A network security testing and evaluation system

Abstract

This invention discloses a network security testing and assessment system, comprising: a data acquisition module; a prediction model module; a response strategy generation module; a feedback and learning module; a system management and control module; and a security assessment report generation module. By introducing a prediction model, the system predicts the intensity and likelihood of network attacks in real time and takes appropriate measures based on the prediction results. This enables the security system to make judgments and prepare for attacks before they occur, reducing the likelihood of successful attacks and minimizing the losses caused by attacks.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a network security testing and evaluation system. Background Art

[0002] With the rapid development of the internet and the widespread adoption of informatization, network security has become a core concern across all industries. The forms and methods of cyberattacks are becoming increasingly diverse and complex, posing significant security risks to businesses, governments, and individual users. Traditional network security measures, such as firewalls, intrusion detection systems, and antivirus software, while capable of providing a certain degree of protection, are often based on defending against known threats and are therefore limited in their effectiveness against new or unknown attack vectors. In recent years, with the advancement of big data, artificial intelligence (AI), and machine learning (ML), the network security field has gradually begun to incorporate these technologies to enhance its ability to detect and defend against cyberattacks. In particular, by building predictive models to analyze and process large amounts of network traffic and user behavior data, it is possible to predict potential threats before they occur and generate appropriate response strategies.

[0003] However, existing network security testing and evaluation systems typically focus on post-attack response, lacking the ability to predict and prevent potential attacks. Especially in the face of complex and ever-changing network environments, how to accurately predict possible attacks in real time and take effective preventive measures remains a major challenge in the field of network security. Summary of the Invention

[0004] The purpose of this section is to summarize some aspects of the embodiments of the present invention and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section and the abstract and title of this application to avoid obscuring the purpose of this section, the abstract and the title of the invention, and such simplifications or omissions should not be used to limit the scope of the present invention.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0006] In a first aspect, an embodiment of the present invention provides a network security testing and evaluation system, comprising:

[0007] Data collection module: responsible for collecting various data from the network environment in real time and pre-processing the data, including traffic data, log data, user behavior data, and device status data;

[0008] Prediction model module: Builds prediction models based on historical data and real-time data to predict potential network attacks;

[0009] Response strategy generation module: Based on the output of the prediction model module, it automatically generates response measures, including strengthening monitoring, recording traffic logs, automatically blocking suspicious traffic, triggering alarms, adjusting firewall rules, and notifying the security team for manual intervention;

[0010] Feedback and Learning Module: This module collects feedback data after the implementation of response strategies, evaluates the effectiveness of response measures, and feeds the results back to the prediction model module to continuously optimize the performance of the prediction model.

[0011] System management and control module: provides a unified management and control interface for the system, including configuration management, policy management, user management, and log auditing;

[0012] Security Assessment Report Generation Module: Generates a detailed security assessment report, including discovered potential attacks, system response measures, accuracy of prediction models, and overall network security posture.

[0013] As a preferred solution of the network security testing and evaluation system described in the present invention, the prediction model is specifically the network attack prediction value P(t) at time t, and the specific calculation formula of P(t) is as follows:

[0014]

[0015] Where Z(t) is the normalization factor; D(t, τ) represents the time-attenuated eigenvalue at time t.

[0016] As a preferred solution of the network security test and evaluation system described in the present invention, the specific calculation formula of D(t, τ) is as follows:

[0017] D(t, τ) = e -λ(T- τ)·S(t, τ)

[0018] Where S(t, τ) represents the comprehensive characteristic value at time t and past state τ; λ is the decay constant; T is the maximum time range; τ is the integral variable, representing the past state of time.

[0019] As a preferred solution of the network security testing and evaluation system described in the present invention, the specific calculation formula of S(t, τ) is as follows:

[0020]

[0021] Where N is the number of features, indicating the number of key features used for prediction; σ i is the weight of the feature, σ i is a positive number, indicating the degree of influence of the reaction characteristics on the prediction results; f i (x(t), τ) represents the characteristic function related to network traffic; gi (y(t), τ) represents a characteristic function related to user behavior.

[0022] As a preferred solution of a network security testing and evaluation system according to the present invention, wherein: the f i The specific calculation formula of (x(t), τ) is as follows:

[0023]

[0024] Where h i is the proportionality coefficient of feature i; β i is the amplification factor of this feature.

[0025] As a preferred solution of a network security testing and evaluation system according to the present invention, wherein: the g i The specific calculation formula of (y(t), τ) is as follows:

[0026] g i (y(t), τ) = k i ·log(1 + y(t - τ))

[0027] Where k i is the proportionality coefficient of feature i.

[0028] As a preferred solution of a network security testing and evaluation system according to the present invention, wherein:

[0029] The P(t) represents the potential network attack intensity and probability at time t, and its value range specifically includes:

[0030] 0 < P(t) < 0.5, low probability, the system maintains a normal operating state, but security audits and inspections need to be carried out regularly;

[0031] 0.5 < P(t) < 0.8, medium probability, the system continues to operate, but monitoring needs to be strengthened, traffic logs need to be recorded, and an alarm is triggered to notify the staff;

[0032] 0.8 < P(t) < 1, high probability, the system triggers security measures to automatically block suspicious traffic, trigger an alarm, adjust firewall rules, and notify the security team for manual intervention.

[0033] In a second aspect, an embodiment of the present invention provides a network security testing and evaluation method, which specifically includes:

[0034] S1. The data acquisition module obtains data from the network in real time and transmits it to the prediction model module;

[0035] S2. The prediction model module analyzes and calculates based on the collected data to predict potential network attacks;

[0036] S3, the response strategy generation module immediately formulates and implements response measures based on the prediction results;

[0037] S4, the feedback and learning module collects the effects of the response measures and feeds them back to the prediction model to optimize the model performance;

[0038] S5. The security assessment report generation module generates and displays a detailed security assessment report.

[0039] In a third aspect, an embodiment of the present invention provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and wherein the processor executes a network security testing and evaluation system as described in the first aspect of the present invention.

[0040] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program is executed by a processor as the network security testing and evaluation system described in the first aspect of the present invention.

[0041] Beneficial effects of the present invention:

[0042] This invention introduces a prediction model to predict the intensity and possibility of network attacks in real time, and takes corresponding measures based on the prediction results, so that the security system can make judgments and preparations before the attack occurs, reducing the possibility of successful attacks and minimizing the losses caused by the attack. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. Those skilled in the art can also derive other drawings based on these drawings without inventive effort. Among them:

[0044] Figure 1 This is a system framework diagram of a network security testing and evaluation system proposed by the present invention;

[0045] Figure 2 A flowchart of the network security testing and evaluation system proposed by the present invention;

[0046] Figure 3 This is a comparison chart of reaction times in Example 2;

[0047] Figure 4 This is a comparison chart of the number of attacks successfully blocked in Example 2;

[0048] Figure 5 This is a comparison chart of CPU occupancy in Example 2;

[0049] Figure 6 This is a comparison chart of the successful defense rates in Example 2. DETAILED DESCRIPTION

[0050] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0051] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0052] Secondly, the term "one embodiment" or "embodiment" herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in various places throughout this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive of other embodiments.

[0053] Example 1

[0054] Reference Figure 1-2 The present invention provides a network security testing and evaluation system, comprising:

[0055] Data acquisition module: Responsible for collecting various data from the network environment in real time and pre-processing the data, including traffic data, log data, user behavior data, and device status data. Sensors are deployed at key locations in the network and the collected data is transmitted to the central processing unit through secure channels.

[0056] Prediction model module: Builds prediction models based on historical data and real-time data to predict potential network attacks;

[0057] Response strategy generation module: Based on the output of the prediction model module, it automatically generates response measures, including strengthening monitoring, recording traffic logs, automatically blocking suspicious traffic, triggering alarms, adjusting firewall rules, and notifying the security team for manual intervention;

[0058] Feedback and Learning Module: This module collects feedback data after the implementation of response strategies, evaluates the effectiveness of response measures, and feeds the results back to the prediction model module to continuously optimize the performance of the prediction model.

[0059] System Management and Control Module: Provides a unified management and control interface for the system, including configuration management, policy management, user management, and log auditing. It uses a web-based management interface that integrates access control, audit logs, and user rights management to ensure system security and operability.

[0060] Security Assessment Report Generation Module: Generates detailed security assessment reports, including potential attacks discovered, system response measures, accuracy of prediction models, and overall network security posture. Reports can be generated periodically or instantly based on user needs.

[0061] The prediction model is specifically the network attack prediction value P(t) at time t. The specific calculation formula of P(t) is as follows:

[0062]

[0063] Where Z(t) is a normalization factor used to ensure the reasonable range of the predicted value. The specific form is where α j is a positive constant; D(t, τ) represents the time-attenuated eigenvalue at time t. Furthermore, the specific calculation formula of D(t, τ) is as follows:

[0064] D(t, τ) = e -λ(T-τ) S(t, τ)

[0065] Where S(t, τ) represents the comprehensive characteristic value at time t and past state τ; λ is the decay constant, which controls the influence of past data on the current prediction; T is the maximum time range, which represents the maximum time span of historical data; τ is the integral variable, which represents the past state of time.

[0066] Furthermore, the specific calculation formula of S(t, τ) is as follows:

[0067]

[0068] Where N is the number of features, indicating the number of key features used for prediction; σ i is the weight of the feature, σ i is a positive number, indicating the degree of influence of the reaction characteristics on the prediction results; f i (x(t), τ) represents the characteristic function related to network traffic, which depends on the real-time collection of network traffic data x(t) and the past state τ; g i (y(t), τ) represents the characteristic function related to user behavior, which depends on the real-time collected user behavior data y(t) and the past state τ.

[0069] Furthermore, f i The specific calculation formula of (x(t), τ) is as follows:

[0070]

[0071] where h i is the proportional coefficient of feature i; βi is the amplification factor for this feature.

[0072] Furthermore, g i (y(t), τ) has the following specific calculation formula:

[0073] g i (y(t), τ) = k i ·log(1 + y(t - τ))

[0074] where k i is the proportionality coefficient of feature i.

[0075] Furthermore, P(t) represents the potential network attack intensity and probability at time t, and its value range specifically includes:

[0076] 0 < P(t) < 0.5, low probability, the system maintains normal operation, but regular security audits and checks are required;

[0077] 0.5 < P(t) < 0.8, medium probability, the system continues to operate, but monitoring needs to be strengthened, traffic logs need to be recorded, and an alarm needs to be triggered to notify the staff;

[0078] 0.8 < P(t) < 1, high probability, the system triggers security measures to automatically block suspicious traffic, trigger an alarm, adjust firewall rules, and notify the security team for manual intervention, and monitor network security in real time according to different prediction results.

[0079] This embodiment also provides a network security test and evaluation method, which specifically includes:

[0080] S1. The data acquisition module obtains data from the network in real time and transmits it to the prediction model module;

[0081] S2. The prediction model module analyzes and calculates based on the collected data to predict potential network attacks;

[0082] S3. The response strategy generation module immediately formulates and executes response measures according to the prediction results;

[0083] S4. The feedback and learning module collects the effects of the response measures and feeds them back to the prediction model to optimize the model performance;

[0084] S5. The security evaluation report generation module generates and displays a detailed security evaluation report.

[0085] This embodiment also provides a computer device, including a memory and a processor. The memory stores a computer program, and the processor executes a network security test and evaluation system as described above.

[0086] The computer device may be a terminal, comprising a processor, a memory, a communication interface, a display screen and an input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device comprises a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner may be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. The display screen of the computer device may be a liquid crystal display or an electronic ink display screen, and the input device of the computer device may be a touch layer covering the display screen, or a button, trackball or touchpad provided on the housing of the computer device, or an external keyboard, touchpad or mouse.

[0087] This embodiment also provides a computer-readable storage medium having a computer program stored thereon, such as a network security testing and evaluation system described above, executed by a processor. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0088] Example 2

[0089] Reference Figure 3 , which is the second embodiment of the present invention. This embodiment is different from the first embodiment in that, in order to verify its beneficial effects, experimental comparison data between the present invention and the prior art are provided.

[0090] This example sets up a virtual enterprise network containing 1,000 hosts, equipped with a traditional firewall, an intrusion detection system (IDS), and a predictive model system based on the present invention. Three different types of attacks are simulated within the network: a distributed denial of service (DDoS) attack, a SQL injection attack, and a phishing email attack.

[0091] Normal traffic and user behavior are simulated in the network, and data is collected to train the prediction model of the present invention. The model adopts a supervised learning algorithm and uses the collected network traffic characteristics and user behavior characteristics for learning and model optimization. Afterwards, before launching each attack, the model will make real-time predictions based on the latest traffic data, and when possible signs of attack are detected, it will automatically adjust the firewall rules and IDS policies to reduce the impact of the attack. As the attack begins, abnormal behavior gradually appears in the network traffic. Traditional firewalls and IDS can identify a portion of known attack traffic and intercept it, but for unknown or incompletely matched attacks, some traffic still passes through. The prediction model of the present invention can identify abnormal trends before the attack occurs by analyzing traffic characteristics in real time, and take defensive measures in advance, such as temporarily isolating the target host, limiting bandwidth, or enabling backup servers. The specific situation is shown in the following table:

[0092]

[0093]

[0094] As the table above shows, the prediction model's response time, number of successful blocking attempts, and successful defense rate for impact on system performance are significantly superior to existing technologies. Therefore, by predicting potential network attacks in real time, it not only significantly improves system protection but also reduces system resource consumption, fully demonstrating its practical application value and superiority in the field of network security.

[0095] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A network security testing and evaluation system, characterized by: include: Data collection module: responsible for collecting various data from the network environment in real time and pre-processing the data, including traffic data, log data, user behavior data, and device status data; Prediction model module: Builds prediction models based on historical data and real-time data to predict potential network attacks; Response strategy generation module: Based on the output of the prediction model module, it automatically generates response measures, including strengthening monitoring, recording traffic logs, automatically blocking suspicious traffic, triggering alarms, adjusting firewall rules, and notifying the security team for manual intervention; Feedback and Learning Module: This module collects feedback data after the implementation of response strategies, evaluates the effectiveness of response measures, and feeds the results back to the prediction model module to continuously optimize the performance of the prediction model. System management and control module: provides a unified management and control interface for the system, including configuration management, policy management, user management, and log auditing; Security Assessment Report Generation Module: Generates a detailed security assessment report, including discovered potential attacks, system response measures, accuracy of prediction models, and overall network security posture; The prediction model is specifically Prediction value of network attacks , The specific calculation formula is as follows: in is the normalization factor; Indicates time The time-decayed eigenvalue under ; described The specific calculation formula is as follows: in Indicates time and past state The comprehensive eigenvalue under ; is the decay constant; is the maximum time range; is the integral variable, which represents the past state of time; described The specific calculation formula is as follows: in is the number of features, indicating the number of key features used for prediction; is the weight of the feature, If it is a positive number, it indicates the degree of influence of the reaction feature on the prediction result; Represents the characteristic function related to network traffic; Represents the feature function related to user behavior; described Indicates time The potential network attack intensity and possibility at any moment, with a value range specifically including: , low probability, the system remains in normal operation, but regular security audits and inspections are required; ,Medium probability, the system continues to operate, but requires enhanced monitoring, recording traffic logs, and triggering alarms to notify staff; ,With a high probability, the system triggers security measures to automatically block suspicious traffic, trigger alerts, adjust firewall rules, and notify the security team for manual intervention.

2. A network security testing and evaluation system according to claim 1, characterized in that: described The specific calculation formula is as follows: in Features The proportionality coefficient of is the amplification factor of this feature.

3. A network security testing and evaluation system according to claim 2, characterized in that: described The specific calculation formula is as follows: in feature The proportional coefficient of .

4. A network security testing and evaluation method, based on a network security testing and evaluation system according to any one of claims 1 to 3, characterized in that: Specifically include: S1, the data acquisition module obtains data from the network in real time and transmits it to the prediction model module; S2, the prediction model module performs analysis and calculation based on the collected data to predict potential network attacks; S3, the response strategy generation module immediately formulates and implements response measures based on the prediction results; S4, the feedback and learning module collects the effects of the response measures and feeds them back to the prediction model to optimize the model performance; S5. The security assessment report generation module generates and displays a detailed security assessment report.

5. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: The processor executes the network security testing and evaluation method described in claim 4.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that: The network security testing and evaluation method described in claim 4 is executed by a processor.

Images