Network operation and maintenance environment risk assessment method and system based on mimicry security technology

Abstract

The invention relates to the technical field of network operation and maintenance supervision, in particular to a network operation and maintenance environment risk assessment method and system based on a mimicry security technology, and the method comprises the steps: carrying out the collection and preprocessing of network operation and maintenance environment data, and generating standardized security data; abnormal feature data and disturbance response data are extracted through real mimicry analysis and active challenge mimicry analysis, and associated threat feature data are generated through fusion; based on the associated threat feature data, constructing a heterogeneous twin model, performing state modeling, threat modeling and resource modeling, and generating risk assessment data; and generating an optimal response strategy through a multi-objective optimization algorithm, including flow control, node isolation and resource scheduling, and dynamically updating a risk state through a feedback regulation mechanism. Through dynamic threat identification and real-time optimization response, the risk assessment accuracy and the security defense level of the network operation and maintenance environment are improved, and the method has the advantages of being efficient, intelligent and dynamic.

Description

Technical Field

[0001] The present invention relates to the field of network operation and maintenance supervision technology, and in particular to a network operation and maintenance environment risk assessment method and system based on mimicry security technology. Background Art

[0002] As the network operation and maintenance environment becomes more complex, traditional security protection methods (such as static defense and rule matching detection technology) are difficult to effectively respond to new network attacks, especially dynamic, diversified and intelligent threats. This is because the existing technology (Chinese invention patent, publication number: CN117834305B, name: A network operation and maintenance environment assessment system based on mimic security technology) mostly uses single indicator monitoring and static assessment methods, relying on fixed security policies or feature-based threat identification mechanisms, and cannot simulate complex attack scenarios in real time, nor can it perform effective dynamic feedback regulation, resulting in the following defects:

[0003] Delayed threat identification: Due to reliance on static analysis, dynamic threats cannot be quickly identified;

[0004] Insufficient global risk assessment: Lack of cross-level data association and modeling leads to inaccurate risk assessment;

[0005] The response measures are not smart enough: It is impossible to generate dynamic and optimal response strategies based on risk assessment results, resulting in insufficient timeliness and accuracy of network defense. Summary of the invention

[0006] In response to the many problems existing in the above-mentioned prior arts, the present invention provides a network operation and maintenance environment risk assessment method and system based on mimicry security technology. The present invention extracts abnormal feature data and disturbance response data in the network operation and maintenance environment through data collection, real mimicry analysis and active challenge mimicry analysis, and performs data fusion and risk quantification assessment through a cross-layer association mapping model to generate an optimal response strategy, realize dynamic risk identification and real-time optimization of network security status, and enhance network security monitoring and response capabilities.

[0007] A network operation and maintenance environment risk assessment method based on mimic security technology includes the following steps:

[0008] Collect and pre-process data in the network operation and maintenance environment, and perform deduplication, time alignment and standardization on the collected data to generate standardized security data;

[0009] Based on the standardized security data, real abnormal feature data and virtual disturbance response data are respectively extracted through real mimicry analysis and active challenge mimicry analysis, and the real abnormal feature data and the virtual disturbance response data are fused to generate associated threat feature data;

[0010] Based on the associated threat feature data, a heterogeneous twin model is constructed to perform state modeling, threat modeling, and resource modeling, and risk assessment data is generated through data fusion and risk quantification assessment algorithm;

[0011] Based on the risk assessment data, an optimal response strategy is generated through a multi-objective optimization algorithm. The optimal response strategy includes traffic control, node isolation and resource scheduling. The optimal response strategy is executed, and strategy execution feedback data is collected. The feedback data is then transmitted back to the heterogeneous twin model through a feedback control mechanism to update and optimize the risk status.

[0012] Preferably, the data in the network operation and maintenance environment includes network traffic data, user behavior data and system log data. When deduplicating the collected data, the data identification information is compared based on a hash deduplication algorithm to eliminate duplicate data. When time-aligning the collected data, data source time alignment is achieved based on a timestamp synchronization mechanism, and the deduplicated and time-aligned data is converted into standardized security data in a unified format through a standardized algorithm.

[0013] Preferably, real mimicry analysis extracts abnormal features from network traffic data, user behavior data, and system log data through a deep behavior matching algorithm, and the deviation value of the abnormal feature is calculated by the following formula:

[0014]

[0015] Where D represents the abnormal deviation value; X i represents the actual value of the i-th data point; M represents the reference value in the normal behavior template; n represents the number of data points.

[0016] Preferably, the active challenge mimicry analysis generates disturbance response data through a dynamic disturbance engine, wherein the disturbance response data includes simulated abnormal data packets, virtual vulnerability triggering operations, and disguised user operations.

[0017] Preferably, when the real abnormal feature data and the virtual disturbance response data are fused, the feature weight is dynamically adjusted by an adaptive fusion method, and the feature fusion weight calculation formula is as follows:

[0018]

[0019] Among them, W i represents the fusion weight of the i-th feature; T i represents the weight reference value of the i-th feature; n represents the number of features.

[0020] Preferably, the heterogeneous twin model includes state modeling, threat modeling and resource modeling, wherein state modeling generates node state mapping data through network node health parameters, threat modeling generates threat propagation path based on associated threat feature data, and resource modeling generates node resource adaptation state data based on resource load distribution.

[0021] Preferably, the state modeling data, threat modeling data and resource modeling data are fused and processed through a cross-layer association mapping model to generate risk assessment data, including risk level, impact scope and quantitative score.

[0022] Preferably, the risk quantification assessment performs quantitative analysis on the state modeling data, threat modeling data and resource modeling data through a risk quantification assessment algorithm to calculate the risk level, and the risk level R is determined by the following formula:

[0023] R=α·S+β·W+γ·L

[0024] Among them, R represents the risk level; S represents the risk score of state modeling data; W represents the risk score of threat modeling data; L represents the risk score of resource modeling data; α, β, and γ are the weight coefficients of risk assessment.

[0025] Preferably, the risk assessment results and execution feedback data are transmitted back to the heterogeneous twin model through a feedback control mechanism, and the network node status, threat propagation path and resource load distribution are dynamically updated to optimize the risk quantification assessment results.

[0026] A system for implementing the network operation and maintenance environment risk assessment method based on mimic security technology, comprising:

[0027] A data collection and preprocessing module is used to collect and preprocess data in the network operation and maintenance environment, deduplicate, time align and standardize the data, and generate standardized security data;

[0028] A mimicry analysis module, for respectively extracting real abnormality feature data and virtual disturbance response data through real mimicry analysis and active challenge mimicry analysis based on the standardized security data, and fusing the real abnormality feature data with the virtual disturbance response data to generate associated threat feature data;

[0029] A heterogeneous twin modeling module is used to construct a heterogeneous twin model based on the associated threat feature data, perform state modeling, threat modeling and resource modeling, and generate risk assessment data through data fusion and risk quantification assessment algorithm;

[0030] An optimal response strategy generation module, used to generate an optimal response strategy based on the risk assessment data through a multi-objective optimization algorithm, wherein the optimal response strategy includes flow control, node isolation and resource scheduling;

[0031] The strategy execution and feedback control module is used to execute the optimal response strategy, collect strategy execution feedback data, and transmit the feedback data back to the heterogeneous twin model through the feedback control mechanism to dynamically update the risk status.

[0032] Compared with the prior art, the advantages and beneficial effects of the present invention are:

[0033] The present invention realizes dynamic threat simulation and identification through the mimic security technology, can quickly extract abnormal feature data and virtual response data, and improve the comprehensiveness and accuracy of threat identification;

[0034] The present invention realizes the data fusion of state modeling, threat modeling and resource modeling through a cross-layer association mapping model, quantitatively evaluates the risk level, and provides accurate risk assessment results;

[0035] The present invention generates the optimal response strategy through a multi-objective optimization algorithm to achieve flow control, node isolation and resource scheduling, and realizes dynamic update and optimization of risk status through a feedback control mechanism;

[0036] The present invention improves the security and intelligence level of the network operation and maintenance environment through full-process dynamic evaluation, and effectively responds to complex security threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 It is a schematic diagram of the process of the present invention;

[0038] Figure 2 Schematic diagram of the feedback control mechanism in the present invention;

[0039] Figure 3 Generate a schematic diagram for the multi-objective optimization strategy of the present invention;

[0040] Figure 4 It is a schematic diagram of risk quantification assessment in the present invention;

[0041] Figure 5 It is a structural block diagram of the system of the present invention. DETAILED DESCRIPTION

[0042] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure.

[0043] like Figure 1 As shown, a network operation and maintenance environment risk assessment method based on mimic security technology includes the following steps:

[0044] Collect and pre-process data in the network operation and maintenance environment, and perform deduplication, time alignment and standardization on the collected data to generate standardized security data;

[0045] Preferably, the data in the network operation and maintenance environment includes network traffic data, user behavior data and system log data. When deduplicating the collected data, the data identification information is compared based on a hash deduplication algorithm to eliminate duplicate data. When time-aligning the collected data, data source time alignment is achieved based on a timestamp synchronization mechanism, and the deduplicated and time-aligned data is converted into standardized security data in a unified format through a standardized algorithm.

[0046] In the present invention, collecting and preprocessing data in the network operation and maintenance environment, and deduplicating, time-aligning and standardizing the collected data are the basic links for realizing risk assessment of the network operation and maintenance environment based on mimicry security technology, aiming to ensure the accuracy, consistency and standardization of the data.

[0047] The data in the network operation and maintenance environment includes network traffic data, user behavior data and system log data. These data are obtained through the distributed data acquisition module. The network traffic data is extracted in real time by the traffic capture tool, the data packet, traffic path and traffic intensity. The user behavior data is based on the user operation log to analyze the access behavior and operation mode. The system log data is extracted through the operation and maintenance system log. Fault information, error records and resource usage.

[0048] The collected data is first deduplicated. The uniqueness of the data identification information (such as data ID, timestamp or hash value of the content) is judged by the hash deduplication algorithm, and duplicate data is eliminated to avoid data redundancy from interfering with subsequent processing. Then, the collected data is time-aligned. The data from different sources are unified in the time dimension through the timestamp synchronization mechanism to solve the time offset problem existing in the process of collecting multiple data sources. This process specifically includes adding high-precision timestamps to the data and adjusting the time axis mapping in data preprocessing to ensure the time synchronization and alignment of the data. Finally, the deduplicated and time-aligned data is standardized by the standardization algorithm. The specific implementation is to convert the data from different sources into standardized security data in a unified format through numerical normalization or standardized transformation, thereby eliminating the differences in data scale, unit and numerical distribution, making the data comparable and consistent, and providing stable data input for subsequent risk assessment analysis. Through the above preprocessing process, the standardized security data obtained has high accuracy, consistency and integrity, which can effectively support the subsequent real mimicry analysis and active challenge mimicry analysis, and improve the reliability and execution efficiency of data application in risk assessment.

[0049] Based on the standardized security data, real abnormal feature data and virtual disturbance response data are respectively extracted through real mimicry analysis and active challenge mimicry analysis, and the real abnormal feature data and the virtual disturbance response data are fused to generate associated threat feature data;

[0050] Based on the standardized security data, the present invention extracts real abnormal feature data and virtual disturbance response data respectively through two key links: real mimicry analysis and active challenge mimicry analysis, and performs fusion processing on this basis to finally generate associated threat feature data, thereby providing accurate threat feature input for subsequent risk assessment.

[0051] Real mimicry analysis is to identify abnormal features in the data that deviate significantly from normal behavior through deep behavior matching and feature analysis of standardized security data in the network operation and maintenance environment. For example, by performing path analysis on network traffic data, access paths with abnormal traffic can be extracted; by comparing operation sequences with user behavior data, abnormal instruction sequences can be extracted; and by performing error record detection on system log data, frequently occurring fault logs can be identified. The extraction of these deviation features is based on the matching deviation between normal behavior templates and current observation data, ensuring that real abnormal feature data can accurately reflect abnormal situations in the actual operation and maintenance environment.

[0052] Active challenge mimicry analysis injects simulated anomaly and challenge data into the network operation and maintenance environment through a dynamic disturbance engine, including simulating abnormal network traffic, triggering virtual vulnerabilities, and simulating user operations, inducing potential risks and threat behaviors in the network system to appear, thereby obtaining virtual disturbance response data under simulated disturbance conditions. For example, specific data packet disturbances are introduced into network traffic data to observe changes in node traffic distribution, or virtual vulnerabilities are triggered in system resource data and system log responses are recorded, thereby obtaining the response characteristics of the system under abnormal disturbances.

[0053] The real abnormal feature data and the virtual disturbance response data extract threat features from the actual network environment and the simulated abnormal environment respectively. These two types of data are associated in the present invention through the method of multi-dimensional feature mapping and weight fusion. Specifically, the data dimensions of the real abnormal features and virtual response features are uniformly mapped, and highly correlated feature items are screened through the similarity matching algorithm. The feature fusion ratio is dynamically adjusted in combination with the adaptive weight allocation mechanism, so as to generate associated threat feature data.

[0054] On the one hand, the generation of correlated threat feature data can effectively aggregate abnormal behaviors in real environments and response characteristics under simulated challenges, thereby improving the ability to identify potential threats. On the other hand, by integrating threat features from multi-source data, a more comprehensive threat feature description can be constructed, reducing the limitations and misjudgment rate brought about by feature extraction from a single data source, and providing high-accuracy and high-confidence input data for subsequent heterogeneous twin model modeling, thereby enhancing the overall effect and accuracy of risk assessment in the network operation and maintenance environment.

[0055] Preferably, real mimicry analysis extracts abnormal features from network traffic data, user behavior data, and system log data through a deep behavior matching algorithm, and the deviation value of the abnormal feature is calculated by the following formula:

[0056]

[0057] Where D represents the abnormal deviation value; X i represents the actual value of the i-th data point; M represents the reference value in the normal behavior template; n represents the number of data points.

[0058] In the present invention, real mimicry analysis extracts abnormal features from network traffic data, user behavior data, and system log data through a deep behavior matching algorithm, which is an important step in realizing risk assessment of the network operation and maintenance environment. Its core lies in identifying abnormal features that deviate significantly from normal behavior patterns through deep comparison of behavior features, thereby revealing potential security threats in the network operation and maintenance environment. Specifically, network traffic data analyzes the data packet transmission path, traffic intensity, and access timing; user behavior data analyzes the user's operating instructions, login frequency, and access path; and system log data extracts fault information and error records from the log, and compares them with normal behavior templates to identify feature points that deviate from the normal state. During implementation, the deep behavior matching algorithm quantifies the degree of abnormality by calculating the deviation value between the observed data and the normal template data. The deviation value is calculated by the following formula:

[0059]

[0060] The principle of this formula is that by taking the difference between all observed data and normal template data item by item and taking the absolute value for accumulation, the overall deviation between the current data and the normal behavior pattern can be effectively quantified. When the deviation value D exceeds the preset threshold, it can be determined that the data has abnormal characteristics and further threat analysis is required. In practical applications, the deep behavior matching algorithm can perform a comprehensive feature comparison of network traffic, user behavior and system log data by constructing normal behavior templates in different scenarios. For example, when the access path in the network traffic data has multiple abnormal jumps from the normal template, the operation sequence in the user behavior data deviates from the normal access pattern, or a large number of continuous error records appear in the system log, the algorithm will capture these abnormal data points and confirm the significance of the abnormality through deviation value calculation.

[0061] The effect of extracting abnormal features through real mimicry analysis is that it can accurately identify potential security threats in the network operation and maintenance environment, especially abnormal behaviors hidden in normal data streams, and quantify these abnormal features to provide data support for subsequent threat modeling and risk assessment. In addition, through the calculation and quantification of deviation values, the interference of data noise on anomaly detection can be effectively eliminated, and the accuracy and robustness of abnormal feature extraction can be improved. Overall, the real mimicry analysis in the present invention realizes efficient identification and accurate quantification of potential risks in the network operation and maintenance environment through deep behavior matching algorithms and quantitative calculation of deviation values, providing a strong basic support for risk assessment based on mimicry security technology.

[0062] Preferably, the active challenge mimicry analysis generates disturbance response data through a dynamic disturbance engine, wherein the disturbance response data includes simulated abnormal data packets, virtual vulnerability triggering operations, and disguised user operations.

[0063] In the present invention, active challenge mimicry analysis is to inject disturbance factors into the network operation and maintenance environment through a dynamic disturbance engine to generate disturbance response data, thereby inducing the manifestation of potential security threats, and further identifying and extracting the response characteristics of the network system under abnormal challenge conditions. The core function of the dynamic disturbance engine is to actively trigger abnormal behavior or vulnerability responses in the network environment by constructing simulated abnormal scenarios to obtain the change characteristics of network traffic data, user behavior data, and system log data under specific disturbance conditions. Specifically, the disturbance response data includes three types of content: simulated abnormal data packets, virtual vulnerability triggering operations, and disguised user operations.

[0064] Simulating abnormal data packets is to send specially constructed data packets to the target network system through the dynamic perturbation engine. These data packets include abnormal traffic load, unexpected protocol traffic, and data content that does not meet normal communication standards. For example, a large number of disguised high-concurrency requests are introduced into the network traffic to simulate the DDoS attack scenario, and the response feature data of the abnormal traffic is extracted by observing the traffic response, data packet loss rate and delay changes of the network nodes. Secondly, the virtual vulnerability trigger operation is to simulate a specific vulnerability trigger mechanism in the network system or application through the dynamic perturbation engine, and induce the system to show abnormal state when responding to virtual threats. For example, by sending carefully constructed malicious inputs or simulating file read and write operations to the system, triggering phenomena such as abnormal occupation of system resources, log error records or process crashes, the vulnerability response characteristics in the system log data are captured. Finally, the disguised user operation is to simulate the access behavior and operation path of real users, introduce abnormal operation sequences or disguise identities for access, so as to verify the abnormal response of the system when dealing with unexpected user behavior. For example, by simulating multiple users logging in at the same time, submitting abnormal operation instructions or frequently switching access paths, the system is induced to record abnormal user behavior data, including the number of abnormal accesses, the frequency of operation path jumps and instruction error responses.

[0065] The principle of active challenge mimicry analysis is to actively apply external interference through a dynamic perturbation engine, so that potential threats hidden in normal data flows can be revealed, and their response characteristics in network traffic, system resources and user behavior can be captured. The implementation of this process combines dynamic data generation, real-time monitoring and feature extraction technology to ensure the efficiency and accuracy of perturbation generation and data capture. Compared with passive monitoring methods, the advantage of active challenge mimicry analysis is that it can trigger potential threats by actively introducing perturbations, discover hidden risks that are difficult to identify by traditional detection methods, and quickly verify the security status and protection capabilities of the system, especially when facing unknown threats or zero-day vulnerabilities. In addition, by simulating a variety of abnormal scenarios (such as DDoS attacks, vulnerability exploits and user abuse operations) and extracting corresponding response data, it provides high-quality input data for subsequent threat feature fusion and modeling, effectively improving the comprehensiveness and accuracy of risk assessment of the network operation and maintenance environment. Overall, active challenge mimicry analysis exposes potential risks in the network operation and maintenance system in a challenging environment through dynamic perturbations, providing key support for generating high-confidence threat response features.

[0066] Example 1: Simulating a DDoS attack scenario, in a network operation and maintenance environment, the dynamic perturbation engine constructs a simulated DDoS attack scenario by sending high concurrent request traffic to the target network system. These request packets include:

[0067] High-frequency repeated requests: simulate the behavior of legitimate users frequently accessing specific services;

[0068] Non-standard protocol data packets: Send abnormal data packets that do not conform to normal network protocols;

[0069] Large data packet transmission: simulates large-scale file upload or download operations, consuming network bandwidth.

[0070] During this process, the dynamic perturbation engine monitors the response status of network nodes in real time, including network traffic load, data packet loss rate, delay time and resource occupancy rate, so as to extract network abnormal response characteristics. For example, when the traffic exceeds the normal threshold, the node may experience increased response delay, data loss or excessive system resource load. These abnormal features will be captured and used as virtual perturbation response data, which will be further used for fusion analysis with real abnormal data. In this way, the system's protection capabilities in the face of high concurrent abnormal traffic can be effectively verified, and potential network bottlenecks and security vulnerabilities can be exposed.

[0071] Example 2: Virtual vulnerability triggering and system crash detection, the dynamic perturbation engine injects specific simulated vulnerability attack operations into the target operation and maintenance system or application to trigger a potential vulnerability response. For example:

[0072] Input validation vulnerability: Simulate common SQL injection attacks by submitting specific SQL injection statements to the database;

[0073] Buffer overflow vulnerability: Inputting a data packet exceeding the expected length into the system triggers a buffer overflow;

[0074] Illegal file access: Simulate users accessing unauthorized directories or files in the system, inducing the system to trigger abnormal warning logs.

[0075] When performing the above operations, the dynamic perturbation engine records the real-time response data of the system, including system log error records, CPU and memory usage anomalies, process crashes, and file access error information. For example, when a buffer overflow vulnerability is triggered, the system may record continuous error logs, the CPU usage rate rises rapidly, the service is interrupted, and an abnormal response is returned. These abnormal features will be extracted as virtual perturbation response data to verify the stability and security of the system in the vulnerability exploitation scenario and provide data support for vulnerability repair.

[0076] Example 3: Simulating abnormal user behavior detection. In the network operation and maintenance environment, the dynamic perturbation engine challenges and verifies the security of user behavior by simulating abnormal operations of disguised users, specifically including:

[0077] Frequent login failures: simulate a fake user repeatedly trying to log into the system, triggering account lockout or security warnings;

[0078] Abnormal path access: constructing abnormal operation path sequences, such as accessing hidden management backends or unauthorized pages;

[0079] High-frequency instruction execution: simulates the user continuously executing the same instruction or illegal instructions in a short period of time.

[0080] In this scenario, the dynamic perturbation engine captures system response data, including the number of login failures, operation path jump frequency, instruction execution error records, etc. Taking frequent login failures as an example, when an account enters an incorrect password multiple times in a row, the system will automatically trigger the security protection mechanism, generate abnormal access logs and record account status lock information. These data will be extracted as virtual perturbation response data for comparison and analysis with normal user operation behavior data, and then identify the characteristic patterns of abnormal user operations and improve the detection ability of disguised users.

[0081] Example 4: Multi-node resource occupancy abnormal simulation, the dynamic perturbation engine verifies the resource scheduling stability of the multi-node system by simulating resource contention operations. For example:

[0082] Initiate resource occupation requests to multiple nodes simultaneously, such as large file transfer or virtual resource allocation;

[0083] Simulate node failure or single node overload and observe the rescheduling process of resources in the system.

[0084] During the simulation, the dynamic perturbation engine records the real-time status data of node resources, including resource utilization, task allocation delay, faulty node recovery time, etc. For example, when a node fails in simulation, the system may reschedule resources to other nodes, but the overall task delay will increase. Through these resource status data, the system's recovery capability and load balancing effect in abnormal resource contention scenarios can be evaluated.

[0085] Preferably, when the real abnormal feature data and the virtual disturbance response data are fused, the feature weight is dynamically adjusted by an adaptive fusion method, and the feature fusion weight calculation formula is as follows:

[0086]

[0087] Among them, W i represents the fusion weight of the i-th feature; T i represents the weight reference value of the i-th feature; n represents the number of features.

[0088] In the present invention, fusing real abnormal feature data with virtual disturbance response data is an important step to achieve high-precision associated threat feature generation. The core is to dynamically adjust feature weights through adaptive fusion methods to ensure that threat features in different data sources are effectively fused and quantified. Specifically, real abnormal feature data are abnormal behavior features extracted from the actual network operation and maintenance environment through real mimicry analysis, including network traffic path deviations, user operation instruction anomalies, and system log error records; virtual disturbance response data are system response features induced under simulated challenge conditions through active challenge mimicry analysis, including abnormal traffic loads, resource utilization anomalies, and virtual vulnerability trigger features. These two types of data differ in source, characteristics, and importance. In order to more effectively express the overall impact of potential threat features, it is necessary to use adaptive fusion methods to assign weights and uniformly quantify different features.

[0089] The core principle of the adaptive fusion method is to dynamically adjust the fusion weight of each feature according to the weight reference value of the feature data. The feature fusion weight calculation formula is as follows:

[0090] In the specific implementation process, it is first necessary to unify the dimension mapping of the real abnormal feature data and the virtual disturbance response data to ensure the comparability of feature data from different sources in terms of dimension and scale. Then, the weight reference value T of each feature is adjusted by the adaptive fusion algorithm. iFor example, for abnormal path features in network traffic, the weight reference value can be determined according to the frequency of abnormal traffic or traffic deviation value; for virtual vulnerability trigger features in system log data, different weights can be assigned according to the severity level of the error log or the number of fault triggers. Finally, the fusion weight W of each feature is dynamically calculated through the above formula i The real abnormal features and the virtual disturbance response features are weighted and fused according to the weight ratio to generate the associated threat feature data.

[0091] Through the dynamic weight adjustment of the adaptive fusion method, the importance of feature data can be adaptively distributed, the ability to express key threat features can be enhanced, and the interference of secondary features on the overall analysis results can be reduced. For example, in a certain network environment, the traffic deviation in the real abnormal feature data is more significant, and the resource utilization anomaly in the virtual disturbance response data is also more prominent. The adaptive fusion method will dynamically assign a higher fusion weight based on the weight baseline value of these two types of features, thereby ensuring that the two types of key features occupy a dominant position in the final fusion result.

[0092] The effect of this fusion processing is that it can organically combine the abnormal features in the real environment with the disturbance response features under the simulated challenge to form more representative and comprehensive associated threat feature data, providing high-quality input for subsequent risk assessment and response strategy generation. Compared with the traditional simple feature weighting method, the adaptive fusion method of the present invention has stronger adaptability and accuracy by dynamically adjusting the feature weights. It can achieve real-time optimization of weights according to the importance of different features, and improve the expression ability and credibility of the fused data in threat identification and modeling. At the same time, through the quantitative calculation of feature weights, the system can more accurately capture the main feature sources of potential risks and significantly improve the accuracy and efficiency of risk assessment in the network operation and maintenance environment.

[0093] Based on the associated threat feature data, a heterogeneous twin model is constructed to perform state modeling, threat modeling, and resource modeling, and risk assessment data is generated through data fusion and risk quantification assessment algorithm;

[0094] Based on the associated threat feature data, the present invention realizes state modeling, threat modeling and resource modeling of the network operation and maintenance environment by constructing a heterogeneous twin model, and generates risk assessment data through data fusion and risk quantification assessment algorithm to comprehensively evaluate the current risk status and potential threat characteristics of the system. The core role of the heterogeneous twin model in the present invention is to reproduce the actual operating status of the network operation and maintenance environment through a modeling method that combines virtuality and reality, and establish a multi-dimensional feature representation of the network environment, thereby realizing a full range of modeling and analysis of the system status, threat propagation path and resource scheduling.

[0095] State modeling mainly generates node state mapping data by quantifying the health status of network nodes, traffic load conditions, and system resource utilization in real time. In the specific implementation process, the system dynamically monitors network traffic data and node performance parameters (such as response time, packet loss rate, and load rate), and uses historical normal state data as a benchmark to quantify the health of network nodes. For example, when the load rate of a node exceeds the set threshold or the packet loss rate increases significantly, the state modeling module marks the node as abnormal and generates state risk feature data.

[0096] Threat modeling is based on correlating threat feature data to analyze threat propagation paths and impact ranges in the network operation and maintenance environment. By correlating abnormal features (such as traffic deviation paths, abnormal user operations, and system fault logs), the system uses a graph structure modeling method to describe the threat propagation path, including the threat impact relationship between nodes and the calculation of propagation costs. For example, by calculating the length and cost of the risk propagation path from an abnormal node to other nodes, high-risk propagation links are identified, thereby determining the impact range and key nodes of the threat. This modeling method can clearly depict the propagation process of potential threats in the network and provide path-level threat quantification data for risk assessment.

[0097] Resource modeling mainly focuses on the distribution of system resources (including computing resources, storage resources, and network bandwidth) to quantify the load status and adaptability of resources. By monitoring resource utilization, task allocation status, and resource scheduling between nodes, resource adaptability feature data is generated. For example, when the resource utilization of a node reaches saturation, the resource modeling module will mark the resource risk of the node and analyze the potential impact of uneven resource allocation on network operation and maintenance, thereby providing basic data support for subsequent optimization scheduling.

[0098] After completing state modeling, threat modeling, and resource modeling, the system uses data fusion and risk quantification assessment algorithms to fuse and analyze the above modeling data and finally generate risk assessment data. Data fusion uses a cross-layer association mapping method to uniformly quantify state data, threat path data, and resource distribution data to ensure that data from different sources are comparable and consistent in risk assessment. The risk quantification assessment algorithm uses a multi-objective weighted calculation method to quantitatively assess the overall risk level of the system. For example, it performs weighted calculations on the node health in the state modeling results, the propagation path risk in the threat modeling results, and the resource load risk in the resource modeling results, and combines the weight coefficients to generate the final risk assessment data, which is used to measure the current risk status and potential safety hazards of the system.

[0099] By constructing a heterogeneous twin model, the present invention realizes virtual-real mapping and dynamic modeling of the network operation and maintenance environment, which can comprehensively capture the multi-dimensional characteristics of the system in abnormal state, threat propagation and resource scheduling, and generate high-precision risk assessment data. Compared with the traditional single-dimensional risk assessment method, the heterogeneous twin model has stronger expression ability and adaptability, can discover potential risks through multi-dimensional data fusion and dynamic modeling, and provide key decision-making basis for the subsequent generation of optimal response strategies, which greatly improves the accuracy, comprehensiveness and executability of risk assessment of the network operation and maintenance environment.

[0100] Preferably, the heterogeneous twin model includes state modeling, threat modeling and resource modeling, wherein state modeling generates node state mapping data through network node health parameters, threat modeling generates threat propagation path based on associated threat feature data, and resource modeling generates node resource adaptation state data based on resource load distribution.

[0101] In the present invention, the heterogeneous twin model realizes a comprehensive risk assessment of the network operation and maintenance environment through three core modules: state modeling, threat modeling, and resource modeling. The principle of the heterogeneous twin model is to dynamically model and map the state parameters, threat characteristics, and resource distribution in the real network environment by building a virtual image of the network operation and maintenance system, forming a multi-dimensional mapping and correlation analysis of the network operation and maintenance environment, and providing data support and decision-making basis for risk assessment and optimization. The following describes in detail the principles and applications of each modeling module from the perspective of specific implementation and effect, and explains its actual operation process in combination with the examples.

[0102] State modeling generates node state mapping data through network node health parameters. Its main function is to quantify the health status of network nodes in real time and identify abnormal conditions in node operation. Node health parameters include indicators such as network node load rate, packet loss rate, response time, and CPU occupancy. During implementation, the system will collect and analyze the real-time performance data of each network node, compare the collected node parameters with the health threshold, and generate the node health index. For example, if the node load rate continues to exceed 90% or the packet loss rate is significantly higher than the preset threshold, the node status is marked as "high risk". Through state modeling, the system generates node state mapping data, including the health, abnormal markings, and operation trends of each node, which is used to identify key risk nodes and provide basic data for subsequent threat modeling and resource modeling.

[0103] Threat modeling generates threat propagation paths based on associated threat feature data. The core of threat modeling is to analyze the propagation process and impact range of potential threats in the network. Threat modeling uses a graph structure modeling method to regard network nodes as vertices in the graph, and the communication relationship between nodes as edges in the graph. It combines associated threat feature data (such as abnormal traffic paths, user operation deviations, and system log fault records) to generate threat propagation paths. For example, after detecting an abnormal traffic deviation at a node, the system will analyze the communication path between the node and other nodes, calculate the cost and path length of threat propagation, identify other nodes that may be affected, and generate a threat propagation graph. In this process, the threat propagation path will be dynamically updated. For example, when the threat node switches the communication path, the system will adjust the threat propagation graph in real time to ensure the accuracy of risk analysis. The results of threat modeling include propagation paths, affected node lists, and propagation intensity data, which provide support for subsequent risk quantification assessment and optimal response strategy generation.

[0104] Resource modeling generates node resource adaptation status data based on resource load distribution. Its main function is to quantify the resource allocation and load status of each node in the network operation and maintenance system, and analyze the adaptability and risk of resource distribution. Resource modeling generates a resource load distribution diagram by real-time monitoring of the computing resources (CPU, memory usage), storage resources, and network bandwidth usage of each node. For example, if the CPU usage of a node is close to 100%, while the resource utilization of adjacent nodes is low, the resource modeling module will mark the current resource distribution as "unbalanced" and generate node resource adaptability data, including resource utilization, load balancing coefficient, and resource anomaly markers. These data are used to analyze the resource scheduling efficiency and adaptability of the system, identify potential resource bottlenecks and overload risks, and provide data support for resource scheduling optimization.

[0105] Embodiment: In a distributed network operation and maintenance environment, the system comprehensively analyzes the risk status of the network through state modeling, threat modeling and resource modeling. During the state modeling process, the system monitors the health parameters of nodes A, B, and C in real time, and detects that the load rate of node A reaches 95%, and the packet loss rate is 8%, which obviously exceeds the normal threshold, so node A is marked as a high-risk node. During the threat modeling process, the system further analyzes the communication path between node A and other nodes, and finds that node A sends abnormal traffic to node B, and node B has a response delay. The system calculates the length and cost of the threat propagation path from node A to node C through threat propagation path modeling, and determines that node C may also be affected. During the resource modeling process, the system analyzes the resource load distribution of nodes A, B, and C, and finds that the resource load of node A is too high, while the resource utilization of nodes B and C is low. The system marks the current resource distribution state as an unbalanced state and generates node resource adaptation state data.

[0106] Through state modeling, the high-risk state of node A is identified. Threat modeling dynamically generates the threat propagation path from node A to node C. Resource modeling analyzes the resource load problem of node A, and finally generates comprehensive risk assessment data for nodes A, B, and C, including node health status, threat propagation path, and resource load adaptability. These assessment data provide decision support for the subsequent generation of optimal response strategies, such as reducing the traffic pressure of node A through traffic regulation, or allocating tasks to nodes B and C through resource scheduling, thereby effectively reducing the overall risk of the system.

[0107] Preferably, the state modeling data, threat modeling data and resource modeling data are fused and processed through a cross-layer association mapping model to generate risk assessment data, including risk level, impact scope and quantitative score.

[0108] In the present invention, the integration of state modeling data, threat modeling data and resource modeling data through a cross-layer association mapping model is a key step in realizing risk assessment of the network operation and maintenance environment. The core of this modeling modeling modeling model is to conduct unified association analysis and quantitative assessment of modeling data from different dimensions, thereby generating risk assessment data including risk level, impact range and quantitative score. The design of the cross-layer association mapping model breaks through the limitations of single data source analysis, realizes the comprehensiveness and accuracy of risk assessment through multi-dimensional data fusion, and provides comprehensive risk situation awareness and decision support for the network operation and maintenance system.

[0109] In the specific implementation, the cross-layer association mapping model realizes the association processing of modeling data through data fusion and quantitative evaluation algorithm. First, the state modeling data provides the health status information of the network nodes, including the node load rate, response time, data packet loss rate and other parameters; the threat modeling data describes the threat propagation path and impact range, including abnormal nodes, propagation links and risk propagation intensity; the resource modeling data reflects the resource load and adaptability of each node, including resource utilization, task allocation and resource scheduling status. These three types of data are standardized in a unified data dimension in the cross-layer association mapping model to ensure the consistency of data from different data sources in scale and dimension.

[0110] The core principle of the cross-layer association mapping model is to achieve unified data analysis through cross-dimensional feature association and weight fusion. First, based on the association mapping mechanism, the system associates the abnormal node information in the state modeling data with the propagation path in the threat modeling data to determine the key role of the abnormal state node in the threat propagation link; at the same time, combined with the resource modeling data, the impact of the resource load of the abnormal node on the overall system stability is analyzed. For example, if a high-risk node (state modeling) is located on an important communication link (threat modeling) and the resources are close to saturation (resource modeling), the system will mark the node as a high-priority risk node. In this process, the cross-layer association mapping model dynamically assigns weights to the data of each dimension, adjusts the weight parameters according to the actual impact of the risk factors, and finally generates risk assessment data, including risk level, impact range and quantitative score.

[0111] The risk level is calculated through a quantitative assessment algorithm, taking into account multiple indicators such as node status, threat propagation intensity, and resource load adaptability. For example, the overall risk level score is determined by weighted calculation of the node health score, threat propagation path length, and resource load score, thereby dividing the system into risk levels (such as high risk, medium risk, and low risk). The scope of impact is determined by the threat propagation path modeling results, which describes the number of network nodes and propagation links that the risk may affect, ensuring that the system can intuitively identify the scope of risk propagation. The quantitative score is a numerical output of the risk level, providing a quantifiable risk metric to facilitate subsequent risk response and optimization regulation.

[0112] Embodiment, in a complex network operation and maintenance environment, the system first detects abnormal health parameters of nodes A, B and C through state modeling, the load rate of node A exceeds 95%, the response time of node B continues to increase, and the data packet loss rate of node C increases significantly; then, the threat modeling module analyzes and finds that there is an abnormal traffic propagation path between nodes A and B, and further determines that node B propagates abnormal traffic to node C, forming a threat propagation link; the resource modeling module also detects that the resource utilization rate of node A is close to saturation, while the resource scheduling of nodes B and C is in an unbalanced state. Through the cross-layer association mapping model, the system associates and analyzes the node state abnormality, threat propagation path and resource load distribution, dynamically adjusts the weight of each data dimension, and generates the following risk assessment data: node A is marked as a "high-risk node", and its impact range includes nodes B and C, and the propagation path weight accounts for 60% of the overall risk score; the risk level of the overall network operation and maintenance environment is assessed as "high risk", and the risk quantification score is 87 points (the risk score range is 0-100, and the higher the score, the greater the risk).

[0113] Through the above-mentioned embodiments, the cross-layer association mapping model plays a core role in multi-dimensional data fusion and association analysis, successfully identifies risk source nodes, propagation paths and resource load status, and quantifies the overall risk level and impact range. Compared with the traditional single-dimensional risk assessment method, the present invention realizes the dynamic association and quantitative assessment of three types of data: status, threat and resource through the cross-layer association mapping model, which has higher accuracy and comprehensiveness, and can provide intuitive and quantitative risk assessment results for the network operation and maintenance environment, supporting the formulation of subsequent risk response and optimization and control strategies.

[0114] like Figure 2 As shown, based on the risk assessment data, an optimal response strategy is generated through a multi-objective optimization algorithm. The optimal response strategy includes flow control, node isolation and resource scheduling. The optimal response strategy is executed, and strategy execution feedback data is collected. The feedback data is then transmitted back to the heterogeneous twin model through a feedback control mechanism for risk status update and optimization.

[0115] like Figure 3 As shown in the figure, the core of the multi-objective optimization algorithm is to weigh and solve multiple evaluation indicators to ensure that the generated response strategy achieves the optimal balance between different objectives. Specifically, the input data is the risk assessment results, including risk level, threat propagation path, node status and resource load. By analyzing these risk assessment data, the system identifies the key goals that need to be optimized, such as node load balancing, threat isolation priority and traffic control path. The multi-objective optimization algorithm calculates the optimal solution by establishing an objective function and combining constraints with network resource allocation rules.

[0116] Traffic control is to relieve the pressure of high-load nodes and prevent network congestion and performance degradation by adjusting the transmission path and traffic distribution of network data packets. The specific implementation methods include re-planning the traffic forwarding path based on the abnormal traffic path information in the risk assessment data, preferentially redirecting abnormal traffic to low-load nodes, or limiting the speed of non-critical data flows. For example, when a node is detected to have high-risk traffic, the system will dynamically modify the routing table and re-plan the traffic path to reduce the load pressure of the node.

[0117] Node isolation temporarily removes high-risk nodes from the network through physical or logical isolation to block the further spread of threats. Based on the risk assessment data of the threat propagation path, the system identifies the key nodes for threat propagation and adopts isolation strategies, such as blocking the external communication of the node through firewall rules, or logically separating the node from the main network through virtualization technology to ensure that it no longer affects other normal nodes. For example, when a node is detected to continuously propagate abnormal data packets, the system will generate a node isolation strategy to temporarily shut down the network interface of the node or transfer it to an isolated area for troubleshooting.

[0118] Resource scheduling aims to optimize the allocation of computing resources and storage resources between network nodes, solve the problem of resource load imbalance, and improve the overall operating efficiency of the system. Based on the resource load distribution in the resource modeling data, the system identifies nodes with overloaded resources and dynamically migrates some tasks to nodes with idle resources. For example, the system uses virtual machine migration technology to schedule some computing tasks of node A to nodes B and C with lower loads, thereby achieving resource load balancing and improving the adaptability and stability of the system.

[0119] After executing the optimal response strategy, the system dynamically evaluates the execution effect of the strategy by real-time monitoring of the feedback data of the strategy execution, and transmits the feedback data back to the heterogeneous twin model to update and optimize the risk status. The implementation of the feedback control mechanism includes real-time monitoring of traffic status, node isolation effect and resource load changes, such as detecting whether network congestion is relieved after traffic redirection, whether threat propagation is blocked after node isolation, and whether the system load is balanced after resource scheduling. These feedback data are passed back to the system as optimization parameters to further adjust the optimization strategy to form an adaptive risk dynamic response closed loop. For example, after executing the resource scheduling strategy, the system detects that the node load is still at a high level. The system will call back the optimization model, readjust the task migration path, and further balance resource allocation.

[0120] Example: In a network operation and maintenance environment, the system detects that node A is in a high-load state, and there is a threat of abnormal traffic spreading to nodes B and C. Based on the risk assessment data, the system generates the following optimal response strategy through a multi-objective optimization algorithm:

[0121] Traffic control: Replan the traffic path of node A and forward non-critical data flows to node D to reduce the load on node A.

[0122] Node isolation: temporarily isolate node A from the external network logic to block the further spread of abnormal traffic;

[0123] Resource scheduling: Dynamically migrate computing tasks on node A to nodes B and C with idle resources to achieve load balancing.

[0124] After the strategy is executed, the system monitors the traffic status and task load distribution of node A through the feedback control mechanism, and finds that the load rate of node A has dropped significantly, the propagation of abnormal traffic has stopped, and the overall load balance of the system after resource scheduling has increased by 15%. The feedback data is transmitted back to the heterogeneous twin model to update the risk status of node A, and further optimize and adjust the threat propagation path and resource allocation plan.

[0125] Preferably, Figure 4As shown, the risk quantification assessment performs quantitative analysis on the state modeling data, threat modeling data and resource modeling data through a risk quantification assessment algorithm to calculate the risk level. The risk level R is determined by the following formula:

[0126] R=α·S+β·W+γ·L

[0127] Among them, R represents the risk level; S represents the risk score of state modeling data; W represents the risk score of threat modeling data; L represents the risk score of resource modeling data; α, β, and γ are the weight coefficients of risk assessment.

[0128] The state modeling data S provides the risk score of the health status of the network nodes, including the comprehensive score of the node load rate, data packet loss rate, response time and other indicators, reflecting the operational health of the node; the threat modeling data W represents the risk score of the threat propagation path, quantifying the degree of propagation and impact of potential threats in the network, including indicators such as the number of threat nodes, propagation link length and propagation intensity; the resource modeling data L represents the risk score of the resource load distribution, measuring the utilization efficiency and imbalance of computing resources, storage resources and network bandwidth in the system. The risk quantification assessment algorithm combines these three types of risk scores through weighted fusion to obtain the overall risk level R.

[0129] The implementation of risk quantitative assessment first requires preprocessing of the data of state modeling, threat modeling and resource modeling, and normalizing the indicator values ​​of various types of data to a unified dimensional range. Usually, a linear normalization method is used to ensure that data from different sources are comparable in risk assessment. Then, the system performs a weighted calculation on the risk scores of the three types of data according to the risk weight coefficients α, β, and γ to obtain the overall risk level R of the system. For example, when S = 0.8 (the node health status is poor), W = 0.7 (the threat spreads widely) and L = 0.5 (the resource load is general), and the system sets the weight coefficients to α = 0.5, β = 0.3, and γ = 0.2, the formula can be used to calculate:

[0130] R=0.5·0.8+0.3·0.7+0.2·0.5=0.71

[0131] The system converts the risk level RRR into a visual risk level category, for example: R>0.8 is high risk, 0.5≤R≤0.8 is medium risk, and R<0.5 is low risk.

[0132] Example: In a complex network operation and maintenance environment, the system detects abnormal health status of nodes A, B and C through state modeling. The load rate of node A is as high as 95%, the data packet loss rate of node B is 7%, the response time of node C is 200ms, and the state risk score S = 0.8. The threat modeling module analyzes that node A propagates abnormal traffic to node B, forming a threat path with high propagation cost, and the threat risk score W = 0.75. The resource modeling module monitors that the resource utilization of node A is close to saturation, while the resource distribution of nodes B and C is uneven, and the resource risk score L = 0.6. The system combines the weight coefficients α = 0.4, β = 0.4, and γ = 0.2, and calculates the overall risk level through the risk quantification assessment algorithm:

[0133] R=0.4·0.8+0.4·0.75+0.2·0.6=0.74

[0134] Based on the calculation results, the system assesses the current network operation and maintenance environment as "medium risk", and further analyzes that node A is the main risk source, the threat propagation path from node A to node B has a high risk intensity, and the uneven distribution of resources is an important factor affecting the overall risk.

[0135] Through the risk quantification assessment algorithm, the present invention realizes the quantitative fusion analysis of state modeling, threat modeling and resource modeling data, can dynamically and accurately calculate the overall risk level of the system, clarify the main sources of risk and the scope of influence, and provide a quantitative basis for the risk assessment of the network operation and maintenance environment. Compared with the traditional risk assessment method, the present invention has higher accuracy and flexibility through multi-dimensional data fusion and dynamic weight adjustment, and can dynamically adjust the risk indicators according to the actual state of the system to ensure that the risk assessment results are highly matched with the actual system state. At the same time, through the quantification and visual classification of risk levels, the system can intuitively display the risk situation to the operation and maintenance personnel, provide decision support for the subsequent optimal response strategy generation, and significantly improve the security protection capabilities and risk management level of the network operation and maintenance environment.

[0136] Preferably, the risk assessment results and execution feedback data are transmitted back to the heterogeneous twin model through a feedback control mechanism, and the network node status, threat propagation path and resource load distribution are dynamically updated to optimize the risk quantification assessment results.

[0137] The core principle of the feedback control mechanism is to quantitatively evaluate the current system status and the effect of the execution strategy through real-time collection and analysis of execution feedback data, and to transmit the updated data back to the heterogeneous twin model to achieve dynamic iterative update of the model status. Specifically, after executing the optimal response strategy, the system monitors the changes in the network node status, threat propagation path and resource load distribution in real time, and generates execution feedback data by collecting node health parameters (such as load rate, response time, data packet loss rate), threat propagation links (such as propagation path length, propagation cost) and resource utilization status (such as CPU occupancy rate, storage utilization rate).

[0138] These feedback data are passed back to the heterogeneous twin model through the feedback control mechanism to dynamically update the three types of modeling of the network operation and maintenance environment:

[0139] Dynamic update of network node status: Based on the node health parameters in the feedback data, the operating status of each node is re-evaluated and the status modeling data is updated. For example, if the load rate of a node drops significantly after executing the traffic control strategy, the system will mark the node as "returned to normal" and update the node health status mapping data.

[0140] Dynamic update of threat propagation path: Dynamically adjust the threat propagation path by changing the threat propagation link in the feedback data. For example, after isolating a high-risk node, the system detects that the abnormal traffic path has been successfully blocked, and the threat propagation path will be recalculated and updated to ensure that the impact range of the current threat is accurately quantified.

[0141] Dynamic update of resource load distribution: Based on the resource utilization in the feedback data, the system updates the resource modeling data in real time to reflect the latest resource allocation status of each node. For example, if the task migration is successful after the resource scheduling strategy is executed and the node resource load tends to be balanced, the system will record the resource utilization change of the node and update the resource load distribution map.

[0142] Through the above dynamic updates, the system can recalculate the risk quantification assessment results, generate more accurate risk levels and impact ranges, and provide updated data support for the next round of optimization strategies.

[0143] Example: In a network operation and maintenance environment, the system implements the optimal response strategy based on the risk quantification assessment results: redirecting traffic to node A, implementing logical isolation on node B, and scheduling the task load of node C to node D. After executing the strategy, the system monitors the status of each node in real time through the feedback control mechanism and finds the following changes:

[0144] The load rate of node A dropped from 95% to 70%, and the packet loss rate returned to the normal range;

[0145] After node B is isolated, the system detects that the threat propagation path ends at node B, and the abnormal traffic stops propagating to other nodes;

[0146] The computing task of node C is successfully migrated to node D. The CPU usage of node C is reduced from 90% to 50%, and resource allocation tends to be balanced.

[0147] The system transmits the above execution feedback data back to the heterogeneous twin model to dynamically update the state modeling, threat modeling, and resource modeling:

[0148] In the state modeling data, the health status of node A is updated to "recovered to normal", node B is marked as "isolated state", and the resource utilization state of node C is re-marked as "load balanced";

[0149] In the threat modeling data, the original propagation path is adjusted to the terminated state, and the system records that the threat impact range has been reduced to the isolated node B;

[0150] In the resource modeling data, the resource load status of node C and node D is re-evaluated to form the latest resource allocation map.

[0151] Based on the updated modeling data, the system re-evaluated the risk quantification and calculated the new risk level through the risk quantification algorithm. Due to the effective implementation of traffic control, node isolation and resource scheduling, the overall risk level was reduced from the original "high risk" to "medium risk", and the risk score was reduced from 0.85 to 0.6.

[0152] like Figure 5 As shown, a system for implementing the network operation and maintenance environment risk assessment method based on mimic security technology includes:

[0153] The data collection and preprocessing module is used to collect and preprocess data in the network operation and maintenance environment, deduplicate, time align and standardize the data, and generate standardized security data; this module collects network traffic data, user behavior data and system log data in the network operation and maintenance environment, deduplicates, time aligns and standardizes the data, and generates standardized security data. Here, the hash deduplication algorithm is used to remove duplicate data, the timestamp synchronization mechanism realizes data time alignment, and the standardization algorithm unifies the data format to provide high-quality input for subsequent analysis.

[0154] The mimicry analysis module is used to extract real abnormal feature data and virtual disturbance response data respectively based on the standardized security data through real mimicry analysis and active challenge mimicry analysis, and fuse the real abnormal feature data and virtual disturbance response data to generate associated threat feature data; based on the standardized security data, the module extracts two types of data through real mimicry analysis and active challenge mimicry analysis: real abnormal feature data and virtual disturbance response data. Real mimicry analysis identifies abnormal features through a deep behavior matching algorithm, and active challenge mimicry analysis generates simulated abnormal data packets and virtual vulnerability trigger responses through a dynamic disturbance engine. The two types of data are fused to generate associated threat feature data, realizing multi-dimensional feature extraction and association analysis of threats.

[0155] The heterogeneous twin modeling module is used to build a heterogeneous twin model based on the associated threat feature data, perform state modeling, threat modeling and resource modeling, and generate risk assessment data through data fusion and risk quantification assessment algorithm; this module builds a heterogeneous twin model based on the associated threat feature data, and performs state modeling (network node health status), threat modeling (threat propagation path) and resource modeling (node ​​resource distribution). Through data fusion and risk quantification assessment algorithm, the module outputs risk assessment data, including risk level, impact range and quantitative score, to provide accurate risk assessment results for the system.

[0156] The optimal response strategy generation module is used to generate the optimal response strategy based on the risk assessment data through a multi-objective optimization algorithm, and the optimal response strategy includes flow control, node isolation and resource scheduling; the module is based on the risk assessment data, weighs the system performance goals through a multi-objective optimization algorithm, and generates the optimal response strategy including flow control, node isolation and resource scheduling to ensure network security recovery and stable operation.

[0157] The strategy execution and feedback control module is used to execute the optimal response strategy, collect strategy execution feedback data, and transmit the feedback data back to the heterogeneous twin model through the feedback control mechanism to dynamically update the risk status. After executing the optimal response strategy, the system collects strategy execution feedback data and transmits it back to the heterogeneous twin model through the feedback control mechanism to dynamically update the network node status, threat propagation path and resource load distribution, realize adaptive iterative optimization of the model, and improve the real-time and accuracy of risk assessment.

[0158] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A network operation and maintenance environment risk assessment method based on mimic security technology, characterized in that: The following steps are involved: Collect and pre-process data in the network operation and maintenance environment, and perform deduplication, time alignment and standardization on the collected data to generate standardized security data; Based on the standardized security data, real abnormal feature data and virtual disturbance response data are respectively extracted through real mimicry analysis and active challenge mimicry analysis, and the real abnormal feature data and the virtual disturbance response data are fused to generate associated threat feature data; Based on the associated threat feature data, a heterogeneous twin model is constructed to perform state modeling, threat modeling, and resource modeling, and risk assessment data is generated through data fusion and risk quantification assessment algorithm; Based on the risk assessment data, an optimal response strategy is generated through a multi-objective optimization algorithm. The optimal response strategy includes traffic control, node isolation and resource scheduling. The optimal response strategy is executed, and strategy execution feedback data is collected. The feedback data is then transmitted back to the heterogeneous twin model through a feedback control mechanism to update and optimize the risk status.

2. According to claim 1, the network operation and maintenance environment risk assessment method based on mimic security technology is characterized in that: The data in the network operation and maintenance environment includes network traffic data, user behavior data and system log data. When deduplicating the collected data, the data identification information is compared based on a hash deduplication algorithm to remove duplicate data; When the collected data is time-aligned, the data source time alignment is implemented based on the timestamp synchronization mechanism, and the deduplicated and time-aligned data is converted into standardized security data in a unified format through a standardized algorithm.

3. According to claim 1, the network operation and maintenance environment risk assessment method based on mimic security technology is characterized in that: Real mimicry analysis uses a deep behavior matching algorithm to extract abnormal features from network traffic data, user behavior data, and system log data. The deviation value of the abnormal feature is calculated using the following formula: Where D represents the abnormal deviation value; X i represents the actual value of the i-th data point; M represents the reference value in the normal behavior template; n represents the number of data points.

4. According to claim 1, the network operation and maintenance environment risk assessment method based on mimic security technology is characterized in that: Active challenge mimicry analysis generates perturbation response data through a dynamic perturbation engine, and the perturbation response data includes simulated abnormal data packets, virtual vulnerability triggering operations, and disguised user operations.

5. According to claim 1, the network operation and maintenance environment risk assessment method based on mimic security technology is characterized in that: When the real abnormal feature data and the virtual disturbance response data are fused, the feature weight is dynamically adjusted by the adaptive fusion method. The feature fusion weight calculation formula is as follows: Among them, W i represents the fusion weight of the i-th feature; T i represents the weight reference value of the i-th feature; n represents the number of features.

6. According to claim 1, the network operation and maintenance environment risk assessment method based on mimic security technology is characterized in that: The heterogeneous twin model includes state modeling, threat modeling and resource modeling, wherein state modeling generates node state mapping data through network node health parameters, threat modeling generates threat propagation path based on associated threat feature data, and resource modeling generates node resource adaptation state data based on resource load distribution.

7. The network operation and maintenance environment risk assessment method based on mimic security technology according to claim 6 is characterized in that: The state modeling data, threat modeling data and resource modeling data are fused and processed through a cross-layer association mapping model to generate risk assessment data, including risk level, impact scope and quantitative score.

8. The network operation and maintenance environment risk assessment method based on mimic security technology according to claim 1 is characterized in that: The risk quantification assessment performs quantitative analysis on the state modeling data, threat modeling data and resource modeling data through a risk quantification assessment algorithm to calculate the risk level. The risk level R is determined by the following formula: R=α·S+β·W+γ·L Among them, R represents the risk level; S represents the risk score of state modeling data; W represents the risk score of threat modeling data; L represents the risk score of resource modeling data; α, β, and γ are the weight coefficients of risk assessment.

9. The network operation and maintenance environment risk assessment method based on mimic security technology according to claim 8 is characterized in that: Through the feedback control mechanism, the risk assessment results and execution feedback data are transmitted back to the heterogeneous twin model, dynamically updating the network node status, threat propagation path and resource load distribution, and optimizing the risk quantification assessment results.

10. A system for implementing the network operation and maintenance environment risk assessment method based on mimic security technology as described in any one of claims 1 to 9, characterized in that: include: A data collection and preprocessing module is used to collect and preprocess data in the network operation and maintenance environment, deduplicate, time align and standardize the data, and generate standardized security data; A mimicry analysis module, for respectively extracting real abnormality feature data and virtual disturbance response data through real mimicry analysis and active challenge mimicry analysis based on the standardized security data, and fusing the real abnormality feature data with the virtual disturbance response data to generate associated threat feature data; A heterogeneous twin modeling module is used to construct a heterogeneous twin model based on the associated threat feature data, perform state modeling, threat modeling and resource modeling, and generate risk assessment data through data fusion and risk quantification assessment algorithm; An optimal response strategy generation module, used to generate an optimal response strategy based on the risk assessment data through a multi-objective optimization algorithm, wherein the optimal response strategy includes flow control, node isolation and resource scheduling; The strategy execution and feedback control module is used to execute the optimal response strategy, collect strategy execution feedback data, and transmit the feedback data back to the heterogeneous twin model through the feedback control mechanism to dynamically update the risk status.

Images