Network security management method and system, electronic equipment and storage medium

Abstract

The invention relates to the technical field of Internet, in particular to a network security management method and system, electronic equipment and a storage medium, and the method comprises the steps: obtaining network traffic data; matching the network flow data with virus data in a preset virus library, and if the matching fails, determining the corresponding network flow data as potential risk data; performing data risk prediction on the basis of the potential risk data and a preset risk value prediction model to obtain a risk value of the potential risk data, and in the prediction process, determining a timestamp in the potential risk data as first-dimensional data, determining at least one item of remaining data in the potential risk data as second-dimensional data, performing data risk prediction based on a two-dimensional array formed by the first-dimensional data and the second-dimensional data; performing network security management based on the risk value; according to the method, the potential risk in the network traffic data can be well identified, so that subsequent network security management is facilitated.

Description

Technical Field

[0001] The present invention relates to the field of Internet technology, and in particular to a network security management method, system, electronic device and storage medium. Background Art

[0002] With the continuous development of information technology, the Internet has become an indispensable part of modern society. With the widespread popularity of network applications, network security issues have become increasingly prominent. Network security incidents, such as data leaks, network attacks, and malware, have caused huge losses to individuals and enterprises. Therefore, network security management is of vital importance.

[0003] At present, analysis and filtering technology is usually used to filter network traffic data. For example, the IP (Internet Protocol) address in the network traffic data is analyzed to determine whether the IP address is in the preset IP blacklist, thereby completing the network traffic data filtering. However, this method is difficult to analyze network traffic data with potential risks and is difficult to meet network security management needs. Summary of the invention

[0004] The present invention provides a network security management method, system, electronic device and storage medium to solve the problem in the prior art that it is difficult to identify network traffic data with potential risks and it is difficult to meet network security management needs.

[0005] The network security management method provided by the present invention comprises:

[0006] Get network traffic data;

[0007] Matching the network traffic data with virus data in a preset virus library, and if the match fails, determining the corresponding network traffic data as potential risk data;

[0008] Based on the potential risk data and a preset risk value prediction model, data risk prediction is performed to obtain the risk value of the potential risk data. During the prediction process, the timestamp in the potential risk data is determined as the first dimensional data, at least one item of the remaining data in the potential risk data is determined as the second dimensional data, and data risk prediction is performed based on a two-dimensional array composed of the first dimensional data and the second dimensional data;

[0009] Based on the risk value, network security management is performed.

[0010] In one embodiment of the present invention, data risk prediction is performed based on a two-dimensional array composed of the first dimensional data and the second dimensional data, including:

[0011] The two-dimensional array is preprocessed to perform data risk prediction based on the preprocessed two-dimensional array and the risk value prediction model, wherein the preprocessing includes: data deduplication processing, missing value filling processing, and abnormal data processing, wherein the abnormal data processing includes:

[0012] Determine the current two-dimensional array as a target data point, and determine two two-dimensional arrays adjacent to the target data point as a first data point and a second data point;

[0013] Obtaining a deviation value of the target data point based on a Manhattan distance between the first data point and the target data point, and a Manhattan distance between the second data point and the target data point;

[0014] If the deviation value is greater than a preset deviation threshold, the target data point is determined as abnormal data, and the abnormal data is deleted or replaced;

[0015] Traverse the remaining two-dimensional array to complete the abnormal data processing.

[0016] In one embodiment of the present invention, the data deduplication process includes:

[0017] Sort the multiple two-dimensional arrays according to timestamps to obtain a target sequence;

[0018] Performing a repeatability check on any one of the two-dimensional arrays in the target sequence and the remaining two-dimensional arrays, and if there is a repeated two-dimensional array, deleting the repeated two-dimensional array;

[0019] The remaining two-dimensional array is traversed to complete the data deduplication process.

[0020] In one embodiment of the present invention, the missing value filling process includes:

[0021] Determine the type of missing values ​​in the current two-dimensional array;

[0022] Based on the missing value type and a preset mapping relationship, a plurality of target feature types associated with the missing value type are obtained, wherein the preset mapping relationship includes a plurality of missing value types and a target feature type associated with the missing value type;

[0023] According to the target feature type, obtaining feature data corresponding to the target feature type;

[0024] Determine the average of the plurality of characteristic data as the value to be filled;

[0025] Fill the missing value position in the two-dimensional array with the value to be filled.

[0026] In one embodiment of the present invention, data risk prediction is performed based on a two-dimensional array composed of the first dimensional data and the second dimensional data, including:

[0027] Grouping a plurality of the two-dimensional arrays to obtain a plurality of target groups, wherein the target group includes at least two of the two-dimensional arrays;

[0028] Segmenting the data in the target group to obtain a plurality of target data segments;

[0029] Inputting the target data segment into the risk value prediction model to perform risk value prediction to obtain the risk value of the target data segment output by the risk value prediction model;

[0030] Determine the total risk value by summing the risk values ​​of multiple target data segments in the same target group;

[0031] If the total risk value is greater than or equal to a preset risk threshold, the two-dimensional array in the current target group is determined to be high-risk traffic data and an alarm is issued.

[0032] In one embodiment of the present invention, the target data segment is input into the risk value prediction model to perform risk value prediction to obtain the risk value of the target data segment output by the risk value prediction model, including:

[0033] Inputting the target data segment into the risk value prediction model, performing feature extraction, and obtaining target feature values ​​of a plurality of feature indicators of the target data segment, wherein the feature indicators correspond one-to-one to the target feature values, and the feature indicators have preset risk feature values ​​corresponding one-to-one to them;

[0034] Determine the difference between the target characteristic value and the corresponding risk characteristic value as a first value; determine the square value of the first value as a second value;

[0035] A sum of the plurality of second numerical values ​​of the target data segment is determined as a risk value of the target data segment.

[0036] The present invention also provides a network security management system, the system comprising:

[0037] A data acquisition module, used to acquire network traffic data;

[0038] A virus matching module, used to match the network flow data with virus data in a preset virus library, and if the match fails, determine the corresponding network flow data as potential risk data;

[0039] A risk prediction module, used to perform data risk prediction based on the potential risk data and a preset risk value prediction model to obtain the risk value of the potential risk data. During the prediction process, a timestamp in the potential risk data is determined as first-dimensional data, and at least one item of the remaining data in the potential risk data is determined as second-dimensional data. Data risk prediction is performed based on a two-dimensional array composed of the first-dimensional data and the second-dimensional data;

[0040] The network security management module is used to perform network security management based on the risk value.

[0041] In one embodiment of the present invention, the network security management system is integrated into a preset plug-in, and the plug-in is deployed on a target device; the plug-in includes:

[0042] A pressure detection module, used to detect the physical pressure of the plug-in and transmit a pressure data set consisting of a plurality of pressure data to a preset pressure risk analysis module;

[0043] The pressure risk analysis module is used to extract features from the pressure data in the pressure data set to obtain multiple types of pressure features; based on the gap between the pressure features and the preset risk pressure features, as well as the feature weights corresponding to different types of pressure features, a risk pressure value is obtained; if the risk pressure value is greater than or equal to a preset pressure risk threshold, an alarm is issued.

[0044] The present invention also provides an electronic device, comprising a processor, a memory and a communication bus; the communication bus is used to connect the processor and the memory; the processor is used to execute a computer program stored in the memory to implement a network security management method provided in any one of the above embodiments.

[0045] The present invention also provides a computer-readable storage medium on which a computer program is stored. The computer program is used to enable a computer to execute the network security management method provided in any of the above embodiments.

[0046] Beneficial effects of the present invention: The network security management method, system, electronic device and storage medium provided by the present invention, the method obtains network traffic data; matches the network traffic data with the virus data in the preset virus library, if the match fails, the corresponding network traffic data is determined as potential risk data; based on the potential risk data and the preset risk value prediction model, data risk prediction is performed to obtain the risk value of the potential risk data, during the prediction process, the timestamp in the potential risk data is determined as the first dimension data, at least one item of the remaining data in the potential risk data is determined as the second dimension data, based on the two-dimensional array composed of the first dimension data and the second dimension data, data risk prediction is performed; based on the risk value, network security management is performed. The method can better identify the potential risks in the network traffic data, such as determining the network traffic data with too high risk value as high-risk traffic data, etc., so as to facilitate the subsequent network security management and better meet the network security management needs. In addition, by converting the potential risk data into a two-dimensional array during the data risk prediction process, the data structure can be simplified, the time characteristics of the potential risk data can be presented more concisely, and the difficulty of subsequent analysis can be reduced. At the same time, it helps the risk value prediction model capture the temporal patterns of multiple potential risk data, such as sudden increases or decreases in traffic, thereby improving the accuracy of subsequent risk predictions. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 A schematic diagram of a flow chart of a network security management method provided by an embodiment of the present invention;

[0048] Figure 2 A schematic diagram of the structure of a network security management system provided in one embodiment of the present invention;

[0049] Figure 3 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0050] The following describes the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0051] It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present invention, and thus the drawings only show components related to the present invention rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0052] In the following description, numerous details are discussed to provide a more thorough explanation of the embodiments of the present invention. However, it is obvious to those skilled in the art that the embodiments of the present invention can be implemented without these specific details. In other embodiments, well-known structures and devices are shown in the form of block diagrams rather than in detail to avoid making the embodiments of the present invention difficult to understand.

[0053] Combine the following Figures 1 to 3 , the network security management method, system, electronic device and storage medium provided by the present invention are explained.

[0054] See also Figure 1 , Figure 1 A schematic diagram of a flow chart of a network security management method provided by an embodiment of the present invention is shown in FIG. Figure 1 As shown, the method includes:

[0055] S110: Obtain network traffic data.

[0056] In some examples of this embodiment, the network traffic data may be a network message, etc., which may include a timestamp, a source IP address, a destination IP address, a protocol type, a packet size, and a payload (the actual content of the packet), etc.

[0057] S120: Match the network traffic data with the virus data in a preset virus database. If the match fails, determine the corresponding network traffic data as potential risk data.

[0058] In some examples of this embodiment, if the match is successful, the corresponding network traffic data is determined as dangerous network data and an alarm is issued.

[0059] S130: Based on the potential risk data and a preset risk value prediction model, data risk prediction is performed to obtain the risk value of the potential risk data. During the prediction process, the timestamp in the potential risk data is determined as the first dimensional data, and at least one item of the remaining data in the potential risk data is determined as the second dimensional data. Data risk prediction is performed based on a two-dimensional array composed of the first dimensional data and the second dimensional data.

[0060] In some examples of this embodiment, the risk value prediction model may be a neural network model, etc. The risk value predicted in the above steps refers to the risk level of the potential risk data. The larger the risk value, the higher the risk level, which facilitates subsequent network security management.

[0061] It is understandable that by forming a two-dimensional array with the timestamp and at least one of the remaining data in the potential risk data other than the timestamp, a simplified data structure can be achieved. Simply put, compared with directly analyzing the network traffic data, this two-dimensional array structure can more easily identify the time information of the network traffic data, thereby reducing the difficulty of analysis. In addition, by constructing the above two-dimensional data, it can help the risk value prediction model capture the temporal regularity of multiple potential risk data, thereby improving the accuracy of subsequent risk prediction.

[0062] In addition, at least one item of the remaining data in the potential risk data may be a source IP address, a destination IP address, a protocol type, a data packet size, and a valid load, etc.

[0063] S140: Perform network security management based on the risk value.

[0064] In some examples of this embodiment, risk warnings may be issued for potential risk data with higher risk values, such as issuing an alarm.

[0065] It is understandable that different alarm modes may be set for dangerous network data and potential risk data with higher risks to distinguish the risk levels of the dangerous network data and potential risk data with higher risks.

[0066] In some embodiments, performing data risk prediction based on a two-dimensional array consisting of the first dimensional data and the second dimensional data includes:

[0067] The two-dimensional array is preprocessed to perform data risk prediction based on the preprocessed two-dimensional array and the risk value prediction model, and the preprocessing includes: data deduplication processing, missing value filling processing, and abnormal data processing.

[0068] It is understandable that the above preprocessing can help improve the accuracy of subsequent data risk prediction. In addition, the missing value determination method can be to determine the data that is "null" in the two-dimensional array as a missing value.

[0069] In some embodiments, the abnormal data processing includes:

[0070] 1. Determine the current two-dimensional array as a target data point, and determine two two-dimensional arrays adjacent to the target data point as a first data point and a second data point.

[0071] 2. Based on the Manhattan distance between the first data point and the target data point, and the Manhattan distance between the second data point and the target data point, obtain the deviation value of the target data point.

[0072] In some examples of this embodiment, the mathematical expression for obtaining the deviation value of the target data point is:

[0073]

[0074] Wherein, (a, b) represents the target data point, (x, y) represents the first data point, and (c, d) represents the second data point. |xa|+|yb| represents the Manhattan distance between the first data point and the target data point, and |ca|+|db| represents the Manhattan distance between the second data point and the target data point. It can be understood that a represents the timestamp in the target data point, and b represents at least one item of data other than the timestamp in the potential risk data corresponding to the target data point. The same applies to x, y, c, and d. In addition, it can be understood that the above calculation can be completed by using hash values ​​and the like.

[0075] By determining the deviation value of the target data point in the above manner, the degree of deviation between the target data point and the adjacent data points can be obtained more accurately, thereby achieving abnormal data processing.

[0076] In addition, for the first two-dimensional array and the last two-dimensional array, array compensation can be used to complete the calculation of the above deviation values, such as adding an array before the first two-dimensional array and adding an array after the last two-dimensional array.

[0077] 3. If the deviation value is greater than a preset deviation threshold, the target data point is determined as abnormal data, and the abnormal data is deleted or replaced.

[0078] In some examples of this embodiment, the deviation threshold can be set according to actual needs, such as 100%.

[0079] In addition, the abnormal data can be replaced in the following ways: updating the timestamp in the abnormal data to the middle value of the timestamps in the first data point and the second data point, updating the second dimension data in the abnormal data to the mean of the second dimension data in the first data point and the second data point, etc.

[0080] 4. Traverse the remaining two-dimensional array to complete abnormal data processing.

[0081] It can be understood that the above steps 1 to 3 are repeated for each remaining two-dimensional array to complete the abnormal data processing.

[0082] In some embodiments, the data deduplication process includes:

[0083] 1. Sort the multiple two-dimensional arrays according to timestamps to obtain a target sequence.

[0084] 2. Perform a repeatability check on any one of the two-dimensional arrays in the target sequence and the remaining two-dimensional arrays. If a repeated two-dimensional array exists, delete the repeated two-dimensional array.

[0085] In some examples of this embodiment, the first two-dimensional array may be processed first, that is, the first two-dimensional array is checked for repeatability with the remaining two-dimensional arrays one by one according to the sequence arrangement order, and if a duplicate two-dimensional array is detected, it is deleted. The advantage of sorting the two-dimensional arrays according to timestamps and performing repeatability checks one by one in order is that the complexity of repeatability detection can be reduced to a certain extent.

[0086] 3. Traverse the remaining two-dimensional array to complete data deduplication processing.

[0087] In some embodiments, the missing value filling process includes:

[0088] 1. Determine the type of missing values ​​in the current two-dimensional array.

[0089] In some examples of this embodiment, the type of missing value can be inferred based on the network traffic data, that is, the protocol type of the two-dimensional array, and the context of the missing value. For example: assuming that the data structure corresponding to the protocol of the current two-dimensional array is "timestamp + source IP address + destination IP address + protocol type + data packet size + payload (the actual content of the data packet)...", and the second dimension data of the two-dimensional array at this time is "timestamp + source IP address + destination IP address + protocol type + null + payload (the actual content of the data packet)...", it can be inferred that the current missing value type is the data packet size.

[0090] 2. Based on the missing value type and a preset mapping relationship, a plurality of target feature types associated with the missing value type are obtained, wherein the preset mapping relationship includes a plurality of missing value types and a target feature type associated with the missing value type.

[0091] It is understandable that the preset mapping relationship can be set according to the actual situation. The target feature type refers to the indicator type associated with the missing value of the network traffic data. For example, assuming that the missing value type is the packet size, the associated target feature type can be the size of the upstream traffic (data traffic from the client to the server) and the size of the downstream traffic (data traffic from the server to the client).

[0092] 3. According to the target feature type, characteristic data corresponding to the target feature type is obtained.

[0093] It can be understood that the characteristic data corresponding to the target characteristic type can be a preset value, such as a preset uplink traffic size and a downlink traffic size.

[0094] 4. Determine the average of the plurality of characteristic data as the value to be filled.

[0095] 5. Fill the missing value position in the two-dimensional array with the value to be filled.

[0096] Through the above method, the accuracy of missing value filling can be improved.

[0097] In some embodiments, the mathematical expression for obtaining the value to be filled is:

[0098]

[0099] Among them, D i represents the value to be filled, n represents the number of target feature types, D j Represents the feature data of the j-th target feature type.

[0100] In some embodiments, performing data risk prediction based on a two-dimensional array consisting of the first dimensional data and the second dimensional data includes:

[0101] 1. Grouping the plurality of two-dimensional arrays to obtain a plurality of target groups, wherein the target group includes at least two of the two-dimensional arrays. Generally, a target group usually includes a plurality of two-dimensional arrays.

[0102] 2. Segment the data in the target group to obtain multiple target data segments.

[0103] It is understandable that, due to the huge volume of network traffic data, the above grouping and segmentation method can facilitate subsequent risk prediction. In addition, it may be difficult to predict the potential risk of a single two-dimensional grouping, so the above grouping and segmentation method facilitates subsequent comprehensive prediction based on multiple two-dimensional groups in the target data segment, thereby improving the prediction accuracy.

[0104] 3. Inputting the target data segment into the risk value prediction model to perform risk value prediction to obtain the risk value of the target data segment output by the risk value prediction model.

[0105] 4. Determine the total risk value by summing the risk values ​​of multiple target data segments in the same target group.

[0106] 5. If the total risk value is greater than or equal to a preset risk threshold, the two-dimensional array in the current target group is determined to be high-risk traffic data and an alarm is issued.

[0107] Through the above steps, more accurate data risk prediction can be achieved.

[0108] In some embodiments, inputting the target data segment into the risk value prediction model to perform risk value prediction to obtain the risk value of the target data segment output by the risk value prediction model includes:

[0109] 1. Input the target data segment into the risk value prediction model to perform feature extraction to obtain target feature values ​​of multiple feature indicators of the target data segment, wherein the feature indicators correspond one-to-one to the target feature values, and the feature indicators have preset risk feature values ​​that correspond one-to-one to them.

[0110] In some examples of this embodiment, the characteristic index may be an attack peak, attack times, stolen data type, etc. The target characteristic value of the characteristic index is the value of the characteristic index extracted from the target data segment. The risk characteristic value is equivalent to the risk threshold of the characteristic value.

[0111] In some examples of this embodiment, since there are many types of attacks, by extracting features from the target data segment, target feature values ​​of multiple feature indicators corresponding to different attack types can be extracted. It is understandable that each attack type (such as DDoS (Distributed Denial of Service) attack, XSS (Cross-Site Scripting) attack, etc.) can correspond to multiple feature indicators, and the feature indicators corresponding to each attack type may be the same or different. When performing feature extraction, feature extraction can be performed one by one for the feature indicators of each attack type, which helps to improve the accuracy of the risk value obtained subsequently.

[0112] 2. Determine the difference between the target characteristic value and the corresponding risk characteristic value as a first value; and determine the square value of the first value as a second value.

[0113] 3. Determine the sum of the plurality of second numerical values ​​of the target data segment as the risk value of the target data segment.

[0114] In some examples of this embodiment, the mathematical expression for obtaining the risk value is:

[0115]

[0116] Among them, S i represents the risk value, w ijrepresents the target characteristic value of the jth characteristic indicator of the i-th attack type, v ij represents the risk characteristic value of the jth characteristic indicator of the ith attack type, r represents the number of attack types, and u represents the number of characteristic indicators.

[0117] Through the above method, a more accurate risk value can be obtained.

[0118] The network security management system provided by the present invention is described below. The network security management system described below and the network security management method described above can be referenced to each other.

[0119] Please refer to Figure 2 The network security management system provided in this embodiment includes:

[0120] A data acquisition module 210 is used to acquire network traffic data;

[0121] The virus matching module 220 is used to match the network traffic data with the virus data in the preset virus library. If the match fails, the corresponding network traffic data is determined as potential risk data;

[0122] The risk prediction module 230 is used to perform data risk prediction based on the potential risk data and a preset risk value prediction model to obtain the risk value of the potential risk data. During the prediction process, the timestamp in the potential risk data is determined as the first dimension data, and at least one item of the remaining data in the potential risk data is determined as the second dimension data. The data risk prediction is performed based on the two-dimensional array composed of the first dimension data and the second dimension data;

[0123] The network security management module 240 is used to perform network security management based on the risk value. The network security management system in this embodiment can achieve the technical effect achieved by the network security management method in the above embodiment, which will not be described in detail here.

[0124] In some embodiments, the network security management system is integrated into a preset plug-in, and the plug-in is deployed on the target device; the plug-in includes:

[0125] A pressure detection module, used to detect the physical pressure of the plug-in and transmit a pressure data set consisting of a plurality of pressure data to a preset pressure risk analysis module;

[0126] The pressure risk analysis module is used to extract features from the pressure data in the pressure data set to obtain multiple types of pressure features; based on the gap between the pressure features and the preset risk pressure features, as well as the feature weights corresponding to different types of pressure features, a risk pressure value is obtained; if the risk pressure value is greater than or equal to a preset pressure risk threshold, an alarm is issued.

[0127] It can be understood that the risk pressure feature refers to the value of the pressure feature of this type when it is in a risk state.

[0128] In some examples of this embodiment, the mathematical expression for obtaining the risk pressure value is:

[0129]

[0130] Among them, C represents the risk pressure value, α k represents the feature weight of the k-th pressure feature, P k It represents the gap or difference between the pressure feature and the preset risk pressure feature, and m represents the number of pressure features.

[0131] It can be understood that the above method can realize real-time monitoring of the pressure on the plug-in, avoid damage to the plug-in due to excessive pressure values, and avoid unnecessary impact on network security management due to plug-in damage.

[0132] In addition, the plug-in is also used to record monitored security events and processing actions in logs for post-audit and analysis.

[0133] It should be noted that the target device in this embodiment may be an edge device or the like.

[0134] In some embodiments, the risk prediction module 230 is specifically used to preprocess the two-dimensional array to perform data risk prediction based on the preprocessed two-dimensional array and the risk value prediction model, wherein the preprocessing includes: data deduplication processing, missing value filling processing, and abnormal data processing, wherein the abnormal data processing includes:

[0135] Determine the current two-dimensional array as a target data point, and determine two two-dimensional arrays adjacent to the target data point as a first data point and a second data point;

[0136] Obtaining a deviation value of the target data point based on a Manhattan distance between the first data point and the target data point, and a Manhattan distance between the second data point and the target data point;

[0137] If the deviation value is greater than a preset deviation threshold, the target data point is determined as abnormal data, and the abnormal data is deleted or replaced;

[0138] Traverse the remaining two-dimensional array to complete the abnormal data processing.

[0139] In some embodiments, the risk prediction module 230 is further specifically used to sort the plurality of two-dimensional arrays according to timestamps to obtain a target sequence;

[0140] Performing a repeatability check on any one of the two-dimensional arrays in the target sequence and the remaining two-dimensional arrays, and if there is a repeated two-dimensional array, deleting the repeated two-dimensional array;

[0141] The remaining two-dimensional array is traversed to complete the data deduplication process.

[0142] In some embodiments, the risk prediction module 230 is further specifically used to determine the type of missing values ​​in the current two-dimensional array;

[0143] Based on the missing value type and a preset mapping relationship, a plurality of target feature types associated with the missing value type are obtained, wherein the preset mapping relationship includes a plurality of missing value types and a target feature type associated with the missing value type;

[0144] According to the target feature type, obtaining feature data corresponding to the target feature type;

[0145] Determine the average of the plurality of characteristic data as the value to be filled;

[0146] Fill the missing value position in the two-dimensional array with the value to be filled.

[0147] In some embodiments, the risk prediction module 230 is specifically used to group the plurality of the two-dimensional arrays to obtain a plurality of target groups, wherein the target group includes at least two of the two-dimensional arrays;

[0148] Segmenting the data in the target group to obtain a plurality of target data segments;

[0149] Inputting the target data segment into the risk value prediction model to perform risk value prediction to obtain the risk value of the target data segment output by the risk value prediction model;

[0150] Determine the total risk value by summing the risk values ​​of multiple target data segments in the same target group;

[0151] If the total risk value is greater than or equal to a preset risk threshold, the two-dimensional array in the current target group is determined to be high-risk traffic data and an alarm is issued.

[0152] In some embodiments, the risk prediction module 230 is further specifically used to input the target data segment into the risk value prediction model, perform feature extraction, and obtain target feature values ​​of multiple feature indicators of the target data segment, wherein the feature indicators correspond one-to-one to the target feature values, and the feature indicators have preset risk feature values ​​corresponding one-to-one to them;

[0153] Determine the difference between the target characteristic value and the corresponding risk characteristic value as a first value; determine the square value of the first value as a second value;

[0154] A sum of the plurality of second numerical values ​​of the target data segment is determined as a risk value of the target data segment.

[0155] In some embodiments, an electronic device is also provided, which may be a server, and its internal structure is shown in FIG. Figure 3 As shown. The electronic device includes a processor, a memory, a network interface and a database connected via a system bus. The processor of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile and / or volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the electronic device is used to communicate with an external client via a network connection. When the computer program is executed by the processor, the functions or steps on the server side of the above method are implemented.

[0156] In some embodiments, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the following steps are implemented: obtaining network traffic data; matching the network traffic data with virus data in a preset virus library, and if the match fails, determining the corresponding network traffic data as potential risk data; performing data risk prediction based on the potential risk data and a preset risk value prediction model to obtain a risk value for the potential risk data. During the prediction process, the timestamp in the potential risk data is determined as first dimensional data, and at least one item of the remaining data in the potential risk data is determined as second dimensional data; and data risk prediction is performed based on a two-dimensional array consisting of the first dimensional data and the second dimensional data; and network security management is performed based on the risk value.

[0157] In some embodiments, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented: obtaining network traffic data; matching the network traffic data with virus data in a preset virus library, and if the match fails, determining the corresponding network traffic data as potential risk data; performing data risk prediction based on the potential risk data and a preset risk value prediction model to obtain the risk value of the potential risk data. During the prediction process, the timestamp in the potential risk data is determined as first-dimensional data, and at least one item of the remaining data in the potential risk data is determined as second-dimensional data, and data risk prediction is performed based on a two-dimensional array composed of the first-dimensional data and the second-dimensional data; and network security management is performed based on the risk value.

[0158] It should be noted that the above functions or steps that can be implemented by the computer-readable storage medium or electronic device can refer to the relevant descriptions on the server side and the client side in the aforementioned method embodiment. To avoid repetition, they will not be described one by one here.

[0159] The flow chart and block diagram in the accompanying drawings illustrate the possible implementation architecture, function and operation of the method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0160] The above embodiments are merely illustrative of the principles and effects of the present invention, and are not intended to limit the present invention. Anyone familiar with the art may modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by a person of ordinary skill in the art without departing from the spirit and technical concept disclosed by the present invention shall still be covered by the claims of the present invention.

Claims

1. A network security management method, characterized in that: include: Get network traffic data; Matching the network traffic data with virus data in a preset virus library, and if the match fails, determining the corresponding network traffic data as potential risk data; Based on the potential risk data and a preset risk value prediction model, data risk prediction is performed to obtain the risk value of the potential risk data. During the prediction process, the timestamp in the potential risk data is determined as the first dimensional data, at least one item of the remaining data in the potential risk data is determined as the second dimensional data, and data risk prediction is performed based on a two-dimensional array composed of the first dimensional data and the second dimensional data; Based on the risk value, network security management is performed.

2. The network security management method according to claim 1, characterized in that: Based on the two-dimensional array composed of the first-dimensional data and the second-dimensional data, data risk prediction is performed, including: The two-dimensional array is preprocessed to perform data risk prediction based on the preprocessed two-dimensional array and the risk value prediction model, wherein the preprocessing includes: data deduplication processing, missing value filling processing, and abnormal data processing, wherein the abnormal data processing includes: Determine the current two-dimensional array as a target data point, and determine two two-dimensional arrays adjacent to the target data point as a first data point and a second data point; Obtaining a deviation value of the target data point based on a Manhattan distance between the first data point and the target data point, and a Manhattan distance between the second data point and the target data point; If the deviation value is greater than a preset deviation threshold, the target data point is determined as abnormal data, and the abnormal data is deleted or replaced; Traverse the remaining two-dimensional array to complete the abnormal data processing.

3. The network security management method according to claim 2, characterized in that: The data deduplication processing includes: Sort the multiple two-dimensional arrays according to timestamps to obtain a target sequence; Performing a repeatability check on any one of the two-dimensional arrays in the target sequence and the remaining two-dimensional arrays, and if there is a repeated two-dimensional array, deleting the repeated two-dimensional array; The remaining two-dimensional array is traversed to complete the data deduplication process.

4. The network security management method according to claim 2, characterized in that: The missing value filling process includes: Determine the type of missing values ​​in the current two-dimensional array; Based on the missing value type and a preset mapping relationship, a plurality of target feature types associated with the missing value type are obtained, wherein the preset mapping relationship includes a plurality of missing value types and a target feature type associated with the missing value type; According to the target feature type, obtaining feature data corresponding to the target feature type; Determine the average of the plurality of characteristic data as the value to be filled; Fill the missing value position in the two-dimensional array with the value to be filled.

5. The network security management method according to claim 1, characterized in that: Based on the two-dimensional array composed of the first-dimensional data and the second-dimensional data, data risk prediction is performed, including: Grouping a plurality of the two-dimensional arrays to obtain a plurality of target groups, wherein the target group includes at least two of the two-dimensional arrays; Segmenting the data in the target group to obtain a plurality of target data segments; Inputting the target data segment into the risk value prediction model to perform risk value prediction to obtain the risk value of the target data segment output by the risk value prediction model; Determine the total risk value by summing the risk values ​​of multiple target data segments in the same target group; If the total risk value is greater than or equal to a preset risk threshold, the two-dimensional array in the current target group is determined to be high-risk traffic data and an alarm is issued.

6. The network security management method according to claim 5, characterized in that: Inputting the target data segment into the risk value prediction model to perform risk value prediction to obtain the risk value of the target data segment output by the risk value prediction model, including: Inputting the target data segment into the risk value prediction model, performing feature extraction, and obtaining target feature values ​​of a plurality of feature indicators of the target data segment, wherein the feature indicators correspond one-to-one to the target feature values, and the feature indicators have preset risk feature values ​​corresponding one-to-one to them; Determine the difference between the target characteristic value and the corresponding risk characteristic value as a first value; determine the square value of the first value as a second value; A sum of the plurality of second numerical values ​​of the target data segment is determined as a risk value of the target data segment.

7. A network security management system, characterized in that: include: A data acquisition module, used to acquire network traffic data; A virus matching module, used to match the network flow data with virus data in a preset virus library, and if the match fails, determine the corresponding network flow data as potential risk data; A risk prediction module, used to perform data risk prediction based on the potential risk data and a preset risk value prediction model to obtain the risk value of the potential risk data. During the prediction process, a timestamp in the potential risk data is determined as first-dimensional data, and at least one item of the remaining data in the potential risk data is determined as second-dimensional data. Data risk prediction is performed based on a two-dimensional array composed of the first-dimensional data and the second-dimensional data; The network security management module is used to perform network security management based on the risk value.

8. The network security management system according to claim 7, characterized in that: The network security management system is integrated into a preset plug-in, and the plug-in is deployed on the target device; the plug-in includes: A pressure detection module, used to detect the physical pressure of the plug-in and transmit a pressure data set consisting of a plurality of pressure data to a preset pressure risk analysis module; The pressure risk analysis module is used to extract features from the pressure data in the pressure data set to obtain multiple types of pressure features; based on the gap between the pressure features and the preset risk pressure features, as well as the feature weights corresponding to different types of pressure features, a risk pressure value is obtained; if the risk pressure value is greater than or equal to a preset pressure risk threshold, an alarm is issued.

9. An electronic device, characterized in that: It comprises a processor, a memory and a communication bus; the communication bus is used to connect the processor and the memory; the processor is used to execute the computer program stored in the memory to implement the network security management method as described in any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and the computer program is used to enable a computer to execute the network security management method according to any one of claims 1 to 6.

Images