Equipment collaborative construction method and system

Abstract

The invention discloses an equipment collaborative construction method and system, and the method comprises the steps: obtaining a collaborative security record, carrying out the feature extraction of the collaborative security record, and obtaining a corresponding security feature; performing simulation drilling on the security feature by using a virtual reality technology to obtain a drilling result; and matching is carried out in a preset equipment collaborative optimization strategy library according to the drilling result, and if the matching is successful, a corresponding equipment collaborative optimization strategy is executed, so that the overall level of network security protection is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a device collaborative construction method and system. Background Art

[0002] In today's digital age, network security is of vital importance. The inventors found the following problems when studying the existing network security equipment collaborative construction mechanism: traditional network security testing and drill methods are often limited to theoretical analysis and some actual scenario simulations, which are difficult to fully and truly reflect the complex and changeable network attack situations. For example, testing in an actual network environment may interfere with normal business, and it is difficult to accurately control attack variables to deeply analyze the effect of device collaboration. In addition, the collaboration between various devices under the existing mechanism lacks in-depth verification and optimization methods, and potential collaboration vulnerabilities cannot be discovered in time; with the continuous upgrading and diversification of network attack methods, the existing network security protection system is difficult to quickly adapt to new threats, and traditional testing methods are slow to respond to new attacks, and cannot provide effective improvement directions for the device collaborative construction mechanism in advance.

[0003] The application of virtual reality technology has brought new opportunities to solve these problems. It can build highly realistic network attack scenarios, conduct comprehensive network security simulation drills without affecting actual business, and accurately control attack parameters and scenario variables to deeply test the performance of the device collaborative construction mechanism in different situations. It can also simulate new attacks in advance to help network security personnel better understand potential threats and provide forward-looking guidance for the optimization of the device collaborative construction mechanism, thereby effectively improving the overall level of network security protection. Therefore, a new device collaborative construction method for network security using virtual reality technology is needed. Summary of the invention

[0004] In view of the above existing problems, the present invention is proposed.

[0005] Therefore, the present invention provides a device collaborative construction method and system to solve the problems that traditional methods are limited to theoretical analysis and partial actual scenario simulation, and it is difficult to fully and truly reflect the complex and changeable network attack situations, and the existing network security protection system is difficult to quickly adapt to new threats. Traditional testing methods are slow to respond to new attacks and cannot provide effective improvement directions for the device collaborative construction mechanism in advance.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0007] In a first aspect, the present invention provides a device collaborative construction method, comprising:

[0008] Acquire collaborative security records, perform feature extraction on the collaborative security records, and obtain corresponding security features;

[0009] Using virtual reality technology to simulate and drill the security features to obtain drill results;

[0010] A match is performed in a preset device collaborative optimization strategy library according to the drill results, and if the match is successful, the corresponding device collaborative optimization strategy is executed.

[0011] As a preferred solution of the device collaborative construction method described in the present invention, wherein: extracting features from the collaborative security record includes:

[0012] The network space is regarded as a directed graph, and the correlation analysis of the collaboration between network nodes is performed based on the data flow by evaluating the in-degree and out-degree of different vertices;

[0013] By evaluating the overall topology of the directed graph, key nodes in the graph space are selected;

[0014] Importance evaluation is performed based on the attributes of key nodes, and feature selection is performed.

[0015] As a preferred solution of the device collaborative construction method of the present invention, the simulation exercise of the security feature includes:

[0016] Abstract the input and output of physical network resources and simulate the behavior of physical network resources to obtain virtual space;

[0017] Acquire the attack situation and the corresponding attack characteristics, and restore the attack situation in the virtual space using the attack situation and the corresponding attack characteristics;

[0018] A simulated attack is performed on the corresponding virtual node of the network node in the virtual space, and the process of the simulated attack is recorded to obtain the drill result.

[0019] As a preferred solution of the device collaborative construction method described in the present invention, matching in a preset device collaborative optimization strategy library includes:

[0020] Analyze the drill results and obtain the corresponding problem classification;

[0021] Use problem classification to match the corresponding device collaborative optimization strategy. If the match is successful, execute the corresponding device collaborative optimization strategy to adjust the device configuration or upgrade and deploy the software.

[0022] As a preferred solution of the device collaborative construction method described in the present invention, it also includes:

[0023] If the matching fails, the uniqueness analysis and complexity analysis are performed on the drill results that are not matched to the device collaborative optimization strategy;

[0024] Based on the results of uniqueness analysis and complexity analysis, the corresponding exercise report is generated in combination with natural language processing technology.

[0025] As a preferred solution of the device collaborative construction method described in the present invention, the uniqueness analysis and complexity analysis include:

[0026] If the security characteristics corresponding to the drill results are different from the historical security characteristics, the drill results are unique;

[0027] If the security features corresponding to the drill results have cross-influences, the drill results will be complex.

[0028] As a preferred solution of the device collaborative construction method described in the present invention, it also includes:

[0029] When executing the corresponding device collaborative optimization strategy, the collection frequency is increased to a preset value based on the optimization strategy;

[0030] When the corresponding device collaborative optimization strategy ends, the previous collection frequency is restored.

[0031] In a second aspect, the present invention provides a device collaborative construction system, comprising:

[0032] A feature extraction module, used to obtain collaborative safety records, perform feature extraction on the collaborative safety records, and obtain corresponding safety features;

[0033] A simulation and drill module, used to simulate and drill the security features using virtual reality technology to obtain a drill result;

[0034] The matching module is used to match the preset device collaborative optimization strategy library according to the drill results, and if the match is successful, the corresponding device collaborative optimization strategy is executed.

[0035] In a third aspect, the present invention provides a computing device, comprising:

[0036] Memory and processor;

[0037] The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the device collaborative construction method are implemented.

[0038] In a fourth aspect, the present invention provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the device collaborative construction method.

[0039] Compared with the prior art, the present invention has the following beneficial effects: the present invention collects collaborative security records from each network node in the network system, extracts features from the security records, conducts simulation drills in a virtual space, and matches optimization strategies or outputs mismatched situations based on the drill results, thereby realizing an efficient collaborative construction mechanism for network security equipment; it solves the problem of data isolation and difficulty in fully reflecting the network security situation, and provides a data basis for subsequent decision-making based on accurate analysis of the operation, attack and processing characteristics of network nodes; based on simulation drills, it discovers potential security issues in advance, making up for the deficiency in reflecting complex attack situations, thereby improving the overall level of network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0041] Figure 1 The figure is a schematic diagram of the overall process logic of the device collaborative construction method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0042] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0043] Example 1

[0044] Reference Figure 1 , as an embodiment of the present invention, provides a device collaborative construction method, comprising:

[0045] S100: Acquire collaborative security records, extract features from the collaborative security records, and obtain corresponding security features;

[0046] S200: Use virtual reality technology to simulate and exercise the security features and obtain the exercise results;

[0047] S300: Matching is performed in a preset device collaborative optimization strategy library according to the drill results. If the match is successful, the corresponding device collaborative optimization strategy is executed.

[0048] It should be noted that by collecting collaborative security records at each network node in the network system, extracting features from the security records, conducting simulation drills in a virtual space, and matching optimization strategies or outputting mismatched situations based on the drill results, an efficient collaborative construction mechanism for network security equipment is implemented, solving the problem of isolated data and difficulty in fully reflecting the network security situation. By integrating data from multiple network nodes, a more comprehensive network security view is provided.

[0049] In the embodiment of the present application, the above step S100 includes the following sub-steps A1-A3;

[0050] In A1: the network space is regarded as a directed graph, and the correlation analysis of the collaboration between network nodes is performed based on the data flow by evaluating the in-degree and out-degree of different vertices;

[0051] In A2: By evaluating the overall topology of the directed graph, key nodes in the graph space are selected;

[0052] In A3: Importance evaluation is performed based on the attributes of key nodes, and feature selection is performed.

[0053] In the embodiment of the present application, feature extraction technology is used to extract features from security records;

[0054] Specifically, data preprocessing and feature selection are performed on the security records; data preprocessing includes data cleaning, data standardization and data segmentation; feature selection includes correlation analysis and corresponding importance evaluation based on the collaboration between network nodes, and feature selection based on the results of importance evaluation.

[0055] It should be noted that the processing of security records is achieved by using data preprocessing and feature selection technology. By performing data preprocessing and feature selection on security records, and through operations such as data cleaning, standardization and segmentation, the data quality and consistency are improved. Feature selection is performed based on correlation analysis and importance assessment to ensure that the extracted security features are of high value, providing a reliable basis for accurately assessing network security status and conducting simulation exercises.

[0056] In the embodiment of the present application, the features include operation features, attack features, and processing features;

[0057] Operational characteristics include at least equipment performance characteristics, network connection characteristics, and system status characteristics;

[0058] Attack characteristics at least include attack type characteristics, attack behavior characteristics and attack consequence characteristics;

[0059] The processing characteristics at least include response time characteristics, processing method characteristics and processing effect characteristics.

[0060] Specifically, device performance characteristics include CPU usage, memory usage, disk read and write speed, and network bandwidth utilization; network connection characteristics include the number of connected devices, the type and number of connected ports, and network traffic patterns; system status characteristics include process list and running status, service operation status, and system log records; attack type characteristics include malware characteristics, network attack characteristics, and social engineering attack characteristics; attack behavior characteristics include attack frequency, attack duration, attack path, and propagation method; attack consequence characteristics include system performance degradation characteristics, data leakage characteristics, and service interruption characteristics; response time characteristics include response time after detecting an attack, repair time characteristics, etc.; processing method characteristics include type of defense measures, collaborative processing characteristics, etc.; processing effect characteristics include whether the attack is successfully blocked and the degree of system recovery.

[0061] It should be noted that the detailed division of operation characteristics, attack characteristics and processing characteristics, covering multiple aspects such as equipment performance, network connection and system status, can fully understand the operation status of network nodes, and provide specific indicators and directions for timely discovery of potential problems and optimization of equipment coordination.

[0062] In the embodiment of the present application, blockchain technology is used to collect data at each network node in the network system;

[0063] Specifically, corresponding security records are collected at network nodes based on a preset collection period; the network nodes include at least core routers, switches and servers; the operating conditions include at least the operating conditions of the core routers, the operating conditions of the switches and the operating conditions of the servers; the corresponding attack conditions include at least the attack conditions of the core routers, the attack conditions of the switches and the attack conditions of the servers; the corresponding processing conditions include at least the processing conditions of the core routers, the processing conditions of the switches and the processing conditions of the servers.

[0064] Exemplarily, network nodes are composed of various network security devices, such as firewalls, intrusion detection systems, intrusion prevention systems, antivirus software, etc. These devices are responsible for real-time monitoring of network traffic, system status, etc., and sensing potential security threats. The devices in the perception layer continuously collect data and pass it to the upper layer for analysis and processing; through the preset collection cycle, security records are collected at network nodes such as core routers, switches and servers, covering the operation, attack and processing of different key devices, providing a rich data foundation for subsequent analysis, ensuring accurate grasp of the security status of the entire network system.

[0065] It should be noted that blockchain technology, with its tamper-proof and traceable characteristics, enhances the security of collected data and ensures the authenticity and integrity of the data. By collecting security records at key network nodes such as core routers, switches and servers, it can comprehensively monitor the network's operating status, attack status and processing status, thereby improving the coverage of network security monitoring.

[0066] In the embodiment of the present application, after completing steps A1-A3 in the above step S100, the following steps A4-A5 are also included;

[0067] In A4: when executing the corresponding device collaborative optimization strategy, the collection frequency is increased to a preset value based on the optimization strategy;

[0068] In A5: When the corresponding device collaborative optimization strategy ends, the previous collection frequency is restored.

[0069] Specifically, when a specific device collaborative optimization strategy is executed, the system is adjusting the collaborative working mode between devices in the network according to the strategy. In the process of executing the device collaborative optimization strategy, in order to more accurately monitor the effect of the optimization strategy and increase the frequency of collecting security records from network nodes, network status and behavior data can be obtained more frequently, so as to discover problems and respond more quickly. The preset value is set according to the actual situation. Once the execution of the device collaborative optimization strategy is completed, high-frequency data collection will no longer be required to monitor the effect of the strategy, so the frequency of data collection will be restored to the preset period before the execution of the optimization strategy.

[0070] It should be noted that when executing the corresponding device collaborative optimization strategy, the execution results need to be verified, so the collection frequency is increased; when the device collaborative optimization strategy is executed, the collection frequency is increased, and the normal collection cycle is restored after the strategy execution is completed, which realizes closer monitoring of data during critical periods, helps to timely evaluate the effectiveness of the optimization strategy and reasonably allocate resources in normal times, and improves the flexibility and pertinence of data collection.

[0071] In the embodiment of the present application, the above step S200 includes the following sub-steps B1-B3;

[0072] In B1: the input and output of physical network resources are abstracted, and the behavior of physical network resources is simulated to obtain virtual space;

[0073] In B2: obtaining the attack situation and the corresponding attack characteristics, and restoring the attack situation in the virtual space using the attack situation and the corresponding attack characteristics;

[0074] In B3: a simulated attack is performed on a virtual node corresponding to the network node in the virtual space, and the process of the simulated attack is recorded to obtain a drill result.

[0075] It should be noted that by obtaining the attack situation and attack characteristics, restoring the attack situation at the virtual network layer and simulating attacks on virtual nodes, and finally recording the process to generate exercise results, a comprehensive simulation and evaluation of the network security situation is achieved, providing a real and reliable basis for optimizing equipment collaboration.

[0076] In the embodiment of the present application, the network virtual space includes a network infrastructure layer, a virtual network layer and an application service layer;

[0077] Specifically, the network infrastructure layer connects with the perception layer and receives security records and corresponding security features; the virtual network layer abstracts and virtualizes the physical network resources of the perception layer, that is, abstracts the input and output of the physical network resources, thereby simulating the behavior of physical network resources in the virtual network layer, and specifically includes obtaining the corresponding virtual space for simulation exercises; the application service layer includes a variety of network applications and services;

[0078] It should be noted that the use of existing virtual technologies to create network virtual space, abstract and virtualize physical network resources, provide a realistic environment for simulation exercises, and cover the application service layer at the same time, which can comprehensively evaluate the impact of network security on actual business and improve the practicality and effectiveness of the equipment collaborative construction mechanism.

[0079] In an embodiment of the present application, the process of generating the drill results includes continuously collecting various attack-related data during the simulation of the attack; collecting the response data of each network security device on the virtual node to the attack; collecting the status data of the corresponding virtual network; and using the obtained data to evaluate the attack effect and the corresponding device coordination performance to obtain the drill results.

[0080] Specifically, the various attack-related data, response data, and status data that are continuously collected may include information such as the type of attack, the intensity of the attack, the time series of the attack, the source of the attack, etc. If it is a DDoS attack, it is necessary to record the size of the attack traffic, the duration of the attack, the IP address distribution of the attack source, etc.; in the response data, the firewall blocking records, the alarm information of the intrusion detection system, the interception records of the intrusion prevention system, the scanning results of the anti-virus software, etc., and also include the performance data such as the response time of the device, the number of data packets processed, and the resource usage;

[0081] It should be noted that during the simulated attack process, attack-related data, device response data and network status data are continuously collected, and these data are used to evaluate the attack effect and device coordination performance. The generated exercise results can accurately reflect the actual situation of network security and the effectiveness of device coordination, providing a scientific basis for further optimization.

[0082] In the embodiment of the present application, the above step S300 includes the following sub-steps C1-C4;

[0083] In C1: Analyze the drill results and obtain the corresponding problem classification;

[0084] In C2: Use problem classification to match the corresponding device collaborative optimization strategy. If the match is successful, execute the corresponding device collaborative optimization strategy to adjust the device configuration or upgrade and deploy the software;

[0085] In C3: if the matching fails, the uniqueness analysis and complexity analysis are performed on the exercise results that are not matched to the device collaborative optimization strategy;

[0086] In C4: Based on the results of uniqueness analysis and complexity analysis, the corresponding exercise report is generated in combination with natural language processing technology.

[0087] Specifically, the results generated by the simulation exercise are comprehensively collated, and the results of the exercise are analyzed to obtain equipment performance issues, information sharing issues, and coordination strategy issues;

[0088] For example, if it is found that the performance of some devices degrades when processing a large amount of attack traffic, or that the information transmission between devices is not timely, resulting in incoherent collaborative response, then the corresponding device collaborative optimization strategy is matched;

[0089] For firewalls with insufficient processing power, their memory capacity can be increased or the processor can be upgraded. For information sharing issues, communication protocols can be improved, more efficient information sharing platforms can be established, and data encryption can be strengthened. For example, more advanced encryption technology can be used to ensure the secure transmission of threat intelligence between devices;

[0090] Specifically, the device configuration adjustment can be performed through the centralized management platform or the device's own management interface to adjust parameters.

[0091] For example, the detection threshold of the intrusion detection system can be adjusted to increase its sensitivity to specific types of attacks, and the adjustment process and parameter changes can be recorded for subsequent effect evaluation; software upgrades can be deployment optimization strategies involving software upgrades, and operations are performed according to the established upgrade process, including downloading the latest software version, performing compatibility testing, and deploying during non-business peak hours, etc., to ensure that the normal operation of the network is not affected during the software upgrade process.

[0092] It should be noted that the drill results are analyzed to obtain problem classification, and then the corresponding device collaboration optimization strategy is matched and device configuration adjustment or software upgrade deployment is executed, which achieves targeted optimization of device collaboration and improves the efficiency and effectiveness of network security protection.

[0093] In the embodiment of the present application, after completing steps C1-C4 in the above step S300, the following steps C5-C6 are also included;

[0094] In C5: If the security characteristics corresponding to the drill results are different from the historical security characteristics, the drill results are unique;

[0095] In C6: If the safety features corresponding to the drill results have cross-influences, the drill results are complex;

[0096] In the embodiment of the present application, uniqueness analysis is used to determine whether the drill result is unique, and uniqueness is used to characterize whether the security features corresponding to the drill result are different from the historical security features; complexity analysis is used to determine whether there is a cross-influence between the security features corresponding to the drill result, and complexity is used to characterize whether the security features corresponding to the drill result cannot directly apply the existing equipment collaborative optimization strategy;

[0097] Specifically, uniqueness analysis determines whether the issues reflected in the results of this exercise are unique;

[0098] For example, whether it is a new attack type or a special situation in a specific network environment, which makes the existing optimization strategy inapplicable;

[0099] Specifically, complexity analysis evaluates the complexity of the problem. In specific applications, multiple problems may be intertwined, making it difficult to directly apply existing optimization strategies.

[0100] For example, there are multiple problems such as equipment performance problems, poor information sharing and unreasonable coordination strategies, etc.

[0101] Existing natural language processing technology is used to generate a corresponding detailed report, which includes a basic introduction to the drill, a specific description of the problem, the analysis process and results, etc. The report can be in a variety of forms such as text and charts to clearly display the problem.

[0102] It should be noted that conducting uniqueness and complexity analysis on the drill results that are not matched to the optimization strategy and generating drill reports in combination with natural language processing technology can help to gain a deeper understanding of special situations and provide an important reference for further research and formulation of new optimization strategies.

[0103] The above is a schematic scheme of a device collaborative construction method of this embodiment. It should be noted that the technical scheme of the device collaborative construction system and the technical scheme of the above-mentioned device collaborative construction method belong to the same concept, and the details of the technical scheme of the device collaborative construction system in this embodiment that are not described in detail can all be referred to the description of the technical scheme of the above-mentioned device collaborative construction method.

[0104] In this embodiment, the device collaborative construction system includes:

[0105] A feature extraction module, used to obtain collaborative safety records, perform feature extraction on the collaborative safety records, and obtain corresponding safety features;

[0106] A simulation and drill module, used to simulate and drill the security features using virtual reality technology to obtain a drill result;

[0107] The matching module is used to match the preset device collaborative optimization strategy library according to the drill results, and if the match is successful, the corresponding device collaborative optimization strategy is executed.

[0108] In the embodiment of the present application, it includes a perception layer, a processing layer, a decision layer and a control layer;

[0109] The perception layer, processing layer, decision layer and control layer are connected in communication in sequence;

[0110] Specifically, the perception layer is configured as follows: using blockchain technology to collect data from each network node in the network system to obtain corresponding collaborative security records; wherein the collaborative security records store the collaborative operation status between network nodes, the corresponding attack status and the corresponding processing status;

[0111] The processing layer is configured as follows: extracting features from security records using feature extraction technology to obtain corresponding security features; wherein the security features include operation features, corresponding attack features, and corresponding processing features; the operation features are used to characterize the operation status of network nodes; the attack features are used to characterize the attack status of network nodes; and the processing features are used to characterize the processing status of network nodes when they are attacked;

[0112] The decision-making layer is configured as follows: using virtual reality technology and security features to conduct simulation drills and obtain drill results; wherein the simulation drill is to use security features in a preset network virtual space to conduct simulated attacks on network nodes, and the drill results are used to characterize the security status of network nodes after the simulation drills;

[0113] The control layer is configured as follows: based on the drill results, the corresponding device collaborative optimization strategy is matched and executed in the preset device collaborative optimization strategy library, and the drill results are output when the corresponding device collaborative optimization strategy is not matched; wherein, the device collaborative optimization strategy is used to update the collaboration between network nodes.

[0114] It should be noted that the system improves the efficiency of network security management through a layered approach. Each layer is responsible for different tasks, making the entire network security management process clearer and more efficient. The use of blockchain technology for data collection ensures the immutability and transparency of the data, and enhances the integrity and credibility of the data. Through the feature extraction technology of the processing layer, key security features can be extracted from security records, providing a basis for accurate analysis of network conditions. The decision-making layer uses virtual reality technology for simulation drills, which can simulate various network attacks and defense situations without affecting the actual network operation, thereby improving the ability to respond to real attacks. The control layer can automatically match and execute equipment collaborative optimization strategies based on the drill results, thereby improving the response speed and processing capabilities to network security threats.

[0115] This embodiment further provides a computing device, which is applicable to the device collaborative construction situation, including:

[0116] Memory and processor; the memory is used to store computer executable instructions, and the processor is used to execute computer executable instructions to implement the device collaborative construction method proposed in the above embodiment.

[0117] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, the method for realizing collaborative construction of devices as proposed in the above embodiment is implemented.

[0118] The storage medium proposed in this embodiment and the method for realizing device collaborative construction proposed in the above embodiment belong to the same inventive concept. The technical details not fully described in this embodiment can be referred to the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0119] Through the above description of the implementation methods, the technicians in the relevant field can clearly understand that the present invention can be implemented by means of software and necessary general hardware, and of course can also be implemented by hardware. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ReadOnly, Memory, ROM), random access memory (Random Access Memory, RAM), flash memory (FLASH), hard disk or optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform the methods of various embodiments of the present invention.

Claims

1. A device collaborative construction method, characterized in that: include: Acquire collaborative security records, perform feature extraction on the collaborative security records, and obtain corresponding security features; Using virtual reality technology to simulate and drill the security features to obtain drill results; A match is performed in a preset device collaborative optimization strategy library according to the drill results, and if the match is successful, the corresponding device collaborative optimization strategy is executed.

2. The device collaborative construction method according to claim 1, characterized in that: Extracting features from the collaborative safety record includes: The network space is regarded as a directed graph, and the correlation analysis of the collaboration between network nodes is performed based on the data flow by evaluating the in-degree and out-degree of different vertices; By evaluating the overall topology of the directed graph, key nodes in the graph space are selected; Importance evaluation is performed based on the attributes of key nodes, and feature selection is performed.

3. The device collaborative construction method according to claim 2, characterized in that: The simulation exercise of the safety features includes: Abstract the input and output of physical network resources and simulate the behavior of physical network resources to obtain virtual space; Acquire the attack situation and the corresponding attack characteristics, and restore the attack situation in the virtual space using the attack situation and the corresponding attack characteristics; A simulated attack is performed on the corresponding virtual node of the network node in the virtual space, and the process of the simulated attack is recorded to obtain the drill result.

4. The device collaborative construction method according to claim 3, characterized in that: Matching in the preset equipment collaborative optimization strategy library includes: Analyze the drill results and obtain the corresponding problem classification; Use problem classification to match the corresponding device collaborative optimization strategy. If the match is successful, execute the corresponding device collaborative optimization strategy to adjust the device configuration or upgrade and deploy the software.

5. The device collaborative construction method according to claim 4, characterized in that: Also includes: If the matching fails, the uniqueness analysis and complexity analysis are performed on the drill results that are not matched to the device collaborative optimization strategy; Based on the results of uniqueness analysis and complexity analysis, the corresponding exercise report is generated in combination with natural language processing technology.

6. The device collaborative construction method according to claim 5, characterized in that: Uniqueness and complexity analysis include: If the security characteristics corresponding to the drill results are different from the historical security characteristics, the drill results are unique; If the security features corresponding to the drill results have cross-influences, the drill results will be complex.

7. The device collaborative construction method according to claim 1 or 6, characterized in that: Also includes: When executing the corresponding device collaborative optimization strategy, the collection frequency is increased to a preset value based on the optimization strategy; When the corresponding device collaborative optimization strategy ends, the previous collection frequency is restored.

8. A system using the device collaborative construction method according to any one of claims 1 to 7, characterized in that: include: A feature extraction module, used to obtain collaborative safety records, perform feature extraction on the collaborative safety records, and obtain corresponding safety features; A simulation and drill module, used to simulate and drill the security features using virtual reality technology to obtain a drill result; The matching module is used to match the preset device collaborative optimization strategy library according to the drill results, and if the match is successful, the corresponding device collaborative optimization strategy is executed.

9. An electronic device, comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the device collaborative construction method described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the device collaborative construction method described in any one of claims 1 to 7.

Images