Server security situation awareness and risk early warning system

Abstract

The invention discloses a server security situation awareness and risk early warning system, and particularly relates to the technical field of network security, a data acquisition module collects server security situation feature data in real time to form a security situation feature data set; the data analysis module analyzes the data input rule and the feature matching model to generate an output result; the risk early warning module triggers early warning operation according to the analysis result; the evaluation module evaluates the sensitivity and coverage of the rule model, and generates a false report quality index and a missing report quality index respectively; the fuzzy reasoning module is used for reasoning an optimization direction based on an evaluation result; the feedback module adjusts the rule model according to the optimization direction and feeds back an optimization result to the data analysis module to form a dynamically optimized closed-loop system, so that the detection accuracy and coverage are improved; according to the method, the rule and the feature matching model can be dynamically adjusted, closed-loop optimization of the security system is realized, and the rule model is ensured to be always in an optimal state so as to adapt to a rapidly changing attack scene.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and more specifically, to a server security situation awareness and risk warning system. Background Art

[0002] Currently, with the rapid development of information technology, servers have become one of the core components of network information systems, carrying a large amount of data storage, processing and transmission tasks. However, servers are also facing increasingly complex security threats and challenges, such as network attacks, data leakage, malware, distributed denial of service attacks and other issues. These threats pose a significant risk to the stability of servers and the integrity of data.

[0003] Traditional server security protection methods are mainly based on preset rules and feature libraries, and identify threats by matching network traffic or system behavior to see if they comply with the rules. The advantages of this method are simplicity and efficiency, but it also has limitations: strict rule matching can easily lead to normal behavior being misjudged as a threat, and traditional rule libraries are often unable to cover new and unknown attack features, resulting in undetected attacks. This situation reduces the credibility and practicality of the system. When faced with complex and changing attack scenarios, there is still a lack of a solution that can dynamically adjust rules and automatically optimize sensitivity and coverage. Therefore, the present invention proposes a server security situation awareness and risk warning system in order to solve the above problems. Summary of the invention

[0004] To achieve the above object, the present invention provides the following technical solutions:

[0005] Server security situation awareness and risk warning system, including data collection module, data analysis module, evaluation module, fuzzy reasoning module, feedback module, and risk warning module;

[0006] The data collection module is used to collect the preset server security situation feature data in real time to obtain the security situation feature data set;

[0007] The data analysis module is used to transmit the security situation feature data set to the preset rule and feature matching model or the feedback rule and feature matching model, analyze and obtain the output result of the rule and feature matching model;

[0008] The risk warning module is used to perform risk warning operations based on the output results of the rule and feature matching model;

[0009] The evaluation module is used to evaluate the sensitivity of the current feature matching rule and the coverage of the current feature matching rule according to the output results of the rule and feature matching model;

[0010] The fuzzy reasoning module is used to perform fuzzy reasoning based on the evaluation results of the evaluation module, obtain the optimization direction of the current rule and feature matching model and transmit it to the feedback module;

[0011] The feedback module is used to optimize the corresponding preset strategy according to the optimization direction obtained by the fuzzy reasoning module and feed back the optimization results to the data analysis module.

[0012] In a preferred embodiment, the evaluation module includes evaluation unit 1 and evaluation unit 2. Evaluation unit 1 performs sensitivity evaluation of the current feature matching rule and generates a false alarm quality index; evaluation unit 2 performs coverage evaluation of the current feature matching rule and generates a false alarm quality index.

[0013] In a preferred embodiment, the logic for obtaining the false alarm quality index is:

[0014] In a fixed time window, obtain the false positive event information in the output results of the rule and feature matching model, and then perform the following calculations:

[0015] 1(P i =1) is an indicator function. When the i-th event is falsely reported, P i The value is 1, otherwise P i The value is zero, W i is the weighted value of the ith false alarm event, N is the number of total events in the current time window, and FPR represents the false alarm quality index.

[0016] In a preferred embodiment, the weighted value W of the i-th false alarm event is i The acquisition logic is:

[0017] Get the frequency of the i-th false alarm event as F i The fixed time window used for normalization processing is the total length of the evaluation time period, which is T. The impact of the i-th false alarm event is I i , the preset maximum value of the influence for normalization processing is M, and the duration of the i-th false alarm event, that is, the time interval from the detection of the i-th false alarm event to the completion of the processing, is D i , the preset maximum duration for normalization is L, and then substitute it into the following calculation formula:

[0018] γ, δ, and ζ are all preset adjustment coefficients, and the sum of the three adjustment coefficients is one.

[0019] In a preferred embodiment, the acquisition logic of the underreporting quality index is:

[0020] In a fixed time window, obtain the missed event information in the output results of the rule and feature matching model to obtain the potential missed event set The total number of missed events is M, and the missed quality index calculation formula is:

[0021] Risk(L k ) represents the risk of the kth missed event, β represents the time decay factor of the missed event, τ k is the duration of the kth missed event, indicating the delay from the start of the attack to its detection, γ is the preset adjustment factor for controlling the impact of the missed event period, T k represents the detection period of the kth missed event, It represents the average period of the entire monitoring time window, i.e., the fixed time window, as the benchmark of the normal detection period, λ1 is a preset constant, and FNI represents the false negative quality index.

[0022] In a preferred embodiment, the risk of the kth missed event Risk (L k )'s acquisition logic is:

[0023] Get the impact range type of the kth missed event as R k , the predefined influence range type r is R r , the influence coefficient corresponding to the influence range type r is υ r , and then substitute the following calculation formula:

[0024] N R Indicates the total number of impact range types r, 1(R k =R r ) is the indicator function, if the influence range is R r , then it is 1, otherwise it is 0.

[0025] In a preferred embodiment, the use principle of the fuzzy reasoning module is:

[0026] The underreporting quality index and false alarm quality index corresponding to the same fixed time window are taken as input variables, and the optimization direction of the current rule and feature matching model is taken as the output variable. The input variables are fuzzified and the values ​​of the input variables are converted into fuzzy sets. The output variables are fuzzified and the output variables are converted into fuzzy sets. Fuzzy rules are formulated to describe the fitness of the current rules and each optimization direction of the feature matching model under different data type combinations. The fuzzified input variables are inferred through fuzzy rules to obtain the optimization direction of the current rules and feature matching model.

[0027] In a preferred embodiment, the feedback module generates a positive feedback signal or a negative feedback signal according to the optimization direction obtained by reasoning with the fuzzy reasoning module. When a negative feedback signal is generated, the corresponding preset strategy is optimized and the optimization result is fed back to the data analysis module. When a positive feedback signal is generated, no feedback operation is performed to the data analysis module.

[0028] Technical effects and advantages of the present invention:

[0029] The present invention introduces a false alarm quality index to dynamically evaluate and optimize the sensitivity of the rule and feature matching model, which can significantly reduce the system's misjudgment of normal behavior during security detection. It reduces the number of unnecessary alarms, reduces the workload of the security operation and maintenance team, improves the credibility of the system, and avoids important threats caused by frequent false alarms from being ignored. Through the false alarm quality index, the system can evaluate the coverage of potential threats by the current rules, and expand the coverage for high-risk scenarios, reduce the probability of false alarms, improve the detection ability of the rule model for unknown threats and complex attack patterns, enhance the system's protection coverage, and avoid key security incidents caused by false alarms.

[0030] The present invention adopts a fuzzy reasoning mechanism, which can achieve a dynamic balance between sensitivity (reducing false positives) and coverage (reducing missed reports). The system can automatically adjust the rule model according to the current security situation to adapt to different scenario requirements, such as increasing coverage in high-risk environments and reducing sensitivity in low-risk environments to reduce interference. The system generates optimization directions through analysis and dynamic evaluation of real-time security situation data, and reloads the optimized rule model into the data analysis module through the feedback module. The closed-loop optimization of the security system is achieved, avoiding the optimization lag problem caused by human intervention, and ensuring that the rule model is always in the best state to adapt to rapidly changing attack scenarios.

[0031] The present invention can dynamically adjust rules and feature matching models according to threat patterns or situation changes monitored in real time. Even in the face of evolving new attacks, the system can quickly adapt and perform automatic optimization, thereby improving the system's ability to cope with complex threats and significantly shortening the response time. The risk warning module can quickly and accurately identify potential threats and issue warning signals based on the output results of the rule and feature matching model, thereby reducing the time from the occurrence to the identification of a security incident, improving the timeliness of the warning, and enabling the security operation and maintenance team to quickly take protective measures to avoid further expansion of losses. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to facilitate understanding by those skilled in the art, the present invention is further described below in conjunction with the accompanying drawings;

[0033] Figure 1This is a schematic diagram of the server security situation awareness and risk warning system in the present invention. DETAILED DESCRIPTION

[0034] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0035] Embodiment 1:

[0036] The server risk warning method in the existing technology is an integrated security management solution that uses advanced technical means to monitor the server around the clock. By collecting various server logs, network traffic, intrusion detection data and other information, it can analyze potential security threats and provide warnings based on threat levels to help enterprises identify security vulnerabilities, malicious attacks, abnormal behaviors and other problems, and enhance the enterprise's response capabilities to network security.

[0037] The core functions include situational awareness, risk assessment, threat detection and early warning release. First, the security situation data of the current server is collected and analyzed, and then the possible risk points are evaluated. Through real-time processing and deep learning analysis of data, abnormal behavior or attack behavior can be discovered, and different levels of alarms can be generated according to the severity of the incident. The early warning information can be automatically pushed to relevant personnel so that preventive measures can be taken as soon as possible.

[0038] In the existing technology, some security monitoring methods based on rules or traditional feature matching may have high false alarm and missed alarm rates. False alarms usually lead to a large number of irrelevant warning messages, increasing the workload of security personnel; while missed alarms may cause real security threats to not be detected in time. This situation reduces the credibility and applicability of the system, and security personnel may ignore important threats when dealing with massive false alarm information, or cause potential losses when they cannot identify attack behaviors in time.

[0039] Therefore, based on the prior art, the present invention proposes a server security situation awareness and risk warning system, including a data acquisition module, a data analysis module, an evaluation module, a fuzzy reasoning module, a feedback module, and a risk warning module;

[0040] The data acquisition module is used to collect the preset server security situation feature data in real time to obtain the security situation feature data set; the data acquisition module is responsible for real-time acquisition and collection of various feature data related to the server security situation. By monitoring and acquiring data from different dimensions such as the network and application layers, a security situation feature data set is constructed to provide basic data for subsequent analysis, early warning and optimization. It provides the most direct and comprehensive data support for the subsequent analysis of the system and is the basic building block of the system, ensuring that the system can perceive the external environment and internal changes of the system in real time, and collect potential security threat data in a timely manner. Collect a variety of different types of data (such as network traffic, system logs, application logs, etc.) to ensure a comprehensive understanding of the security status of the server.

[0041] The data analysis module is used to transmit the security situation feature data set to the preset rule and feature matching model or the feedback rule and feature matching model, analyze and obtain the output results of the rule and feature matching model; the data analysis module inputs the collected security situation feature data set into the rule and feature matching model for analysis to identify potential security threats. The module will generate corresponding output results by comparing with the preset or feedback rule and feature matching model. By analyzing the data, security threats in the system can be identified, and potential attack events or abnormal behaviors can be discovered in time. According to the preset rules and features, the output results of the matching model are analyzed to prepare for subsequent risk assessment and early warning. Automated data analysis is realized, manual monitoring costs are reduced, and detection efficiency is improved.

[0042] The risk warning module is used to perform risk warning operations based on the output results of the rule and feature matching model. The risk warning module warns of potential security threats based on the output results of the rule and feature matching model, identifies the threat level and issues an alarm to prompt the administrator to take preventive measures in a timely manner. Timely discover and prompt possible security risks to reduce the possibility of losses. Through early warning, it helps administrators automatically start response mechanisms, such as security policy adjustment, network isolation and other operations. Provide real-time information to decision makers to ensure that the server can respond quickly when it is attacked.

[0043] The evaluation module is used to evaluate the sensitivity of the current feature matching rules and the coverage of the current feature matching rules according to the output results of the rule and feature matching model; the evaluation module performs sensitivity evaluation (i.e. false positive evaluation) and coverage evaluation (i.e. false negative evaluation) according to the output results of the rule and feature matching model, and generates false positive quality index and false negative quality index respectively. The evaluation module reflects the accuracy and coverage of the current rules through these indexes. Through the evaluation indicators, it helps to optimize the rules of the matching model, avoid false positives and false negatives, and improve the accuracy of detection. It provides performance feedback for the real-time adjustment of rules and models to ensure that the model is always in the best state.

[0044] The fuzzy reasoning module is used to perform fuzzy reasoning based on the evaluation results of the evaluation module, obtain the optimization direction of the current rule and feature matching model and transmit it to the feedback module; the fuzzy reasoning module performs fuzzification processing based on the false alarm quality index and missed alarm quality index obtained by the evaluation module, and infers the optimization direction of the current rule and feature matching model through fuzzy rules, and outputs it to the feedback module. Errors and uncertainties are handled by fuzzy reasoning methods to avoid system instability caused by overly precise data errors. Appropriate optimization strategies are inferred based on the evaluation results to provide guidance for model adjustment. Through fuzzy logic reasoning, the system can intelligently judge and select optimization strategies without relying entirely on human intervention.

[0045] The feedback module is used to optimize the corresponding preset strategy according to the optimization direction obtained by the fuzzy reasoning module and feed back the optimization results to the data analysis module. The feedback module receives the optimization direction from the fuzzy reasoning module and optimizes the rule and feature matching model according to the preset strategy. The optimization results will be fed back to the data analysis module, so that the rule and feature matching model is continuously optimized and adapted to the new security situation. The feedback mechanism can be optimized according to the actual situation, so that the model can adjust itself as the environment and attack mode change, and continuously optimize the model to ensure that the system can cope with new attack modes and changing security threats. The feedback module ensures that the security system can be adjusted in real time and dynamically to continuously improve the accuracy of rule matching.

[0046] The evaluation module includes evaluation unit 1 and evaluation unit 2. Evaluation unit 1 performs sensitivity evaluation on the current feature matching rule and generates a false alarm quality index; evaluation unit 2 performs coverage evaluation on the current feature matching rule and generates a false alarm quality index.

[0047] The evaluation unit 1 mainly evaluates the sensitivity of feature matching rules, that is, evaluates the false alarms that may be generated by the system when detecting security threats. False alarms refer to the system mistakenly identifying normal behavior or harmless events as attacks or threats. The evaluation unit generates a false alarm quality index by analyzing the number of false alarms, the degree of impact, and other factors. The core purpose of sensitivity evaluation is to reduce the false alarm rate and ensure that the system only issues warnings when threats do exist. Reducing false alarms can reduce the workload of managers and improve the efficiency of system use. Through the evaluation of false alarms, the system can provide feedback to the rule and feature matching model to optimize the current rule settings and avoid false alarms caused by overly loose matching. False alarms may cause the system to generate a large number of useless alarms, wasting operation and maintenance personnel and computing resources. Accurate false alarm quality evaluation can effectively reduce this waste. If the system has a low false alarm rate, administrators will have a higher degree of trust in the system and are willing to rely on the system for daily security management and emergency response.

[0048] Evaluation Unit 2 is responsible for the coverage evaluation of feature matching rules, that is, evaluating whether the system may have missed detections when detecting potential threats. A missed detection refers to the failure of the system to identify actual threats or attack events, resulting in the successful attack without being discovered in time. The missed detection quality index reflects the threat detection coverage of the system and helps evaluate whether the detection mechanism is comprehensive enough. The core goal of the missed detection evaluation is to improve the coverage of the detection system to ensure that no real security threats are missed. This helps ensure that all potential attacks can be discovered and responded to in a timely manner. A missed detection means that the system fails to identify some attacks, which reduces the system's defense capabilities. The missed detection quality evaluation helps to discover the blind spots of the system and make targeted improvements. Missed detections can cause attacks to be delayed or completely ignored, while the missed detection quality evaluation helps to improve the response speed and efficiency and ensure that potential threats are effectively blocked at an early stage. Missed detections are often caused by incomplete or erroneous rules. Through the evaluation of the missed detection quality index, the system can identify which rules have insufficient coverage and take measures to fix them.

[0049] The combination of evaluation unit one and evaluation unit two ensures that the system strikes a balance between providing accuracy (avoiding false alarms) and comprehensiveness (covering all threats). This helps to improve the overall effectiveness of the security detection system. By generating a false alarm quality index and a false negative quality index, the system can perform adaptive optimization based on real-time evaluation results. For example, by reducing false alarms and improving coverage, the rule and feature matching model can be continuously improved to adapt to complex network attack environments. By identifying the sources of false alarms and false negatives, the evaluation module can help optimize the allocation of resources, improve the response efficiency of operation and maintenance personnel, and reduce system operation and maintenance costs. Accurate false alarm and false negative evaluation enhances the reliability of the system, significantly increases the end user's dependence and trust in the system, and helps to be widely used in various security management scenarios.

[0050] The false alarm quality index is used to evaluate whether the system's sensitivity in identifying security threats is too high, which leads to the frequency and impact of false alarms. This indicator can help evaluate the accuracy of the feature matching model and optimize the current rules to reduce meaningless alarms. In a specific time window, a weighted calculation is performed based on the false alarm events of the model. By combining the number of false alarm events and the weighted value of the false alarm events, a comprehensive indicator that can reflect the false alarm situation of the system is obtained. The logic for obtaining the false alarm quality index is:

[0051] In a fixed time window, obtain the false positive event information in the output results of the rule and feature matching model, and then perform the following calculations:

[0052] 1(P i =1) is an indicator function. When the i-th event is falsely reported, P iThe value is 1, otherwise P i The value is zero, W i is the weighted value of the i-th false alarm event, N is the total number of events in the current time window, and FPR represents the false alarm quality index. The numerator represents the comprehensive weight of all events judged as false alarms in the time window, and the denominator represents the total weight of all events in the current time window. The role of the denominator is normalization to ensure that the false alarm quality index in different time windows or different system scales can be compared. The normalized calculation avoids the problem of distortion of indicators due to a large number of events or a large number of false alarms when the time window is large. Through the ratio of the numerator and the denominator, FPR reflects the proportion of the weighted sum of false alarm events to the total weight of all events in the current time window. The higher the FPR value, the higher the severity of the system's false alarms, the higher the sensitivity, and the need to optimize the rules to reduce the false alarm rate.

[0053] The weighted value W of the i-th false alarm event i The acquisition logic is: Get the occurrence frequency of the i-th false alarm event as F i The fixed time window used for normalization processing is the total length of the evaluation time period, which is T. The impact of the i-th false alarm event is I i , the preset maximum value of the influence for normalization processing is M, and the duration of the i-th false alarm event, that is, the time interval from the detection of the i-th false alarm event to the completion of the processing, is D i , the preset maximum duration for normalization is L, and then substitute it into the following calculation formula:

[0054] γ, δ, and ζ are all preset adjustment coefficients, and the sum of the three adjustment coefficients is one. After normalization, it reflects the relative importance of false alarm events in the evaluation period. After normalization, it indicates the severity of the potential risk or resource waste of the event to the system. At the same time, the longer the false alarm event lasts, the greater the impact on the system. Taking into account the importance and impact of each false alarm event, the system's false alarm problem will not be excessively magnified due to some unimportant false alarm events. The adjustment coefficient can be adjusted according to different application scenarios or user needs to adapt to the evaluation needs in specific scenarios.

[0055] The false negative quality index is a key indicator used to measure the coverage capability of the current rule and feature matching model. It comprehensively reflects the performance of the system in false negatives by calculating the set of false negative events in the system within a certain time window, combining the risk, time decay, and time period impact of each false negative event. The logic for obtaining the false negative quality index is as follows:

[0056] In a fixed time window, obtain the missed event information in the output results of the rule and feature matching model to obtain the potential missed event set The total number of missed events is M, and the missed quality index calculation formula is:

[0057] Risk(L k ) represents the risk of the kth missed event. The risk of missed events varies depending on the event type and impact scope, so it is necessary to assess the risk of each event separately. β represents the time decay factor of the missed event, and τ k is the duration of the kth missed event, indicating the delay from the start of the attack to its detection, γ is the preset adjustment factor for controlling the impact of the missed event period, T k represents the detection period of the kth missed event, It represents the average period of the entire monitoring time window, that is, the fixed time window, as the benchmark of the normal detection period. λ1 is a preset constant. FNI represents the missed report quality index. K represents the total number of missed reports, which means the total amount of potential threats that the system has failed to detect within a specific time window. It is the basic quantitative indicator for missed report assessment. The larger the value, the higher the risk of missed reports of the system. Describes the attenuation effect of the time lag of the kth missed event on the risk. The longer the attack or abnormal event occurs, the more likely its impact will be weakened or covered by other defense measures. Therefore, the time lag will reduce the risk weight of the missed event to the system. It indicates the impact of the detection period when the missed event occurs on the risk assessment. If the missed event occurs in a high-priority or sensitive period (such as high system load time), the impact may be greater; while the impact of missed events in non-critical periods will be weakened.

[0058] The risk of the kth missed event Risk(L k )'s acquisition logic is:

[0059] Get the impact range type of the kth missed event as R k , such as database, network layer, key services, etc., the predefined impact scope type r is R r , if r is 1, it means database, r is 2, it means network, the influence coefficient corresponding to the influence range type r is υ r , indicating the potential risk level of this type. For example, the impact coefficient of a database risk may be higher than that of ordinary network traffic. Then substitute it into the following calculation formula:

[0060] N R Indicates the total number of impact range types r, 1(R k =R r ) is the indicator function, if the influence range is R r, then it is 1, otherwise it is 0. Each missed event may affect different system components, with different importance and risk levels. For example, the risk of an attack affecting a database is much higher than that of an ordinary log file. Therefore, it is necessary to calculate the risk by impact scope. By assigning weights, i.e., impact coefficients, to different impact scope types, the system can more accurately reflect the actual threat of missed reports.

[0061] The usage principle of the fuzzy reasoning module is:

[0062] The underreporting quality index and false alarm quality index corresponding to the same fixed time window are taken as input variables, and the optimization direction of the current rule and feature matching model is taken as the output variable. The input variables are fuzzified and the values ​​of the input variables are converted into fuzzy sets. The output variables are fuzzified and the output variables are converted into fuzzy sets. Fuzzy rules are formulated to describe the fitness of the current rules and each optimization direction of the feature matching model under different data type combinations. The fuzzified input variables are inferred through fuzzy rules to obtain the optimization direction of the current rules and feature matching model.

[0063] Input variables: False negative quality index (FNI): measures the coverage of the current system rules and feature matching model. False positive quality index (FPR): measures the sensitivity of the current system rules and feature matching model. Through comprehensive evaluation of false negatives and false positives, the two input quality indexes reflect the accuracy and coverage of the model respectively. This is an important basis for the fuzzy reasoning module to analyze whether the current rules need to be optimized.

[0064] Fuzzification of input variables: Input variables (missing quality index, false alarm quality index) are quantitative numerical data. When directly inferring these data, the decision results may be inaccurate due to the uncertainty of boundaries or thresholds. Fuzzification processing is to convert the values ​​of input variables into fuzzy sets and use language variables to describe the attributes of data, so that the system can better handle uncertainty.

[0065] Division of fuzzy sets: Divide the false negative quality index FNI and the false positive quality index FPR into multiple fuzzy intervals, such as: FNI: low, medium, high. FPR: low, medium, high. Use membership functions to represent the degree of membership of data in different fuzzy sets. The membership function can be a trigonometric function, a trapezoidal function, or a Gaussian function.

[0066] Output variables: The optimization direction of the current rule and feature matching model may include the following: increasing sensitivity (improving rule detection accuracy). Expanding coverage (enhancing rule detection capabilities). Balancing sensitivity and coverage.

[0067] Fuzzification: Output variables are also described by language variables, for example, optimization direction: small optimization, medium optimization, large optimization. For each optimization direction, a corresponding fuzzy set is also established.

[0068] Formulate fuzzy rules: Fuzzy rules are used to describe the corresponding optimization direction under different input combinations. Rule examples: Rule 1: If FNI is high and FPR is low, the optimization direction is "expand coverage". Rule 2: If FNI is low and FPR is high, the optimization direction is "reduce sensitivity". Rule 3: If FNI is medium and FPR is medium, the optimization direction is "balanced optimization". Fuzzy rules combine the experience of security experts and actual system requirements, and describe how the combination of input variables affects the optimization direction through logical rules.

[0069] Fuzzy reasoning: Through fuzzy logic operations (such as the maximum-minimum synthesis method), combined with all activation rules, the fuzzy set of optimization directions is derived. The output of fuzzy reasoning is a fuzzy set, which needs to be converted into specific values ​​or clear optimization directions through defuzzification methods. Commonly used defuzzification methods: Centroid method: calculate the centroid of the fuzzy set membership function as the output value; Maximum membership method: select the representative value of the set with the largest membership; finally, according to the defuzzification result, output the specific optimization direction.

[0070] The feedback module generates a positive feedback signal or a negative feedback signal according to the optimization direction obtained by the fuzzy reasoning module. When a negative feedback signal is generated, the corresponding preset strategy is optimized and the optimization result is fed back to the data analysis module. When a positive feedback signal is generated, no feedback operation is performed to the data analysis module.

[0071] The optimization of the preset strategy refers to the adjustment of the system's rules and feature matching models, including optimization of the model's sensitivity, coverage, rule complexity, etc. The goal of this optimization is to reduce false positives and false negatives and improve the overall performance of the system.

[0072] Types of optimization strategies: Depending on the optimization direction, the optimization of preset strategies usually includes the following:

[0073] Sensitivity optimization: Adjust the sensitivity of rules or models to reduce false positives. Specific operations: Lower the matching threshold of rules: Increase the tolerance of rules by reducing misjudgments of normal behaviors. For example, adjust the sensitivity value of some rules from 0.8 to 0.7. Remove overly strict rules: For specific rules, if the triggering conditions are too strict and prone to false positives, you can optimize them by modifying the rule logic or weights. Application scenario: When the false positive quality index (FPR) is high and the false negative quality index (FNI) is low, sensitivity optimization is required.

[0074] Coverage optimization: Adjust the coverage of rules or models to reduce missed events. Specific operations: Expand the rule base: Add rules for new attack features to cover more potential threats. Refine rule matching: Refine existing rules to improve the detection ability of rules for specific types of threats. Introduce more extensive feature detection: Add more dimensional detection indicators, such as adding abnormal traffic detection or abnormal user behavior monitoring. Application scenario: When the missed quality index (FNI) is high and the false positive quality index (FPR) is low, coverage optimization is required.

[0075] Balanced optimization: trade-off optimization between sensitivity and coverage to find the best balance point. Specific operations: adjust rule weights: redistribute the weights of each rule in the rule base so that the system can achieve a better balance between sensitivity and coverage. Dynamically adjust thresholds: dynamically adjust sensitivity thresholds and coverage boundaries based on real-time system status. Application scenarios: when both the false positive quality index (FPR) and the false negative quality index (FNI) are high, balanced optimization is required.

[0076] When the fuzzy reasoning module deduces that the current rules and feature matching model do not need to be optimized, a positive feedback signal is generated. The positive feedback signal indicates that the current system rules have reached a relatively optimal state and do not need further optimization. In this case, the feedback module will not perform any feedback operations on the data analysis module. Avoid unnecessary adjustments, maintain the stability of system operation, reduce computing and resource consumption, and improve system efficiency.

[0077] When the fuzzy reasoning module deduces that the current rule and feature matching model needs to be optimized, a negative feedback signal is generated. Operation: Trigger the optimization of the preset strategy: According to the optimization direction derived by the fuzzy reasoning module, select the corresponding preset strategy (sensitivity optimization, coverage optimization, balance optimization, etc.). Feedback the optimization results to the data analysis module: Load the optimized rule and feature matching model into the data analysis module. The data analysis module restarts the analysis of the security situation feature data set and generates new analysis results based on the optimized rule model. Update the system status: After the optimization is completed, the system's false alarm quality index (FPR) and false negative quality index (FNI) will be recalculated in the next time window to verify the optimization effect. Ensure that the system can adapt to the dynamically changing security situation and achieve continuous improvement and optimization of the rule and feature matching model.

[0078] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters in the formula are set by technicians in this field according to actual conditions.

[0079] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0080] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0081] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0082] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. Server security situation awareness and risk warning system, characterized by: It includes data acquisition module, data analysis module, evaluation module, fuzzy reasoning module, feedback module and risk warning module; The data collection module is used to collect the preset server security situation feature data in real time to obtain the security situation feature data set; The data analysis module is used to transmit the security situation feature data set to the preset rule and feature matching model or the feedback rule and feature matching model, analyze and obtain the output result of the rule and feature matching model; The risk warning module is used to perform risk warning operations based on the output results of the rule and feature matching model; The evaluation module is used to evaluate the sensitivity of the current feature matching rule and the coverage of the current feature matching rule according to the output results of the rule and feature matching model; The fuzzy reasoning module is used to perform fuzzy reasoning based on the evaluation results of the evaluation module, obtain the optimization direction of the current rule and feature matching model and transmit it to the feedback module; The feedback module is used to optimize the corresponding preset strategy according to the optimization direction obtained by the fuzzy reasoning module and feed back the optimization results to the data analysis module.

2. The server security situation awareness and risk warning system according to claim 1 is characterized in that: The evaluation module includes evaluation unit 1 and evaluation unit 2. Evaluation unit 1 performs sensitivity evaluation on the current feature matching rule and generates a false alarm quality index; evaluation unit 2 performs coverage evaluation on the current feature matching rule and generates a false alarm quality index.

3. The server security situation awareness and risk warning system according to claim 2 is characterized in that: The logic for obtaining the false alarm quality index is: In a fixed time window, obtain the false positive event information in the output results of the rule and feature matching model, and then perform the following calculations: 1(P i =1) is an indicator function. When the i-th event is falsely reported, P i The value is 1, otherwise P i The value is zero, W i is the weighted value of the ith false alarm event, N is the number of total events in the current time window, and FPR represents the false alarm quality index.

4. The server security situation awareness and risk warning system according to claim 3 is characterized in that: The weighted value W of the i-th false alarm event i The acquisition logic is: Get the frequency of the i-th false alarm event as F i The fixed time window used for normalization processing is the total length of the evaluation time period, which is T. The impact of the i-th false alarm event is I i , the preset maximum value of the influence for normalization processing is M, and the duration of the i-th false alarm event, that is, the time interval from the detection of the i-th false alarm event to the completion of the processing, is D i , the preset maximum duration for normalization is L, and then substitute it into the following calculation formula: γ, δ, and ζ are all preset adjustment coefficients, and the sum of the three adjustment coefficients is one.

5. The server security situation awareness and risk warning system according to claim 4 is characterized in that: The logic for obtaining the underreporting quality index is: In a fixed time window, obtain the missed event information in the output results of the rule and feature matching model to obtain the potential missed event set The total number of missed events is M, and the missed quality index calculation formula is: Risk(L k ) represents the risk of the kth missed event, K represents the total number of missed events, β represents the time decay factor of missed events, τ k is the duration of the kth missed event, indicating the delay from the start of the attack to its detection, γ is the preset adjustment factor for controlling the impact of the missed event period, T k represents the detection period of the kth missed event, It represents the average period of the entire monitoring time window, i.e., the fixed time window, as the benchmark of the normal detection period, λ1 is a preset constant, and FNI represents the false negative quality index.

6. The server security situation awareness and risk warning system according to claim 5, characterized in that: The risk of the kth missed event Risk(L k )'s acquisition logic is: Get the impact range type of the kth missed event as R k , the predefined influence range type r is R r , the influence coefficient corresponding to the influence range type r is v r , and then substitute the following calculation formula: N R Indicates the total number of impact range types r, 1(R k =R r ) is the indicator function, if the influence range is R r , then it is 1, otherwise it is 0.

7. The server security situation awareness and risk warning system according to claim 5, characterized in that: The usage principle of the fuzzy reasoning module is: The underreporting quality index and false alarm quality index corresponding to the same fixed time window are taken as input variables, and the optimization direction of the current rule and feature matching model is taken as the output variable. The input variables are fuzzified and the values ​​of the input variables are converted into fuzzy sets. The output variables are fuzzified and the output variables are converted into fuzzy sets. Fuzzy rules are formulated to describe the fitness of the current rules and each optimization direction of the feature matching model under different data type combinations. The fuzzified input variables are inferred through fuzzy rules to obtain the optimization direction of the current rules and feature matching model.

8. The server security situation awareness and risk warning system according to claim 7, characterized in that: The feedback module generates a positive feedback signal or a negative feedback signal according to the optimization direction obtained by the fuzzy reasoning module. When a negative feedback signal is generated, the corresponding preset strategy is optimized and the optimization result is fed back to the data analysis module. When a positive feedback signal is generated, no feedback operation is performed to the data analysis module.

Images