on the adaptive response function, and to perform multi-level linkage defense based on the defense strength dynamic adjustment function; A defense evaluation module is used to evaluate the defense effect of the multi-level linkage defense through a defense effectiveness evaluation model to obtain a corresponding evaluation result; The defense optimization module is used to continuously optimize the executed multi-level linkage defense according to the evaluation result.

Images