Intelligent network security state prediction method and system

Abstract

The invention provides an intelligent network security state prediction method and system, and belongs to the technical field of network security, and the method comprises the steps: obtaining network time sequence index data, and carrying out the preprocessing of the network time sequence index data, and obtaining a training sample set; an improved Boosting evaluation algorithm is used to obtain a strong learner, and random feature clipping is carried out; by means of improvement of a hierarchical calculation system, an overall situation value is obtained by calculating the weight of importance of each host; and constructing and training an LSTM situation prediction model, and predicting the network security state by using the trained LSTM situation prediction model to complete intelligent network security state prediction. According to the method, the problems of multi-type data comprehensive analysis, targeted model improvement, multi-service scene situation calculation and the like in power information system network security situation assessment are solved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to an intelligent network security status prediction method and system. Background Art

[0002] With the rapid development of information technology, network security issues have become increasingly prominent, and network security status prediction has become one of the key technologies to ensure network security. In this context, many data preprocessing technologies and network security situation assessment models have emerged.

[0003] (1) Data preprocessing is an important step to improve data quality and ensure the accuracy of subsequent analysis. It mainly includes two aspects: data cleaning and data dimensionality reduction.

[0004] (2) Network status prediction and evaluation model

[0005] Classic models include the Endsley three-layer perception model, the JDL model, and the Tim Bass model. The Endsley three-layer perception model simulates human cognitive behavior, covering three stages: situation element extraction, situation understanding, and situation prediction. It provides an effective method for situation awareness by analyzing various factors that affect the situation, but in actual applications, it needs to be further refined and improved in combination with specific scenarios. The JDL model is mainly used for situation awareness in military and battlefield scenarios. It is divided into six levels, which closely collaborate from the data preprocessing layer to the knowledge extraction layer to efficiently perceive the battlefield situation. However, it needs to be appropriately improved when applied to other scenarios. The Tim Bass model integrates data from many sensors and perceives the network security situation through a five-layer structure. It emphasizes the importance of data fusion and needs to be further optimized when facing complex network environments and diversified business needs.

[0006] In addition to the classic model, there are other models. The hierarchical analysis model calculates the security situation in the hierarchical order of attacks, services, hosts and the entire network. The hierarchical structure is clear and easy to visualize and understand, but it may be affected by subjective factors during data integration and weighting. Models based on neural networks, such as BP neural networks, RBF neural networks and generalized regression neural networks, have the advantages of strong nonlinear fitting ability and simple learning rules, but they are sensitive to parameter selection during training, and inappropriate parameters will seriously affect the accuracy of the model. Models based on support vector machines have advantages in scenarios such as small samples, nonlinear and high-dimensional pattern recognition. By introducing kernel functions to solve problems, they have strong adaptability and generalization performance. Models based on Bayesian networks are based on the Bayesian formula, use directed acyclic graphs to describe node relationships, and estimate node state probabilities through learning parameters. In practical applications, due to the lack of understanding of the network topology, it is necessary to find a suitable architecture.

[0007] To improve model performance, ensemble learning combines multiple weak learners into a strong learner using a certain strategy. The combination methods include homogeneous and heterogeneous methods. The generalization performance of the model is improved by combining the advantages of multiple learners.

[0008] According to the research and description of the above existing methods, there are still some problems and challenges in the actual application of state prediction, which are also the main problems to be solved by the present invention:

[0009] 1. Data preprocessing

[0010] There are many problems with data preprocessing. First, there is a lack of a unified standard process. Different data require different processing methods, and some methods have limitations. For example, when filling missing values, some methods are not ideal when the data volume or complex data structure is large, which makes it difficult to effectively ensure data quality, thus affecting subsequent analysis and evaluation.

[0011] 2. Cybersecurity situation assessment model

[0012] 1. Single system is not targeted enough

[0013] Existing research focuses on a single system, ignoring the fact that actual business scenarios often involve multiple services. This leads to difficulties in applying the model to multi-service scenarios and makes it impossible to accurately assess the security situation in complex network environments.

[0014] 2. Model accuracy issues

[0015] Traditional mathematical model-based methods require a lot of expert experience, a large workload, and the evaluation contains subjective factors. In addition, some single classifiers have poor generalization performance and stability, and their performance degrades when facing difficult samples and noisy samples of power information systems, affecting the accuracy of the evaluation.

[0016] 3. Insufficient quantification of the situation

[0017] Many studies only evaluate the network security situation, lack a quantitative process, and the results are not intuitive. It is impossible to construct a situation trend chart, which is not conducive to decision makers and operation and maintenance personnel to grasp and make decisions on the network security situation.

[0018] 4. Unreasonable hierarchy

[0019] Some hierarchical evaluation models do not take into account changes in network structure, and the hierarchical division is unreasonable. For example, some models place the host layer above the service layer, which is not conducive to fault tracing and security situation value calculation, affecting the practicality and effectiveness of the model.

[0020] In summary, although the existing data preprocessing technology and network security situation assessment model have laid a certain foundation for network security protection, there are still many shortcomings that need further research and improvement to meet the increasingly complex network environment and diversified business needs. Summary of the invention

[0021] In view of the above-mentioned deficiencies in the prior art, the present invention provides an intelligent network security status prediction method and system. The purpose of the present invention is to design and implement a security situation assessment system based on ensemble learning. By mining and analyzing indicators and alarm data, the power information system in multiple service scenarios is evaluated and the future operation status is predicted, so as to provide technical support for operation and maintenance personnel.

[0022] In order to achieve the above objectives, the technical solution adopted by the present invention is: an intelligent network security status prediction method, comprising the following steps:

[0023] S1. Obtain network timing indicator data, and preprocess the network timing indicator data to obtain a training sample set;

[0024] S2. Based on the training sample set, the improved Boosting evaluation algorithm is used to obtain a strong learner and perform random feature pruning.

[0025] S3, taking the processing result of step S2 as input, using the improvement of the hierarchical computing system, and obtaining the overall situation value by calculating the weight of the importance of each host;

[0026] S4. Use the overall situation value to build and train the LSTM situation prediction model, and use the trained LSTM situation prediction model to predict the network security status to complete the intelligent network security status prediction.

[0027] The beneficial effects of the present invention are as follows: the present invention overcomes the limitations of the prior art and improves the comprehensive analysis capability of multi-type data through a variety of data preprocessing methods, such as neighborhood mean filling, SAE dimensionality reduction, alarm information extraction and fusion, etc.; the present invention is based on an improved Boosting algorithm, and solves the problems of difficult samples and noise samples by limiting weight updates and random feature clipping, thereby improving the accuracy of the model; the present invention combines the advantages of multiple weak learners, has better generalization than a single classifier, and improves accuracy; at the same time, the present invention improves the hierarchical computing system, divides it into four layers, and calculates weights through AHP, which is suitable for multi-service scenarios and solves the limitations of the existing single system model.

[0028] Furthermore, the step S1 includes the following steps:

[0029] S101, obtaining network timing indicator data;

[0030] S102: When network time series indicator data is missing, the neighborhood mean filling method is used to select the first 5 pieces of data and the last 5 pieces of data of the missing data, and the average value of the selected 10 pieces of data is calculated to fill the missing position;

[0031] S103, add a regular term to control sparsity in the original loss function, and map each unlabeled training data n'-dimensional vector to an m'-dimensional encoding vector x through a hidden layer h , in order to achieve dimensionality reduction processing of network time series indicator data;

[0032] S104, when checking and recording the network timing indicator data after the dimension reduction process, if the network timing indicator data already exists at the time point, the new value is not recorded, and the existing network timing indicator data is normalized;

[0033] S105, extracting key information from the alarm data;

[0034] S106: splice the normalized network timing indicator data with the extracted alarm key information to obtain network timing specification data, perform numerical processing to obtain a training sample set, and complete the preprocessing of the network timing indicator data.

[0035] The beneficial effect of the above further scheme is that the present invention optimizes the model performance by iteratively updating the sample weights and classifier weights. This scheme not only improves the adaptability and accuracy of the model to complex data sets, but also enhances the robustness of the model by dynamically adjusting the focus during the learning process. The adaptive learning mechanism ensures that the model can effectively respond to various data characteristics, especially in unbalanced or variable data environments. In addition, the method also improves the computational efficiency and the generalization ability of the model by optimizing resource allocation and reducing the risk of overfitting, and is suitable for use in resource-constrained scenarios.

[0036] Furthermore, the original loss function of step S103 is expressed as follows:

[0037]

[0038] Among them, J(w,b) represents the original loss function, n represents the number of samples, and x′ i represents the actual input data of the i-th group of samples, x″ i represents the output result of the i-th group of sample data, γ represents the regularization coefficient, ω1 and ω2 both represent weight vectors, β represents the coefficient of the penalty term, j represents the index of a single neuron in the hidden layer, S h represents the total number of hidden layer neurons, KL(ρ||ρ j ) represents ρ and ρ j The relative information entropy between them, ρ represents the preset sparse parameter, ρ j represents the actual average activation value of the jth hidden layer neuron, w and b represent the weight and bias respectively.

[0039] The beneficial effect of the above further scheme is that the loss function combines multiple objectives to optimize the model to improve prediction accuracy and promote sparsity of feature selection. It contains a term to enhance the accuracy of the model's reconstruction of the data, ensuring that the model can accurately restore or predict the input data. At the same time, through the weighted square term, it helps to control the complexity of the model, prevent overfitting, and ensure the generalization ability of the model. In addition, through the KL divergence term, the function further promotes the sparsity of the model weights, helping the model to focus on a few key features, thereby improving the interpretability and computational efficiency of the model. Overall, this composite loss function effectively optimizes the multi-faceted performance of the model by establishing a balance between accuracy, complexity, and sparsity.

[0040] Furthermore, step S2 includes the following steps:

[0041] S201, assign initial weights to the training data, and use the training data with the initial weights to classify the first classifier G k (x) Perform training to obtain the first weak classifier;

[0042] S202, calculate the error of the first weak classifier based on the sample weights, and adjust the training set sample weights according to the error to update the weight distribution ω of the next round of training sample sets k'+1 ;

[0043] S203, determine whether all weak classifiers have been trained. If so, linearly combine all weak classifiers into a strong learner G(x), and proceed to step S204, otherwise, return to step S201;

[0044] S204, selecting the network time series indicator data with the largest sample weight after training, randomly cropping it, and setting the selected feature points to zero.

[0045] The beneficial effect of the above further scheme is: the present invention describes a process for optimizing machine learning models through reinforcement learning and adjustment strategies. In step S201, the performance of the model is enhanced by introducing a new classifier; the subsequent step S202 further optimizes the effects of these classifiers and adjusts the sample weights to enhance the next round of learning. Step S203 repeats this process to ensure that each round of learning can accurately adjust for difficult samples. Finally, in step S204, the model is further simplified through trimming operations to reduce unnecessary complexity and make the model more streamlined and efficient. The entire process effectively improves the prediction accuracy and generalization ability of the model through continuous iteration and dynamic adjustment, while also optimizing the use of computing resources, making the model more efficient and stable when processing large-scale data.

[0046] Furthermore, the expression of the strong learner G(x) is as follows:

[0047]

[0048] Among them, sign() represents the sign function, k represents the kth weak classifier, T represents the total number of weak classifiers, α k represents the normalization factor, G k (x) represents multiple weak classifiers, e k represents the error of the weak classifier, P() represents the probability, y represents the true label, i represents the i-th group of samples, m represents the total number of training samples, ω k'i represents the weight of sample x in the k'th round of training, I represents the indicator function, G k (x i ) represents the prediction result of the kth weak classifier for the i-th group of samples x, y i Represents the true label of the i-th group of samples.

[0049] Furthermore, the weight distribution of the next round of training sample set is updated k+1 The update rules are as follows:

[0050] In each round of training of the weak classifier, the weight average and standard deviation of the training sample data set are calculated respectively. When the deviation between a certain sample weight and the average sample weight before update is less than the threshold, the weight distribution ω is stopped. k'+1 The update of ω k'i to update.

[0051] The further scheme has the following beneficial effects: This step describes the process of using a boosting algorithm (Boosting) to improve the prediction performance through an integration of a series of classifiers. In each iteration, by adjusting the weights of each classifier, the process strengthens the overall model's ability to fit the data. This method calculates the error rate of each classifier and adjusts its weight accordingly, so that the poorly performing classifiers have a higher chance of improvement in subsequent iterations, while the well-performing classifiers maintain relatively small weight adjustments. This mechanism ensures that the model not only focuses on data that is easy to classify correctly, but also on samples that are difficult to classify correctly, thereby improving the model's generalization ability to the overall data set.

[0052] Furthermore, step S3 includes the following steps:

[0053] S301, using the attack layer to obtain network information according to the updated weight distribution of the training sample set;

[0054] S302, combining the updated classifier weights, using the host layer to perform fusion processing on the acquired network information, and perform security status analysis and evaluation;

[0055] S303, at the service layer, the host importance weight is calculated based on the adjustment of the training sample set weight, and the service status value is obtained in combination with the analysis and evaluation results;

[0056] S304: Using the system layer, based on the adjusted sample set weights and classifier effects, the service status values ​​are integrated to obtain an overall status value.

[0057] The beneficial effect of the above further scheme is that the present invention relates to the training process of the LSTM situation prediction model, starting from data collection and preprocessing, optimizing data representation through feature engineering, then training and verifying the model, and finally optimizing the model to ensure optimal performance. The entire process aims to improve the prediction accuracy and response efficiency of the model through refined data processing and systematic model evaluation, and is particularly suitable for scenarios that require highly accurate security situation analysis. This method ensures the effectiveness and reliability of the model in actual operation by integrating technical processing at each stage.

[0058] The present invention provides an intelligent network security status prediction system, which is used to execute an intelligent network security status prediction method, including:

[0059] A data preprocessing module is used to obtain network timing indicator data and preprocess the network timing indicator data to obtain a training sample set;

[0060] The situation assessment module is used to obtain a strong learner based on the training sample set using the improved Boosting evaluation algorithm and perform random feature clipping;

[0061] The situation quantification module is used to take the results processed by the situation assessment module as input, and use the improvement of the hierarchical computing system to obtain the overall situation value by calculating the weight of the importance of each host;

[0062] The situation prediction module is used to use the overall situation value to build and train the LSTM situation prediction model, and use the trained LSTM situation prediction model to predict the network security status to complete the intelligent network security status prediction.

[0063] The beneficial effects of the present invention are as follows: the present invention overcomes the limitations of the prior art and improves the comprehensive analysis capability of multi-type data through a variety of data preprocessing methods, such as neighborhood mean filling, SAE dimensionality reduction, alarm information extraction and fusion, etc.; the present invention is based on an improved Boosting algorithm, and solves the problems of difficult samples and noise samples by limiting weight updates and random feature clipping, thereby improving the accuracy of the model; the present invention combines the advantages of multiple weak learners, has better generalization than a single classifier, and improves accuracy; at the same time, the present invention improves the hierarchical computing system, divides it into four layers, and calculates weights through AHP, which is suitable for multi-service scenarios and solves the limitations of the existing single system model. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] Figure 1 The figure is a flow chart of the method of the present invention.

[0065] Figure 2 It is a schematic diagram of the system structure of the present invention. DETAILED DESCRIPTION

[0066] The specific implementation modes of the present invention are described below so that those skilled in the art can understand the present invention. However, it should be clear that the present invention is not limited to the scope of the specific implementation modes. For those of ordinary skill in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the attached claims, these changes are obvious, and all inventions and creations utilizing the concept of the present invention are protected.

[0067] Example 1

[0068] Based on the above background technology, it can be seen that the invention aims to solve a series of key technical problems in the prediction of network security status of power information system and achieve the corresponding purpose. The technical problems to be solved include: first, the problem of comprehensive analysis of multi-type data. The power information system has a large amount of indicator data and alarm data, but lacks comprehensive processing and unified analysis methods; second, the problem of targeted model improvement. The previous situation assessment model has not been improved enough for specific data problems. When facing difficult samples and noise samples in the power system, the model performance decreases; third, the situation calculation problem of multi-service scenarios. The actual business contains multiple services, and most of the existing models for a single system are difficult to apply.

[0069] like Figure 1 As shown, the present invention provides an intelligent network security status prediction method, and its implementation method is as follows:

[0070] S1. Obtain network timing indicator data, and preprocess the network timing indicator data to obtain a training sample set. The implementation method is as follows:

[0071] S101, obtaining network timing indicator data;

[0072] S102: When network time series indicator data is missing, the neighborhood mean filling method is used to select the first 5 pieces of data and the last 5 pieces of data of the missing data, and the average value of the selected 10 pieces of data is calculated to fill the missing position;

[0073] S103, add a regular term to control sparsity in the original loss function, and map each unlabeled training data n'-dimensional vector to an m'-dimensional encoding vector x through a hidden layer h , in order to achieve dimensionality reduction processing of network timing indicator data, wherein the network timing indicator data after dimensionality reduction is then subjected to subsequent normalization processing, and dimensionality reduction is to eliminate unnecessary calculations caused by redundant data.

[0074] S104, when checking and recording the network timing indicator data after the dimension reduction process, if the network timing indicator data already exists at the time point, the new value is not recorded, and the existing network timing indicator data is normalized;

[0075] S105, extracting key information from the alarm data;

[0076] S106: splice the normalized network timing indicator data with the extracted alarm key information to obtain network timing specification data, perform numerical processing to obtain a training sample set, and complete the preprocessing of the network timing indicator data.

[0077] In this embodiment, in the data preprocessing layer, the time series indicator data is first processed. The neighborhood mean filling method is used to fill missing values, and the average value is calculated and filled by a specific formula. The SAE algorithm is used for data dimensionality reduction, and its core is to define a loss function containing multiple factors and optimize it through the gradient descent method. At the same time, duplicate value deletion and data normalization are also performed. In addition, key information is extracted from the alarm data, and the indicator data and alarm key information are merged.

[0078] Missing value filling: The neighborhood mean filling method is used. For the collected indicator data, if there is a missing value, select the first 5 data and the last 5 data of the missing data, calculate the average value of these 10 data, and fill in the missing position. The formula is to calculate the average value of these 10 data (Assume that the missing position data is x0, and the previous and next data are x -5 ,x -4 ,...,x4,x5), using the average Fill in x0, where the expression for the mean is as follows:

[0079]

[0080] Among them, x iRepresents an observation in network time series metric data.

[0081] Data dimensionality reduction: SAE (Sparse AutoEncoder) is used as the data dimensionality reduction algorithm. A regularization term to control sparsity is added to the original loss function, and each unlabeled training data n-dimensional vector x' is mapped into an m'-dimensional encoding vector x through the hidden layer. h . Its core is to define the loss function:

[0082]

[0083] Among them, J(w,b) represents the original loss function, n represents the number of samples, and x′ i represents the actual input data of the i-th group of samples, x″ i represents the output result of the i-th group of sample data, γ represents the regularization coefficient, ω1 and ω2 both represent weight vectors, β represents the coefficient of the penalty term, j represents the index of a single neuron in the hidden layer, S h represents the total number of hidden layer neurons, KL(ρ||ρ j ) represents ρ and ρ j The relative information entropy between them, ρ represents the preset sparse parameter, ρ j represents the actual average activation value of the jth hidden layer neuron, w and b represent the weight and bias of the model respectively, S h Represents the number of neurons in the hidden layer. This function and parameters ω and b are optimized by gradient descent to achieve data dimensionality reduction.

[0084] Other processing: Duplicate value deletion adopts the method of ignoring new values, that is, checking whether there is data at the time point when recording data. If there is, the new value is not recorded. Data normalization adopts the minimum-maximum standard method, and the formula is Reduce the data size range to between 0 and 1, where x' represents the normalized data point, whose value will be converted to between 0 and 1, and x represents the original data point, that is, the data without normalization. min Represents the minimum value in the data set, used as the bottom line for data normalization, x max Indicates the maximum value in the data set and is used as the upper limit for data normalization.

[0085] Extraction of key alarm information: Extract key information such as the host's most recent unhandled alarm time, level, type, total number of unhandled alarms, average level, maximum level, etc. from the alarm data.

[0086] Indicator alarm data fusion: The indicator data and alarm key information are spliced ​​with the network timing specification data, and the result status is digitized, and five classification results are marked with "-2, -1, 0, 1, 2".

[0087] S2. Based on the training sample set, the improved Boosting evaluation algorithm is used to obtain a strong learner and perform random feature clipping. The implementation method is as follows:

[0088] S201, assign initial weights to the training data, and use the training data with the initial weights to classify the first classifier G k (x) Perform training to obtain the first weak classifier;

[0089] S202, calculate the error of the first weak classifier based on the sample weights, and adjust the training set sample weights according to the error to update the weight distribution ω of the next round of training sample sets k'+1 ;

[0090] S203, determine whether all weak classifiers have been trained. If so, linearly combine all weak classifiers into a strong learner G(x), and proceed to step S204, otherwise, return to step S201;

[0091] S204, selecting the network time series indicator data with the largest sample weight after training, randomly cropping it, and setting the selected feature points to zero.

[0092] In this embodiment, update the weight distribution ω of the next round of training sample set k'+1 The update rule is as follows: in each round of training of the weak classifier, the weight average and standard deviation of the training sample data set are calculated respectively. When the deviation between a certain sample weight and the average sample weight before the update is less than the threshold, the weight distribution ω is stopped. k'+1 The update of ω k'i to update.

[0093] In this embodiment, in the situation assessment layer, the Boosting evaluation algorithm is first implemented, including a series of steps such as initializing weights, training weak classifiers, calculating errors and adjusting weights, and finally combining them into a strong learner. On this basis, the Boosting algorithm is improved. On the one hand, the weight update rule is improved, and the weight average and standard deviation are calculated to limit the increase of sample weights; on the other hand, random feature clipping is performed to combat noise.

[0094] Boosting evaluation algorithm implementation: Boosting algorithm is used as the evaluation layer algorithm. First, the training data is assigned an initial weight D1 = (ω 11 ,ω 12 ,...,ω 1m ), Then use the training data with initial weights to train the first classifier G k (x) is trained to obtain the first weak classifier. The error of the weak learner is calculated by combining the sample weights Among them, I(t) is a universal function. When the parameter t is true, the output is 1, and when it is false, the output is 0. According to the error performance, the weight of the training set samples is adjusted, and the weight distribution of the next round of training sample set is updated ω k'+1 , in, is the normalization factor. Repeat this process until all weak learners are trained, and finally these weak learners are linearly combined into a strong learner:

[0095]

[0096] Among them, sign() represents the sign function, k represents the kth weak classifier, T represents the total number of weak classifiers, α k represents the normalization factor, G k (x) represents multiple weak classifiers, e k represents the error of the weak classifier, P() represents the probability, y represents the true label, i represents the i-th group of samples, m represents the total number of training samples, ω k'i represents the weight of sample x in the k'th round of training, I represents the indicator function, G k (x i ) represents the prediction result of the kth weak classifier for the i-th group of samples x, y i Represents the true label of the i-th group of samples.

[0097] Improved Boosting evaluation algorithm: Improved weight update rule: In each round of training of weak classifiers, calculate the weighted average of the training sample data set and standard deviation If the deviation between a sample weight and the average sample weight before updating is greater than 3σ, the weight corresponding to this sample will no longer increase.

[0098] Random feature cropping: Select a part of the data with the largest sample weight after the previous round of weak classifier training, and randomly crop the feature points to zero to combat the overfitting phenomenon caused by noise.

[0099] In this step, the strong learner generated in step S2 is obtained through the Boosting evaluation algorithm, which usually means that multiple weak learners are combined into a single model with stronger performance through a specific algorithm. In the whole process, the strong learner generated in step S2 is used in step S3 as part of the input data.

[0100] S3, taking the processing result of step S2 as input, using the improvement of the hierarchical computing system, and calculating the weight of the importance of each host to obtain the overall situation value, the implementation method is as follows:

[0101] S301, using the attack layer to obtain network information according to the updated weight distribution of the training sample set;

[0102] S302, combining the updated classifier weights, using the host layer to perform fusion processing on the acquired network information, and perform security status analysis and evaluation;

[0103] S303, at the service layer, the host importance weight is calculated based on the adjustment of the training sample set weight, and the service status value is obtained in combination with the analysis and evaluation results;

[0104] S304: Using the system layer, based on the adjusted sample set weights and classifier effects, the service status values ​​are integrated to obtain an overall status value.

[0105] This embodiment further illustrates the above steps:

[0106] S301: This step uses the training sample weights adjusted in S2 to reselect or resample samples for a new round of weak classifier training or verification.

[0107] S302: This step requires the classifier weights updated from step S2 to decide which samples or data features need more or less attention.

[0108] S303: The adjustment of the training sample weights in this step can affect how to perform feature selection and the final evaluation of the samples, especially in scenarios where weights are needed to measure the importance of samples.

[0109] S304: The final strategy evaluation and decision making in this step may depend on the training sample weights and classifier effects adjusted by step S2 to evaluate the performance of the entire system.

[0110] In this embodiment, at the situation quantification layer, the hierarchical computing system is improved and divided into four levels: attack layer, host layer, service layer and the entire system. The attack layer collects information, the host layer performs information fusion and risk quantification calculation, and calculates the risk value according to the CVSS scoring system formula. The service layer calculates the host importance weight through the AHP hierarchical analysis method and combines the risk value to obtain the service situation value. The entire system level then integrates the service situation values ​​to obtain the overall situation value.

[0111] Improvement of hierarchical computing system: The hierarchical structure is divided into four levels: attack layer, host layer, service layer and the entire system. The attack layer is responsible for collecting network-related information. The host layer integrates information related to the network related information of the host, and analyzes and evaluates the security status through the network security status prediction model. The host risk is quantitatively calculated based on the CVSS common vulnerability scoring system and the security status classification results of the host layer. Assume that the confidentiality weight, integrity weight, and availability weight are ω1, ω2, and ω3 respectively. According to the CVSS scoring calculation method, the quantitative score of risk class i' is R i =10*AV*AC*AU*(C*ω1+I*ω2+A*ω3), where AV, AC, AU, C, I, and A are the relevant values ​​of attack path, attack complexity, authentication, confidentiality, integrity, and availability. The service layer calculates the weight of each host's importance through the AHP hierarchical analysis method based on the host-related information.

[0112] S4. Build and train the LSTM situation prediction model, and use the trained LSTM situation prediction model to predict the network security status to complete the intelligent network security status prediction.

[0113] In the situation prediction layer, the LSTM situation prediction model is used to predict the security status. The LSTM situation prediction model includes a forget gate, an input gate, and an output gate. The information retention of the previous state of the forget gate is Indicates that, X t represents the input vector at the current time t, H t-1 is the output of the previous moment, σ is the activation function, w f and b f are the relevant weights and biases. The input threshold is expressed as The candidate unit state is represented as Update the current unit status The mean square error (MSE) is selected as the loss function, and the LSTM situation prediction model is trained based on the hidden layer output and the state. The particle swarm algorithm (PSO) is used to optimize the LSTM situation prediction model.

[0114] In this embodiment, the LSTM situation prediction model training process is as follows:

[0115] Data preprocessing (step S1): Collect and clean network time series indicator data to ensure data quality, provide a stable basis for training, and extract relevant features, such as ROI features of images or key information of text descriptions.

[0116] Training strong learners (step S2): Multiple weak learners are combined using the Boosting evaluation algorithm, and multiple weak learners are gradually improved and adjusted to minimize the overall prediction error. In each round of the Boosting evaluation algorithm, the weights of the weak learners are adjusted to focus on improving the parts that were not predicted by the previous model.

[0117] LSTM situation prediction model integration and further training (S3): The output of the strong learner trained in step S2 is combined into the new analysis model, and the training is continued to optimize the model parameters in step S3 to ensure that the new composite model (i.e., LSTM situation prediction model) can effectively process wider or deeper data features.

[0118] The application of the LSTM situation prediction model (S4) is as follows: the overall situation value output from step S3 is used as input, and the LSTM situation prediction model is trained to capture the time series features or other sequence dependencies in the data. The LSTM situation prediction model focuses on learning long-term dependencies from sequence data, so that the model can predict future trends or patterns.

[0119] Prediction output results of the LSTM situation prediction model: Input new or unseen data into the trained LSTM situation prediction model, first through the preprocessing data of step S1, and then through steps S2, S3 and S4 in sequence, each step adjusts its prediction according to the output of the previous step.

[0120] Prediction result analysis: The final prediction result output is generated by the LSTM situation prediction model in step S4, which integrates the information of all previous steps.

[0121] Analyze prediction results and evaluate model performance: Through this detailed training and prediction process, we can ensure that the model fully learns and integrates various data features and patterns at each stage, so as to provide high-quality prediction output in practical applications.

[0122] In this embodiment, the loss function of the LSTM situation prediction model is the mean square error MSE, which is expressed as follows:

[0123]

[0124] Where n represents the number of samples, that is, the total number of observations in the data set, and y i represents the actual value of the i-th observation, and is the target value that we want to predict accurately, y i Represents the predicted value of the i-th observation, which is the model's prediction of y based on the input data i The estimate of (y i -y i ) 2Represents the square of the difference between the actual value and the predicted value, used to quantify the error size of a single prediction. The mean squared error ensures that all errors are non-negative and gives heavier penalties for larger errors.

[0125] In summary, based on the above design, the present invention solves the problems of comprehensive analysis of multi-type data, targeted model improvement, and multi-service scenario situation calculation in network security situation assessment of power information systems.

[0126] Example 2

[0127] like Figure 2 As shown, the present invention provides an intelligent network security status prediction system, which is used to execute the intelligent network security status prediction method described in Example 1, including:

[0128] A data preprocessing module is used to obtain network timing indicator data and preprocess the network timing indicator data to obtain a training sample set;

[0129] The situation assessment module is used to obtain a strong learner based on the training sample set using the improved Boosting evaluation algorithm and perform random feature clipping;

[0130] The situation quantification module is used to take the results processed by the situation assessment module as input, and use the improvement of the hierarchical computing system to obtain the overall situation value by calculating the weight of the importance of each host;

[0131] The situation prediction module is used to use the overall situation value to build and train the LSTM situation prediction model, and use the trained LSTM situation prediction model to predict the network security status to complete the intelligent network security status prediction.

[0132] like Figure 2 The intelligent network security status prediction system provided by the illustrated embodiment can execute the technical solution shown in the intelligent network security status prediction method of the above method embodiment, and its implementation principle and beneficial effects are similar and will not be repeated here.

[0133] In this embodiment, the present application can divide the functional units according to the intelligent network security status prediction method. For example, each function can be divided into each functional unit, or two or more functions can be integrated into one processing unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. It should be noted that the division of units in the present invention is schematic and is only a logical division. There may be other division methods in actual implementation.

[0134] In this embodiment, in order to realize the principles and beneficial effects of the intelligent network security status prediction method, the intelligent network security status prediction system includes hardware structures and / or software modules that perform corresponding functions. Those skilled in the art should easily realize that, in combination with the schematic units and algorithm steps described in the embodiments disclosed in the present invention, the present invention can be implemented in the form of hardware and / or a combination of hardware and computer software. Whether a function is executed in a hardware or computer software driven manner depends on the specific application and design constraints of the technical solution. Different methods can be used for each specific application to implement the described function, but such implementation should not be considered to exceed the scope of this application.

Claims

1. An intelligent network security status prediction method, characterized in that: The following steps are involved: S1. Obtain network timing indicator data, and preprocess the network timing indicator data to obtain a training sample set; S2. Based on the training sample set, the improved Boosting evaluation algorithm is used to obtain a strong learner and perform random feature pruning. S3, taking the processing result of step S2 as input, using the improvement of the hierarchical computing system, and obtaining the overall situation value by calculating the weight of the importance of each host; S4. Use the overall situation value to build and train the LSTM situation prediction model, and use the trained LSTM situation prediction model to predict the network security status to complete the intelligent network security status prediction.

2. The intelligent network security status prediction method according to claim 1 is characterized in that: The step S1 comprises the following steps: S101, obtaining network timing indicator data; S102: When network time series indicator data is missing, the neighborhood mean filling method is used to select the first 5 pieces of data and the last 5 pieces of data of the missing data, and the average value of the selected 10 pieces of data is calculated to fill the missing position; S103, add a regular term to control sparsity in the original loss function, and map each unlabeled training data n'-dimensional vector to an m'-dimensional encoding vector x through a hidden layer h , in order to achieve dimensionality reduction processing of network time series indicator data; S104, when checking and recording the network timing indicator data after the dimension reduction process, if the network timing indicator data already exists at the time point, the new value is not recorded, and the existing network timing indicator data is normalized; S105, extracting key information from the alarm data; S106: splice the normalized network timing indicator data with the extracted alarm key information to obtain network timing specification data, perform numerical processing to obtain a training sample set, and complete the preprocessing of the network timing indicator data.

3. The intelligent network security status prediction method according to claim 2 is characterized in that: The expression of the original loss function in step S103 is as follows: Among them, J(w,b) represents the original loss function, n represents the number of samples, and x' i Represents the actual input data of the i-th group of samples, x" i represents the output result of the i-th group of sample data, γ represents the regularization coefficient, ω1 and ω2 both represent weight vectors, β represents the coefficient of the penalty term, j represents the index of a single neuron in the hidden layer, S h represents the total number of hidden layer neurons, KL(ρ||ρ j ) represents ρ and ρ j The relative information entropy between them, ρ represents the preset sparse parameter, ρ j represents the actual average activation value of the jth hidden layer neuron, w and b represent the weight and bias respectively.

4. The intelligent network security status prediction method according to claim 1 is characterized in that: The step S2 comprises the following steps: S201, assign initial weights to the training data, and use the training data with the initial weights to classify the first classifier G k (x) Perform training to obtain the first weak classifier; S202, calculate the error of the first weak classifier based on the sample weights, and adjust the training set sample weights according to the error to update the weight distribution ω of the next round of training sample sets k'+1 ; S203, determine whether all weak classifiers have been trained. If so, linearly combine all weak classifiers into a strong learner G(x), and proceed to step S204, otherwise, return to step S201; S204, selecting the network time series indicator data with the largest sample weight after training, randomly cropping it, and setting the selected feature points to zero.

5. The intelligent network security status prediction method according to claim 4 is characterized in that: The expression of the strong learner G(x) is as follows: Among them, sign() represents the sign function, k represents the kth weak classifier, T represents the total number of weak classifiers, α k represents the normalization factor, G k (x) represents multiple weak classifiers, e k represents the error of the weak classifier, P() represents the probability, y represents the true label, i represents the i-th group of samples, m represents the total number of training samples, ω k'i represents the weight of sample x in the k'th round of training, I represents the indicator function, G k (x i ) represents the prediction result of the kth weak classifier for the i-th group of samples x, y i Represents the true label of the i-th group of samples.

6. The intelligent network security status prediction method according to claim 5 is characterized in that: The update weight distribution ω of the next round of training sample set k'+1 The update rules are as follows: In each round of training of the weak classifier, the weight average and standard deviation of the training sample data set are calculated respectively. When the deviation between a certain sample weight and the average sample weight before update is less than the threshold, the weight distribution ω is stopped. k'+1 The update of ω k'i to update.

7. The intelligent network security status prediction method according to claim 4 is characterized in that: The step S3 comprises the following steps: S301, using the attack layer to obtain network information according to the updated weight distribution of the training sample set; S302, combining the updated classifier weights, using the host layer to perform fusion processing on the acquired network information, and perform security status analysis and evaluation; S303, at the service layer, the host importance weight is calculated based on the adjustment of the training sample set weight, and the service status value is obtained in combination with the analysis and evaluation results; S304: Using the system layer, based on the adjusted sample set weights and classifier effects, the service status values ​​are integrated to obtain an overall status value.

8. An intelligent network security status prediction system, characterized in that: The intelligent network security status prediction system is used to execute an intelligent network security status prediction method, including: A data preprocessing module is used to obtain network timing indicator data and preprocess the network timing indicator data to obtain a training sample set; The situation assessment module is used to obtain a strong learner based on the training sample set using the improved Boosting evaluation algorithm and perform random feature clipping; The situation quantification module is used to take the results processed by the situation assessment module as input, and use the improvement of the hierarchical computing system to obtain the overall situation value by calculating the weight of the importance of each host; The situation prediction module is used to use the overall situation value to build and train the LSTM situation prediction model, and use the trained LSTM situation prediction model to predict the network security status to complete the intelligent network security status prediction.

Images