Network security information processing method and system

Abstract

The invention discloses a network security information processing method and system, relates to the technical field of network security, and realizes accurate calculation of frequency and duration of error code information and error stack information and comprehensive quantification of abnormal features of a system by forming a log feature vector L through integration. On the basis, high-precision identification of the abnormal state of the system is realized by substituting an established abnormal detection algorithm formula and calculating an abnormal detection score Ae, and the abnormal state is compared with a preset alarm triggering threshold value Ee, so that timely early warning notification can be triggered, and targeted safety protection measures are automatically activated. Meanwhile, by counting the anomaly detection score Ae in the fixed period and obtaining the comprehensive safety index Se of program and system operation, comprehensive evaluation of the network environment safety state is further achieved, and the adaptive capacity to the complex network environment and the real-time prevention and control capacity of safety risks are remarkably improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a network security information processing method and system. Background Art

[0002] Network security has always been a core issue in the field of information technology. With the popularization of the Internet and the advancement of digital transformation, the challenges of information security are increasing. Network security protection is not limited to basic protection measures such as firewalls and intrusion detection systems (IDS), but also involves multi-level security monitoring and protection of network traffic, data storage, and applications. Among these protection mechanisms, error log analysis, as an important means of security information processing, has gradually attracted people's attention.

[0003] In the current network security protection system, traditional defense methods often focus on identifying and blocking external attacks, such as using firewalls, IDS / IPS and other technologies to detect and prevent abnormal behavior in traffic. However, many network attacks, especially those targeting the application layer, often pose serious threats to the system by forging normal requests or bypassing traditional defense mechanisms through covert means. Specifically, error codes that appear in applications, especially high-frequency error code combinations, may represent initial signs of attack behavior. However, existing network security systems usually do not effectively associate and analyze error codes and stack information with other security events. As a result, in many cases, error codes do not attract enough attention, but are simply regarded as internal anomalies or failures of the system.

[0004] Existing monitoring tools focus on macro-level monitoring of network traffic, system resources, etc., while ignoring detailed information in error logs. For example, when attacks such as DDoS attacks or SQL injections occur, the combination patterns of error codes often show certain regularities, especially in the early stages of the attack, when these regularities have not yet aroused sufficient vigilance. Existing log analysis tools often rely on manually set rules and lack sufficient intelligence and automation, making it difficult to detect potential attack behaviors in real time. Summary of the invention

[0005] In view of the deficiencies in the prior art, the present invention provides a network security information processing method and system, which solves the problems mentioned in the background technology.

[0006] To achieve the above objectives, the present invention is implemented through the following technical solutions: A network security information processing method comprises the following steps:

[0007] S1, extracting log information from program logs and system logs, including error code information, error stack information, timestamp information and request information, and obtaining a log feature vector L through integration;

[0008] S2. Calculate the frequency and duration of the error code information and error stack information based on the acquired log feature vector L, and acquire the code error frequency DMp, code error duration DMs, error stack frequency DZp, and stack error duration DZs;

[0009] S3, by substituting the code error frequency DMp, the code error duration DMs, the error stack frequency DZp and the stack error duration DZs into the established anomaly detection algorithm formula to identify the abnormal state and obtain the anomaly detection score Ae;

[0010] S4, based on the obtained anomaly detection score Ae and the preset alarm trigger threshold Ee, obtain the early warning notification trigger result, and trigger the preset security protection measures according to the early warning notification trigger result;

[0011] S5. Obtain the comprehensive security index Se of program and system operation by counting the anomaly detection score Ae within a fixed period, evaluate the security status of the network environment in which the program and system operate, and adjust the security protection level of the program and system within a fixed period according to the security status results.

[0012] Preferably, said S1 includes S11 and S12;

[0013] S11, extracting fixed-period log information from program logs and system logs, including error code information, error stack information, timestamp information and request information, to obtain error status code CEc, error stack trace information FZt, extraction time TQt and request mode RFt tag information;

[0014] The error code information is obtained by extracting the error status field information in the program log and the system log, and marked as the error status code CEc to reflect the type of problem that occurs in the system and the program;

[0015] The error stack information is obtained by extracting the error stack field information in the program log and the system log, and marked as the error stack trace information FZt, which is used for fault analysis and fault tracing;

[0016] The timestamp information is obtained by extracting the time field information when the error code information and the error stack information appear, and is marked as the extraction time TQt;

[0017] The request information is obtained by extracting the request type field information and the IP address field information when the error code information and the error stack information appear, and is marked as the request mode RFt.

[0018] Preferably, S12, by standardizing, transcoding and natural language processing the extracted extraction time TQt, error status code CEc, error stack trace information FZt and request mode RFt tag information, obtaining time Tt, error code Ce, error stack vector Ft and request Rt, and obtaining log feature vector L through integration;

[0019] The standardization process is to obtain the time Tt by standardizing the extraction time TQt;

[0020] The encoding conversion performs encoding conversion on the error status code CEc and the request mode RFt to obtain the error code Ce and the request Rt;

[0021] Natural language processing obtains the error stack vector Ft by applying natural language processing to the error stack trace information FZt.

[0022] Preferably, the time Tt is obtained by the following calculation formula:

[0023]

[0024] In the formula, sin represents the sine function, cos represents the cosine function, π represents a constant, which is 3.14, and hour represents a time interval constant;

[0025] The error code Ce is obtained by the following encoding conversion formula:

[0026]

[0027] Wherein, M represents the total number of error status code lists preset by error status code CEc, m represents the mth error status, when error status code CEc satisfies any non-repeated error status code in {404, 500, 503, ...}, then is established and 1 is returned, otherwise else is established and 0 is returned, when all error status codes in the total number of error status code lists M are traversed, the total number of then being established is returned and assigned to error code Ce;

[0028] The request Rt is obtained by the following encoding conversion formula:

[0029]

[0030] Wherein, IPToInteger represents the IP conversion function. When request(RFt) matches the request method of GET, it returns 1, and when it matches the request methods related to POST and PUT, it returns 0. The specific request method that returns 1 is set by the user. The request Rt is composed by integrating the matching result of the request method RFt and the numerical form of the IP address of the request method RFt.

[0031] The error stack vector Ft is obtained by the following natural language processing method:

[0032] Ft = TF-IDF(FZt);

[0033] Wherein, TF-IDF represents the term frequency-inverse document frequency algorithm function, which is specifically used to find the preset error stack terms in the context of the error stack trace information FZt. It is specifically divided into TF term frequency, which is used to count the frequency of occurrence of the preset error stack terms, and IDF inverse document frequency, which is used to count the proportion of the frequency of occurrence of the preset error stack terms in the error stack trace information FZt, where the error stack terms are set by the user.

[0034] Preferably, said S2 includes S21;

[0035] S21, calculating the frequency and duration of the error code information and error stack information based on the acquired log feature vector L, and acquiring the code error frequency DMp, the code error duration DMs, the error stack frequency DZp, and the stack error duration DZs;

[0036] The code error frequency DMp is obtained by the following calculation formula:

[0037]

[0038] In the formula, n represents the total number of logs, i represents the i-th log data, β represents the exponential function, Ce(i) represents the error code in the i-th log data, Rt(i) represents the request in the i-th log data, and △Tt represents the time interval between the start time and the end time in the total number of logs n;

[0039] The code error duration DMs is obtained by the following calculation formula:

[0040]

[0041] Where, Tt(i, end) represents the end time of the i-th log data extraction code error, and Tt(i, start) represents the start time of the i-th log data extraction code error;

[0042] The error stack frequency DZp is obtained by the following calculation formula:

[0043]

[0044] Where Ft(i) represents the error stack vector in the i-th log data;

[0045] The stack error duration DZs is obtained by the following calculation formula:

[0046]

[0047] Preferably, said S3 includes S31;

[0048] S31, by substituting the code error frequency DMp, the code error duration DMs, the error stack frequency DZp and the stack error duration DZs into the established anomaly detection algorithm formula to identify the abnormal state, obtain the anomaly detection score Ae, and quantify and evaluate the impact of the error information and code in the current log information;

[0049] The anomaly detection score Ae is obtained by the following calculation formula:

[0050]

[0051] Wherein, a1, a2, a3 and a4 represent weight coefficients of the calculation results of the code error frequency DMp, the code error duration DMs, the error stack frequency DZp and the stack error duration DZs with the time interval △Tt, respectively. The specific values ​​are set by the user, and a1+a2+a3+a4=1.

[0052] Preferably, the S4 includes S41;

[0053] S41, comparing the obtained anomaly detection score Ae with the preset alarm trigger threshold Ee, obtaining an early warning notification trigger result, and triggering a preset safety protection measure according to the early warning notification trigger result;

[0054] The alarm notification triggering result is obtained by the following comparison method:

[0055] When the anomaly detection score Ae≥alarm trigger threshold Ee, the early warning notification trigger result is obtained as a trigger notification, and the preset security protection measures are triggered synchronously, including sending a real-time notification SMS to the security administrator, extracting the log feature vector L to fill it into the notification SMS, and marking the number of anomalies YCJL that occurred in the system on a natural day for +1 operation;

[0056] When the anomaly detection score Ae is less than the alarm trigger threshold Ee, the early warning notification trigger result is obtained as not triggering notification, and the anomaly number YCJL is -1 after the preset number of times of not triggering notification.

[0057] Among them, when the number of abnormalities YCJL ≥ 9 times, restrict non-whitelist IP access to the system, start additional identity authentication mechanisms, and isolate affected service instances;

[0058] When the number of exceptions YCJL ≥ 10 times, the system executes read-only mode, stops the database addition, modification and deletion functions, and only provides read functions.

[0059] Preferably, said S5 includes S51 and S52;

[0060] S51. Obtain the comprehensive safety index Se of program and system operation by counting the abnormal detection score Ae within a fixed period, and evaluate the safety status of the system within a fixed period after the preset safety protection measures are triggered and the execution effect of the preset safety protection measures;

[0061] The comprehensive safety index Se is obtained by the following calculation formula:

[0062]

[0063] Where Q represents the total number of times the anomaly detection score Ae is statistically calculated within a fixed period, and Ae(q) represents the anomaly detection score obtained by the qth statistical calculation.

[0064] Preferably, S52, evaluating the security status result of the network environment in which the program and system are running according to the obtained comprehensive security index Se, specifically by matching with the preset upper threshold Syz and lower threshold Xyz of the security status, and adjusting the security protection level of the program and system within a fixed period according to the security status result;

[0065] The security status result is obtained by the following matching method:

[0066] When the comprehensive security index Se ≥ the upper threshold Syz, the security status result is obtained as the first-level status, the system upstream and downstream traffic is restricted, mandatory user identity authentication is started, the system executes read-only mode, and the number of abnormal times YCJL is -1 and suspended for one natural day;

[0067] When the lower threshold value Xyz is less than the comprehensive safety index Se and less than the upper threshold value Syz, the safety status result is obtained as the second level status, the system opens the additional function, performs the -1 operation for the number of abnormal times YCJL, and cancels the -1 operation for the number of abnormal times YCJL and suspends the operation for one natural day;

[0068] When the comprehensive security index Se ≤ the lower threshold Xyz, the security status result is obtained as the third level status, the read-only mode executed by the system is exited, the full functions of the database are provided, and the mechanism of restricting non-whitelist IP access to the system is exited.

[0069] A network security information processing method and system, including a log extraction module, a log analysis module, a network security identification module, a security trigger module and an iterative optimization and decision module;

[0070] The log extraction module extracts log information from program logs and system logs, including error code information, error stack information, timestamp information and request information, and obtains a log feature vector L through integration;

[0071] The log analysis module calculates the frequency and duration of the error code information and error stack information based on the acquired log feature vector L, and acquires the code error frequency DMp, the code error duration DMs, the error stack frequency DZp and the stack error duration DZs;

[0072] The network security identification module identifies the abnormal state by substituting the code error frequency DMp, the code error duration DMs, the error stack frequency DZp and the stack error duration DZs into the established abnormal detection algorithm formula to obtain the abnormal detection score Ae;

[0073] The safety trigger module compares the obtained anomaly detection score Ae with the preset alarm trigger threshold Ee to obtain the early warning notification trigger result, and triggers the preset safety protection measures according to the early warning notification trigger result;

[0074] The iterative optimization and decision-making module obtains the comprehensive security index Se of program and system operation by statistically analyzing the anomaly detection score Ae within a fixed period, evaluates the security status results of the network environment in which the program and system run, and adjusts the security protection level of the program and system within a fixed period according to the security status results.

[0075] The present invention provides a network security information processing system, which has the following beneficial effects:

[0076] (1) By integrating the log feature vector L, the frequency and duration of error code information and error stack information are accurately calculated, and the abnormal characteristics of the system are fully quantified. On this basis, by substituting the established anomaly detection algorithm formula, the anomaly detection score Ae is calculated to achieve high-precision identification of the system abnormal state, and compared with the preset alarm trigger threshold Ee, so as to trigger timely warning notifications and automatically activate targeted security protection measures. This mechanism significantly improves the response speed and accuracy to abnormal behavior. At the same time, by statistically analyzing the anomaly detection score Ae within a fixed period, the comprehensive security index Se of program and system operation is obtained, further realizing a comprehensive assessment of the security status of the network environment, significantly improving the adaptability to complex network environments and the real-time prevention and control capabilities of security risks. This closed-loop design with full process automation from "identification-warning-protection-optimization" can more effectively reduce the security risks of the system and meet the requirements of safe operation in a high-intensity network environment.

[0077] (2) Through the calculation based on the log feature vector LLL, the code error frequency DMp, code error duration DMs, error stack frequency DZp and stack error duration DZs can be obtained, and these key parameters are substituted into the established anomaly detection algorithm formula to calculate the anomaly detection score Ae, realizing the quantitative analysis and accurate evaluation of the error information and stack information in the log data. This method fully reflects the influence of the error frequency and duration on the system stability by performing multi-dimensional calculations on parameters such as error code Ce, request Rt and error stack vector Ft, combined with the adjustment of time interval △Tt and weight coefficient, and dynamically captures the occurrence law of error events in log data. Through accurate frequency and duration calculation, the scientificity and reliability of the anomaly detection score Ae are enhanced, providing efficient support for system error analysis and problem location.

[0078] (3) By comparing the anomaly detection score Ae with the alarm trigger threshold Ee, not only can the real-time warning notification trigger result be obtained, but also the security protection measures of the system can be adjusted dynamically. In particular, by accumulating or subtracting the number of anomalies YCJL, the number of abnormal behaviors in the system within a natural day is accurately recorded, thereby triggering a hierarchical security protection strategy. At the same time, by counting the anomaly detection score Ae within a fixed period, the comprehensive security index Se is calculated, and the effect of the security protection measures is dynamically evaluated. The system security status result is further obtained by combining the matching of the comprehensive security index Se with the upper threshold Syz and the lower threshold Xyz. The security protection level of the program and the system is adjusted according to the result, which can respond to the current abnormal behavior in real time. It can also achieve dynamic optimization of the system protection strategy through hierarchical matching of security status results. Compared with the existing methods, this method establishes a closed-loop protection system of "real-time response-periodic evaluation-dynamic optimization" through the accumulation strategy of the number of anomalies YCJL and the periodic evaluation of the comprehensive security index Se, which greatly improves the system's security operation capability and strategy adaptability in a complex network environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0079] Figure 1 A schematic diagram of the steps of a network security information processing method of the present invention;

[0080] Figure 2 The present invention is a schematic diagram of a network security information processing system block diagram. DETAILED DESCRIPTION

[0081] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0082] Example 1

[0083] The present invention provides a network security information processing method, please refer to Figure 1 , including the following steps:

[0084] S1, extracting log information from program logs and system logs, including error code information, error stack information, timestamp information and request information, and obtaining a log feature vector L through integration;

[0085] S2. Calculate the frequency and duration of the error code information and error stack information based on the acquired log feature vector L, and acquire the code error frequency DMp, code error duration DMs, error stack frequency DZp, and stack error duration DZs;

[0086] S3, by substituting the code error frequency DMp, the code error duration DMs, the error stack frequency DZp and the stack error duration DZs into the established anomaly detection algorithm formula to identify the abnormal state and obtain the anomaly detection score Ae;

[0087] S4, based on the obtained anomaly detection score Ae and the preset alarm trigger threshold Ee, obtain the early warning notification trigger result, and trigger the preset security protection measures according to the early warning notification trigger result;

[0088] S5. Obtain the comprehensive security index Se of program and system operation by counting the anomaly detection score Ae within a fixed period, evaluate the security status of the network environment in which the program and system operate, and adjust the security protection level of the program and system within a fixed period according to the security status results.

[0089] In this embodiment, by integrating and forming the log feature vector L, the frequency and duration of the error code information and the error stack information are accurately calculated, and the abnormal characteristics of the system are fully quantified. On this basis, by substituting the established abnormal detection algorithm formula, the abnormal detection score Ae is calculated to achieve high-precision identification of the abnormal state of the system, and compared with the preset alarm trigger threshold Ee, so as to trigger timely early warning notifications, and then automatically activate targeted security protection measures. This mechanism significantly improves the response speed and accuracy to abnormal behavior. At the same time, by statistically analyzing the abnormal detection score Ae within a fixed period, the comprehensive security index Se of the program and system operation is obtained, and the comprehensive evaluation of the security status of the network environment is further realized, which significantly improves the adaptability to complex network environments and the real-time prevention and control capabilities of security risks. This closed-loop design of full-process automation from "identification-early warning-protection-optimization" can more effectively reduce the security risks of the system and meet the requirements of safe operation in a high-intensity network environment.

[0090] Example 2

[0091] This embodiment is explained in Example 1, please refer to Figure 1 , specifically: the S1 includes S11 and S12;

[0092] S11, extracting fixed-period log information from program logs and system logs, including error code information, error stack information, timestamp information and request information, to obtain error status code CEc, error stack trace information FZt, extraction time TQt and request mode RFt tag information;

[0093] The error code information is obtained by extracting the error status field information in the program log and the system log, and marked as the error status code CEc to reflect the type of problem that occurs in the system and the program;

[0094] The error stack information is obtained by extracting the error stack field information in the program log and the system log, and marked as the error stack trace information FZt, which is used for fault analysis and fault tracing;

[0095] The timestamp information is obtained by extracting the time field information when the error code information and the error stack information appear, and is marked as the extraction time TQt;

[0096] The request information is obtained by extracting the request type field information and the IP address field information when the error code information and the error stack information appear, and is marked as the request mode RFt.

[0097] S12, by standardizing, transcoding and natural language processing the extracted extraction time TQt, error status code CEc, error stack trace information FZt and request mode RFt tag information, obtain the time Tt, error code Ce, error stack vector Ft and request Rt, and obtain the log feature vector L through integration;

[0098] The standardization process is to obtain the time Tt by standardizing the extraction time TQt;

[0099] The encoding conversion performs encoding conversion on the error status code CEc and the request mode RFt to obtain the error code Ce and the request Rt;

[0100] Natural language processing obtains the error stack vector Ft by applying natural language processing to the error stack trace information FZt.

[0101] The time Tt is obtained by the following calculation formula standardization formula:

[0102]

[0103] In the formula, sin represents the sine function, cos represents the cosine function, π represents a constant, which is 3.14, and hour represents a time interval constant;

[0104] The error code Ce is obtained by the following encoding conversion formula:

[0105]

[0106] Wherein, M represents the total number of error status code lists preset by error status code CEc, m represents the mth error status, when error status code CEc satisfies any non-repeated error status code in {404, 500, 503, ...}, then is established and 1 is returned, otherwise else is established and 0 is returned, when all error status codes in the total number of error status code lists M are traversed, the total number of then being established is returned and assigned to error code Ce;

[0107] The request Rt is obtained by the following encoding conversion formula:

[0108]

[0109] Wherein, IPToInteger represents an IP conversion function, which is specifically used to convert an IP address into a numerical form. When request(RFt) matches the request method of GET, it returns 1, and returns 0 when it matches the request methods related to POST and PUT. The specific request method that returns 1 is set by the user. The request Rt is composed by integrating the matching result of the request method RFt and the numerical form of the IP address of the request method RFt.

[0110] The error stack vector Ft is obtained by the following natural language processing method:

[0111] Ft = TF-IDF(FZt);

[0112] Wherein, TF-IDF represents the term frequency-inverse document frequency algorithm function, which is specifically used to find the preset error stack terms in the context of the error stack trace information FZt. It is specifically divided into TF term frequency, which is used to count the frequency of occurrence of the preset error stack terms, and IDF inverse document frequency, which is used to count the proportion of the frequency of occurrence of the preset error stack terms in the error stack trace information FZt, where the error stack terms are set by the user.

[0113] In this embodiment, the error status code CEc, error stack trace information FZt, extraction time TQt and request method RFt in a fixed period in the program log and system log are fully extracted and processed, and the log feature vector L is finally generated through standardization, encoding conversion and natural language processing technology. This process realizes the efficient conversion of log information from raw data to structured data, so that parameters such as time Tt, error code Ce, error stack vector Ft and request Rt can be quantified and expressed, and become a reliable basis for subsequent analysis and anomaly detection, which can significantly reduce the parsing error caused by the diversity of log formats and is suitable for multi-dimensional dynamic network security detection scenarios.

[0114] Example 3

[0115] This embodiment is explained in Example 2. Please refer to Figure 1 , specifically: the S2 includes S21;

[0116] S21, calculating the frequency and duration of the error code information and error stack information based on the acquired log feature vector L, and acquiring the code error frequency DMp, the code error duration DMs, the error stack frequency DZp, and the stack error duration DZs;

[0117] The code error frequency DMp is obtained by the following calculation formula:

[0118]

[0119] In the formula, n represents the total number of logs, specifically the total number of log data analyzed, i represents the i-th log data, β represents the exponential function, which is specifically used to determine whether the error code Ce(i) is consistent with the error code that the user cares about. If yes, it returns 1, otherwise it returns 0, Ce(i) represents the error code in the i-th log data, Rt(i) represents the request in the i-th log data, △Tt represents the time interval between the start time and the end time in the total number of logs n, which is specifically obtained by the difference between the time Tt of the first log and the time Tt of the last log in the total number of logs n;

[0120] The code error duration DMs is obtained by the following calculation formula:

[0121]

[0122] Where, Tt(i, end) represents the end time of the i-th log data extraction code error, and Tt(i, start) represents the start time of the i-th log data extraction code error;

[0123] The error stack frequency DZp is obtained by the following calculation formula:

[0124]

[0125] Where Ft(i) represents the error stack vector in the i-th log data;

[0126] The stack error duration DZs is obtained by the following calculation formula:

[0127]

[0128] The S3 includes S31;

[0129] S31, by substituting the code error frequency DMp, the code error duration DMs, the error stack frequency DZp and the stack error duration DZs into the established anomaly detection algorithm formula to identify the abnormal state, obtain the anomaly detection score Ae, and quantify and evaluate the impact of the error information and code in the current log information;

[0130] The anomaly detection score Ae is obtained by the following calculation formula:

[0131]

[0132] Wherein, a1, a2, a3 and a4 represent weight coefficients of the calculation results of the code error frequency DMp, the code error duration DMs, the error stack frequency DZp and the stack error duration DZs with the time interval △Tt, respectively. The specific values ​​are set by the user, and a1+a2+a3+a4=1.

[0133] In this embodiment, the code error frequency DMp, code error duration DMs, error stack frequency DZp and stack error duration DZs can be obtained through calculation based on the log feature vector LLL, and these key parameters are substituted into the established anomaly detection algorithm formula to calculate the anomaly detection score Ae, thereby realizing quantitative analysis and accurate evaluation of error information and stack information in the log data. This method fully reflects the influence of error frequency and duration on system stability by performing multi-dimensional calculations on parameters such as error code Ce, request Rt and error stack vector Ft, combined with the adjustment of time interval △Tt and weight coefficient, and dynamically captures the occurrence law of error events in log data. Through accurate frequency and duration calculations, the scientificity and reliability of the anomaly detection score Ae are enhanced, providing efficient support for system error analysis and problem location.

[0134] Example 4

[0135] This embodiment is explained in Example 3, please refer to Figure 1 Specifically: S4 includes S41;

[0136] S41, comparing the obtained anomaly detection score Ae with the preset alarm trigger threshold Ee, obtaining an early warning notification trigger result, and triggering a preset safety protection measure according to the early warning notification trigger result;

[0137] The alarm notification triggering result is obtained by the following comparison method:

[0138] When the anomaly detection score Ae≥alarm trigger threshold Ee, the early warning notification trigger result is obtained as a trigger notification, and the preset security protection measures are triggered synchronously, including sending a real-time notification SMS to the security administrator, extracting the log feature vector L to fill it into the notification SMS, and marking the number of anomalies YCJL that occurred in the system on a natural day for +1 operation;

[0139] When the anomaly detection score Ae is less than the alarm trigger threshold Ee, the early warning notification trigger result is obtained as not triggering notification, and the anomaly number YCJL is -1 after the preset number of times of not triggering notification.

[0140] Among them, when the number of abnormalities YCJL ≥ 9 times, restrict non-whitelist IP access to the system, start additional identity authentication mechanisms, and isolate affected service instances;

[0141] When the number of exceptions YCJL ≥ 10 times, the system executes read-only mode, stops the database addition, modification and deletion functions, and only provides read functions.

[0142] The S5 includes S51 and S52;

[0143] S51. Obtain the comprehensive safety index Se of program and system operation by counting the abnormal detection score Ae within a fixed period, and evaluate the safety status of the system within a fixed period after the preset safety protection measures are triggered and the execution effect of the preset safety protection measures;

[0144] The comprehensive safety index Se is obtained by the following calculation formula:

[0145]

[0146] Where Q represents the total number of times the anomaly detection score Ae is statistically calculated within a fixed period, and Ae(q) represents the anomaly detection score obtained by the qth statistical calculation.

[0147] S52, evaluating the security status result of the network environment in which the program and system are running according to the obtained comprehensive security index Se, specifically by matching with the preset upper threshold Syz and lower threshold Xyz of the security status, and adjusting the security protection level of the program and system within a fixed period according to the security status result;

[0148] The security status result is obtained by the following matching method:

[0149] When the comprehensive security index Se ≥ the upper threshold Syz, the security status result is obtained as the first-level status, the system upstream and downstream traffic is restricted, mandatory user identity authentication is started, the system executes read-only mode, and the number of abnormal times YCJL is -1 and suspended for one natural day;

[0150] When the lower threshold value Xyz is less than the comprehensive safety index Se and less than the upper threshold value Syz, the safety status result is obtained as the second level status, the system opens the additional function, performs the -1 operation for the number of abnormal times YCJL, and cancels the -1 operation for the number of abnormal times YCJL and suspends the operation for one natural day;

[0151] When the comprehensive security index Se ≤ the lower threshold Xyz, the security status result is obtained as the third level status, the read-only mode executed by the system is exited, the full functions of the database are provided, and the mechanism of restricting non-whitelist IP access to the system is exited.

[0152] In this example, by comparing the anomaly detection score Ae with the alarm trigger threshold Ee, not only can the real-time warning notification trigger result be obtained, but also the security protection measures of the system can be adjusted dynamically. In particular, by accumulating or subtracting the number of anomalies YCJL, the number of abnormal behaviors in the system within a natural day is accurately recorded, thereby triggering a hierarchical security protection strategy. For example, when the number of anomalies YCJL reaches the preset value, the system will gradually upgrade to high-intensity protection measures such as restricting non-whitelist IP access, starting additional identity authentication mechanisms, isolating affected service instances, and even entering read-only mode. At the same time, by counting the anomaly detection score Ae within a fixed period, calculating the comprehensive security index Se, dynamically evaluating the effect of security protection measures, and further combining the comprehensive security index Se with the upper threshold Syz and the lower threshold Xyz to obtain the system security status results, and adjust the security protection level of the program and system according to the results, so as to respond to the current abnormal behavior in real time, and realize the dynamic optimization of the system protection strategy through hierarchical matching of security status results. For example, the comprehensive security index Se is used to judge whether the system executes read-only mode in the first level state or restores all functions in the third level state, ensuring the dynamic balance between system security and availability. Compared with the existing methods, this method establishes a closed-loop protection system of "real-time response-periodic evaluation-dynamic optimization" through the accumulation strategy of the number of anomalies YCJL and the periodic evaluation of the comprehensive security index Se, which greatly improves the system's safe operation capability and strategy adaptability in complex network environments.

[0153] Example 5

[0154] A network security information processing system, please refer to Figure 2 ,Specifically: including log extraction module, log analysis module, network security identification module, security trigger module and iterative optimization and decision module;

[0155] The log extraction module extracts log information from program logs and system logs, including error code information, error stack information, timestamp information and request information, and obtains a log feature vector L through integration;

[0156] The log analysis module calculates the frequency and duration of the error code information and error stack information based on the acquired log feature vector L, and acquires the code error frequency DMp, the code error duration DMs, the error stack frequency DZp and the stack error duration DZs;

[0157] The network security identification module identifies the abnormal state by substituting the code error frequency DMp, the code error duration DMs, the error stack frequency DZp and the stack error duration DZs into the established abnormal detection algorithm formula to obtain the abnormal detection score Ae;

[0158] The safety trigger module compares the obtained anomaly detection score Ae with the preset alarm trigger threshold Ee to obtain the early warning notification trigger result, and triggers the preset safety protection measures according to the early warning notification trigger result;

[0159] The iterative optimization and decision-making module obtains the comprehensive security index Se of program and system operation by statistically analyzing the anomaly detection score Ae within a fixed period, evaluates the security status results of the network environment in which the program and system run, and adjusts the security protection level of the program and system within a fixed period according to the security status results.

[0160] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A network security information processing method, characterized in that: The following steps are involved: S1, extracting log information from program logs and system logs, including error code information, error stack information, timestamp information and request information, and obtaining a log feature vector L through integration; S2. Calculate the frequency and duration of the error code information and error stack information based on the acquired log feature vector L, and acquire the code error frequency DMp, code error duration DMs, error stack frequency DZp, and stack error duration DZs; S3, by substituting the code error frequency DMp, the code error duration DMs, the error stack frequency DZp and the stack error duration DZs into the established anomaly detection algorithm formula to identify the abnormal state and obtain the anomaly detection score Ae; S4, based on the obtained anomaly detection score Ae and the preset alarm trigger threshold Ee, obtain the early warning notification trigger result, and trigger the preset security protection measures according to the early warning notification trigger result; S5. Obtain the comprehensive security index Se of program and system operation by counting the anomaly detection score Ae within a fixed period, evaluate the security status of the network environment in which the program and system operate, and adjust the security protection level of the program and system within a fixed period according to the security status results.

2. A network security information processing method according to claim 1, characterized in that: Said S1 includes S11 and S12; S11, extracting fixed-period log information from program logs and system logs, including error code information, error stack information, timestamp information and request information, to obtain error status code CEc, error stack trace information FZt, extraction time TQt and request mode RFt tag information; The error code information is obtained by extracting the error status field information in the program log and the system log, and marked as the error status code CEc to reflect the type of problem that occurs in the system and the program; The error stack information is obtained by extracting the error stack field information in the program log and the system log, and marked as the error stack trace information FZt, which is used for fault analysis and fault tracing; The timestamp information is obtained by extracting the time field information when the error code information and the error stack information appear, and is marked as the extraction time TQt; The request information is obtained by extracting the request type field information and the IP address field information when the error code information and the error stack information appear, and is marked as the request mode RFt.

3. A network security information processing method according to claim 2, characterized in that: S12, by standardizing, transcoding and natural language processing the extracted extraction time TQt, error status code CEc, error stack trace information FZt and request mode RFt tag information, obtain the time Tt, error code Ce, error stack vector Ft and request Rt, and obtain the log feature vector L through integration; The standardization process is to obtain the time Tt by standardizing the extraction time TQt; The encoding conversion performs encoding conversion on the error status code CEc and the request mode RFt to obtain the error code Ce and the request Rt; Natural language processing obtains the error stack vector Ft by applying natural language processing to the error stack trace information FZt.

4. A network security information processing method according to claim 3, characterized in that: The time Tt is obtained by the following calculation formula standardization formula: In the formula, sin represents the sine function, cos represents the cosine function, π represents a constant, which is 3.14, and hour represents a time interval constant; The error code Ce is obtained by the following encoding conversion formula: Wherein, M represents the total number of error status code lists preset by error status code CEc, m represents the mth error status, when error status code CEc satisfies any non-repeated error status code in {404, 500, 503, ...}, then is established and 1 is returned, otherwise else is established and 0 is returned, when all error status codes in the total number of error status code lists M are traversed, the total number of then being established is returned and assigned to error code Ce; The request Rt is obtained by the following encoding conversion formula: Wherein, IPToInteger represents the IP conversion function. When request(RFt) matches the request method of GET, it returns 1, and when it matches the request methods related to POST and PUT, it returns 0. The specific request method that returns 1 is set by the user. The request Rt is composed by integrating the matching result of the request method RFt and the numerical form of the IP address of the request method RFt. The error stack vector Ft is obtained by the following natural language processing method: Ft = TF-IDF(FZt); Wherein, TF-IDF represents the term frequency-inverse document frequency algorithm function, which is specifically used to find the preset error stack terms in the context of the error stack trace information FZt. It is specifically divided into TF term frequency, which is used to count the frequency of occurrence of the preset error stack terms, and IDF inverse document frequency, which is used to count the proportion of the frequency of occurrence of the preset error stack terms in the error stack trace information FZt, where the error stack terms are set by the user.

5. A network security information processing method according to claim 3, characterized in that: Said S2 includes S21; S21, calculating the frequency and duration of the error code information and error stack information based on the acquired log feature vector L, and acquiring the code error frequency DMp, the code error duration DMs, the error stack frequency DZp, and the stack error duration DZs; The code error frequency DMp is obtained by the following calculation formula: In the formula, n represents the total number of logs, i represents the i-th log data, β represents the exponential function, Ce(i) represents the error code in the i-th log data, Rt(i) represents the request in the i-th log data, and △Tt represents the time interval between the start time and the end time in the total number of logs n; The code error duration DMs is obtained by the following calculation formula: Where, Tt(i, end) represents the end time of the i-th log data extraction code error, and Tt(i, start) represents the start time of the i-th log data extraction code error; The error stack frequency DZp is obtained by the following calculation formula: Where Ft(i) represents the error stack vector in the i-th log data; The stack error duration DZs is obtained by the following calculation formula:

6. A network security information processing method according to claim 5, characterized in that: The S3 includes S31; S31, by substituting the code error frequency DMp, the code error duration DMs, the error stack frequency DZp and the stack error duration DZs into the established anomaly detection algorithm formula to identify the abnormal state, obtain the anomaly detection score Ae, and quantify and evaluate the impact of the error information and code in the current log information; The anomaly detection score Ae is obtained by the following calculation formula: Wherein, a1, a2, a3 and a4 represent weight coefficients of the calculation results of the code error frequency DMp, the code error duration DMs, the error stack frequency DZp and the stack error duration DZs with the time interval △Tt, respectively. The specific values ​​are set by the user, and a1+a2+a3+a4=1.

7. A network security information processing method according to claim 3, characterized in that: The S4 includes S41; S41, comparing the obtained anomaly detection score Ae with the preset alarm trigger threshold Ee, obtaining an early warning notification trigger result, and triggering a preset safety protection measure according to the early warning notification trigger result; The alarm notification triggering result is obtained by the following comparison method: When the anomaly detection score Ae≥alarm trigger threshold Ee, the early warning notification trigger result is obtained as a trigger notification, and the preset security protection measures are triggered synchronously, including sending a real-time notification SMS to the security administrator, extracting the log feature vector L to fill it into the notification SMS, and marking the number of anomalies YCJL that occurred in the system on a natural day for +1 operation; When the anomaly detection score Ae is less than the alarm trigger threshold Ee, the early warning notification trigger result is obtained as not triggering notification, and the anomaly number YCJL is -1 after the preset number of times of not triggering notification. Among them, when the number of abnormalities YCJL ≥ 9 times, restrict non-whitelist IP access to the system, start additional identity authentication mechanisms, and isolate affected service instances; When the number of exceptions YCJL ≥ 10 times, the system executes read-only mode, stops the database addition, modification and deletion functions, and only provides read functions.

8. A network security information processing method according to claim 7, characterized in that: The S5 includes S51 and S52; S51. Obtain the comprehensive safety index Se of program and system operation by counting the abnormal detection score Ae within a fixed period, and evaluate the safety status of the system within a fixed period after the preset safety protection measures are triggered and the execution effect of the preset safety protection measures; The comprehensive safety index Se is obtained by the following calculation formula: Where Q represents the total number of times the anomaly detection score Ae is statistically calculated within a fixed period, and Ae(q) represents the anomaly detection score obtained by the qth statistical calculation.

9. A network security information processing method according to claim 8, characterized in that: S52, evaluating the security status result of the network environment in which the program and system are running according to the obtained comprehensive security index Se, specifically by matching with the preset upper threshold Syz and lower threshold Xyz of the security status, and adjusting the security protection level of the program and system within a fixed period according to the security status result; The security status result is obtained by the following matching method: When the comprehensive security index Se ≥ the upper threshold Syz, the security status result is obtained as the first-level status, the system upstream and downstream traffic is restricted, mandatory user identity authentication is started, the system executes read-only mode, and the number of abnormal times YCJL is -1 and suspended for one natural day; When the lower threshold value Xyz is less than the comprehensive safety index Se and less than the upper threshold value Syz, the safety status result is obtained as the second level status, the system opens the additional function, performs the -1 operation for the number of abnormal times YCJL, and cancels the -1 operation for the number of abnormal times YCJL and suspends the operation for one natural day; When the comprehensive security index Se ≤ the lower threshold Xyz, the security status result is obtained as the third level status, the read-only mode executed by the system is exited, the full functions of the database are provided, and the mechanism of restricting non-whitelist IP access to the system is exited.

10. A network security information processing system, applied to a network security information processing method according to any one of claims 1 to 9, characterized in that: It includes log extraction module, log analysis module, network security identification module, security trigger module and iterative optimization and decision module; The log extraction module extracts log information from program logs and system logs, including error code information, error stack information, timestamp information and request information, and obtains a log feature vector L through integration; The log analysis module calculates the frequency and duration of the error code information and error stack information based on the acquired log feature vector L, and acquires the code error frequency DMp, the code error duration DMs, the error stack frequency DZp and the stack error duration DZs; The network security identification module identifies the abnormal state by substituting the code error frequency DMp, the code error duration DMs, the error stack frequency DZp and the stack error duration DZs into the established abnormal detection algorithm formula to obtain the abnormal detection score Ae; The safety trigger module compares the obtained anomaly detection score Ae with the preset alarm trigger threshold Ee to obtain the early warning notification trigger result, and triggers the preset safety protection measures according to the early warning notification trigger result; The iterative optimization and decision-making module obtains the comprehensive security index Se of program and system operation by statistically analyzing the anomaly detection score Ae within a fixed period, evaluates the security status results of the network environment in which the program and system run, and adjusts the security protection level of the program and system within a fixed period according to the security status results.

Images