Network security test method and system based on big data

Abstract

The invention relates to the technical field of network security, in particular to a network security test method and system based on big data. According to the network security testing method based on the big data, comprehensive coverage of the network security is achieved by constructing the network security testing method based on the big data and combining a plurality of testing items. By utilizing an SVM (Support Vector Machine) model, large-scale network data can be efficiently processed, a network security score can be dynamically generated, and potential threats and security weaknesses can be quickly positioned; network data are collected and analyzed in real time through a distributed data processing framework, and a security score vector changing along with time is generated. In combination with the visualization means of the scoring star map, the security state of the network in each test item can be intuitively displayed, so that technicians can quickly identify problems; and 3, based on the preset test environment feature matching space, a user is supported to customize the test requirements by inputting parameters, and the test items and the depth degree are dynamically adjusted according to different requirements.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security testing method and system based on big data. Background Art

[0002] Network security refers to the ability to protect network systems, data and related infrastructure from illegal access, attacks, destruction or data leakage through technical means and management measures. With the rapid development of Internet technology, the network has become an important infrastructure in the fields of social economy, national defense security, medical services, industrial control, etc., and network security, as the "security barrier" of the information age, is becoming increasingly important. Network security testing refers to the use of a series of technical means and tools to verify the security of network systems, find potential vulnerabilities and security risks, and ensure that the system can resist known or unknown attack threats.

[0003] However, existing network security testing technologies still have many limitations and shortcomings. First, existing network security technologies are often limited to a single or a few test items, such as focusing only on vulnerability scanning or firewall configuration checks. This isolated testing method is difficult to fully cover potential security threats in the network and is prone to overlooking key attack paths or weak links.

[0004] Secondly, many existing technologies use periodic scanning or static analysis, which lack the ability to capture and dynamically evaluate the real-time status of the network. When facing network attacks, traditional methods have a slow response speed and cannot track changes in security status over time.

[0005] Finally, existing network security technologies are usually based on predefined fixed rule sets or templates, which are difficult to adapt to the diverse needs of users or complex network environments.

[0006] In response to the above problems, it is necessary to propose a network security testing method and system based on big data. Summary of the invention

[0007] The purpose of the present invention is to solve the problems existing in the background technology and to propose a network security testing method and system based on big data.

[0008] The purpose of the present invention can be achieved through the following technical solutions:

[0009] In a first aspect, the present invention provides a network security testing method based on big data, comprising the following steps:

[0010] Step 1: Test environment setting and demand analysis;

[0011] The application field, application scenario and network environment of the network security test are determined through the test parameters input by the user.

[0012] As a preferred method of the present invention, the corresponding test items and depth are matched according to the test items, application scenarios and network environment. The specific process is as follows:

[0013] The environmental characteristic value E1 corresponding to the application field, the characteristic value E2 corresponding to the application scenario and the characteristic value E3 corresponding to the network environment are obtained to generate a test environment characteristic vector (E1, E2, E3).

[0014] Retrieve a preset test environment feature matching space, which is three-dimensional and has several standard test environment feature vectors preset. Where i is the number of the standard test environment feature vector; i=1, 2, ..., n; n is the total number of standard test environment feature vectors. Each standard test environment feature vector corresponds to a set of preset test items, depth, test scope and test tools.

[0015] By preset formula Calculate the test environment feature vector (E1, E2, E3) and each preset standard test environment feature vector The matching value Similarity(i) is obtained. The maximum value MaxSimilarity(i) is extracted from Similarity(i) = Similarity(1), Similarity(2), ..., Similarity(n), and the test parameters input by the user are determined to be the same as the standard test environment feature vector with the maximum matching value. The match was successful.

[0016] Finally, the output Corresponding test items and depth.

[0017] Step 2: Network data collection;

[0018] The network data recorded by data sources including network devices, IDS intrusion detection systems, firewalls, and log systems in the network to be tested are uniformly connected to the distributed data processing framework.

[0019] At every preset time interval t, the data flow in the network to be tested is managed through the distributed data processing framework, and the network traffic information contained in each data flow in the network data is extracted.

[0020] As a preferred embodiment of the present invention, at every preset time interval t, the security data in the network to be tested is managed through a distributed data processing framework to extract network security information from the IDS intrusion detection system, firewall, and log system.

[0021] Step 3: Feature extraction and representation;

[0022] Extract network security related features from the collected network data, including traffic features, protocol features and port features.

[0023] The data flows with the same source IP address and destination IP address are classified into the same session connection to obtain several session connections, each of which contains several data flows. All session connections are numbered.

[0024] By extracting traffic features, we can obtain the average length of data packets, the fluctuation value of data packet length, and the network traffic density of each session connection.

[0025] By extracting protocol features, we can obtain the protocol type anomaly degree and protocol time dispersion:

[0026] By extracting the port features, the port abnormal feature value is obtained;

[0027] As a preferred method of the present invention, network security related features are extracted from security information, and the specific process is as follows:

[0028] At every preset time interval t, each alarm record is numbered according to the alarm record identifier alert_id, and the numbering symbol is q; q = 1, 2, ..., Q. Obtain the security feature value E(q) corresponding to the attack type of each alarm record identifier attack_type ; Get the attack source IP address attack_src_ip(q) and attack target IP address attack_dst_ip(q) corresponding to each alarm record identifier number q; Get the network subnet size N corresponding to each alarm record identifier number q subnet (q); obtain the attack time period attack_timestamp(q) corresponding to each alarm record identifier number q; obtain the occurrence probability Sq of the attack signature corresponding to each alarm record identifier number q.

[0029] By preset formula

[0030] Calculate the attack characteristic value E atk .in is the XOR symbol of the IP address; where w f 、w r 、w t and w h These are all preset weight factors.

[0031] As a preferred method of the present invention, the average length D of the data packets corresponding to each session connection is counted. len , Data packet length fluctuation value σ len , network traffic density R pkt , protocol type abnormality χproto , protocol time dispersion H proto , port abnormal characteristic value E port and attack characteristic value E atk Generate the feature vector e of each session connection = {D len , σ len , R pkt , χ proto , H proto , E port}.

[0032] At every preset time interval t, a session connection feature matrix A(t) is generated according to the number V of session connections.

[0033] Step 4: Establish a network security rating model;

[0034] S401, Model Building

[0035] A network security evaluation model based on SVM support vector machine is established to evaluate the execution effect of network security defense in subsequent attack simulations.

[0036] It is stipulated that the input of the SVM support vector machine is the session connection feature matrix A(t) generated at each preset time interval t.

[0037] The output of the SVM support vector machine is defined as a security score vector, including several security score elements, each of which has a value from 0 to 100, representing the score of the network in each test item. When a test item is not participated in, the output value of the corresponding security score element is set to the string SKIP.

[0038] The topological structure of the SVM support vector machine is:

[0039] Input layer: includes several nodes, each of which is used to input the session connection feature matrix A(t) at different time intervals t;

[0040] Hidden layer: Select RBF kernel as the nonlinear kernel function to map the data extracted from the session connection feature matrix A(t) to a high-dimensional space;

[0041] Output layer: Several nodes, corresponding to the safety scores of several test items. Each output value is between 0 and 100, or the string SKIP.

[0042] S402, model training;

[0043] The historical network connection data and the corresponding security score vector are used to train the network security rating model based on the SVM support vector machine. Each input session connection feature matrix A(t) and the target security score vector are used as training samples for learning and training.

[0044] Step 5: Attack simulation and vulnerability scanning;

[0045] The network to be tested is subjected to an attack test according to the test items and depth determined in step 1. Then, step 3 is repeated every preset time interval t to obtain the session connection feature matrix A(t) at each time t and output it to the network security rating model established in step 4 to obtain a security score vector.

[0046] Step 6: Comprehensive analysis of test results and report generation;

[0047] A score star map is generated with each safety score element in the safety score vector as the side length.

[0048] The rating star chart is a regular polygon, and the distance from each corner point of the regular polygon to the center corresponds to the value of each safety rating element.

[0049] In particular, when the value of the safety score element is the string SKIP, the corresponding distance value is set to 0.

[0050] As a preferred method of the present invention, the session connection feature matrix of each preset time interval is extracted, and the mean value of the packet length, the packet length fluctuation value, the network traffic density, the protocol type abnormality, the protocol time discreteness and the derivative of the port abnormal feature value to time t corresponding to each session connection are calculated and counted respectively. The weakness coefficient ω of each session connection is calculated by a preset formula, and the source IP address src_ip and the target IP address corresponding to the session connection with the weakness coefficient ω greater than the preset one are marked as attack vulnerabilities.

[0051] In a second aspect, the present invention provides a network security testing system based on big data, including a demand determination module, a data collection module, a database, a preprocessing module, a learning module and an attack simulation module.

[0052] The requirement determination module is used to store a preset test environment feature matching space, which is three-dimensional and has a number of standard test environment feature vectors preset. Where i is the number of the standard test environment feature vector; i=1, 2, ..., n; n is the total number of standard test environment feature vectors. Each standard test environment feature vector corresponds to a set of preset test items, depth, test scope and test tools.

[0053] As a preferred method of the present invention, the application field, application scenario and network environment of the network security test are determined by the test parameters input by the user. The environmental characteristic value E1 corresponding to the application field, the characteristic value E2 corresponding to the application scenario and the characteristic value E3 corresponding to the network environment are obtained to generate the test environment characteristic vector (E1, E2, E3).

[0054] By preset formula Calculate the test environment feature vector (E1, E2, E3) and each preset standard test environment feature vector The matching value Similarity(i) is obtained. The maximum value MaxSimilarity(i) is extracted from Similarity(i) = Similarity(1), Similarity(2), ..., Similarity(n), and the test parameters input by the user are determined to be the same as the standard test environment feature vector with the maximum matching value. The match was successful.

[0055] Finally, the output Corresponding test items and depth.

[0056] The data collection module connects the network data recorded by data sources including network devices, IDS intrusion detection systems, firewalls, and log systems in the network to be tested to a distributed data processing framework.

[0057] At every preset time interval t, the data flow in the network to be tested is managed through the distributed data processing framework, and the network traffic information contained in each data flow in the network data is extracted.

[0058] At preset time intervals t, the security data in the network to be tested is managed through a distributed data processing framework, and network security information from IDS intrusion detection systems, firewalls, and log systems is extracted.

[0059] The database stores the distributed data processing framework and the network traffic information and network security information it collects.

[0060] The preprocessing module extracts network security-related features from the collected network data, including traffic features, protocol features, and port features.

[0061] By extracting traffic features, we can obtain the average length of data packets, the fluctuation value of data packet length, and the network traffic density of each session connection.

[0062] By extracting protocol features, we can obtain the protocol type anomaly degree and protocol time dispersion:

[0063] By extracting the port features, the port abnormal feature value is obtained;

[0064] As a preferred method of the present invention, network security related features are extracted from security information, and the specific process is as follows:

[0065] At every preset time interval t, each alarm record is numbered according to the alarm record identifier alert_id, and the numbering symbol is q; q = 1, 2, ..., Q. Obtain the security feature value E(q) corresponding to the attack type of each alarm record identifier attack_type ; Get the attack source IP address attack_src_ip(q) and attack target IP address attack_dst_ip(q) corresponding to each alarm record identifier number q; Get the network subnet size N corresponding to each alarm record identifier number q subnet (q); obtain the attack time period attack_timestamp(q) corresponding to each alarm record identifier number q; obtain the occurrence probability Sq of the attack signature corresponding to each alarm record identifier number q.

[0066] By preset formula

[0067] Calculate the attack characteristic value E atk .in is the XOR symbol of the IP address; where w f 、w r 、w t and w h These are all preset weight factors.

[0068] As a preferred method of the present invention, the average length D of the data packets corresponding to each session connection is counted. len , Data packet length fluctuation value σ len , network traffic density R pkt , protocol type abnormality χ proto , protocol time dispersion H proto , port abnormal characteristic value E port and attack characteristic value E atk Generate the feature vector e of each session connection = {D len , σ len , R pkt , χ proto , H proto , E port}.

[0069] At every preset time interval t, a session connection feature matrix A(t) is generated according to the number V of session connections.

[0070] The learning module is used to save the network security assessment model based on SVM support vector machine.

[0071] The topological structure of the SVM support vector machine is:

[0072] Input layer: includes several nodes, each of which is used to input the session connection feature matrix A(t) at different time intervals t;

[0073] Hidden layer: Select RBF kernel as the nonlinear kernel function to map the data extracted from the session connection feature matrix A(t) to a high-dimensional space;

[0074] Output layer: includes several nodes, corresponding to the safety scores of several test items. Each output value is between 0 and 100, or the string SKIP.

[0075] As a preferred method of the present invention, historical network connection data and corresponding security score vectors are used to train a network security rating model based on an SVM support vector machine, and each input session connection feature matrix A(t) and target security score vector are used as training samples.

[0076] Save the trained network security assessment model for subsequent network security assessment.

[0077] The attack simulation module performs an attack test on the network to be tested according to the test items and depth determined by the demand determination module. Subsequently, the security score vector output by the learning module is recorded at a preset time interval t. The security score vector includes the security scores of several test items.

[0078] Compared with the prior art, the present invention has the following beneficial effects:

[0079] 1. The present invention achieves comprehensive coverage of network security by constructing a network security testing method based on big data and combining multiple test items. Using the SVM support vector machine model, it can efficiently process large-scale network data, dynamically generate network security scores, and quickly locate potential threats and security weaknesses. This method significantly improves the efficiency and accuracy of network security testing;

[0080] 2. The present invention collects and analyzes network data in real time through a distributed data processing framework, and generates a security score vector that changes over time. Combined with the visualization of the score star chart, it can intuitively display the security status of the network in each test item, making it easier for technicians to quickly identify problems. At the same time, the dynamic score can be continuously updated during the attack simulation process, which helps to evaluate and adjust the execution effect of network defense measures in real time;

[0081] 3. Based on the preset test environment feature matching space, the present invention supports users to customize test requirements by inputting parameters, and dynamically adjusts test items and depth according to different requirements. In addition, the model can be combined with historical network data for learning and optimization, supports the adaptation of multiple network environments and the scalability processing of new attack methods, and has strong versatility and foresight. BRIEF DESCRIPTION OF THE DRAWINGS

[0082] In order to facilitate understanding by those skilled in the art, the present invention is further described below with reference to the accompanying drawings:

[0083] Figure 1 is a flow chart of the method of the present invention;

[0084] Figure 2 A schematic diagram of the test environment feature matching space of the present invention;

[0085] Figure 3 A topological diagram of a support vector machine of the present invention;

[0086] Figure 4 It is a system block diagram of the present invention. DETAILED DESCRIPTION

[0087] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0088] See also Figure 1 As shown, the network security testing method based on big data includes the following steps:

[0089] Step 1: Test environment setting and demand analysis;

[0090] The application field, application scenario and network environment of the network security test are determined through the test parameters input by the user.

[0091] The application areas include: finance, medical care, e-commerce, government public services, industrial control, education and scientific research, and internal business;

[0092] The application scenarios include: enterprise internal network services, Internet services, cloud computing services, Internet of Things services and mobile network services.

[0093] The network environment includes: internal LAN, Internet, intranet, extranet and mixed environment.

[0094] Furthermore, the corresponding test items and depth are matched according to the test items, application scenarios and network environment. The specific process is as follows:

[0095] The environmental characteristic value E1 corresponding to the application field, the characteristic value E2 corresponding to the application scenario and the characteristic value E3 corresponding to the network environment are obtained to generate a test environment characteristic vector (E1, E2, E3).

[0096] See also Figure 2As shown, a preset test environment feature matching space is retrieved, wherein the test environment feature matching space is three-dimensional and has a plurality of standard test environment feature vectors preset. Where i is the number of the standard test environment feature vector; i=1, 2, ..., n; n is the total number of standard test environment feature vectors. Each standard test environment feature vector corresponds to a set of preset test items, depth, test scope and test tools.

[0097] The test items include: vulnerability scanning, penetration testing, identity and access management testing, API security testing, network traffic analysis, cryptography testing, data leakage detection and cloud environment security testing;

[0098] The levels of depth described include: basic testing, comprehensive testing, and in-depth testing.

[0099] By preset formula Calculate the test environment feature vector (E1, E2, E3) and each preset standard test environment feature vector The matching value Similarity(i) is obtained. The maximum value MaxSimilarity(i) is extracted from Similarity(i) = Similarity(1), Similarity(2), ..., Similarity(n), and the test parameters input by the user are determined to be the same as the standard test environment feature vector with the maximum matching value. The match was successful.

[0100] Finally, the output Corresponding test items and depth.

[0101] Step 2: Network data collection;

[0102] The network data recorded by data sources including network devices, IDS intrusion detection systems, firewalls, and log systems in the network to be tested are uniformly connected to the distributed data processing framework.

[0103] At every preset time interval t, the data flow in the network to be tested is managed through the distributed data processing framework, and the network traffic information contained in each data flow in the network data is extracted.

[0104] The network traffic information includes: data flow identifier flow_id, network protocol type proto, source IP address src_ip, destination IP address dst_ip, source port number src_port, destination port number dst_port, data packet length pkt_len and timestamp timestamp.

[0105] Furthermore, at every preset time interval t, the security data in the network to be tested is managed through a distributed data processing framework, and network security information in the IDS intrusion detection system, firewall, and log system is extracted.

[0106] The security information includes: an alert record identifier alert_id, an attack type attack_type, an attack source attack_src_ip, an attack target attack_dst_ip, an attack time period attack_timestamp and an attack signature attack_signature.

[0107] It should be noted that the distributed data processing framework is built to present, save and process large amounts of network data from different sources.

[0108] Step 3: Feature extraction and representation;

[0109] Extract network security related features from the collected network data, including traffic features, protocol features and port features.

[0110] The specific process of extracting traffic features is as follows:

[0111] The data flows with the same source IP address src_ip and destination IP address dst_ip are classified into the same session connection, and several session connections are obtained, each of which contains several data flows. All session connections are numbered, and the number symbol is Session_id.

[0112] In the same session connection, each data stream is numbered, and the numbering symbol is j, j=1, 2, ..., m; m is the total number of data streams included in the session connection.

[0113] The length of the data packet of each data stream j in the same session connection is recorded as pkt_len(j). Every preset time interval t, the preset formula Calculate the average packet length D of each session connection len and packet length fluctuation value σ len .

[0114] At every preset time interval t, obtain the maximum value Maxtimestamp and the minimum value Mintimestamp of the timestamp in each data stream j in the same session connection. Calculate network traffic density R pkt .

[0115] The specific process of extracting protocol features is as follows:

[0116] Count the frequency of data flows of different protocol types in the same session connection, recorded as protocol occurrence frequency O k =O1, O2, ..., O K . Where k is the number of the network protocol type proto; K is the total number of network protocol types.

[0117] Get the expected frequency E of each network protocol type proto k =E1, E2, ..., E K , through the preset formula Calculate the protocol type abnormality χ proto , identify possible protocol abuse or attack behavior; where ck is the preset weight factor.

[0118] Statistics on the occupied time of data flows of different protocol types in the same connection, recorded as protocol occupied time T k =T1, T2, ..., T K . Through the preset formula Calculate the protocol time dispersion H of different protocol types proto . Where D T is the mean of the protocol occupancy time; σ T is the standard deviation of the protocol occupancy time; where F k It is the standard value of the time taken by data flow of different protocol types.

[0119] The specific process of extracting port features is as follows:

[0120] Count the number of visits to different destination port numbers dst_port in the same connection Nd p =Nd1,Nd2,...,Nd P ; Count the number of visits Ns of different source port numbers src_port in the same connection p =Ns1,Ns2,...,Ns P ; Where p is the number of all port numbers; Where P is the total number of port numbers;

[0121] By preset formula Calculate the port abnormal characteristic value E port , where c p is the preset weight factor.

[0122] Furthermore, network security related features are extracted from the security information. The specific process is as follows:

[0123] At every preset time interval t, each alarm record is numbered according to the alarm record identifier alert_id, and the numbering symbol is q; q = 1, 2, ..., Q. Obtain the security feature value E(q) corresponding to the attack type of each alarm record identifierattack_type ; Get the attack source IP address attack_src_ip(q) and attack target IP address attack_dst_ip(q) corresponding to each alarm record identifier number q; Get the network subnet size N corresponding to each alarm record identifier number q subnet (q); obtain the attack time period attack_timestamp(q) corresponding to each alarm record identifier number q; obtain the occurrence probability Sq of the attack signature corresponding to each alarm record identifier number q.

[0124] By preset formula

[0125] Calculate the attack characteristic value E atk .in is the XOR symbol of the IP address; where w f 、w r 、w t and w h These are all preset weight factors.

[0126] Furthermore, the average length of the data packets corresponding to each session connection is counted. len , Data packet length fluctuation value σ len , network traffic density R pkt , protocol type abnormality χ proto , protocol time dispersion H proto , port abnormal characteristic value E port and attack characteristic value E atk Generate the feature vector e of each session connection = {D len , σ len , R pkt , χ proto , H proto , E port}.

[0127] At every preset time interval t, a session connection feature matrix is ​​generated according to the number of session connections V

[0128] It should be noted that the session connection feature matrix will be used as a judgment parameter for attack simulation and vulnerability scanning in the subsequent steps and input into the machine learning model to analyze the impact of each session connection and its represented source IP address and target IP address on the attack feature value.

[0129] Step 4: Establish a network security rating model;

[0130] S401, Model Building

[0131] A network security evaluation model based on SVM support vector machine is established to evaluate the execution effect of network security defense in subsequent attack simulations.

[0132] It is stipulated that the input of the SVM support vector machine is the session connection feature matrix A(t) generated at each preset time interval t.

[0133] The output of the SVM support vector machine is defined as a security score vector {S1, S2, S3, S4, S5, S6, S7, S8}, including several security score elements S1, S2, ..., S8, each of which has a value of 0 to 100, representing the score of the network in each test item. When a test item is not participated in, the output value of the corresponding security score element is set to the string SKIP.

[0134] The test items include: vulnerability scanning, penetration testing, identity and access management testing, API security testing, network traffic analysis, cryptography testing, data leakage detection and cloud environment security testing;

[0135] See also Figure 3 As shown, the topological structure of the SVM support vector machine is:

[0136] Input layer: includes several nodes, each of which is used to input the session connection feature matrix A(t) at different time intervals t;

[0137] Hidden layer: Select RBF kernel as the nonlinear kernel function to map the data extracted from the session connection feature matrix A(t) to a high-dimensional space;

[0138] Output layer: It includes 8 nodes, corresponding to the safety scores of 8 test items. Each output value is between 0 and 100, or the string SKIP.

[0139] S402, model training;

[0140] The network security rating model based on SVM is trained using historical network connection data and the corresponding security score vector. Each input session connection feature matrix A(t) and the target security score vector are used as training samples.

[0141] Step 5: Attack simulation and vulnerability scanning;

[0142] According to the test items and depth determined in step 1, the network to be tested is attacked. Then, step 3 is repeated every preset time interval t to obtain the session connection feature matrix A(t) at each time t and output it to the network security rating model established in step 4 to obtain the security score vector

[0143] {S1, S2, S3, S4, S5, S6, S7, S8}.

[0144] Step 6: Comprehensive analysis of test results and report generation;

[0145] With the security score elements S1, S2, S3, S4, S5, S6, S7, and S8 in the security score vector as the side length, a score star map is generated to intuitively display the performance of the network to be tested in each test item.

[0146] The scoring star chart is a regular octagon, and the distance from each corner point to the center corresponds to the value of S1, S2, S3, S4, S5, S6, S7, and S8.

[0147] In particular, when the value of the safety score element is the string SKIP, the corresponding distance value is set to 0.

[0148] Further, extract the session connection feature matrix for each preset time interval Calculate and count the mean packet length D corresponding to each session connection len , Data packet length fluctuation value σ len , network traffic density R pkt , protocol type abnormality χ proto , protocol time dispersion H proto and port abnormal characteristic value E port The derivative with respect to time t and

[0149] By preset formula

[0150] Calculate the weakness coefficient ω of each session connection, and mark the source IP address src_ip and target IP address corresponding to the session connection with a weakness coefficient ω greater than the preset one as an attack vulnerability. Among them, λ1,λ2,...,λ6 are all preset weight coefficients; among them, α is the preset linear impact factor, and β is the preset exponential impact factor. Among them, μ is the average value operator.

[0151] See also Figure 4 As shown, the network security testing system based on big data includes a demand determination module, a data collection module, a database, a preprocessing module, a learning module and an attack simulation module.

[0152] The requirement determination module is used to store a preset test environment feature matching space, which is three-dimensional and has a number of standard test environment feature vectors preset. Where i is the number of the standard test environment feature vector; i=1, 2, ..., n; n is the total number of standard test environment feature vectors. Each standard test environment feature vector corresponds to a set of preset test items, depth, test scope and test tools.

[0153] The test items include: vulnerability scanning, penetration testing, identity and access management testing, API security testing, network traffic analysis, cryptography testing, data leakage detection and cloud environment security testing;

[0154] The levels of depth described include: basic testing, comprehensive testing, and in-depth testing.

[0155] Furthermore, the application field, application scenario and network environment of the network security test are determined by the test parameters input by the user. The environmental characteristic value E1 corresponding to the application field, the characteristic value E2 corresponding to the application scenario and the characteristic value E3 corresponding to the network environment are obtained to generate the test environment characteristic vector (E1, E2, E3).

[0156] By preset formula Calculate the test environment feature vector (E1, E2, E3) and each preset standard test environment feature vector The matching value Similarity(i) is obtained. The maximum value MaxSimilarity(i) is extracted from Similarity(i) = Similarity(1), Similarity(2), ..., Similarity(n), and the test parameters input by the user are determined to be the same as the standard test environment feature vector with the maximum matching value. The match was successful.

[0157] Finally, the output Corresponding test items and depth.

[0158] The data collection module connects the network data recorded by data sources including network devices, IDS intrusion detection systems, firewalls, and log systems in the network to be tested to a distributed data processing framework.

[0159] At every preset time interval t, the data flow in the network to be tested is managed through the distributed data processing framework, and the network traffic information contained in each data flow in the network data is extracted.

[0160] At preset time intervals t, the security data in the network to be tested is managed through a distributed data processing framework, and network security information from IDS intrusion detection systems, firewalls, and log systems is extracted.

[0161] The database stores the distributed data processing framework and the network traffic information and network security information it collects.

[0162] The preprocessing module extracts network security-related features from the collected network data, including traffic features, protocol features, and port features, and obtains the mean packet length D len , Data packet length fluctuation value σ len , network traffic density R pkt , protocol type abnormality χ proto , protocol time dispersion H proto and port abnormal characteristic value E port .

[0163] Extract network security related features from security information and obtain attack feature value E atk .

[0164] Count the average length of data packets corresponding to each session connection D len , Data packet length fluctuation value σ len , network traffic density R pkt , protocol type abnormality χ proto , protocol time dispersion H proto , port abnormal characteristic value E port and attack characteristic value E atk Generate the feature vector e of each session connection = {D len , σ len , R pkt , χ proto , H proto , E port}.

[0165] At every preset time interval t, a session connection feature matrix is ​​generated according to the number of session connections V

[0166] The learning module is used to save the network security assessment model based on SVM support vector machine.

[0167] The topological structure of the SVM support vector machine is:

[0168] Input layer: includes several nodes, each of which is used to input the session connection feature matrix A(t) at different time intervals t;

[0169] Hidden layer: Select RBF kernel as the nonlinear kernel function to map the data extracted from the session connection feature matrix A(t) to a high-dimensional space;

[0170] Output layer: It includes 8 nodes, corresponding to the safety scores of 8 test items. Each output value is between 0 and 100, or the string SKIP.

[0171] Furthermore, the historical network connection data and the corresponding security score vector are used to train the network security rating model based on the SVM support vector machine. Each input session connection feature matrix A(t) and the target security score vector are used as training samples.

[0172] Save the trained network security assessment model for subsequent network security assessment.

[0173] The attack simulation module performs an attack test on the network to be tested according to the test items and depth determined by the demand determination module. Subsequently, the security score vector {S1, S2, S3, S4, S5, S6, S7, S8} output by the learning module is recorded at every preset time interval t.

[0174] It should be understood that the terms “include” and “comprising” used in the specification and claims of the present disclosure indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or collections thereof.

[0175] It should also be understood that the terms used in this disclosure are only for the purpose of describing specific embodiments and are not intended to limit the disclosure. As used in this disclosure and the claims, the singular forms "a", "an", and "the" are intended to include the plural forms unless the context clearly indicates otherwise. It should also be further understood that the term "and / or" used in this disclosure and the claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes these combinations;

[0176] The preferred embodiments of the present invention disclosed above are only used to help explain the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to only specific implementation methods. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A network security testing method based on big data, characterized in that: The steps include: Step 1: Test environment setting and demand analysis: Determine the application field, application scenario and network environment of network security test through the test parameters input by the user; Determine the test items and depth through the application field, application scenario and network environment of network security test; Step 2: Network data collection: The network data recorded by data sources including network devices, IDS intrusion detection systems, firewalls, and log systems in the network to be tested are uniformly connected to the distributed data processing framework; Step 3: Feature extraction and representation; Extract network security-related features from the collected network data, including traffic features, protocol features, and port features; Extract network security related features from security information; Step 4: Establish a network security rating model; S401, model establishment: Establish a network security assessment model based on SVM support vector machine to evaluate the execution effect of network security defense in the subsequent attack simulation process; S402, model training: using historical network connection data and corresponding security score vectors to train a network security rating model based on an SVM support vector machine; using each input session connection feature matrix A(t) and target security score vector as training samples to carry out learning and training; Step 5: Attack simulation and vulnerability scanning; perform attack tests on the network to be tested according to the test items and depth determined in step 1; then, repeat step 3 once every preset time interval t, obtain the session connection feature matrix A(t) at each time t and output it to the network security rating model established in step 4 to obtain a security score vector; Step 6: Comprehensive analysis of test results and report generation; Visual display of the results of each test item; Get the weakness coefficient through the session connection feature matrix at different times, and determine the security vulnerability based on the weakness coefficient.

2. The network security testing method based on big data according to claim 1 is characterized in that: Determining the test items and depth is achieved in the test environment feature matching space.

3. The network security testing method based on big data according to claim 2 is characterized in that: The test environment feature matching space is three-dimensional, and a number of standard test environment feature vectors are preset. Wherein, i is the number symbol of the standard test environment feature vector; i=1, 2, ..., n; n is the total number of standard test environment feature vectors; each standard test environment feature vector corresponds to a set of preset test items, depth, test scope and test tools.

4. The network security testing method based on big data according to claim 1 is characterized in that: The specific process of extracting traffic features is as follows: The data flows with the same source IP address src_ip and destination IP address dst_ip are classified into the same session connection to obtain several session connections, each of which contains several data flows; and all the session connections are numbered, and the number symbol is Session_id; In the same session connection, each data stream is numbered, and the numbering symbol is j, j=1, 2, ..., m; m is the total number of data streams included in the session connection; The length of the data packet of each data stream j in the same session connection is recorded as pkt_len(j). Every preset time interval t, the preset formula Calculate the average packet length D of each session connection len and packet length fluctuation value σ len ; At every preset time interval t, obtain the maximum value Maxtimestamp and the minimum value Mintimestamp of the timestamp in each data stream j in the same session connection; through the preset formula Calculate network traffic density R pkt .

5. The network security testing method based on big data according to claim 1 is characterized in that: The specific process of extracting protocol features is as follows: Count the frequency of data flows of different protocol types in the same session connection, recorded as protocol occurrence frequency O k =O1, O2, ..., O K ; Where k is the number of the network protocol type proto; K is the total number of network protocol types; Get the expected frequency E of each network protocol type proto k =E1, E2, ..., E K , through the preset formula Calculate the protocol type abnormality χ proto , identify possible protocol abuse or attacks; Where ck is the preset weight factor; Statistics on the occupied time of data flows of different protocol types in the same connection, recorded as protocol occupied time T k =T1, T2, ..., T K ; Through the preset formula Calculate the protocol time dispersion H of different protocol types proto ; where D T is the mean of the protocol occupancy time; σ T is the standard deviation of the protocol occupancy time; where F k It is the standard value of the time taken by data flow of different protocol types.

6. The network security testing method based on big data according to claim 1 is characterized in that: The specific process of extracting port features is as follows: Count the number of visits to different destination port numbers dst_port in the same connection Nd p =Nd1,Nd2,...,Nd P ; Count the number of visits Ns of different source port numbers src_port in the same session connection p =Ns1,Ns2,...,Ns P ; Where p is the number of all port numbers; Where P is the total number of port numbers; By preset formula Calculate the port abnormal characteristic value E port , where c p is the preset weight factor.

7. The network security testing method based on big data according to claim 1 is characterized in that: The specific process of extracting network security related features from security information is as follows: At every preset time interval t, each alarm record is numbered according to the alarm record identifier alert_id, where the numbering symbol is q; q = 1, 2, ..., Q; the security feature value E(q) corresponding to the attack type of each alarm record identifier is obtained. attack_type ; Get the attack source IP address attack_src_ip(q) and attack target IP address attack_dst_ip(q) corresponding to each alarm record identifier number q; Get the network subnet size N corresponding to each alarm record identifier number q subnet (q); obtain the attack time period attack_timestamp(q) corresponding to each alarm record identifier number q; obtain the occurrence probability Sq of the attack signature corresponding to each alarm record identifier number q; By preset formula Calculate the attack characteristic value E atk ;in is the XOR symbol of the IP address; where w f 、w r 、w t and w h These are all preset weight factors.

8. The network security testing method based on big data according to claim 1 is characterized in that: Count the average length of data packets corresponding to each session connection D len , Data packet length fluctuation value σ len , network traffic density R pkt , protocol type abnormality χ proto , protocol time dispersion H proto , port abnormal characteristic value E port and attack characteristic value E atk ; Generate the feature vector e of each session connection = {D len , σ len , R pkt , χ proto , H proto , E port }; At every preset time interval t, a session connection feature matrix is ​​generated according to the number of session connections V 9. The network security testing method based on big data according to claim 1 is characterized in that: The specific process of obtaining the weak coefficient through the session connection feature matrix at different times is as follows: Extract the session connection feature matrix for each preset time interval Calculate and count the mean data packet length D corresponding to each session connection len , Data packet length fluctuation value σ len , network traffic density R pkt , protocol type abnormality χ proto , protocol time dispersion H proto and port abnormal characteristic value E port The derivative with respect to time t and By preset formula Calculate the weakness coefficient ω of each session connection, and mark the source IP address src_ip and target IP address corresponding to the session connection with a weakness coefficient ω greater than the preset one as an attack vulnerability; λ1, λ2, ..., λ6 are all preset weight coefficients; α is the preset linear influence factor, β is the preset exponential influence factor; μ is the average value operator.

10. A network security testing system based on big data, comprising a demand determination module, a data collection module, a database, a preprocessing module, a learning module and an attack simulation module, characterized in that: The requirement determination module is used to store a preset test environment feature matching space, which is three-dimensional and has a number of standard test environment feature vectors preset. Where i is the number of the standard test environment feature vector; i=1, 2, ..., n; n is the total number of standard test environment feature vectors; each standard test environment feature vector corresponds to a set of preset test items, depth, test scope and test tools; Determine the application field, application scenario and network environment of the network security test through the test parameters input by the user; obtain the environmental characteristic value E1 corresponding to the application field, the characteristic value E2 corresponding to the application scenario and the characteristic value E3 corresponding to the network environment, and generate the test environment characteristic vector (E1, E2, E3); By preset formula Calculate the test environment feature vector (E1, E2, E3) and each preset standard test environment feature vector and extract the maximum value MaxSimilarity(i) from Similarity(i)=Similarity(1), Similarity(2), ..., Similarity(n) to determine whether the test parameters input by the user match the standard test environment feature vector with the maximum matching value. Matching success; Finally, the output Corresponding test items and depth; The data collection module connects the network data recorded by data sources including network devices, IDS intrusion detection systems, firewalls, and log systems in the network to be tested to the distributed data processing framework; At every preset time interval t, the data flow in the network to be tested is managed through the distributed data processing framework, and the network traffic information contained in each data flow in the network data is extracted; At every preset time interval t, the security data in the network to be tested is managed through the distributed data processing framework, and network security information in the IDS intrusion detection system, firewall, and log system is extracted; The database stores the distributed data processing framework and the network traffic information and network security information it collects; The preprocessing module extracts network security-related features from the collected network data, including traffic features, protocol features, and port features; By extracting traffic features, we can obtain the average length of data packets, the fluctuation value of data packet length, and the network traffic density of each session connection. By extracting protocol features, we can obtain the protocol type abnormality and protocol time dispersion: By extracting the port features, the port abnormal feature value is obtained; Extract network security related features from security information. The specific process is as follows: At every preset time interval t, each alarm record is numbered according to the alarm record identifier alert_id, where the numbering symbol is q; q = 1, 2, ..., Q; the security feature value E(q) corresponding to the attack type of each alarm record identifier is obtained. attack_type ; Get the attack source IP address attack_src_ip(q) and attack target IP address attack_dst_ip(q) corresponding to each alarm record identifier number q; Get the network subnet size N corresponding to each alarm record identifier number q subnet (q); obtain the attack time period attack_timestamp(q) corresponding to each alarm record identifier number q; obtain the occurrence probability Sq of the attack signature corresponding to each alarm record identifier number q; By preset formula Calculate the attack characteristic value E atk ;in is the XOR symbol of the IP address; where w f 、w r 、w t and w h All are preset weight factors; Count the average length of data packets corresponding to each session connection D len , Data packet length fluctuation value σ len , network traffic density R pkt , protocol type abnormality χ proto , protocol time dispersion H proto , port abnormal characteristic value E port and attack characteristic value E atk ; Generate the feature vector e of each session connection = {D len , σ len , R pkt , χ proto , H proto , E port }; At every preset time interval t, a session connection feature matrix A(t) is generated according to the number of session connections V; The learning module is used to save the network security assessment model based on SVM support vector machine; The topological structure of the SVM support vector machine is: Input layer: includes several nodes, each of which is used to input the session connection feature matrix A(t) at different time intervals t; Hidden layer: Select RBF kernel as the nonlinear kernel function to map the data extracted from the session connection feature matrix A(t) to a high-dimensional space; Output layer: includes several nodes, corresponding to the safety scores of several test items; each output value is between 0 and 100, or the string SKIP; Use historical network connection data and the corresponding security score vector to train a network security rating model based on the SVM support vector machine; use each input session connection feature matrix A(t) and the target security score vector as training samples; Save the trained network security assessment model for subsequent network security assessment; The attack simulation module performs an attack test on the network to be tested according to the test items and depth determined by the demand determination module; then, the security score vector output by the learning module is recorded at a preset time interval t; the security score vector includes the security scores of several test items.

Images