Network security monitoring and protection method, electronic device and storage medium

Abstract

The present invention relates to the field of network security technology, and specifically to a network security monitoring and protection method, electronic device, and storage medium. The present invention first calculates the behavioral trust, purpose trust, and state trust by monitoring the operational data of each enterprise employee to obtain the individual trust of the enterprise employees; then, a group trust propagation mechanism is adopted to calculate the group trust of each group based on the individual trust, and the organizational trust is calculated through a graph neural network based on the group trust; in addition, a dynamic trust attenuation mechanism and a dynamic trust repair mechanism are adopted to adjust the individual trust of the enterprise employees and then recalculate the group trust and organizational trust; finally, based on the recalculated individual trust, group trust, and organizational trust, the operational risk value of the enterprise employees at the current moment is calculated, and an adaptive protection strategy is selected based on the operational risk value. The present invention can effectively deal with the security risks caused by internal employee operations.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security monitoring and protection method, electronic equipment, and storage medium. Background Art

[0002] With the rapid development of information technology, network security has become a core concern for modern enterprises and institutions. In the daily operation of information systems, employee behavior is a key factor affecting system security. Enterprises typically assign specific permissions to different employees to complete their work, but employees may exhibit diverse behaviors during operations, such as logging in from multiple locations, frequently switching devices, or performing unusually complex operation sequences. These behaviors may stem from normal work requirements or represent potential risks. Especially in complex business scenarios and with a large number of employees, improper operations by internal employees can pose a serious threat to system security.

[0003] Existing security protection methods often focus on protecting against external threats, such as preventing unauthorized access or attacks, while monitoring internal employee operations relies on preset rules and static analysis. This approach struggles to adapt to the dynamic nature of employee behavior, leading to missed detections and false positives of anomalous behavior. Furthermore, existing methods lack the ability to analyze the propagation and linkage of behavioral trust at the group and organizational levels, making it difficult to fully understand operational risks within an organization. Therefore, accurately identifying and effectively addressing security risks posed by internal employee operations through multi-dimensional, real-time employee behavior monitoring and dynamic trust assessment has become a pressing technical challenge.

[0004] To this end, a network security monitoring and protection method, electronic equipment and storage medium are proposed. Summary of the Invention

[0005] The purpose of the present invention is to provide a network security monitoring and protection method, electronic device and storage medium. The present invention calculates the behavior trust, purpose trust and state trust by monitoring the operation data of each enterprise employee, and obtains the individual trust of the enterprise employees; then adopts the group trust propagation mechanism to calculate the group trust of each group based on the individual trust, and calculates the organizational trust through the graph neural network based on the group trust; in addition, adopts the dynamic trust attenuation mechanism and the dynamic trust repair mechanism to adjust the individual trust of the enterprise employees and then recalculate the group trust and organizational trust; finally, according to the recalculated individual trust, group trust and organizational trust, calculates the operational risk value of the enterprise employees at the current moment, and selects an adaptive protection strategy based on the operational risk value. The present invention can effectively deal with the security risks caused by internal employee operations.

[0006] To achieve the above object, the present invention provides the following technical solutions:

[0007] A network security monitoring and protection method, comprising:

[0008] Monitor each employee's operation sequence, operation time, operation location, operation equipment, and operation network through enterprise system logs;

[0009] Calculate the employee's behavior trust and purpose trust in real time based on the operation sequence; calculate the employee's state trust based on the operation time, the operation location, the operation device, and the operation network; and calculate the individual employee's trust based on the behavior trust, the purpose trust, and the state trust;

[0010] Adopting the group trust propagation mechanism, the group trust of each group is calculated based on the individual trust of enterprise employees;

[0011] Build an organizational knowledge graph through a graph neural network and calculate the organizational trust based on the group trust of all groups;

[0012] Adopting a dynamic trust decay mechanism and a dynamic trust repair mechanism to adjust the individual trust of enterprise employees, and recalculating the group trust and the organizational trust based on the adjusted individual trust;

[0013] Based on the recalculated individual trust, group trust and organizational trust, the operational risk value of the enterprise employees at the current moment is calculated, and an adaptive protection strategy is selected based on the operational risk value; the adaptive protection strategy includes allowing operations, secondary identity authentication, multi-factor verification and blocking operations.

[0014] Preferably, the calculation of the individual trustworthiness includes:

[0015] Calculating the behavior complexity based on the operation sequence, and calculating the behavior trust according to the behavior complexity;

[0016] constructing an operation sequence vector based on the operation sequence, identifying the purpose of the operation sequence vector through an attention mechanism to obtain a purpose probability vector, and calculating the purpose confidence based on the purpose probability vector;

[0017] Calculating time compliance, location compliance, device compliance, and network compliance based on the operation time, the operation location, the operation device, and the operation network, and calculating the state trust according to the time compliance, the location compliance, the device compliance, and the network compliance;

[0018] The individual trust degree is obtained by performing weighted calculation on the behavior trust degree, the purpose trust degree and the state trust degree.

[0019] Preferably, the calculation of the group trust degree includes:

[0020] The group trust propagation mechanism is established as follows:

[0021]

[0022] Among them, T group (g, t) represents the group trust of group g at time t; T individual (u,t) represents the individual trust of enterprise employee u at time t; I(u,g) represents the collaborative influence of employee u in group g; u∈g means that enterprise employee u belongs to group g;

[0023] The group trust degree of each group is calculated according to the group trust propagation mechanism.

[0024] Preferably, the calculation of the organizational trustworthiness includes:

[0025] The organizational knowledge graph is constructed through a graph neural network, and node weights are dynamically updated; the organizational knowledge graph includes at least employee nodes, group nodes, and department nodes;

[0026] The organization trust is calculated based on the updated node weights using the formula:

[0027]

[0028] Among them, T org (t) represents the organizational trust at time t; D represents the set of all departments; φ(d) represents the node weight of department d; T dept (d,t) represents the department trust of department d at time t; d∈D means department d belongs to D;

[0029] The calculation formula of the department trust is:

[0030]

[0031] Among them, G d represents the set of all groups in department d; ψ(g) represents the node weight of group g; T group (g,t) represents the group trust of group g at time t; g∈G d Indicates that group g belongs to G d .

[0032] Preferably, the dynamic trust decay mechanism includes:

[0033] Define the trust decay function:

[0034] Tdecay (t) = T0*e -η(t)*△t ;

[0035] Among them, T decay (t) represents the trust after decay at time t; T0 represents the trust before decay; η(t) represents the dynamic decay rate; △t represents the trust decay period; e represents the natural logarithm base;

[0036] Calculate the environmental risk value, and adjust the dynamic decay rate according to the environmental risk value. The adjustment formula of the dynamic decay rate is:

[0037] η(t)=η0+△η*R env (t);

[0038] Wherein, η(t) represents the dynamic decay rate at time t; η0 represents the basic decay rate; △η represents the maximum increment of the decay rate; R env (t) represents the environmental risk value;

[0039] The trust decay period is set, and the individual trust degree is adjusted according to the trust decay function every other trust decay period.

[0040] Preferably, the dynamic trust repair mechanism includes:

[0041] Obtain the continuous normal operation time of each enterprise employee;

[0042] Define the trust repair function:

[0043]

[0044] Among them, T repair (t) represents the repair confidence at time t; T min Indicates the minimum value of repair trust; T max represents the maximum value of repair trust; λ(t) represents the dynamic repair rate at time t; t normal represents the duration of continuous normal operation; e represents the base of the natural logarithm;

[0045] Calculate the behavior score, and adjust the dynamic repair rate according to the behavior score. The adjustment formula of the dynamic repair rate is:

[0046] λ(t)=λ0*(1+κ*Score behavior (t));

[0047] Wherein, λ(t) represents the dynamic repair rate at time t; λ0 represents the basic repair rate; κ represents the repair rate adjustment coefficient; Score behavior (t) represents the behavior score of the corresponding enterprise employee at time t;

[0048] When the duration of the continuous normal operation is greater than a preset threshold, the individual trust level of the corresponding enterprise employee is adjusted according to the trust repair function.

[0049] Preferably, the calculation of the operational risk value includes:

[0050] Risk(u,t)=1-(w1*T individual (u,t)+w2*T group (g,t)+w3*T org (t))*S(u,t);

[0051] Among them, Risk(u,t) represents the operational risk value of enterprise employee u at time t; w1, w2 and w3 represent weights; S(u,t) represents the operational sensitivity of enterprise employee u at time t.

[0052] Preferably, selecting the adaptive protection strategy based on the operational risk value includes:

[0053] Based on the operational risk value, a risk level threshold is set to perform risk level classification; the risk levels include a first risk level, a second risk level, a third risk level, and a fourth risk level;

[0054] The corresponding adaptive protection strategy is selected according to the risk level; the first risk level corresponds to the allowed operation, the second risk level corresponds to the secondary identity authentication, the third risk level corresponds to the multi-factor authentication, and the fourth risk level corresponds to the blocking operation.

[0055] An electronic device includes a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and when the program is executed on the processor, steps in a network security monitoring and protection method are implemented.

[0056] A storage medium stores computer program instructions, which, when executed by a processor, implement steps in a network security monitoring and protection method.

[0057] Compared with the prior art, the present invention has the following beneficial effects:

[0058] 1. The invention monitors relevant data on enterprise employee operations, calculates behavior trust, purpose trust, and state trust in real time, and then comprehensively weights them to form individual trust. This multi-dimensional calculation method accurately captures abnormal patterns in employee behavior, significantly improving the detection of internal security threats. Purpose identification uses an attention mechanism to conduct in-depth analysis of operation sequence vectors, accurately assessing the purpose of the behavior and reducing false alarm rates. Simultaneously, state trust strengthens the ability to identify potential malicious behavior by dynamically evaluating the compliance of time, location, and equipment. This provides a foundation for efficient individual behavior analysis and effectively improves the ability to monitor internal employee operational risks.

[0059] 2. By building a group trust propagation mechanism, group trust is calculated based on individual trust and collaborative influence. Furthermore, a graph neural network is used to construct an organizational knowledge graph, enabling dynamic calculation of organizational trust. This mechanism not only encompasses the multi-level trust transfer from individuals to groups and then to the organization, but also captures real-time changes in trust within the organization by dynamically adjusting node weights. The comprehensive calculation of organizational trust enhances the ability to monitor anomalous group behavior in large-scale enterprise environments and reduces trust blind spots caused by single points of failure. The group and organizational trust assessment system establishes a risk propagation chain from the individual to the entire organization, significantly improving the ability to monitor internal risk transmission.

[0060] 3. A dynamic trust decay mechanism and repair mechanism have been designed to dynamically adjust individual trust levels over time and as behavior changes. The trust decay mechanism adapts to different environmental risk levels by dynamically adjusting the decay rate, ensuring a dynamic balance of trust. The trust repair mechanism uses a repair function to positively adjust trust based on employees' continued normal operating behavior. This dual dynamic control mechanism ensures the rationality and adaptability of trust changes. At the same time, through real-time feedback on behavioral scores, it enhances the flexibility of trust adjustments and reduces the impact of misjudgments on employees' normal operations. The dynamic trust control mechanism improves the timeliness and accuracy of individual trust assessments, provides real-time and reliable data support for the optimization of overall protection strategies, and effectively solves the dynamic management of internal employee operational risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 A schematic flow chart of a network security monitoring and protection method according to the present invention;

[0062] Figure 2 Schematic diagram of the adaptive protection strategy of the present invention;

[0063] Figure 3 The figure is a schematic diagram of the data calculation process of a network security monitoring and protection method of the present invention. DETAILED DESCRIPTION

[0064] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0065] See also Figures 1 to 3 The present invention provides a network security monitoring and protection method, electronic device and storage medium, and the technical solution is as follows:

[0066] Example 1

[0067] A large financial technology company found in its daily operations that with the popularity of remote work and cloud services, the security risks of employee operations have increased significantly. In order to achieve company-wide security monitoring and protection, a network security monitoring and protection method was deployed, such as Figure 1 Shown, including:

[0068] Monitor each employee's operation sequence, operation time, operation location, operation equipment, and operation network through enterprise system logs;

[0069] Calculate the employee's behavior trust and purpose trust in real time based on the operation sequence; calculate the employee's state trust based on the operation time, the operation location, the operation device, and the operation network; and calculate the individual employee's trust based on the behavior trust, the purpose trust, and the state trust;

[0070] Adopting the group trust propagation mechanism, the group trust of each group is calculated based on the individual trust of enterprise employees;

[0071] Build an organizational knowledge graph through a graph neural network and calculate the organizational trust based on the group trust of all groups;

[0072] Adopting a dynamic trust decay mechanism and a dynamic trust repair mechanism to adjust the individual trust of enterprise employees, and recalculating the group trust and the organizational trust based on the adjusted individual trust;

[0073] Based on the recalculated individual trust, group trust and organizational trust, the operational risk value of the enterprise employees at the current moment is calculated, and an adaptive protection strategy is selected based on the operational risk value; the adaptive protection strategy includes allowing operations, secondary identity authentication, multi-factor verification and blocking operations.

[0074] Furthermore, the calculation of the individual trustworthiness includes:

[0075] Calculating the behavior complexity based on the operation sequence, and calculating the behavior trust according to the behavior complexity;

[0076] constructing an operation sequence vector based on the operation sequence, identifying the purpose of the operation sequence vector through an attention mechanism to obtain a purpose probability vector, and calculating the purpose confidence based on the purpose probability vector;

[0077] Calculating time compliance, location compliance, device compliance, and network compliance based on the operation time, the operation location, the operation device, and the operation network, and calculating the state trust according to the time compliance, the location compliance, the device compliance, and the network compliance;

[0078] The individual trust degree is obtained by performing weighted calculation on the behavior trust degree, the purpose trust degree and the state trust degree.

[0079] The formula for calculating individual trust is:

[0080] T individual (u,t)=α1*T1(u,t)+α2*T2(u,t)+α3*T3(u,t);

[0081]

[0082] T3(u,t)=β1*L1(u,t)+β2*L2(u,t)+β3*L3(u,t)+β4*L4(u,t);

[0083] Among them, T individual (u,t) represents the individual trust of enterprise employee u at time t; T1(u,t), T2(u,t) and T3(u,t) represent behavior trust, purpose trust and state trust respectively; α1, α2 and α3 as well as β1, β2, β3 and β4 all represent weight coefficients, and e represents the base of natural logarithm; γ represents the adjustment coefficient; represents the behavioral complexity baseline, which is calculated through the long-term historical operation sequence of enterprise employees; C represents the behavioral complexity of enterprise employees within the evaluation time window; n represents the length of the target probability vector; ω i represents the probability P of the i-th target i The weight coefficients are: L1(u,t), L2(u,t), L3(u,t), and L4(u,t) represent time compliance, location compliance, device compliance, and network compliance, respectively. In this embodiment, a destination probability vector is set for each group.

[0084] The calculation of behavioral complexity includes: according to the operation sequence of enterprise employees within the evaluation time window, obtaining the occurrence probability of each operation type, the time interval of each operation and the number of resource accesses, calculating the operation sequence complexity, time pattern complexity and resource access complexity respectively, and taking the weighted sum of the operation sequence complexity, time pattern complexity and resource access complexity to obtain the behavioral complexity of employees within the evaluation time window.

[0085] The calculation of time compliance, location compliance, equipment compliance and network compliance includes: when the operation time is normal working time, the time compliance is 1, otherwise Where δ represents the adjustment coefficient, Indicates the deviation between the operation time and the normal working time; when the operation location is an authorized location, the location compliance is 1; when the operation location is a semi-authorized location, the location compliance is 0.5; otherwise, the location compliance is 0; when the device used for operation is a registered enterprise device, the device compliance is 1; when the device used for operation is not a registered enterprise device but an employee's private device, the device compliance is 0.3; otherwise, the device compliance is 0; when the network used for operation is a secure network, the network compliance is 1; when the network used for operation is a known network instead of a secure network, the network compliance is 0.4; otherwise, the network compliance is 0.

[0086] Table 1 shows the individual trust calculation process for an employee in the system operations team. As can be seen from the table, the employee's behavioral complexity is slightly higher than the baseline, but still within a reasonable range; purpose identification shows that their actions have clear work goals.

[0087] Table 1 Example of individual trust calculation

[0088]

[0089] An individual trust calculation method based on behavior trust, purpose trust, and state trust can accurately quantify whether an employee's operational behavior conforms to normal patterns. By introducing operation sequence vectors and an attention mechanism, it accurately identifies the purpose of an operation and significantly reduces the false alarm rate. It also dynamically assesses state trust by combining multi-dimensional information such as time, location, device, and network, improving the accuracy of detecting abnormal behavior. This ensures the accuracy of individual behavior analysis and provides a reliable data foundation for subsequent group trust calculations.

[0090] Furthermore, the calculation of the group trust degree includes:

[0091] The group trust propagation mechanism is established as follows:

[0092]

[0093] Among them, Tgroup (g, t) represents the group trust of group g at time t; T individual (u,t) represents the individual trust of enterprise employee u at time t; I(u,g) represents the collaborative influence of employee u in group g; u∈g means that enterprise employee u belongs to group g;

[0094] The group trust degree of each group is calculated according to the group trust propagation mechanism.

[0095] The calculation of collaborative influence includes: allocating initial collaborative influence to each individual in the group based on the position and qualifications of the enterprise employees, obtaining the collaborative activity factor based on the actual number of collaborations of the enterprise employees and the average number of collaborations of the group within the evaluation time window, obtaining the historical performance factor based on the performance scores of the enterprise employees within the evaluation time window, taking the weighted sum of the collaborative activity factor and the historical performance factor, and using the weighted sum result to update the initial collaborative influence to obtain the collaborative influence.

[0096] Table 2 shows the trust status of each group in this embodiment. Among them, the security audit group shows the highest group trust due to the nature of its work and strict operating regulations.

[0097] Table 2 Group trust data

[0098] group Number of employees Average individual trust Collaborative sphere of influence Group trust System Operation and Maintenance Group 25 0.862 0.15～0.25 0.878 Data Analysis Group 35 0.891 0.12～0.22 0.895 Development and testing group 40 0.875 0.10～0.20 0.882 Security Audit Team 20 0.903 0.18～0.28 0.912 Business Support Group 30 0.884 0.13～0.23 0.889

[0099] Through a group trust propagation mechanism, combining individual trust and collaborative influence, group trust is dynamically calculated, enabling trust assessment from the individual to the group level. This mechanism effectively captures the trust deficit in group behavior, providing strong support for overall trust assessment within the organization while also enhancing macro-awareness of internal risks.

[0100] Furthermore, the calculation of the organizational trustworthiness includes:

[0101] The organizational knowledge graph is constructed through a graph neural network, and node weights are dynamically updated; the organizational knowledge graph includes at least employee nodes, group nodes, and department nodes;

[0102] The organization trust is calculated based on the updated node weights using the formula:

[0103]

[0104] Among them, T org (t) represents the organizational trust at time t; D represents the set of all departments; φ(d) represents the node weight of department d; T dept (d,t) represents the department trust of department d at time t; d∈D means department d belongs to D;

[0105] The calculation formula of the department trust is:

[0106]

[0107] Among them, G d represents the set of all groups in department d; ψ(g) represents the node weight of group g; T group (g,t) represents the group trust of group g at time t; g∈G d Indicates that group g belongs to G d .

[0108] By constructing an organizational knowledge graph of a graph neural network, updating node weights in real time and calculating organizational trust, the assessment of organizational trust becomes more comprehensive and accurate, which can effectively perceive potential trust issues within the organization and reduce the overall risk caused by single-point trust failure.

[0109] Furthermore, the dynamic trust decay mechanism includes:

[0110] Define the trust decay function:

[0111] T decay (t) = T0*e -η(t)*△t ;

[0112] Among them, T decay (t) represents the trust after decay at time t; T0 represents the trust before decay; η(t) represents the dynamic decay rate; △t represents the trust decay period; e represents the natural logarithm base;

[0113] Calculate the environmental risk value, and adjust the dynamic decay rate according to the environmental risk value. The adjustment formula of the dynamic decay rate is:

[0114] η(t)=η0+△η*R env (t);

[0115] Wherein, η(t) represents the dynamic decay rate at time t; η0 represents the basic decay rate; △η represents the maximum increment of the decay rate; R env (t) represents the environmental risk value;

[0116] The trust decay period is set, and the individual trust degree is adjusted according to the trust decay function every other trust decay period.

[0117] The calculation of the environmental risk value includes: obtaining security warning information, system vulnerability information and external attack information within the assessment time window for statistical calculation, obtaining corresponding environmental risk assessment indicators, and weighted summing the environmental risk assessment indicators to obtain the environmental risk value.

[0118] The dynamic trust decay mechanism adjusts the trust level through the trust decay function and introduces dynamic influencing factors of the environment to avoid unreasonable situations where the trust level is too high or too low. It effectively improves the system's sensitivity to long-term potential threats and makes the trust assessment more in line with the actual business environment.

[0119] Furthermore, the dynamic trust repair mechanism includes:

[0120] Obtain the continuous normal operation time of each enterprise employee;

[0121] Define the trust repair function:

[0122]

[0123] Among them, T repair (t) represents the repair confidence at time t; T min Indicates the minimum value of repair trust; T max represents the maximum value of repair trust; λ(t) represents the dynamic repair rate at time t; t normal represents the duration of continuous normal operation; e represents the base of the natural logarithm;

[0124] Calculate the behavior score, and adjust the dynamic repair rate according to the behavior score. The adjustment formula of the dynamic repair rate is:

[0125] λ(t)=λ0*(1+κ*Score behavior (t));

[0126] Wherein, λ(t) represents the dynamic repair rate at time t; λ0 represents the basic repair rate; κ represents the repair rate adjustment coefficient; Score behavior (t) represents the behavior score of the corresponding enterprise employee at time t;

[0127] When the duration of the continuous normal operation is greater than a preset threshold, the individual trust of the corresponding enterprise employee is adjusted according to the trust repair function:

[0128] T′ individual (u,t)=min{T repair (t),T max};

[0129] Among them, T′ individual (u, t) represents the individual trust degree adjusted according to the trust repair function; min{} represents the minimum selection function.

[0130] The calculation of the behavior score includes: obtaining the operation time distribution, resource access information and security training completion of enterprise employees within the evaluation time window for statistical calculation, obtaining the corresponding behavior score indicators, and performing weighted summation of the behavior score indicators to obtain the behavior score.

[0131] The dynamic trust repair mechanism monitors the duration of continuous normal operation and uses the trust repair function to adjust the trust level. This not only avoids long-term restrictions on misjudged employees, but also improves the system's response speed to trust recovery, enhancing the adaptability and friendliness of the protection solution.

[0132] Furthermore, the calculation of the operational risk value includes:

[0133] Risk(u,t)=1-(w1*T individual (u,t)+w2*T group (g,t)+w3*T org (t))*S(u,t);

[0134] Among them, Risk(u,t) represents the operational risk value of enterprise employee u at time t; w1, w2 and w3 represent weights; S(u,t) represents the operational sensitivity of enterprise employee u at time t.

[0135] The calculation of operation sensitivity includes: obtaining the operation type, operation impact range, operation frequency and normal baseline frequency of enterprise employees within the evaluation time window for statistical calculation, obtaining the corresponding operation sensitivity index, and performing weighted summation of the operation sensitivity index to obtain the operation sensitivity.

[0136] The calculation of operational risk value comprehensively evaluates employees' real-time operational risks by combining individual trust, group trust and organizational trust, combined with operational sensitivity, accurately reflecting the potential risks of employees' operational behaviors, providing a scientific basis for the subsequent selection of adaptive protection strategies, and ensuring the rationality and efficiency of protection decisions.

[0137] Furthermore, selecting the adaptive protection strategy based on the operational risk value includes:

[0138] Based on the operational risk value, a risk level threshold is set to perform risk level classification; the risk levels include a first risk level, a second risk level, a third risk level, and a fourth risk level;

[0139] Select the corresponding adaptive protection strategy according to the risk level; Figure 2 As shown, the first risk level corresponds to the allow operation, the second risk level corresponds to the secondary identity verification, the third risk level corresponds to the multi-factor verification, and the fourth risk level corresponds to the block operation.

[0140] Specific measures for allowing operations include directly allowing the operations and recording operation logs; specific measures for secondary identity authentication include SMS verification and email confirmation; specific measures for multi-factor authentication include biometric recognition and online approval by superiors; specific measures for blocking operations include automatically blocking operations, triggering security alerts, locking related accounts, and detailed log records.

[0141] The risk level classification and adaptive protection strategy selection based on operational risk values ​​enable the system to flexibly take protection measures for different risk levels, taking into account both security and operational efficiency, and can effectively respond to dynamic risks in employee operations, minimizing the probability of system operation interruption and potential security threats.

[0142] A network security monitoring and protection method of this embodiment monitors the multi-dimensional data of enterprise employees' operation sequences, operation times, operation devices, and operation networks, and comprehensively calculates the employees' behavioral trust, purpose trust, and state trust, thereby deriving individual trust and significantly improving the ability to identify abnormal operation behaviors. Further utilizing the group trust propagation mechanism and the organizational knowledge graph constructed by the graph neural network, a dynamic evaluation of group trust and organizational trust is achieved, which can perceive the potential overall security risks within the organization in real time from a macro level. Combined with the dynamic trust attenuation and trust repair mechanism, the trust of employees is adaptively adjusted. By calculating the operational risk value of employees in real time and dynamically selecting adaptive protection strategies, the protection capability of internal security risks is effectively improved.

[0143] Example 2

[0144] A smart manufacturing solution provider uses an electronic device to monitor the safety of employee operations across the entire enterprise. The data calculation process during the safety monitoring process is as follows: Figure 3 As shown, the steps in implementing a network security monitoring and protection method include:

[0145] Monitor each employee's operation sequence, operation time, operation location, operation equipment, and operation network through enterprise system logs;

[0146] Calculate the employee's behavior trust and purpose trust in real time based on the operation sequence; calculate the employee's state trust based on the operation time, the operation location, the operation device, and the operation network; and calculate the individual employee's trust based on the behavior trust, the purpose trust, and the state trust;

[0147] Adopting the group trust propagation mechanism, the group trust of each group is calculated based on the individual trust of enterprise employees;

[0148] Build an organizational knowledge graph through a graph neural network and calculate the organizational trust based on the group trust of all groups;

[0149] Adopting a dynamic trust decay mechanism and a dynamic trust repair mechanism to adjust the individual trust of enterprise employees, and recalculating the group trust and the organizational trust based on the adjusted individual trust;

[0150] Based on the recalculated individual trust, group trust and organizational trust, the operational risk value of the enterprise employees at the current moment is calculated, and an adaptive protection strategy is selected based on the operational risk value; the adaptive protection strategy includes allowing operations, secondary identity authentication, multi-factor verification and blocking operations.

[0151] Furthermore, the calculation of the individual trustworthiness includes:

[0152] Calculating the behavior complexity based on the operation sequence, and calculating the behavior trust according to the behavior complexity;

[0153] constructing an operation sequence vector based on the operation sequence, identifying the purpose of the operation sequence vector through an attention mechanism to obtain a purpose probability vector, and calculating the purpose confidence based on the purpose probability vector;

[0154] Calculating time compliance, location compliance, device compliance, and network compliance based on the operation time, the operation location, the operation device, and the operation network, and calculating the state trust according to the time compliance, the location compliance, the device compliance, and the network compliance;

[0155] The individual trust degree is obtained by performing weighted calculation on the behavior trust degree, the purpose trust degree and the state trust degree.

[0156] Furthermore, the calculation of the group trust degree includes:

[0157] The group trust propagation mechanism is established as follows:

[0158]

[0159] Among them, T group (g, t) represents the group trust of group g at time t; T individual (u,t) represents the individual trust of enterprise employee u at time t; I(u,g) represents the collaborative influence of employee u in group g; u∈g means that enterprise employee u belongs to group g;

[0160] The group trust degree of each group is calculated according to the group trust propagation mechanism.

[0161] Furthermore, the calculation of the organizational trustworthiness includes:

[0162] The organizational knowledge graph is constructed through a graph neural network, and node weights are dynamically updated; the organizational knowledge graph includes at least employee nodes, group nodes, and department nodes;

[0163] The organization trust is calculated based on the updated node weights using the formula:

[0164]

[0165] Among them, T org (t) represents the organizational trust at time t; D represents the set of all departments; φ(d) represents the node weight of department d; T dept (d,t) represents the department trust of department d at time t; d∈D means department d belongs to D;

[0166] The calculation formula of the department trust is:

[0167]

[0168] Among them, G d represents the set of all groups in department d; ψ(g) represents the node weight of group g; T group (g,t) represents the group trust of group g at time t; g∈G d Indicates that group g belongs to G d .

[0169] Furthermore, the dynamic trust decay mechanism includes:

[0170] Define the trust decay function:

[0171] T decay (t) = T0*e -η(t)*△t ;

[0172] Among them, T decay (t) represents the trust after decay at time t; T0 represents the trust before decay; η(t) represents the dynamic decay rate; △t represents the trust decay period; e represents the natural logarithm base;

[0173] Calculate the environmental risk value, and adjust the dynamic decay rate according to the environmental risk value. The adjustment formula of the dynamic decay rate is:

[0174] η(t)=η0+△η*R env (t);

[0175] Wherein, η(t) represents the dynamic decay rate at time t; η0 represents the basic decay rate; △η represents the maximum increment of the decay rate; R env (t) represents the environmental risk value;

[0176] The trust decay period is set, and the individual trust degree is adjusted according to the trust decay function every other trust decay period.

[0177] Furthermore, the dynamic trust repair mechanism includes:

[0178] Obtain the continuous normal operation time of each enterprise employee;

[0179] Define the trust repair function:

[0180]

[0181] Among them, T repair (t) represents the repair confidence at time t; T min Indicates the minimum value of repair trust; T max represents the maximum value of repair trust; λ(t) represents the dynamic repair rate at time t; t normal represents the duration of continuous normal operation; e represents the base of the natural logarithm;

[0182] Calculate the behavior score, and adjust the dynamic repair rate according to the behavior score. The adjustment formula of the dynamic repair rate is:

[0183] λ(t)=λ0*(1+κ*Score behavior (t));

[0184] Wherein, λ(t) represents the dynamic repair rate at time t; λ0 represents the basic repair rate; κ represents the repair rate adjustment coefficient; Score behavior (t) represents the behavior score of the corresponding enterprise employee at time t;

[0185] When the duration of the continuous normal operation is greater than a preset threshold, the individual trust level of the corresponding enterprise employee is adjusted according to the trust repair function.

[0186] Furthermore, the calculation of the operational risk value includes:

[0187] Risk(u,t)=1-(w1*T individual (u,t)+w2*T group (g,t)+w3*T org (t))*S(u,t);

[0188] Among them, Risk(u,t) represents the operational risk value of enterprise employee u at time t; w1, w2 and w3 represent weights; S(u,t) represents the operational sensitivity of enterprise employee u at time t.

[0189] Furthermore, selecting the adaptive protection strategy based on the operational risk value includes:

[0190] Based on the operational risk value, a risk level threshold is set to perform risk level classification; the risk levels include a first risk level, a second risk level, a third risk level, and a fourth risk level;

[0191] The corresponding adaptive protection strategy is selected according to the risk level; the first risk level corresponds to the allowed operation, the second risk level corresponds to the secondary identity authentication, the third risk level corresponds to the multi-factor authentication, and the fourth risk level corresponds to the blocking operation.

[0192] Table 3 summarizes the overall effect of the protection mechanism of this embodiment within 3 months, showing a low false alarm rate.

[0193] Table 3 Statistics of protection effect

[0194] Protection Strategy Trigger times Proportion False alarm rate Allow Operation 15720 82.5％ 0％ Two-factor authentication 2850 15.0％ 3.2％ Multi-factor authentication 380 2.0％ 8.5％ Blocking Operation 95 0.5％ 5.3％

[0195] Table 4 reflects the dynamic changes in the trust level of each department within three months, which generally shows a stable upward trend, indicating that the solution of this embodiment has a sustained effect on improving organizational security.

[0196] Table 4 Monthly changes in average trust in departments

[0197] department Month 1 Second month March Chip Design Department 0.868 0.882 0.891 Hardware Development Department 0.872 0.878 0.885 Embedded Software Department 0.863 0.875 0.882 Test and Verification Department 0.870 0.879 0.888

[0198] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A network security monitoring and protection method, characterized in that: include: Monitor each employee's operation sequence, operation time, operation location, operation equipment, and operation network through enterprise system logs; Calculate the employee's behavior trust and purpose trust in real time based on the operation sequence; calculate the employee's state trust based on the operation time, the operation location, the operation device, and the operation network; and calculate the individual employee's trust based on the behavior trust, the purpose trust, and the state trust; Adopting the group trust propagation mechanism, the group trust of each group is calculated based on the individual trust of enterprise employees; Build an organizational knowledge graph through a graph neural network and calculate the organizational trust based on the group trust of all groups; Adopting a dynamic trust decay mechanism and a dynamic trust repair mechanism to adjust the individual trust of enterprise employees, and recalculating the group trust and the organizational trust based on the adjusted individual trust; Based on the recalculated individual trust, group trust and organizational trust, the operational risk value of the enterprise employees at the current moment is calculated, and an adaptive protection strategy is selected based on the operational risk value; the adaptive protection strategy includes allowing operations, secondary identity authentication, multi-factor verification and blocking operations.

2. A network security monitoring and protection method according to claim 1, characterized in that: The calculation of the individual trustworthiness includes: Calculating the behavior complexity based on the operation sequence, and calculating the behavior trust according to the behavior complexity; constructing an operation sequence vector based on the operation sequence, identifying the purpose of the operation sequence vector through an attention mechanism to obtain a purpose probability vector, and calculating the purpose confidence based on the purpose probability vector; Calculating time compliance, location compliance, device compliance, and network compliance based on the operation time, the operation location, the operation device, and the operation network, and calculating the state trust according to the time compliance, the location compliance, the device compliance, and the network compliance; The individual trust degree is obtained by performing weighted calculation on the behavior trust degree, the purpose trust degree and the state trust degree.

3. A network security monitoring and protection method according to claim 1, characterized in that: The calculation of the group trust includes: The group trust propagation mechanism is established as follows: Among them, T group (g, t) represents the group trust of group g at time t; T individual (u,t) represents the individual trust of enterprise employee u at time t; I(u,g) represents the collaborative influence of enterprise employee u in group g; u∈g means that enterprise employee u belongs to group g; The group trust degree of each group is calculated according to the group trust propagation mechanism.

4. A network security monitoring and protection method according to claim 1, characterized in that: The calculation of the organizational trustworthiness includes: The organizational knowledge graph is constructed through a graph neural network, and node weights are dynamically updated; the organizational knowledge graph includes at least employee nodes, group nodes, and department nodes; According to the updated node weights, the overall trust of the organization is calculated using the formula: Among them, T org (t) represents the organizational trust at time t; D represents the set of all departments; φ(d) represents the node weight of department d; T dept (d,t) represents the department trust of department d at time t; d∈D means department d belongs to D; The calculation formula of the department trust is: Among them, G d represents the set of all groups in department d; ψ(g) represents the node weight of group g; T group (g,t) represents the group trust of group g at time t; g∈G d Indicates that group g belongs to G d .

5. A network security monitoring and protection method according to claim 1, characterized in that: The dynamic trust decay mechanism includes: Define the trust decay function: T decay (t)=T0*e -η(t)*△t ; Among them, T decay (t) represents the trust after decay at time t; T0 represents the trust before decay; η(t) represents the dynamic decay rate; △t represents the trust decay period; e represents the natural logarithm base; Calculate the environmental risk value, and adjust the dynamic decay rate according to the environmental risk value. The adjustment formula of the dynamic decay rate is: η(t)=η0+△η*R env (t); Wherein, η(t) represents the dynamic decay rate at time t; η0 represents the basic decay rate; △η represents the maximum increment of the decay rate; R env (t) represents the environmental risk value; The trust decay period is set, and the individual trust degree is adjusted according to the trust decay function every other trust decay period.

6. A network security monitoring and protection method according to claim 1, characterized in that: The dynamic trust repair mechanism includes: Obtain the continuous normal operation time of each enterprise employee; Define the trust repair function: Among them, T repair (t) represents the repair confidence at time t; T min Indicates the minimum value of repair trust; T max represents the maximum value of repair trust; λ(t) represents the dynamic repair rate at time t; t normal represents the duration of continuous normal operation; e represents the base of the natural logarithm; Calculate the behavior score, and adjust the dynamic repair rate according to the behavior score. The adjustment formula of the dynamic repair rate is: λ(t)=λ0*(1+κ*Score behavior (t)); Wherein, λ(t) represents the dynamic repair rate at time t; λ0 represents the basic repair rate; κ represents the repair rate adjustment coefficient; Score behavior (t) represents the behavior score of the corresponding enterprise employee at time t; When the duration of the continuous normal operation is greater than a preset threshold, the individual trust level of the corresponding enterprise employee is adjusted according to the trust repair function.

7. A network security monitoring and protection method according to claim 1, characterized in that: The calculation of the operational risk value includes: Risk(u,t)=1-(w1*T individual (u,t)+w2*T group (g,t)+w3*T org (t))*S(u,t); Among them, Risk(u,t) represents the operational risk value of enterprise employee u at time t; w1, w2 and w3 represent weights; S(u,t) represents the operational sensitivity of enterprise employee u at time t.

8. A network security monitoring and protection method according to claim 1, characterized in that: Selecting the adaptive protection strategy based on the operational risk value includes: Based on the operational risk value, a risk level threshold is set to perform risk level classification; the risk levels include a first risk level, a second risk level, a third risk level, and a fourth risk level; The corresponding adaptive protection strategy is selected according to the risk level; the first risk level corresponds to the allowed operation, the second risk level corresponds to the secondary identity authentication, the third risk level corresponds to the multi-factor authentication, and the fourth risk level corresponds to the blocking operation.

9. An electronic device comprising a memory and a processor, characterized in that: The memory stores a computer program that can be run on the processor, and when the program is executed on the processor, the steps in the network security monitoring and protection method as described in any one of claims 1 to 8 are implemented.

10. A storage medium having computer program instructions stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the network security monitoring and protection method described in any one of claims 1 to 8 are implemented.

Images