Power consumption information acquisition network security communication evaluation method based on big data processing

Abstract

The invention discloses an electricity consumption information acquisition network security communication evaluation method based on big data processing, relates to the technical field of network security communication evaluation, and solves the problem of insufficient efficiency and accuracy of network security communication evaluation. Wherein the data filtering unit, the data conversion unit and the data standardization unit are used for carrying out data preprocessing on collected network communication data, the model establishment module adopts a random forest algorithm to construct a security evaluation model, and the model evaluation module evaluates the performance of the security evaluation model through average accuracy. The model optimization module adopts a random forest classifier to adjust the performance of the security assessment model, the data clustering analysis module adopts a clustering layer of the security assessment model to divide network communication data into data clusters, and the assessment result acquisition module realizes network security communication assessment through an assessment diagnosis layer of the security assessment model. According to the invention, the network security communication evaluation efficiency and accuracy are greatly improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security communication assessment, and more specifically to a network security communication assessment method for electricity consumption information collection based on big data processing. Background Art

[0002] The role of the network security communication assessment method based on big data processing is to evaluate the network security status and provide corresponding solutions by analyzing and mining large-scale network communication data. Its main functions include: 1. Threat detection and early warning: through real-time monitoring and analysis of abnormal behaviors, malicious attacks, etc. in big data, it can timely discover potential threats and provide early warning information to help network security personnel take defensive measures in time; 2. Anomaly detection and troubleshooting: through anomaly detection and fault analysis of a large amount of network communication data, it can identify abnormal behaviors, equipment failures and other problems in the network, and help locate and troubleshoot the causes of the problems for rapid repair; 3. Security incident response: using big data processing technology, it is possible to achieve automated response to network security incidents. When a security incident occurs, the system can automatically trigger the corresponding response mechanism and take necessary measures to limit losses and restore normal operation.

[0003] In the prior art, there are many drawbacks in the network security communication assessment method based on big data processing. On the one hand, the lack of a data preprocessing module makes it impossible to remove redundant data and perform format conversion, and cannot ensure the accuracy and reliability of subsequent network security communication assessment, and cannot extract useful network communication data features from the preprocessed network communication data. On the other hand, there is a lack of a security assessment model for network security communication assessment, and the security assessment model cannot be evaluated and optimized, resulting in insufficient performance of the security assessment model, and insufficient efficiency and accuracy of network security communication assessment. Therefore, the present invention proposes a network security communication assessment method for electricity consumption information collection based on big data processing, which aims to improve the efficiency and accuracy of network security communication assessment. Summary of the invention

[0004] In view of the deficiencies of the above-mentioned technologies, the present invention discloses a network security communication evaluation method for electricity consumption information collection based on big data processing. The data preprocessing module removes redundant data and performs format conversion on the collected network communication data through a data filtering unit, a data conversion unit and a data standardization unit, so as to solve the problem that the accuracy and reliability of subsequent network security communication evaluation cannot be ensured. The feature analysis algorithm extracts network communication data features from the preprocessed network communication data, so as to solve the problem that useful network communication data features cannot be extracted from the preprocessed network communication data. The model building module uses a random forest algorithm to train the security assessment model training set to realize the construction of a security assessment model. The model evaluation module evaluates the performance of the security assessment model through average precision. The model optimization module uses a random forest classifier to adjust the performance of the security assessment model, so as to solve the problem that the security assessment model cannot be evaluated and optimized. The data clustering analysis module uses the clustering layer of the security assessment model to divide the network communication data into data clusters. The evaluation result acquisition module realizes network security communication evaluation through the evaluation diagnosis layer of the security assessment model, so as to solve the problem that the efficiency and accuracy of network security communication evaluation are insufficient.

[0005] In view of this, the present invention provides a method for evaluating network security communication of power consumption information collection based on big data processing, and the method comprises the following steps: Step 1: Collect network communication data through network device logs, wherein the network communication data at least includes data packets, source IP addresses, target IP addresses, protocol headers and load data. The network device logs use a network big data filtering engine to capture only the required network communication data. The network big data filtering engine constructs a network communication data collection framework structure through an association rule mechanism. The network device logs accurately capture network communication data according to the data collection framework structure. Step 2: Use a data preprocessing module to preprocess the collected network communication data, remove redundant data and perform format conversion; In step 2, the data preprocessing module includes a data filtering unit, a data conversion unit and a data standardization unit, the output end of the data filtering unit is connected to the input end of the data conversion unit, and the output end of the data conversion unit is connected to the input end of the data standardization unit; Step 3: extracting network communication data features from the preprocessed network communication data using a feature analysis algorithm, wherein the network communication data features include at least target IP address frequency, number of communication network ports, message interval time, and data packet flow direction; Step 4: Establish, evaluate and optimize a security assessment model based on network communication data characteristics using a model building method, wherein the model building method includes a model building module, a model evaluation module and a model optimization module; In step 4, the output end of the model building module is connected to the input end of the model evaluation module, and the output end of the model evaluation module is connected to the input end of the model optimization module; Step 5: The pre-processed network communication data is input into the security assessment model as the network communication data to be assessed. The security assessment model automatically extracts the network communication data through a binary classifier to achieve network communication data clustering and network security communication assessment. In step five, the binary classifier includes a data clustering analysis module and an evaluation result acquisition module, and the output end of the data clustering analysis module is connected to the input end of the evaluation result acquisition module.

[0006] As a further technical solution of the present invention, the association rule mechanism adopts unsupervised association rule analysis to mine and identify the rules and patterns in the network communication data. The unsupervised association rule analysis constructs the attributes and characteristics of the network traffic into a series of association rules through single frequent item set mining. The association rule mechanism then adopts a weighted association analysis engine to construct a network communication data collection framework structure. The weighted association analysis engine finds out the network communication data existing in different time intervals in the data set according to the association rules. The weighted association analysis engine determines the association relationship between the network communication data through a weighted analysis function. Finally, the weighted association analysis engine constructs the network collection nodes with the minimum support threshold in the data set into a network communication data collection framework structure through a weighted frequency association protocol.

[0007] As a further technical solution of the present invention, the data filtering unit adopts a whitelist mechanism and a blacklist mechanism to include the specified source IP address, target IP address and irrelevant identifiers in the whitelist and the blacklist, the data filtering unit filters the network communication data according to the lists of the whitelist and the blacklist, and retains the network communication data allowed to pass in the whitelist, the data conversion unit adopts a pattern definition conversion to convert the network communication data into standardized and unified network communication data, and the data standardization unit adopts numerical normalization to divide the network communication data collected in different time periods according to the same time interval, so as to realize the normalization of the time intervals of the network communication data.

[0008] As a further technical solution of the present invention, the feature analysis algorithm converts the network communication data to the frequency domain through frequency domain feature analysis, and extracts the target IP address frequency in the frequency domain. The feature analysis algorithm uses text mining to extract the communication network port number in the network communication data and obtains the number of communication network ports. The feature analysis algorithm uses timing feature analysis to convert the network communication data to the time domain and extracts the message interval time in the time domain. The feature analysis algorithm uses subnet mask matching to extract features of the source IP address and the target IP address. The subnet mask matching determines the data packet flow direction according to the source IP address and the target IP address. The subnet mask matching extracts the proportion and quantity of internal traffic and external traffic in the data packet flow direction through the subnet mask rule.

[0009] As a further technical solution of the present invention, the working method of the model building module is: Step 1: stratify the network communication data features according to the target IP address frequency by using stratified sampling, wherein the stratified sampling extracts the stratified network communication data feature samples according to a ratio of 3:1 to obtain a security assessment model training set and a security assessment model test set; Step 2: Then, data simulation is used to simulate the network communication data features to synthesize a new data set to expand the security assessment model training set. The security assessment model training set uses a scaling function to scale the network communication data features to the [0,1] interval. The calculation formula for scaling the network communication data is: (1) In formula (1), is the scaling value of the network communication data feature, is the network communication data feature, is the path length of the network communication data characteristics, is the maximum packet loss rate of network communication data characteristics, is the percentile of the scaling function; Step 3: Finally, the random forest algorithm is used to train the security assessment model training set to build a security assessment model. The random forest algorithm iteratively updates the weight of the security assessment model by minimizing the loss function to determine the weight of the security assessment model. The calculation formula for minimizing the loss function is: (2) In formula (2), is the weight of the security assessment model, is the ratio of internal traffic to external traffic in the packet flow, is the number of internal and external flows in the packet flow, is the target IP address frequency, Subscript the frequency of the target IP address, is the learning rate that minimizes the loss function.

[0010] As a further technical solution of the present invention, the model evaluation module evaluates the performance of the security assessment model by average accuracy, the model evaluation module uses a confusion matrix to determine the average accuracy of the security assessment model, the confusion matrix calculates the average accuracy by a cross table of statistical security assessment model evaluation results and actual results, the confusion matrix calculates the average accuracy by a proportional function, and when the range of the average accuracy is [0.1-0.5], the security assessment model is optimized by a model optimization module, and the calculation formula for the proportional function to calculate the average accuracy is: (3) In formula (3), is the average accuracy of the security assessment model, is the indicator weight factor of the proportional function, is the frequency of the difference between the evaluation results of the security assessment model and the actual results, Count the frequencies of the confusion matrix.

[0011] As a further technical solution of the present invention, the model optimization module uses a random forest classifier to adjust the performance of the security assessment model. The random forest classifier controls the generalization ability of the security assessment model by setting the optimal decision tree depth through the objective function to achieve performance optimization of the security assessment model. The objective function limits the depth of the decision tree through the Gini coefficient threshold. The calculation formula for setting the optimal decision tree depth by the objective function is: (4) In formula (4), is the optimal decision tree depth, is the Gini coefficient threshold, is the capacity of the security assessment model training set, t is the subscript of the capacity of the security assessment model training set, is the weight of the objective function.

[0012] As a further technical solution of the present invention, the data clustering analysis module adopts the clustering layer of the security assessment model to divide the network communication data into data clusters. The clustering layer of the security assessment model adopts the mean clustering analysis algorithm to cluster the network communication data with the same characteristics into the same data cluster according to the characteristics of the network communication data. The mean clustering analysis algorithm identifies the communication behavior patterns between different data clusters through the data clusters.

[0013] As a further technical solution of the present invention, the evaluation result acquisition module realizes network security communication evaluation through the evaluation diagnosis layer of the security evaluation model. The evaluation diagnosis layer of the security evaluation model automatically extracts communication behavior patterns through the LOF anomaly detection algorithm to perform network security communication evaluation. The LOF algorithm determines the abnormal points of network security communication through the density ratio between communication behavior patterns. The network security communication evaluation includes normal and abnormal.

[0014] The present invention has the following positive and beneficial effects compared with the prior art: The present invention discloses a network security communication evaluation method for electricity consumption information collection based on big data processing. A data preprocessing module removes redundant data and performs format conversion on the collected network communication data through a data filtering unit, a data conversion unit and a data standardization unit, so as to ensure the accuracy and reliability of subsequent network security communication evaluation. A feature analysis algorithm realizes the extraction of useful network communication data features from the preprocessed network communication data. A model building module adopts a random forest algorithm to train a security evaluation model training set to realize the construction of a security evaluation model. A model evaluation module evaluates the performance of the security evaluation model through average precision. A model optimization module adopts a random forest classifier to adjust the performance of the security evaluation model to realize the evaluation and optimization of the security evaluation model. A data clustering analysis module adopts the clustering layer of the security evaluation model to divide the network communication data into data clusters. An evaluation result acquisition module realizes network security communication evaluation through an evaluation diagnosis layer of the security evaluation model, so as to improve the efficiency and accuracy of network security communication evaluation. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative work, among which: Figure 1 This is a flow chart of a method for evaluating network security communication of power consumption information collection based on big data processing according to the present invention; Figure 2 A workflow diagram for establishing a module for the model of the present invention; Figure 3 It is a structural schematic diagram of the data preprocessing module of the present invention; Figure 4 It is a structural schematic diagram of the model building method of the present invention; Figure 5 Schematic diagram of the structure of the binary classifier of the present invention. DETAILED DESCRIPTION

[0016] The following will be combined with the drawings in the embodiments of this article to clearly and completely describe the technical solutions in the embodiments of this article. Obviously, the described embodiments are only part of the embodiments of this article, not all of the embodiments. It should be understood that these descriptions are only exemplary and are not intended to limit the scope of the present invention. In addition, in the following description, the description of well-known structures and technologies is omitted to avoid unnecessary confusion of the concept of the present invention.

[0017] like Figure 1-Figure 5 As shown, a method for evaluating network security communication of power consumption information collection based on big data processing comprises the following steps: Step 1: Collect network communication data through network device logs, wherein the network communication data at least includes data packets, source IP addresses, target IP addresses, protocol headers and load data. The network device logs use a network big data filtering engine to capture only the required network communication data. The network big data filtering engine constructs a network communication data collection framework structure through an association rule mechanism. The network device logs accurately capture network communication data according to the data collection framework structure. In a specific embodiment, it may also include collecting transmission data from the power consumption information collection system, including user information, power consumption, device status, etc. Network traffic data may also be collected to analyze network behavior and detect anomalies.

[0018] Step 2: Use a data preprocessing module to preprocess the collected network communication data, remove redundant data and perform format conversion; In step 2, the data preprocessing module includes a data filtering unit, a data conversion unit and a data standardization unit, the output end of the data filtering unit is connected to the input end of the data conversion unit, and the output end of the data conversion unit is connected to the input end of the data standardization unit; Step 3: extracting network communication data features from the preprocessed network communication data using a feature analysis algorithm, wherein the network communication data features include at least target IP address frequency, number of communication network ports, message interval time, and data packet flow direction; Step 4: Establish, evaluate and optimize a security assessment model based on network communication data characteristics using a model building method, wherein the model building method includes a model building module, a model evaluation module and a model optimization module; In step 4, the output end of the model building module is connected to the input end of the model evaluation module, and the output end of the model evaluation module is connected to the input end of the model optimization module; Step 5: The pre-processed network communication data is input into the security assessment model as the network communication data to be assessed. The security assessment model automatically extracts the network communication data through a binary classifier to achieve network communication data clustering and network security communication assessment. In step five, the binary classifier includes a data clustering analysis module and an evaluation result acquisition module, and the output end of the data clustering analysis module is connected to the input end of the evaluation result acquisition module.

[0019] In a further embodiment, the association rule mechanism uses unsupervised association rule analysis to mine and identify regularities and patterns in network communication data. The unsupervised association rule analysis constructs the attributes and features of network traffic into a series of association rules through single frequent item set mining. The association rule mechanism then uses a weighted association analysis engine to construct a network communication data collection framework structure. The weighted association analysis engine finds out the network communication data existing in different time intervals in the data set according to the association rules. The weighted association analysis engine determines the association relationship between network communication data through a weighted analysis function. Finally, the weighted association analysis engine constructs the network collection nodes with the minimum support threshold in the data set into a network communication data collection framework structure through a weighted frequency association protocol. Further The core of the association rule mechanism is to find frequent item sets and strong association rules. Frequent item sets refer to item sets that appear in a data set with a frequency exceeding a user-defined threshold. Strong association rules refer to rules that meet the minimum support and minimum confidence requirements. Among them, support refers to the frequency of item sets appearing in a data set, and confidence refers to the frequency of the occurrence of the latter item under the condition of containing the former item. In a further specific embodiment, such as the Apriori algorithm, a list of all single items is first generated according to the network data communication content, which is called a 1-item set. Then, according to the minimum support threshold, frequent 1-item sets are filtered out. Then, frequent 1-item sets are used to generate 2-item sets, and then frequent 2-item sets are filtered out according to the minimum support threshold. Repeat this step until no new item sets can be generated. Finally, association rules are generated based on frequent item sets, and confidence is calculated. If the confidence is greater than the minimum confidence threshold, this rule is considered to be a strong rule, and different parameters in the power consumption information collection network data information can be output, and data information diagnosis, classification or calculation can be performed.

[0020] In a further embodiment, the data filtering unit adopts a whitelist mechanism and a blacklist mechanism to include the specified source IP address, target IP address and irrelevant identifiers in the whitelist and the blacklist, the data filtering unit filters the network communication data according to the whitelist and the blacklist, and retains the network communication data allowed to pass in the whitelist, the data conversion unit adopts a pattern definition conversion to convert the network communication data into standardized and unified network communication data, and the data standardization unit adopts numerical normalization to divide the network communication data collected in different time periods according to the same time interval, thereby realizing the normalization of the time intervals of the network communication data.

[0021] In a specific embodiment, the following information can be obtained by collecting network communication data through network device logs: 1. Data packet: The data packet is the basic unit of network communication, which contains the transmitted data content. By collecting network device logs, the data packet of each communication session can be obtained; 2. Source IP address: The source IP address is the unique identifier of the sender device in the network, which is used to identify the source of the data packet. By collecting network device logs, the IP address of the sender in each communication session can be obtained; 3. Target IP address: The target IP address is the unique identifier of the recipient device in the network, which is used to indicate which device the data packet is to be sent to. By collecting network device logs, the IP address of the recipient in each communication session can be obtained; 4. Protocol header: The protocol header contains meta-information about the data packet and communication protocol. Different protocols have different header formats and fields, such as TCP, UDP, ICMP, etc. By collecting network device logs, you can obtain the protocol type and corresponding protocol header field information used in each communication session; 5. Load data: Load data is the valid data content actually transmitted in addition to the protocol header, which may contain various forms of information such as files, images, audio, etc. By collecting network device logs, you can obtain the load data transmitted in each communication session. The above-mentioned network communication data is the basic information collected through network device logs, which is of great significance for network security analysis, troubleshooting, performance optimization, etc.

[0022] The data conversion unit converts the collected network communication data into standardized and unified network communication data by means of pattern definition conversion. This process can be divided into the following steps: 1. Pattern definition: First, a unified data pattern needs to be defined, including data structure and field definition. The pattern should be able to cover various information required in network communication data, such as data packets, source IP addresses, target IP addresses, protocol headers and load data, etc.; 2. Data parsing: By parsing the raw data in the network device log, the required field information is extracted, and the raw data is parsed according to the pre-defined pattern, and each field is mapped to the corresponding pattern definition; 3. Data conversion: After obtaining the parsed field information, further processing and conversion are performed as needed, which may include format conversion, unit conversion, encoding conversion and other operations to ensure that the final network communication data is standardized and unified; 4. Standardized output: Finally, the converted network communication data is output or stored in a predetermined format, which can be output in the form of structured text or stored in a database or other storage system. By adopting the mode definition conversion method, network communication data from different sources and formats can be processed and analyzed in a unified manner, which helps to improve the operability and scalability of network communication data and facilitate subsequent network security analysis, monitoring and management.

[0023] In a further embodiment, the feature analysis algorithm converts the network communication data to the frequency domain through frequency domain feature analysis, and extracts the target IP address frequency in the frequency domain. The feature analysis algorithm uses text mining to extract the communication network port number in the network communication data and obtains the number of communication network ports. The feature analysis algorithm uses timing feature analysis to convert the network communication data to the time domain and extracts the message interval time in the time domain. The feature analysis algorithm uses subnet mask matching to perform feature extraction on the source IP address and the target IP address. The subnet mask matching determines the data packet flow direction according to the source IP address and the target IP address. The subnet mask matching extracts the proportion and quantity of internal traffic and external traffic in the data packet flow direction through the subnet mask rule.

[0024] In further embodiments, the feature analysis algorithm can be implemented in a high-performance computer, a graphics processing unit (GPU), or a hardware accelerator specifically used for feature analysis. For example, high-speed memory is set: the feature analysis algorithm needs to read and process feature data quickly, so a hardware device with sufficient high-speed memory is required. This can include a memory module with multiple memory channels or a high-speed hard disk. Digital signal processing (DSP) hardware is set: DSP is a hardware platform for processing digital signals, which can be used to implement feature analysis algorithms. Therefore, if you want to implement feature analysis algorithms, you need to use a device with DSP hardware. For example, real-time signal processing hardware is set: some feature analysis algorithms require real-time signal processing, so a device with real-time signal processing hardware is required. This can include a multi-core processor-based device or a hardware platform specifically used for real-time signal processing, and the above algorithm is implemented through this implementation platform. In specific applications, first clarify the goals and application scenarios of the algorithm. Different applications may require different types of features. Collect relevant data according to the problem definition. Data quality directly affects the effect of feature analysis, so the accuracy and completeness of the data need to be ensured. After feature extraction, there may be multiple features. Feature selection is needed to reduce the number of features to simplify the model and reduce the risk of overfitting. Feature selection methods include model-based selection (such as using cross-validation), heuristic-based methods (such as recursive feature elimination), etc.

[0025] In a further embodiment, the working method of the model building module is: Step 1: stratify the network communication data features according to the target IP address frequency by using stratified sampling, wherein the stratified sampling extracts the stratified network communication data feature samples according to a ratio of 3:1 to obtain a security assessment model training set and a security assessment model test set; Step 2: Then, data simulation is used to simulate the network communication data features to synthesize a new data set to expand the security assessment model training set. The security assessment model training set uses a scaling function to scale the network communication data features to the [0,1] interval. The calculation formula for scaling the network communication data is: (1) In formula (1), is the scaling value of the network communication data feature, is the network communication data feature, is the path length of the network communication data characteristics, is the maximum packet loss rate of network communication data characteristics, is the percentile of the scaling function; Step 3: Finally, the random forest algorithm is used to train the security assessment model training set to build a security assessment model. The random forest algorithm iteratively updates the weight of the security assessment model by minimizing the loss function to determine the weight of the security assessment model. The calculation formula for minimizing the loss function is: (2) In formula (2), is the weight of the security assessment model, is the ratio of internal traffic to external traffic in the packet flow, is the number of internal and external flows in the packet flow, is the target IP address frequency, Subscript the frequency of the target IP address, is the learning rate that minimizes the loss function.

[0026] In a specific embodiment, the data simulation method can simulate and synthesize the network communication data features to generate a new data set, thereby expanding the security assessment model training set. The following are general steps to implement this process: 1. Feature modeling: Based on the feature analysis results, establish corresponding feature models. These models can be probability distribution models, machine learning models or other models suitable for describing the distribution laws of specific features; 2. Simulation synthesis: Use the established feature model to simulate and synthesize the original network communication data. According to specific needs and goals, the simulation parameters can be adjusted to control the properties and characteristics of the generated synthetic data set; 3. Data evaluation: Evaluate and verify the generated synthetic data set, which includes comparison with real data, statistical indicator testing and other methods to ensure that the generated synthetic data has characteristics similar to the actual data to a certain extent; 4. Training set expansion: Merge the generated synthetic data set with the original training set to expand the scale of the security assessment model training set, which can increase the number and diversity of samples for training the security assessment model and improve the generalization ability and robustness of the security assessment model.

[0027] In specific applications, the security assessment model needs to rely on hardware conditions such as computer systems, database systems, graphics processors, network facilities, storage devices, etc. The hardware environment for implementing the security assessment model is built through this hardware. The implementation of the security assessment model requires efficient and reliable computer systems, database systems, graphics processors, network facilities and storage devices and other hardware conditions to further improve the application capabilities of the algorithm.

[0028] The minimization loss function measures the difference between the prediction result of the security assessment model and the true label. In each iteration, the weight is updated according to the gradient information of the minimization loss function, so that the security assessment model can gradually converge to a better prediction result. In this way, the optimal weight value can be obtained through multiple iterative updates. The weight iteration results of the optimal security assessment model are shown in Table 1: Table 1 Statistics of weight iteration results of security assessment model

[0029] As shown in Table 1, four test groups are set up, and two methods are used to calculate the weight of the optimal security assessment model. Method 1 uses statistical analysis to infer weights from historical data or sample data. Method 2 is a random forest algorithm that iteratively updates the weights of the security assessment model by minimizing the loss function to determine the weights of the security assessment model. The error of Method 1 is greater than the error of Method 2. It can be seen that the random forest algorithm of the present invention iteratively updates the weights of the security assessment model by minimizing the loss function to determine the weights of the security assessment model, which has outstanding technical effects.

[0030] In a further embodiment, the model evaluation module evaluates the performance of the security assessment model by average accuracy, the model evaluation module uses a confusion matrix to determine the average accuracy of the security assessment model, the confusion matrix calculates the average accuracy by a cross-tabulation of the statistical security assessment model evaluation results and the actual results, the confusion matrix calculates the average accuracy by a proportional function, and when the range of the average accuracy is [0.1-0.5], the security assessment model is optimized by a model optimization module, and the calculation formula for the average accuracy calculated by the proportional function is: (3) In formula (3), is the average accuracy of the security assessment model, is the indicator weight factor of the proportional function, is the frequency of the difference between the evaluation results of the security assessment model and the actual results, Count the frequencies of the confusion matrix.

[0031] In a specific embodiment, the confusion matrix is ​​a tool for evaluating the performance of a classification model. The average precision can be calculated through a proportional function. First, let us understand the confusion matrix. The confusion matrix is ​​a two-dimensional table used to show the correspondence between the prediction results of the classification model on different categories and the true labels. It contains four important indicators: 1. True Positive (TP): indicates the number of samples where the model correctly predicts positive examples as positive examples; 2. False Positive (FP): indicates the number of samples where the model incorrectly predicts negative examples as positive examples; 3. False Negative (FN): indicates the number of samples where the model incorrectly predicts positive examples as negative examples; 4. True Negative (TN): indicates the number of samples where the model correctly predicts negative examples as negative examples. The confusion matrix can calculate the average precision through a proportional function. Average Precision is a performance evaluation indicator for multi-category classification problems. The average precision calculation results are shown in Table 2: Table 2 Statistics of average accuracy calculation results

[0032] As shown in Table 2, four test groups are set, and two methods are used to calculate the average accuracy. Method 3 calculates the accuracy through each category, and then takes the average of the accuracy of each category as the final result. Method 4 calculates the average accuracy through the proportional function of the confusion matrix. The error of Method 3 is greater than the error of Method 4. It can be seen that the present invention has outstanding technical effects by calculating the average accuracy through the proportional function through the confusion matrix.

[0033] In a further embodiment, the model optimization module uses a random forest classifier to adjust the performance of the security assessment model. The random forest classifier controls the generalization ability of the security assessment model by setting the optimal decision tree depth through the objective function to achieve performance optimization of the security assessment model. The objective function limits the depth of the decision tree through the Gini coefficient threshold. The calculation formula for setting the optimal decision tree depth by the objective function is: (4) In formula (4), is the optimal decision tree depth, is the Gini coefficient threshold, is the capacity of the security assessment model training set, t is the subscript of the capacity of the security assessment model training set, is the weight of the objective function.

[0034] In a specific embodiment, random forest is an integrated learning method, which consists of multiple decision trees. Each decision tree is constructed by performing bootstrap sampling and random feature selection on training data. In the random forest, the objective function is optimized by setting the optimal decision tree depth through the random forest classifier. For the random forest classifier, the objective function is to split the decision tree through the Gini coefficient. The Gini coefficient measures the impurity of the sample in a node. When building a decision tree, a threshold can be set to limit the depth of the decision tree. This threshold can be the change of the Gini coefficient, that is, when the change of the Gini coefficient is less than a certain threshold, stop splitting. The statistical table of the optimal decision tree depth calculation results is shown in Table 2 Table 3 Best decision tree depth statistics

[0035] As shown in Table 3, four test groups are set up, and two methods are used to obtain the optimal decision tree depth. Method 5 is based on the grey system theory and determines the optimal decision tree depth by the correlation of the capacity of the safety assessment model training set. Method 6 is an objective function that limits the decision tree depth through the Gini coefficient threshold. The error of method 5 is greater than the error of method 6. It can be seen that the objective function of the present invention limits the decision tree depth through the Gini coefficient threshold and has an outstanding technical effect.

[0036] The random forest classifier is an efficient machine learning algorithm. Its performance is not particularly dependent on hardware conditions, but in practical applications, hardware resources will affect the performance of the algorithm. The following factors affect the performance of the random forest classifier. When working, it needs to perform multiple iterative calculations. Therefore, a high-performance CPU can handle these calculation tasks faster. This requires the CPU to process multiple tasks in parallel, thereby shortening the training and prediction time. The random forest algorithm needs to store the entire data set and the structure of the decision tree during training. Therefore, sufficient memory capacity is essential for processing large data sets. If the data set size exceeds the memory capacity, the algorithm may need to perform frequent disk I / O operations, which will significantly reduce performance. The speed of the memory (hard disk or solid-state drive). If the data set cannot be fully loaded into the memory, the read and write speed of the memory will affect the speed of data loading and algorithm operation. Solid-state drives (SSDs) generally have faster read and write speeds than traditional hard disks (HDDs), which is beneficial for improving the performance of random forests. For tasks that process particularly large data sets or require a large amount of parallel computing, GPUs can provide significant performance improvements. If the random forest classifier is deployed in a distributed system, the network speed will affect the speed of data transmission between different nodes, thereby affecting the overall performance. In summary, although the random forest classifier is not particularly dependent on high-end hardware, having sufficient computing resources (such as memory and CPU performance) and fast storage read and write capabilities will help improve the algorithm's work efficiency and performance.

[0037] In a further embodiment, the data clustering analysis module uses the clustering layer of the security assessment model to divide the network communication data into data clusters. The clustering layer of the security assessment model uses the mean clustering analysis algorithm to cluster the network communication data with the same characteristics into the same data cluster according to the characteristics of the network communication data. The mean clustering analysis algorithm identifies the communication behavior patterns between different data clusters through the data clusters.

[0038] In a further embodiment, the assessment result acquisition module implements network security communication assessment through the assessment diagnosis layer of the security assessment model. The assessment diagnosis layer of the security assessment model automatically extracts communication behavior patterns through the LOF anomaly detection algorithm to perform network security communication assessment. The LOF algorithm determines the abnormal points of network security communication through the density ratio between communication behavior patterns. The network security communication assessment includes normal and abnormal.

[0039] In a specific embodiment, the mean-shift clustering algorithm is an unsupervised learning clustering algorithm that divides data points into different clusters by calculating the similarity between them. For the identification of communication behavior patterns, the mean-shift clustering algorithm can be used to discover the communication behavior patterns between different data clusters. Through the mean-shift clustering algorithm, data points with similar communication behavior patterns can be clustered into the same cluster, and the communication behavior patterns between different data clusters can be identified based on the characteristics of each cluster. This can better understand and analyze the communication behavior characteristics between different groups or entities in the data set. The LOF algorithm (Local Outlier Factor) is an unsupervised learning anomaly detection algorithm. It determines the anomaly in network security communication by calculating the ratio of the local density of a data point to the local density of other data points in its neighborhood. The specific steps are as follows: 1. Determine the neighborhood: For each data point, determine the data points in its neighborhood, which can be selected based on distance or K nearest neighbors; 2. Local reachability density: For each data point, the local reachability density (Local Reachability Density) indicates the closeness of the data point in its neighborhood relative to other data points. The higher the local reachability density, the denser the neighborhood around the point; 3. Local outlier factor: For each data point, the local outlier factor (Local Outlier Factor) Factor) indicates the degree of outlier of the data point relative to other data points in its neighborhood. Whether it is an outlier is determined by comparing the ratio of the local reachable density of the point to other points in its neighborhood. If the local outlier factor of a data point is much larger than 1, it means that the point is an outlier relative to its neighborhood. 5. Determine outliers: Based on the calculated local outlier factor, a threshold can be set to determine which data points are considered outliers. Data points that exceed the threshold are outliers, indicating abnormal behavior in network security communications.

[0040] Although the specific embodiments of the present invention are described above, it should be understood by those skilled in the art that these specific embodiments are only illustrative, and those skilled in the art may omit, replace, and change the details of the above methods and systems in various ways without departing from the principles and essence of the present invention. For example, merging the above method steps so as to perform substantially the same functions in substantially the same manner to achieve substantially the same results is within the scope of the present invention. Therefore, the scope of the present invention is limited only by the appended claims.

Claims

1. A method for evaluating network security communication of power consumption information collection based on big data processing, characterized in that: The method comprises the following steps: Step 1: Collect network communication data through network device logs, wherein the network communication data at least includes data packets, source IP addresses, target IP addresses, protocol headers and load data. The network device logs use a network big data filtering engine to capture only the required network communication data. The network big data filtering engine constructs a network communication data collection framework structure through an association rule mechanism. The network device logs accurately capture network communication data according to the data collection framework structure. Step 2: Use a data preprocessing module to preprocess the collected network communication data, remove redundant data and perform format conversion; In step 2, the data preprocessing module includes a data filtering unit, a data conversion unit and a data standardization unit, the output end of the data filtering unit is connected to the input end of the data conversion unit, and the output end of the data conversion unit is connected to the input end of the data standardization unit; Step 3: extracting network communication data features from the preprocessed network communication data using a feature analysis algorithm, wherein the network communication data features include at least target IP address frequency, number of communication network ports, message interval time, and data packet flow direction; Step 4: Establish, evaluate and optimize a security assessment model based on network communication data characteristics using a model building method, wherein the model building method includes a model building module, a model evaluation module and a model optimization module; In step 4, the output end of the model building module is connected to the input end of the model evaluation module, and the output end of the model evaluation module is connected to the input end of the model optimization module; Step 5: The pre-processed network communication data is input into the security assessment model as the network communication data to be assessed. The security assessment model automatically extracts the network communication data through a binary classifier to achieve network communication data clustering and network security communication assessment. In step five, the binary classifier includes a data clustering analysis module and an evaluation result acquisition module, and the output end of the data clustering analysis module is connected to the input end of the evaluation result acquisition module.

2. According to the method for evaluating network security and communication of power consumption information collection based on big data processing in claim 1, it is characterized by: The association rule mechanism adopts unsupervised association rule analysis to mine and identify the rules and patterns in the network communication data. The unsupervised association rule analysis constructs the attributes and characteristics of the network traffic into a series of association rules through single frequent item set mining. The association rule mechanism then adopts a weighted association analysis engine to construct a network communication data collection framework structure. The weighted association analysis engine finds out the network communication data existing in different time intervals in the data set according to the association rules. The weighted association analysis engine determines the association relationship between the network communication data through a weighted analysis function. Finally, the weighted association analysis engine constructs the network collection nodes with the minimum support threshold in the data set into a network communication data collection framework structure through a weighted frequency association protocol.

3. According to claim 1, a method for evaluating network security and communication of power consumption information collection based on big data processing is characterized by: The data filtering unit adopts a whitelist mechanism and a blacklist mechanism to include the specified source IP address, target IP address and irrelevant identifiers in the whitelist and the blacklist. The data filtering unit filters the network communication data according to the lists of the whitelist and the blacklist, and retains the network communication data allowed to pass in the whitelist. The data conversion unit adopts a pattern definition conversion to convert the network communication data into standardized and unified network communication data. The data standardization unit adopts numerical normalization to divide the network communication data collected in different time periods according to the same time interval, so as to realize the normalization of the time intervals of the network communication data.

4. According to claim 1, a method for evaluating network security and communication of power consumption information collection based on big data processing is characterized in that: The feature analysis algorithm converts network communication data to the frequency domain through frequency domain feature analysis, and extracts the target IP address frequency in the frequency domain. The feature analysis algorithm uses text mining to extract the communication network port number in the network communication data and obtains the number of communication network ports. The feature analysis algorithm uses timing feature analysis to convert network communication data to the time domain and extracts the message interval time in the time domain. The feature analysis algorithm uses subnet mask matching to extract features of the source IP address and the target IP address. The subnet mask matching determines the data packet flow direction according to the source IP address and the target IP address. The subnet mask matching extracts the proportion and quantity of internal traffic and external traffic in the data packet flow direction through the subnet mask rule.

5. According to claim 1, a method for evaluating network security and communication of power consumption information collection based on big data processing is characterized in that: The working method of the model building module is: Step 1: stratify the network communication data features according to the target IP address frequency by using stratified sampling, wherein the stratified sampling extracts the stratified network communication data feature samples according to a ratio of 3:1 to obtain a security assessment model training set and a security assessment model test set; Step 2: Then, data simulation is used to simulate the network communication data features to synthesize a new data set to expand the security assessment model training set. The security assessment model training set uses a scaling function to scale the network communication data features to the [0,1] interval. The calculation formula for scaling the network communication data is: （1） In formula (1), is the scaling value of the network communication data feature, is the network communication data feature, is the path length of the network communication data characteristics, is the maximum packet loss rate of network communication data characteristics, is the percentile of the scaling function; Step 3: Finally, the random forest algorithm is used to train the security assessment model training set to build a security assessment model. The random forest algorithm iteratively updates the weight of the security assessment model by minimizing the loss function to determine the weight of the security assessment model. The calculation formula for minimizing the loss function is: （2） In formula (2), is the weight of the security assessment model, is the ratio of internal traffic to external traffic in the packet flow, is the number of internal and external flows in the packet flow, is the target IP address frequency, Subscript the target IP address frequency, is the learning rate that minimizes the loss function.

6. According to claim 1, a method for evaluating network security and communication of power consumption information collection based on big data processing is characterized in that: The model evaluation module evaluates the performance of the security assessment model by average accuracy. The model evaluation module uses a confusion matrix to determine the average accuracy of the security assessment model. The confusion matrix calculates the average accuracy by a cross table of statistical security assessment model evaluation results and actual results. The confusion matrix calculates the average accuracy by a proportional function. When the range of the average accuracy is [0.1-0.5], the security assessment model is optimized by a model optimization module. The calculation formula for calculating the average accuracy by the proportional function is: （3） In formula (3), is the average accuracy of the security assessment model, is the indicator weight factor of the proportional function, is the frequency of the difference between the evaluation results of the security assessment model and the actual results, Count the frequencies of the confusion matrix.

7. The method for evaluating network security and communication of power consumption information collection based on big data processing according to claim 1 is characterized by: The model optimization module uses a random forest classifier to adjust the performance of the security assessment model. The random forest classifier controls the generalization ability of the security assessment model by setting the optimal decision tree depth through the objective function to achieve performance optimization of the security assessment model. The objective function limits the depth of the decision tree through the Gini coefficient threshold. The calculation formula for setting the optimal decision tree depth by the objective function is: （4） In formula (4), is the optimal decision tree depth, is the Gini coefficient threshold, is the capacity of the security assessment model training set, t is the subscript of the capacity of the security assessment model training set, is the weight of the objective function.

8. The method for evaluating network security and communication of power consumption information collection based on big data processing according to claim 1 is characterized by: The data clustering analysis module uses the clustering layer of the security assessment model to divide the network communication data into data clusters. The clustering layer of the security assessment model uses the mean clustering analysis algorithm to cluster the network communication data with the same characteristics into the same data cluster according to the characteristics of the network communication data. The mean clustering analysis algorithm identifies the communication behavior patterns between different data clusters through data clusters.

9. The method for evaluating network security and communication of power consumption information collection based on big data processing according to claim 1 is characterized by: The evaluation result acquisition module implements network security communication evaluation through the evaluation diagnosis layer of the security evaluation model. The evaluation diagnosis layer of the security evaluation model automatically extracts communication behavior patterns through the LOF anomaly detection algorithm to perform network security communication evaluation. The LOF algorithm determines the abnormal points of network security communication through the density ratio between communication behavior patterns. The network security communication evaluation includes normal and abnormal.

Images