Network attack intelligent early warning method based on big data

Abstract

The invention provides a network attack intelligent early warning method based on big data, and relates to the technical field of network attack intelligent early warning, and the method comprises the steps: collecting a network attack event set in an enterprise network based on big data, carrying out the accident tree analysis, and obtaining a network attack minimum cut set database; constructing a network environment simulation model, and performing multi-dimensional feature hierarchy division to obtain a plurality of model hierarchies; extracting a first model hierarchy, and obtaining real-time network data of the first model hierarchy; attack feature analysis is carried out, feature weighting calculation is carried out on a feature analysis result, and a first model hierarchical network attack coefficient is obtained; analyzing to obtain a real-time network attack risk when the network attack risk is in a first preset level threshold value; and carrying out network attack early warning. The network attack detection method and device solve the technical problems that existing network attack detection is usually based on static data models and rules, the real-time detection and coping capacity is weak, rapid response is difficult to make in a dynamic network environment, and the safety of a system is poor.

Description

Technical Field

[0001] The present invention relates to the technical field of intelligent early warning of network attacks, and in particular to an intelligent early warning method for network attacks based on big data. Background Art

[0002] Cyber ​​attacks can not only lead to the leakage of sensitive data, but also may disrupt the normal operation of corporate networks, causing economic losses and even social harm. In order to cope with the increasingly serious threat of cyber attacks, existing network security protection technologies are constantly developing and trying to deal with various new types of attack methods.

[0003] Traditional network attack defense methods usually include firewalls, intrusion detection systems, intrusion prevention systems and anti-virus software. These methods are mainly based on signature matching, traffic monitoring and rule detection to identify and block known attack patterns. However, the network security environment is dynamically changing. Existing network attack detection is often based on static data models and rules, and has weak real-time detection and response capabilities, especially in terms of rapid response to changes in the dynamic network environment. For example, the behavior of a network attack may be gradual, and the attack may gradually expand from one level to other levels. Existing technologies usually find it difficult to achieve multi-dimensional hierarchical analysis and prediction, resulting in the system losing timeliness and accuracy when facing complex attacks. Summary of the invention

[0004] This application provides an intelligent early warning method for network attacks based on big data, aiming to solve the technical problems that existing network attack detection is often based on static data models and rules, has weak real-time detection and response capabilities, and is difficult to respond quickly in the face of dynamic network environments, resulting in poor system security.

[0005] The present application discloses a method for intelligent early warning of network attacks based on big data, the method comprising: collecting a set of network attack events in an enterprise network based on big data, performing an accident tree analysis on the set of network attack events, and obtaining a network attack minimum cut set database; constructing a network environment simulation model of a target enterprise network environment, performing multi-dimensional feature hierarchical division on the network environment simulation model, and obtaining multiple model hierarchies; extracting a first model hierarchy, dynamically monitoring network data on the first model hierarchy, and obtaining real-time network data of the first model hierarchy, wherein the first model hierarchy has a first predetermined hierarchical threshold; performing attack feature analysis on the real-time network data of the first model hierarchy, and performing feature weighted calculation on the feature analysis results, and obtaining a network attack coefficient of the first model hierarchy; when the network attack coefficient of the first model hierarchy is at the first predetermined hierarchical threshold, analyzing the real-time network data of the first model hierarchy based on the network attack minimum cut set database, and obtaining a real-time network attack risk; combining the network environment simulation model, and performing a network attack early warning on the target enterprise network environment according to the real-time network attack risk.

[0006] One or more technical solutions provided in this application have at least the following beneficial effects:

[0007] By collecting attack events in the enterprise network through big data, we can collect attack data comprehensively and in real time. Through the accident tree analysis of these data, we can obtain the network attack minimum cut set database, effectively identify the minimum triggering conditions of network attacks, that is, the minimum cut set. This analysis provides basic data for subsequent attack detection, helping the system to quickly and accurately identify the root causes of potential attacks. The extraction of the minimum cut set enables the system to understand the key vulnerabilities and loopholes of network attacks, which helps to discover attack patterns in advance and effectively prevent attacks before they break out. Constructing a network environment simulation model and performing multi-dimensional feature hierarchical division provides a comprehensive and detailed digital representation of the enterprise network. Through the simulation and division of the network environment, risk analysis and attack prediction can be performed at different levels. Attack simulation enables enterprises to make more accurate prevention of various types of attack behaviors; dynamic monitoring and attack feature analysis enable the network system to obtain network data in real time and analyze its features. By extracting network data and combining it with attack feature analysis, it can timely identify and evaluate network attack risks; when the network attack coefficient of the first model level is at a predetermined threshold, the network attack risk is further identified in real time based on the analysis of the minimum cut set database, and early warning is issued in combination with the network environment simulation model. This process ensures early identification and early warning before the outbreak of network attacks, thereby providing the network security team with sufficient time to deploy protective measures. Attack early warning based on real-time data analysis has high timeliness and accuracy, effectively reducing the risk of network attacks.

[0008] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1 A flowchart of a big data-based intelligent early warning method for network attacks is provided for an embodiment of the present application.

[0010] Figure 2 A schematic diagram of the process of performing an accident tree analysis in a big data-based intelligent early warning method for network attacks is provided for an embodiment of the present application. DETAILED DESCRIPTION

[0011] The embodiments of the present application provide an intelligent early warning method for network attacks based on big data, thereby solving the technical problem that existing network attack detection is often based on static data models and rules, has weak real-time detection and response capabilities, and is difficult to respond quickly in the face of a dynamic network environment, resulting in poor system security.

[0012] After introducing the basic principles of the present application, various non-limiting implementation methods of the present application will be specifically described below in conjunction with the drawings in the specification.

[0013] like Figure 1 As shown, the embodiment of the present application provides a network attack intelligent early warning method based on big data, the method comprising:

[0014] A set of network attack events in an enterprise network is collected based on big data, and an accident tree analysis is performed on the set of network attack events to obtain a network attack minimum cut set database.

[0015] A large amount of network data is collected from the enterprise's network environment. These data include network traffic, access logs, attack behavior records, etc., which can be obtained through the enterprise's security monitoring tools, intrusion detection / prevention systems, firewalls and other equipment. The collected data covers all network attack incidents, and the types of attacks involved include denial of service attacks, data leaks, malware intrusions, etc.

[0016] Accident tree analysis is performed on the collected network attack event collection. Accident tree analysis is a method commonly used in risk assessment. It constructs a logic diagram (accident tree) to analyze how various potential causes are combined into network attack events. Specifically, a network attack event is selected as the top event, and the accident factors that cause the attack event, such as vulnerabilities, malicious behaviors, system errors, etc., are determined. An accident tree is established, and based on the relationship between each node in the tree, the minimum combination that triggers the attack, that is, the minimum cut set, is identified.

[0017] After completing the accident tree analysis, the minimum cut set of each network attack event is obtained through analysis. The minimum cut set refers to the minimum combination of conditions that can trigger a network attack. It represents the key factors of the attack. These minimum cut sets are summarized and stored in the network attack minimum cut set database to provide data support for subsequent attack prediction and early warning.

[0018] A network environment simulation model of the target enterprise network environment is constructed, and the network environment simulation model is divided into multi-dimensional feature levels to obtain multiple model levels.

[0019] A comprehensive simulation model is established for the target enterprise's network environment. This model needs to reflect the actual structure, equipment, communication paths, application services, and security configuration of the enterprise network. The model may be constructed using graph theory, system simulation and other methods. By modeling all components of the enterprise network, its operating status and relationships can be simulated.

[0020] After the network environment simulation model is built, the model is divided into multi-dimensional feature layers. This process is to divide the complex characteristics of the enterprise network into layers according to different dimensions so that it can be analyzed from different angles. The specific dimensional division includes user permission characteristics, access control characteristics, and network topology characteristics. According to these characteristics, the network environment simulation model is divided into layers to form multiple model layers. Each layer represents a specific network dimension, covering the corresponding security policies and network configurations. These layers can be used for subsequent network attack risk assessment and dynamic monitoring, which helps to accurately identify potential attack targets and vulnerabilities.

[0021] A first model layer is extracted, network data of the first model layer is dynamically monitored, and real-time network data of the first model layer is obtained, wherein the first model layer has a first predetermined layer threshold.

[0022] Multiple model levels are randomly extracted from multiple model levels. This random extraction method is helpful for subsequent traversal analysis of each level and dynamic monitoring of the first model level. The purpose of dynamic monitoring is to obtain data about this level in the network in real time. These data include network traffic, system logs, access records, etc., capture data related to the first model level, and obtain real-time network data of the first model level. These data are real-time and can reflect the status of the current network environment, such as whether there are signs of abnormal access, sudden increase in network traffic or specific attack activities. The first model level has a first predetermined level threshold. The first predetermined level threshold refers to a threshold set in the first model level, which is used to identify the dividing line between normal and abnormal behavior. By comparing the real-time data with the predetermined threshold, it can be determined whether the current network is in a normal state.

[0023] Perform attack feature analysis on the real-time network data at the first model level, and perform feature weighted calculation on the feature analysis results to obtain a first model level network attack coefficient.

[0024] The real-time network data of the first model level is subjected to attack feature analysis. The purpose of attack feature analysis is to extract features related to network attacks from real-time data, including network traffic fluctuations, session duration, connection frequency and density, packet size, and data flow patterns. These features will be analyzed based on pre-defined dynamic network attack indicators and static network attack indicators. For example, dynamic indicators may include traffic patterns, number of connections, etc., while static indicators involve known vulnerabilities and access control configurations.

[0025] Based on the attack feature analysis, each feature is weighted. The purpose of weighting is to assign different weights according to the predictive ability or impact of different features on network attacks. For example, traffic fluctuation may be the most critical feature for judging an attack, so it may be given a higher weight, and changes in session duration can be given a lower weight, unless it appears in conjunction with other features. A comprehensive network attack coefficient is generated through feature weighted calculation, representing the attack risk of the current network. This coefficient reflects the severity of the network attack at the first model level. The larger the value, the more serious the attack threat facing the current network.

[0026] When the network attack coefficient of the first model level is at a first predetermined level threshold, the real-time network data of the first model level is analyzed based on the network attack minimum cut set database to obtain the real-time network attack risk.

[0027] The first predetermined level threshold is a set standard value used to determine whether the network status is abnormal. If the network attack coefficient exceeds this threshold, it means that the network may be facing a serious attack risk and requires an immediate response.

[0028] When the network attack coefficient is within the predetermined threshold, that is, it is still within the safe range, it means that there is no need to respond immediately. In this case, in-depth analysis is required. Specifically, based on the previously constructed network attack minimum cut set database, the real-time network data of the first model level is deeply analyzed. The minimum cut set in the database records the minimum condition combination that triggers a specific network attack. When the network status is abnormal (that is, the attack coefficient is too high), by consulting the minimum cut set database, it is possible to identify which minimum condition combinations may lead to the currently observed network attack. The goal of the analysis is to determine which potential attack paths or vulnerabilities may have been exploited by comparing the current real-time network data with the information in the minimum cut set database.

[0029] Through analysis, we can obtain the real-time network attack risk, that is, the attack probability or risk level in the current network environment. This risk can be quantified based on factors such as vulnerabilities exposed in network data, attack paths, attack characteristics, etc. The real-time network attack risk is a dynamic indicator that reflects the specific threats currently facing the enterprise network and helps assess the severity of these threats.

[0030] In combination with the network environment simulation model, a network attack warning is performed on the target enterprise network environment according to the real-time network attack risk.

[0031] Real-time network attack risks are synchronized to the network environment simulation model for comprehensive analysis. This model provides a detailed and comprehensive view of the enterprise network, including network topology, access control, user permissions, etc. By rendering real-time network attack risks to the model, risks can be visualized, and network attack warnings can be carried out. For example, alarms can be sent to the company's network security personnel, and network defense mechanisms can be automatically triggered, such as adjusting firewall rules, restricting suspicious network connections, etc. The purpose of network attack warnings is to identify and respond in a timely manner before or when an attack occurs, thereby reducing the potential impact of network attacks.

[0032] Furthermore, if Figure 2 As shown, the method of performing an accident tree analysis on the network attack event set to obtain a network attack minimum cut set database includes:

[0033] A first network attack event is extracted based on the network attack event set; the first network attack event is used as a top event, and an accident factor of the top event is obtained through analysis; an accident tree is drawn based on the top event and the accident factor, and a first network attack minimum cut set of the first network attack event is determined according to the accident tree; and the first network attack minimum cut set is added to the network attack minimum cut set database.

[0034] The first network attack event is randomly extracted from the network attack event set as the basis for the subsequent analysis. This random extraction facilitates the subsequent traversal analysis of the entire network attack event set.

[0035] In the accident tree analysis method, the first selected network attack event is first defined as the top event. The top event refers to the target event that eventually occurs (i.e., the occurrence of the attack). It is the top event in the accident tree analysis. In order to determine the root cause of the top event, the accident factors that caused the event are analyzed. Accident factors refer to specific factors that can trigger or contribute to the occurrence of attacks, including system vulnerabilities, such as unpatched operating systems or applications; weak passwords, such as attacks where passwords are guessed or cracked; improper configurations, such as incorrect firewall rule configurations, improper access control, etc.; social engineering, such as phishing attacks or users being tricked into leaking passwords, etc. These accident factors will serve as event nodes of the next layer in the accident tree analysis, representing the various factors that lead to the attack.

[0036] Based on the extracted top events and accident factors, an accident tree is constructed. The accident tree connects different accident factors through logical operators (such as "and" and "or") to form a tree structure, where the AND gate indicates that all sub-events must occur at the same time to trigger the top event; the OR gate indicates that the occurrence of any sub-event can trigger the top event. The root node of the accident tree is the top event, and the branches of the tree represent different accident factors and their relationships.

[0037] In the accident tree, the minimum cut set refers to the minimum combination of accident factors that can trigger the top event. The determination of the minimum cut set is the core of the accident tree analysis. It helps to identify the key factors for the attack. By analyzing the accident tree, the minimum combination of accident factors is found. These combinations are the minimum cut sets. The minimum cut set means that an attack can only occur when these factors exist at the same time or are triggered according to specific conditions.

[0038] The first network attack minimum cut set is added to the network attack minimum cut set database. The database is used to store the minimum cut sets of all network attack events, which provides important data support for subsequent attack prediction and defense. By comparing real-time network data with the records in the minimum cut set database, vulnerabilities and potential attack paths in the network environment can be identified.

[0039] Furthermore, the method of performing multi-dimensional feature hierarchical division on the network environment simulation model to obtain multiple model hierarchies includes:

[0040] The multi-dimensional network characteristics of the target enterprise are obtained, wherein the multi-dimensional network characteristics of the target enterprise include user authority characteristics, access control characteristics, and network topology characteristics; and the network environment simulation model is hierarchically divided according to the multi-dimensional network characteristics of the target enterprise to obtain multiple model levels.

[0041] Acquire multi-dimensional features of the target enterprise network. These features can fully reflect the structure, security policies and behavior patterns of the enterprise network. Among them, user permission features describe the permission settings and role assignments of users or user groups in the network. These features can reveal which users have access rights to network resources and what operations they can perform. For example, some users may only have read-only permissions, while other users may have administrator permissions. Access control features refer to the access control policies implemented in the network, including firewall settings, access control lists (ACLs), VPN configurations, etc. These features help understand which traffic is allowed to pass through the network, which is blocked, and which security measures may have loopholes or be lax. Network topology features describe the physical and logical structure of the network, including the connection relationships between routers, switches, servers, workstations and other devices. Network topology affects the path of data flow, the attack surface and potential security risks.

[0042] According to the multi-dimensional network characteristics of the target enterprise, the network environment simulation model is divided into layers. This step aims to decompose various aspects of the enterprise network into different layers for better analysis and monitoring. Through the hierarchical nature of multi-dimensional characteristics, the simulation model can more clearly reflect the different levels of the network. Among them, the user behavior layer focuses on the user's behavior patterns, access rights, role allocation, etc., and can reveal the interactive relationship between users and network resources; the security policy layer focuses on analyzing the security control measures in the network, including access control lists, firewall rules, identity authentication methods, etc.; the network structure layer reflects the physical and logical topology of the network, including device connections, data flow paths, etc.

[0043] Through this hierarchical structure, the model can reflect the network environment more flexibly and meticulously, and make the prediction and response to network attacks more accurate. The hierarchical structure makes the management and protection of the network clearer, and targeted security measures can be taken according to the characteristics of each level.

[0044] Furthermore, the method of performing attack feature analysis on the first model hierarchical real-time network data includes:

[0045] Based on predetermined network attack dynamic indicators, a network attack dynamic feature analysis is performed on the real-time network data of the first model level to obtain a first network attack dynamic feature, wherein the predetermined network attack dynamic indicator includes network traffic fluctuation, session duration, connection frequency and density, data packet size and data flow pattern; based on predetermined network attack static indicators, a network attack static feature analysis is performed on the real-time network data of the first model level to obtain a first network attack static feature, wherein the predetermined network attack static indicator includes known security vulnerabilities, access control lists, and system permission configuration; the first network attack dynamic feature and the first network attack static feature constitute the feature analysis result.

[0046] Dynamic features refer to the characteristics of network activities that change over time, reflecting the dynamic behavior of network traffic and communication patterns. These features are usually used to identify abnormal network behavior in the short term, such as attack outbreaks, abnormal changes in data flows, etc. Based on predetermined network attack dynamic indicators, real-time network data is analyzed to extract dynamic features of network attacks.

[0047] Among them, network traffic fluctuation refers to the change of network traffic within a certain period of time. Attack behavior, especially distributed denial of service (DDoS) attacks, usually causes sharp fluctuations in traffic. For example, attackers may increase network traffic sharply through a large number of false requests; session duration refers to the length of time a session in the network is maintained. A normal network session may last for a long time, but aggressive behavior (such as botnet attacks) may cause abnormal session duration; connection frequency and density refer to the number of connections initiated per unit time and the density of connections. For example, a malicious attack may manifest as a large number of connection requests in a short period of time; packet size and data flow pattern. The pattern of attack traffic may be significantly different from normal traffic. For example, the size of the packet, the regularity of the data flow, etc. may show specific abnormal patterns when an attack occurs.

[0048] According to the predetermined dynamic indicators, the real-time network data is analyzed to identify whether there are dynamic features related to network attacks. For example, a sudden increase in network traffic may immediately cause a warning of a DDoS attack. Through dynamic feature analysis, the first network attack dynamic features are obtained. These features can describe abnormal behavior in real-time network data and help the system determine whether the current network is facing an attack threat.

[0049] Static features refer to inherent features in a network environment that do not change over time. They usually reflect loopholes or weaknesses in system configurations and security policies. Attackers usually exploit these static weaknesses to launch attacks. Based on predetermined network attack static indicators, real-time network data is analyzed to extract network attack static features.

[0050] Among them, known security vulnerabilities refer to known vulnerabilities or unpatched weaknesses that may exist in the network. For example, a server may have unpatched vulnerabilities that attackers can exploit to launch remote attacks. Access control lists define which traffic can pass and which is rejected on network devices (such as firewalls or routers). Attackers may try to bypass access control lists or exploit configuration vulnerabilities therein. System permission configuration refers to the permission configuration of different users and systems in the network. Incorrect permission settings may cause attackers to obtain excessive permissions to penetrate the system or leak data.

[0051] The focus of static feature analysis is to identify possible security vulnerabilities in the current network configuration and system. By scanning, auditing and comparing network configurations, potential static vulnerabilities or misconfigurations can be discovered. Based on the analysis results of static indicators, the first network attack static features are obtained. These features reveal the vulnerabilities or configuration errors in the current network that may be exploited by attackers, providing data support for subsequent attack detection and defense.

[0052] Integrate the first network attack dynamic features and the first network attack static features to form the feature analysis results, which provide multi-dimensional feature support for the entire network attack warning. Combining dynamic and static analysis can help more accurately identify attack behaviors in the network and respond.

[0053] Furthermore, obtaining the predetermined network attack dynamic indicator includes:

[0054] Acquire network attack feature information based on historical network monitoring data; perform noise reduction on the network attack feature information to acquire network attack feature frequency; and obtain the predetermined network attack dynamic indicator based on the network attack feature frequency.

[0055] Historical network monitoring data refers to all network traffic data collected by enterprises over the past period of time through network monitoring tools such as intrusion detection systems and traffic analyzers. These data include network traffic, port access, protocol usage, user behavior logs, etc. The purpose of collecting historical data is to identify attack events that have occurred in the network, obtain the network behavior patterns during the attack, and provide background information for subsequent analysis.

[0056] Extract network attack feature information from historical data, which refers to the specific behavior patterns exhibited in the network when an attack occurs. Typical attack features include abnormal traffic patterns, abnormal port access, abnormal protocol usage, repeated or continuous connection attempts, etc. Feature extraction based on historical data will help identify the specific behavior, type and pattern of the attack. These features can provide a data basis for subsequent dynamic feature analysis and risk assessment.

[0057] Network monitoring data is usually very large and complex, containing a lot of noise, that is, non-aggressive normal data, which will interfere with the accurate analysis of attack characteristics. The purpose of noise reduction is to remove irrelevant or unrelated data, thereby highlighting information related to network attacks. For example, through statistical analysis methods, it is determined which characteristic values ​​deviate from the norm and are high-probability events of attack behavior; by identifying frequent features that appear in attack behavior, those accidental, non-aggressive events are removed.

[0058] After data noise reduction, the remaining data will be purer and can accurately reflect the true situation of network attack characteristics. By performing frequency analysis on these data, we can identify which attack characteristics appear frequently in historical network monitoring. The frequency of network attack characteristics refers to the frequency of specific attack behaviors or patterns in historical data. For example, if a certain type of DDoS attack frequently appears in historical data, its frequency will be higher. Attack characteristics with higher frequency usually mean that this type of attack has a higher risk and requires priority attention.

[0059] By analyzing the frequency of attack features, dynamic indicators are established. These indicators can help monitor potential threats in the network in real time. For example, if a specific type of attack occurs frequently in a short period of time, it will be determined that the attack behavior has a higher risk and needs to be defended as a priority. Ultimately, through these predetermined dynamic indicators, signs of attacks can be quickly identified in real-time network data monitoring and early warnings can be issued. The changing trends of dynamic indicators can also help companies adjust their defense strategies and respond to changing attack patterns in advance.

[0060] Furthermore, after obtaining the first model level network attack coefficient, the method further includes:

[0061] The first model level also has a first predetermined level weight; based on the first predetermined level weight, a weighted feedback adjustment is performed on the first model level network attack coefficient.

[0062] The first model level is a level in the network environment simulation model, which reflects a certain aspect of the network. The first model level also has a first predetermined level weight, which is a weight value assigned to each level, used to measure the relative importance of the level in the network attack risk assessment. Different network levels may have different influences on the overall attack risk assessment. For example, if there are a large number of high-authority users, the security risk of this level may be higher and require a higher weight. The determination of weights usually depends on the complexity and importance of each level in the network environment. Through risk assessment methods, expert judgment or historical data analysis, different weights can be assigned to each model level. The weight value may be dynamically adjusted as the network environment changes. For example, after the security configuration of a certain level is changed or strengthened, its weight may be reduced, and vice versa.

[0063] The network attack coefficient is a numerical value that reflects the network attack risk of each model layer at a specific time point. It is calculated based on real-time monitoring data. Weighted adjustment refers to multiplying the attack coefficient of each layer by the corresponding predetermined weight to obtain the adjusted attack coefficient. This process makes the assessment of network attack risk more accurate because the attack risk of important layers receives more attention and weight. The purpose of weighted feedback adjustment is to make the entire network attack risk assessment more flexible and targeted. For example, when a certain network layer undergoes important changes, such as adjustments to the network topology or user permissions, the changes in the weight and attack coefficient of the layer will be directly reflected in the overall risk assessment. This dynamic adjustment helps to predict network attack risks more real-time and accurately, and give higher warnings to potential high-risk areas.

[0064] Furthermore, the method for dynamically monitoring network data on the first model level further includes:

[0065] Acquire first network environment information of the first model level, wherein the first network environment information has a first time interval identifier; collect environmental evaluation information for the first network environment information through a multi-dimensional channel, and perform credibility identification on the collected results, and generate first environmental evaluation feature distribution data according to the identification results; generate first monitoring computing power distribution control parameters according to the first environmental evaluation feature distribution data and the first time interval identifier; and perform computing power control for dynamic monitoring of network data according to the first monitoring computing power distribution control parameters.

[0066] The first network environment information of the first model level refers to the specific data about the first model level extracted from the network environment. For example, these data include network topology, user activities, access records, traffic data, etc. Each piece of network environment information is marked with a time interval identifier, which indicates the validity of the data within a specific time period. The network environment is dynamically changing, so assigning a time interval identifier to each data set can help the system understand the network status at a specific time point or time period. For example, if the network is attacked within a certain period of time, the time interval identifier will help the system identify the time window when the attack occurred, so as to conduct relevant attack feature analysis.

[0067] Evaluation information related to the network environment is collected through multiple channels, including network monitoring tools, such as traffic analyzers, intrusion detection systems, etc., which collect real-time information such as traffic and events in the network; system logs and user activity records, including log-in, file access, user permission change logs; external security information, such as known attack events, vulnerability information, network attack trends, etc. Through these multi-dimensional channels, comprehensive data about the network environment can be obtained, including the health status of the network, security events, potential threats, etc.

[0068] The collected network environment information comes from different sources, and the quality and accuracy of each data source are different. In order to ensure the reliability of the information, the collection results need to be credibly identified. The credibility identification can be evaluated based on factors such as the historical accuracy of the data source, the timeliness of data collection, and the performance of the data collection tool. For example, data from long-used and verified security tools may have a higher credibility, while data from unverified new tools may have a lower credibility.

[0069] Based on the credibility identification, the collected data is weighted and the environmental evaluation feature distribution data is generated. These data can reflect the security status, health status and potential threats of the network environment within a certain time period. The environmental evaluation feature distribution data includes network traffic patterns, attack frequency, system load and other aspects.

[0070] Monitoring computing power allocation refers to the reasonable allocation of computing power in order to ensure effective monitoring of different network environment characteristics when dynamically monitoring network data. Different network environments require different computing resources for real-time data analysis. Through environmental evaluation feature distribution data and time interval identification, it is possible to determine which network layers require more monitoring resources within a certain period of time. For example, if the traffic is abnormally high within a certain period of time, more computing power may be required to process the traffic. Based on the environmental evaluation characteristics and time interval data, the monitoring computing power distribution control parameters are generated. These parameters determine how the system allocates and schedules monitoring resources. Parameters include resource allocation ratio, priority adjustment, etc. These control parameters ensure that the system can flexibly adjust resource allocation to cope with dynamically changing network environments and real-time attack threats.

[0071] After obtaining the first monitoring computing power distribution control parameter, dynamic monitoring begins. According to the generated control parameters, the computing power allocation is dynamically adjusted during the real-time monitoring process. For example, more computing resources are invested in traffic analysis and security detection during peak traffic hours. Computing power control is not just a simple resource allocation, but also includes dynamic adjustment of computing tasks. For example, if there are signs of attack within a certain period of time, the monitoring computing power of the area will be automatically increased to further enhance the detection capability of network security incidents. By dynamically controlling computing power, it can be ensured that the dynamic monitoring tasks of network data can be fully supported by resources in different time periods, and timely responses and in-depth analysis can be made for potential security threats to ensure the security of the network environment.

[0072] Furthermore, the method further comprises:

[0073] When the network attack coefficient of the first model level is not within the first predetermined level threshold, network attack warning information is generated; based on the network attack warning information, the network environment simulation model is activated to issue a network attack warning.

[0074] The first model level network attack coefficient is a value calculated based on real-time network data, which indicates the attack risk faced by the network at this level. If the risk indicated by the attack coefficient is too high, it means that the security status of this level is abnormal. The first predetermined level threshold is a standard value set for the network attack coefficient, which is used to determine whether there is a risk that needs attention. When the network attack coefficient exceeds the threshold, it means that the level may be under serious attack or threat.

[0075] If the network attack coefficient is not within the predetermined safety range, that is, not within the threshold, a network attack warning information will be generated immediately. The warning information includes the attack type, attack source, affected level or area, risk level, etc.

[0076] The network environment simulation model is activated according to the network attack warning information. The simulation model can simulate the performance of attacks in different environments according to the content of the warning information, such as the level, type and impact range of the attack, to help predict the further development of the attack. After the simulation model is activated, a network attack warning is issued according to the results of the model simulation. This warning can provide attack spread path, attack impact assessment, defense strategy recommendations, etc. This process uses the simulation model to provide early warning of network attacks, which can help enterprises identify potential attack risks and avoid the spread of attacks or large-scale damage.

[0077] In summary, the network attack intelligent early warning method based on big data provided by the embodiment of the present application has the following technical effects:

[0078] By collecting attack events in the enterprise network through big data, we can collect attack data comprehensively and in real time. Through the accident tree analysis of these data, we can obtain the network attack minimum cut set database, effectively identify the minimum triggering conditions of network attacks, that is, the minimum cut set. This analysis provides basic data for subsequent attack detection, helping the system to quickly and accurately identify the root causes of potential attacks. The extraction of the minimum cut set enables the system to understand the key vulnerabilities and loopholes of network attacks, which helps to discover attack patterns in advance and effectively prevent attacks before they break out. Constructing a network environment simulation model and performing multi-dimensional feature hierarchical division provides a comprehensive and detailed digital representation of the enterprise network. Through the simulation and division of the network environment, risk analysis and attack prediction can be performed at different levels. Attack simulation enables enterprises to make more accurate prevention of various types of attack behaviors; dynamic monitoring and attack feature analysis enable the network system to obtain network data in real time and analyze its features. By extracting network data and combining it with attack feature analysis, it can timely identify and evaluate network attack risks; when the network attack coefficient of the first model level is at a predetermined threshold, the network attack risk is further identified in real time based on the analysis of the minimum cut set database, and early warning is issued in combination with the network environment simulation model. This process ensures early identification and early warning before the outbreak of network attacks, thereby providing the network security team with sufficient time to deploy protective measures. Attack early warning based on real-time data analysis has high timeliness and accuracy, effectively reducing the risk of network attacks.

[0079] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An intelligent early warning method for network attacks based on big data, characterized in that: The method comprises: Based on big data, a set of network attack events in the enterprise network is collected, and an accident tree analysis is performed on the set of network attack events to obtain a network attack minimum cut set database; Constructing a network environment simulation model of the target enterprise network environment, dividing the network environment simulation model into multi-dimensional feature levels, and obtaining multiple model levels; Extracting a first model layer, dynamically monitoring network data of the first model layer, and obtaining real-time network data of the first model layer, wherein the first model layer has a first predetermined layer threshold; Performing attack feature analysis on the real-time network data at the first model level, and performing feature weighted calculation on the feature analysis results to obtain a first model level network attack coefficient; When the network attack coefficient of the first model level is at a first predetermined level threshold, analyzing the real-time network data of the first model level based on the network attack minimum cut set database to obtain a real-time network attack risk; In combination with the network environment simulation model, a network attack warning is performed on the target enterprise network environment according to the real-time network attack risk.

2. The network attack intelligent early warning method based on big data according to claim 1 is characterized in that: The method of performing an accident tree analysis on the network attack event set to obtain a network attack minimum cut set database includes: Extracting a first network attack event based on the network attack event set; Taking the first network attack event as a top event, and analyzing to obtain an accident factor of the top event; Based on the top event and the accident factor, draw an accident tree, and determine a first network attack minimum cut set of the first network attack event according to the accident tree; Adding the first network attack minimum cut set to the network attack minimum cut set database.

3. The network attack intelligent early warning method based on big data according to claim 1 is characterized in that: The method of dividing the network environment simulation model into multi-dimensional feature levels to obtain multiple model levels includes: Acquire multi-dimensional network characteristics of the target enterprise, wherein the multi-dimensional network characteristics of the target enterprise include user authority characteristics, access control characteristics, and network topology characteristics; According to the multi-dimensional network characteristics of the target enterprise, the network environment simulation model is divided into levels to obtain multiple model levels.

4. The network attack intelligent early warning method based on big data according to claim 1 is characterized in that: The method of performing attack feature analysis on the first model hierarchical real-time network data includes: Based on predetermined network attack dynamic indicators, performing network attack dynamic feature analysis on the first model hierarchical real-time network data to obtain a first network attack dynamic feature, wherein the predetermined network attack dynamic indicators include network traffic fluctuations, session duration, connection frequency and density, data packet size, and data flow pattern; Based on predetermined network attack static indicators, performing network attack static feature analysis on the first model hierarchical real-time network data to obtain a first network attack static feature, wherein the predetermined network attack static indicators include known security vulnerabilities, access control lists, and system permission configurations; The first network attack dynamic feature and the first network attack static feature constitute the feature analysis result.

5. The network attack intelligent early warning method based on big data as claimed in claim 4 is characterized in that: Obtaining the predetermined network attack dynamic indicator includes: Obtain network attack feature information based on historical network monitoring data; Denoising the network attack feature information to obtain a network attack feature frequency; The predetermined network attack dynamic indicator is obtained based on the network attack characteristic frequency.

6. The network attack intelligent early warning method based on big data according to claim 1 is characterized in that: After obtaining the first model level network attack coefficient, the method further includes: The first model level also has a first predetermined level weight; A weighted feedback adjustment is performed on the first model level network attack coefficient based on the first predetermined level weight.

7. The network attack intelligent early warning method based on big data according to claim 1 is characterized in that: The method of dynamically monitoring network data on the first model level further includes: Acquire first network environment information of the first model level, wherein the first network environment information has a first time interval identifier; Collecting environmental evaluation information of the first network environment information through multi-dimensional channels, marking the credibility of the collected results, and generating first environmental evaluation feature distribution data according to the marking results; Generate a first monitoring computing power distribution control parameter according to the first environmental evaluation feature distribution data and the first time interval identifier; The computing power control for dynamic monitoring of network data is performed according to the first monitoring computing power distribution control parameter.

8. The network attack intelligent early warning method based on big data according to claim 1 is characterized in that: The method further comprises: When the network attack coefficient of the first model level is not at the first predetermined level threshold, generating network attack warning information; Based on the network attack warning information, the network environment simulation model is activated to perform a network attack warning.

Images