Intelligent early warning method for network attacks based on big data

Abstract

The present invention provides a big data-based intelligent network attack early warning method, which relates to the technical field of intelligent network attack early warning, including: based on big data, collecting a set of network attack events in an enterprise network, performing fault tree analysis, and obtaining a network attack minimum cut set database; constructing a network environment simulation model, performing multi-dimensional feature hierarchical division, and obtaining multiple model levels; extracting the first model level and obtaining real-time network data for the first model level; performing attack feature analysis, performing feature weighted calculation on the feature analysis results, and obtaining a network attack coefficient for the first model level; when the risk reaches a first predetermined level threshold, performing analysis to obtain a real-time network attack risk; and issuing a network attack early warning. The present invention solves the technical problem that existing network attack detection is often based on static data models and rules, has weak real-time detection and response capabilities, and is difficult to respond quickly to dynamic network environments, resulting in poor system security.

Description

Technical Field

[0001] The present invention relates to the technical field of intelligent early warning of network attacks, and in particular to an intelligent early warning method for network attacks based on big data. Background Art

[0002] Cyber attacks can not only lead to the leakage of sensitive data, but also disrupt the normal operation of corporate networks, causing economic losses and even social harm. In order to cope with the increasingly serious threat of cyber attacks, existing network security protection technologies are constantly evolving and trying to deal with various new attack methods.

[0003] Traditional network attack defense methods typically include firewalls, intrusion detection systems, intrusion prevention systems, and anti-virus software. These methods are primarily based on signature matching, traffic monitoring, and rule detection to identify and block known attack patterns. However, the network security environment is dynamically changing, and existing network attack detection is often based on static data models and rules. Its real-time detection and response capabilities are relatively weak, especially in terms of rapid response to changes in the dynamic network environment. For example, the behavior of a network attack may be gradual, and the attack may gradually expand from one level to other levels. However, existing technologies generally find it difficult to achieve multi-dimensional hierarchical analysis and prediction, resulting in the system losing timeliness and accuracy when facing complex attacks. Summary of the Invention

[0004] This application provides an intelligent early warning method for network attacks based on big data, aiming to solve the technical problems that existing network attack detection is often based on static data models and rules, has weak real-time detection and response capabilities, and is difficult to respond quickly in the face of dynamic network environments, resulting in poor system security.

[0005] The present application discloses a big data-based intelligent early warning method for network attacks, which includes: collecting a set of network attack events in an enterprise network based on big data, performing an accident tree analysis on the set of network attack events, and obtaining a network attack minimum cut set database; constructing a network environment simulation model of the target enterprise network environment, performing multi-dimensional feature hierarchical division on the network environment simulation model, and obtaining multiple model levels; extracting a first model level, dynamically monitoring network data on the first model level, and obtaining real-time network data of the first model level, wherein the first model level has a first predetermined level threshold; performing attack feature analysis on the real-time network data of the first model level, and performing feature weighted calculation on the feature analysis results to obtain a first model level network attack coefficient; when the first model level network attack coefficient is within the first predetermined level threshold, analyzing the first model level real-time network data based on the network attack minimum cut set database to obtain a real-time network attack risk; and performing a network attack early warning on the target enterprise network environment according to the real-time network attack risk in combination with the network environment simulation model.

[0006] One or more technical solutions provided in this application have at least the following beneficial effects:

[0007] By collecting attack events in the enterprise network through big data, attack data can be collected comprehensively and in real time. The network attack minimum cut set database can be obtained through fault tree analysis of these data, effectively identifying the minimum triggering conditions of network attacks, namely the minimum cut set. This analysis provides basic data for subsequent attack detection, helping the system to quickly and accurately identify the root causes of potential attacks. The extraction of the minimum cut set enables the system to understand the key vulnerabilities and loopholes of network attacks, which helps to discover attack patterns in advance and thus take effective precautions before the attack breaks out; building a network environment simulation model and performing multi-dimensional feature hierarchical division provides a comprehensive and detailed digital representation of the enterprise network. Through the simulation and division of the network environment, risk analysis and attack prediction can be carried out at different levels. Attack simulation enables enterprises to take more accurate precautions against various types of attacks; dynamic monitoring and attack feature analysis enable the network system to obtain network data in real time and analyze its features. By extracting network data and combining it with attack feature analysis, network attack risks can be identified and assessed in a timely manner. When the network attack coefficient of the first model level is at a predetermined threshold, the network attack risk is further identified in real time based on the analysis of the minimum cut set database, and an early warning is issued in combination with the network environment simulation model. This process ensures early identification and early warning before the network attack breaks out, thereby providing the network security team with sufficient time to deploy protective measures. Attack early warning based on real-time data analysis is highly timely and accurate, effectively reducing the risk of network attacks.

[0008] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1 A flowchart of a big data-based intelligent early warning method for network attacks is provided for an embodiment of the present application.

[0010] Figure 2 The present invention provides a flowchart of an accident tree analysis in a big data-based intelligent early warning method for network attacks. DETAILED DESCRIPTION

[0011] The embodiments of the present application provide an intelligent early warning method for network attacks based on big data, which solves the technical problem that existing network attack detection is often based on static data models and rules, has weak real-time detection and response capabilities, and is difficult to respond quickly in the face of dynamic network environments, resulting in poor system security.

[0012] After introducing the basic principles of the present application, various non-limiting implementation methods of the present application will be specifically introduced in conjunction with the drawings in the specification.

[0013] like Figure 1 As shown, the embodiment of the present application provides a network attack intelligent early warning method based on big data, the method comprising:

[0014] A set of network attack events in an enterprise network is collected based on big data, and an accident tree analysis is performed on the set of network attack events to obtain a network attack minimum cut set database.

[0015] A large amount of network data is collected from the enterprise's network environment. This data includes network traffic, access logs, attack behavior records, etc., which can be obtained through the enterprise's security monitoring tools, intrusion detection / prevention systems, firewalls and other equipment. The collected data covers all network attack events, and the types of attacks involved include denial of service attacks, data leaks, malware intrusions, etc.

[0016] An incident tree analysis is performed on the collected set of network attack events. Incident tree analysis is a commonly used risk assessment method that constructs a logical diagram (an incident tree) to analyze how various potential causes combine to form a network attack event. Specifically, a network attack event is selected as the top event. The accident factors that led to the attack event, such as vulnerabilities, malicious behavior, and system errors, are identified. The incident tree is then constructed, and based on the relationships between the nodes in the tree, the minimum combination that triggers the attack, known as the minimum cut set, is identified.

[0017] After completing the fault tree analysis, the minimum cut set of each network attack event is obtained through analysis. The minimum cut set refers to the minimum combination of conditions that can trigger a network attack. It represents the key factors of the attack. These minimum cut sets are summarized and stored in the network attack minimum cut set database to provide data support for subsequent attack prediction and early warning.

[0018] A network environment simulation model of the target enterprise network environment is constructed, and the network environment simulation model is divided into multi-dimensional feature levels to obtain multiple model levels.

[0019] A comprehensive simulation model is established for the target enterprise's network environment. This model needs to reflect the details of the enterprise network's actual structure, equipment, communication paths, application services, and security configuration. The model construction may adopt graph theory, system simulation and other methods to model all components of the enterprise network and simulate their operating status and relationships.

[0020] After constructing the network environment simulation model, it undergoes a multi-dimensional feature hierarchical partitioning process. This process involves stratifying the complex characteristics of the enterprise network into different dimensions for analysis from different perspectives. Specific dimensions include user permissions, access control, and network topology. Based on these characteristics, the network environment simulation model is divided into multiple layers, each representing a specific network dimension and encompassing the corresponding security policies and network configurations. These layers can be used for subsequent network attack risk assessment and dynamic monitoring, helping to accurately identify potential attack targets and vulnerabilities.

[0021] A first model layer is extracted, and network data dynamic monitoring is performed on the first model layer to obtain real-time network data of the first model layer, wherein the first model layer has a first predetermined layer threshold.

[0022] Multiple model levels are randomly extracted from multiple model levels. This random extraction method is helpful for subsequent traversal analysis of each level and dynamic monitoring of the first model level. The purpose of dynamic monitoring is to obtain data about this level in the network in real time. These data include network traffic, system logs, access records, etc., capture data related to the first model level, and obtain real-time network data of the first model level. These data are real-time and can reflect the status of the current network environment, such as whether there are signs of abnormal access, sudden increase in network traffic or specific attack activities. The first model level has a first predetermined level threshold. The first predetermined level threshold refers to a threshold set in the first model level, which is used to identify the dividing line between normal and abnormal behavior. By comparing real-time data with the predetermined threshold, it can be determined whether the current network is in a normal state.

[0023] An attack feature analysis is performed on the real-time network data at the first model level, and a feature weighted calculation is performed on the feature analysis results to obtain a first model level network attack coefficient.

[0024] The real-time network data of the first model level is subjected to attack feature analysis. The purpose of attack feature analysis is to extract features related to network attacks from real-time data, including network traffic fluctuations, session duration, connection frequency and density, packet size, and data flow patterns. These features will be analyzed based on pre-defined dynamic network attack indicators and static network attack indicators. For example, dynamic indicators may include traffic patterns, number of connections, etc., while static indicators involve known vulnerabilities and access control configurations.

[0025] Based on the attack feature analysis, each feature is weighted. The purpose of weighting is to assign different weights to different features based on their predictive ability or impact on network attacks. For example, traffic fluctuation may be the most critical feature for judging an attack, so it may be given a higher weight. Changes in session duration can be given a lower weight, unless it occurs in conjunction with other features. A comprehensive network attack coefficient is generated through feature weighting calculation to represent the current network attack risk. This coefficient reflects the severity of the network attack at the first model level. The larger the value, the more severe the attack threat facing the current network.

[0026] When the network attack coefficient of the first model level is at a first predetermined level threshold, the real-time network data of the first model level is analyzed based on the network attack minimum cut set database to obtain the real-time network attack risk.

[0027] The first predetermined level threshold is a set standard value used to determine whether the network status is abnormal. If the network attack coefficient exceeds this threshold, it means that the network may be facing a serious attack risk and requires an immediate response.

[0028] When the network attack coefficient is within the predetermined threshold, that is, it is still within the safe range, it means that there is no need to respond immediately. In this case, in-depth analysis is required. Specifically, based on the previously constructed network attack minimum cut set database, the real-time network data of the first model level is deeply analyzed. The minimum cut set in the database records the minimum condition combination that triggers a specific network attack. When the network status is abnormal (that is, the attack coefficient is too high), by consulting the minimum cut set database, it is possible to identify which minimum condition combinations may lead to the currently observed network attack. The goal of the analysis is to determine which potential attack paths or vulnerabilities may have been exploited by comparing the current real-time network data with the information in the minimum cut set database.

[0029] Through analysis, we can derive the real-time network attack risk, which is the attack probability or risk level in the current network environment. This risk can be quantified based on factors such as vulnerabilities exposed in network data, attack paths, and attack characteristics. The real-time network attack risk is a dynamic indicator that reflects the specific threats currently facing the enterprise network and helps assess the severity of these threats.

[0030] In combination with the network environment simulation model, a network attack warning is performed on the target enterprise network environment according to the real-time network attack risk.

[0031] Real-time network attack risks are synchronized with a network environment simulation model for comprehensive analysis. This model provides a detailed and comprehensive view of the enterprise network, including network topology, access control, user permissions, etc. By rendering real-time network attack risks into this model, risks can be visualized, and network attack warnings can be provided. For example, alerts can be sent to the enterprise's network security personnel, automatically triggering network defense mechanisms such as adjusting firewall rules and restricting suspicious network connections. The purpose of network attack warnings is to identify and respond to attacks in a timely manner before or during the attack, thereby reducing the potential impact of network attacks.

[0032] Furthermore, if Figure 2 As shown, the method of performing an accident tree analysis on the network attack event set to obtain a network attack minimum cut set database includes:

[0033] A first network attack event is extracted based on the network attack event set; the first network attack event is used as a top event, and an accident factor of the top event is analyzed to obtain the accident tree; an accident tree is drawn based on the top event and the accident factor, and a first network attack minimum cut set of the first network attack event is determined according to the accident tree; and the first network attack minimum cut set is added to the network attack minimum cut set database.

[0034] The first network attack event is randomly extracted from the network attack event set as the basis for the subsequent analysis. This random extraction facilitates the subsequent traversal analysis of the entire network attack event set.

[0035] In the Fault Tree Analysis method, the first selected cyberattack event is defined as the top event. The top event refers to the final target event (i.e., the attack). It is the top event in the Fault Tree Analysis. To determine the root cause of the top event, the accident factors that led to it are analyzed. Accident factors are specific factors that can trigger or contribute to the attack. These include system vulnerabilities, such as unpatched operating systems or applications; weak passwords, such as password guessing or cracking attacks; improper configurations, such as incorrect firewall rule configurations and improper access control; and social engineering, such as phishing attacks or users being tricked into revealing their passwords. These accident factors serve as event nodes at the next level in the Fault Tree Analysis, representing the various factors that led to the attack.

[0036] Based on the extracted top events and accident factors, an accident tree is constructed. An accident tree connects different accident factors using logical operators (such as "AND" and "OR") to form a tree-like structure. An AND gate indicates that all sub-events must occur simultaneously to trigger the top event, while an OR gate indicates that any sub-event can trigger the top event. The root node of the accident tree is the top event, and the branches of the tree represent different accident factors and their relationships.

[0037] In the accident tree, the minimum cut set refers to the minimum combination of accident factors that can trigger the top event. The determination of the minimum cut set is the core of the accident tree analysis. It helps identify the key factors for the attack. By analyzing the accident tree, the minimum combination of accident factors is found. These combinations are the minimum cut sets. The minimum cut set indicates that an attack can only occur when these factors exist at the same time or are triggered according to specific conditions.

[0038] The first network attack minimal cut set is added to the network attack minimal cut set database. The database is used to store the minimal cut sets of all network attack events, which provides important data support for subsequent attack prediction and defense. By comparing real-time network data with the records in the minimal cut set database, vulnerabilities and potential attack paths in the network environment can be identified.

[0039] Furthermore, the method of performing multi-dimensional feature hierarchical division on the network environment simulation model to obtain multiple model levels includes:

[0040] Acquire multi-dimensional network characteristics of the target enterprise, wherein the multi-dimensional network characteristics of the target enterprise include user authority characteristics, access control characteristics, and network topology characteristics; and hierarchically divide the network environment simulation model according to the multi-dimensional network characteristics of the target enterprise to obtain multiple model levels.

[0041] Obtain multi-dimensional features of the target enterprise network. These features can comprehensively reflect the structure, security policies and behavior patterns of the enterprise network. Among them, user permission features describe the permission settings and role assignments of users or user groups in the network. These features can reveal which users have access rights to network resources and what operations they can perform. For example, some users may only have read-only permissions, while other users may have administrator permissions; access control features refer to the access control policies implemented in the network, including firewall settings, access control lists (ACLs), VPN configurations, etc. These features help understand which traffic is allowed to pass through the network, which is blocked, and which security measures may have loopholes or be lax; network topology features describe the physical and logical structure of the network, including the connection relationships between routers, switches, servers, workstations and other devices. Network topology affects the path of data flow, attack surface and potential security risks.

[0042] Based on the multi-dimensional network characteristics of the target enterprise, the network environment simulation model is divided into layers. This step aims to decompose various aspects of the enterprise network into different layers for better analysis and monitoring. Through the hierarchical nature of multi-dimensional characteristics, the simulation model can more clearly reflect the different levels of the network. Among them, the user behavior layer focuses on the user's behavior patterns, access rights, role allocation, etc., and can reveal the interactive relationship between users and network resources; the security policy layer focuses on analyzing security control measures in the network, including access control lists, firewall rules, authentication methods, etc.; the network structure layer reflects the physical and logical topology of the network, including device connections, data flow paths, etc.

[0043] Through this hierarchical structure, the model can reflect the network environment more flexibly and meticulously, and make the prediction and response to network attacks more accurate. The hierarchical structure makes network management and protection clearer, and targeted security measures can be taken according to the characteristics of each layer.

[0044] Furthermore, the method of performing attack feature analysis on the first model level real-time network data includes:

[0045] Based on predetermined network attack dynamic indicators, a network attack dynamic feature analysis is performed on the real-time network data of the first model level to obtain a first network attack dynamic feature, wherein the predetermined network attack dynamic indicator includes network traffic fluctuation, session duration, connection frequency and density, data packet size and data flow pattern; based on predetermined network attack static indicators, a network attack static feature analysis is performed on the real-time network data of the first model level to obtain a first network attack static feature, wherein the predetermined network attack static indicator includes known security vulnerabilities, access control lists, and system permission configuration; the first network attack dynamic feature and the first network attack static feature constitute the feature analysis result.

[0046] Dynamic features refer to characteristics of network activities that change over time, reflecting the dynamic behavior of network traffic and communication patterns. These features are usually used to identify abnormal network behavior in the short term, such as attack outbreaks and abnormal changes in data flows. Based on predetermined network attack dynamic indicators, real-time network data is analyzed to extract dynamic features of network attacks.

[0047] Among them, network traffic fluctuation refers to the changes in network traffic within a certain period of time. Attack behaviors, especially distributed denial of service (DDoS) attacks, usually cause sharp fluctuations in traffic. For example, attackers may increase network traffic sharply through a large number of false requests; session duration refers to the length of time a session in the network is maintained. Normal network sessions may last for a long time, but aggressive behaviors (such as botnet attacks) may cause abnormal session duration; connection frequency and density refer to the number of connections initiated per unit time and the density of connections. For example, a malicious attack may manifest as a large number of connection requests in a short period of time; packet size and data flow pattern. The pattern of attack traffic may be significantly different from normal traffic. For example, the size of the packet, the regularity of the data flow, etc. may show specific abnormal patterns when an attack occurs.

[0048] Based on predetermined dynamic indicators, real-time network data is analyzed to identify whether there are dynamic features related to network attacks. For example, a sudden increase in network traffic may immediately trigger a DDoS attack warning. Through dynamic feature analysis, the first network attack dynamic features are obtained. These features can describe abnormal behavior in real-time network data and help the system determine whether the current network is facing an attack threat.

[0049] Static features refer to inherent characteristics in a network environment that do not change over time. They usually reflect loopholes or weaknesses in system configurations and security policies. Attackers often exploit these static weaknesses to launch attacks. Based on predetermined network attack static indicators, real-time network data is analyzed to extract network attack static features.

[0050] Among them, known security vulnerabilities refer to known vulnerabilities or unpatched weaknesses that may exist in the network. For example, a server may have unpatched vulnerabilities that attackers can exploit to launch remote attacks; access control lists define which traffic can pass and which is rejected on network devices (such as firewalls or routers). Attackers may try to bypass access control lists or exploit configuration vulnerabilities therein; system permission configuration refers to the permission configuration of different users and systems in the network. Incorrect permission settings may cause attackers to obtain excessive permissions to penetrate the system or leak data.

[0051] The focus of static feature analysis is to identify potential security vulnerabilities in the current network configuration and system. By scanning, auditing, and comparing network configurations, potential static vulnerabilities or misconfigurations can be discovered. Based on the analysis results of static indicators, the first network attack static features are obtained. These features reveal the vulnerabilities or configuration errors in the current network that may be exploited by attackers, providing data support for subsequent attack detection and defense.

[0052] Integrate the first network attack dynamic features and the first network attack static features to form the feature analysis results. This result provides multi-dimensional feature support for the entire network attack warning. Combining dynamic and static analysis can help more accurately identify attack behaviors in the network and respond.

[0053] Furthermore, obtaining the predetermined network attack dynamic indicator includes:

[0054] Acquire network attack feature information based on historical network monitoring data; perform noise reduction on the network attack feature information to obtain network attack feature frequency; and obtain the predetermined network attack dynamic indicator based on the network attack feature frequency.

[0055] Historical network monitoring data refers to all network traffic data collected by enterprises over the past period of time through network monitoring tools such as intrusion detection systems and traffic analyzers. This data includes network traffic, port access, protocol usage, user behavior logs, etc. The purpose of collecting historical data is to identify attack events that have occurred in the network, obtain the network behavior patterns during the attack, and provide background information for subsequent analysis.

[0056] Extracting network attack feature information from historical data refers to the specific behavioral patterns exhibited in the network when an attack occurs. Typical attack features include abnormal traffic patterns, abnormal port access, abnormal protocol usage, repeated or continuous connection attempts, etc. Feature extraction based on historical data will help identify the specific behavior, type, and pattern of the attack. These features can provide a data foundation for subsequent dynamic feature analysis and risk assessment.

[0057] Network monitoring data is usually very large and complex, containing a large amount of noise, that is, non-aggressive normal data. This noise will interfere with the accurate analysis of attack characteristics. The purpose of noise reduction is to remove irrelevant or unrelated data, thereby highlighting information related to network attacks. For example, through statistical analysis methods, it is determined which characteristic values deviate from the norm and are high-probability events of attack behavior; by identifying frequent features that appear in attack behavior, those accidental, non-aggressive events are removed.

[0058] After data noise reduction, the remaining data will be purer and can accurately reflect the true situation of network attack characteristics. By performing frequency analysis on this data, we can identify which attack characteristics appear more frequently in historical network monitoring. Network attack characteristic frequency refers to the frequency with which specific attack behaviors or patterns appear in historical data. For example, if a certain type of DDoS attack frequently appears in historical data, its frequency will be higher. Attack characteristics with higher frequencies usually mean that this type of attack has a higher risk and requires priority attention.

[0059] By analyzing the frequency of attack characteristics, dynamic indicators are established. These indicators can help monitor potential threats in the network in real time. For example, if a specific type of attack occurs frequently in a short period of time, it will be judged that the attack behavior has a higher risk and requires priority defense. Ultimately, through these predetermined dynamic indicators, signs of attack can be quickly identified in real-time network data monitoring and early warnings can be issued. The changing trends of dynamic indicators can also help enterprises adjust their defense strategies and respond to changing attack patterns in advance.

[0060] Furthermore, after obtaining the first model level network attack coefficient, the method further includes:

[0061] The first model level also has a first predetermined level weight; based on the first predetermined level weight, a weighted feedback adjustment is performed on the network attack coefficient of the first model level.

[0062] The first model layer is a level within the network environment simulation model, reflecting a specific aspect of the network. It also has a first predetermined layer weight. This weight is assigned to each layer to measure its relative importance in the network attack risk assessment. Different network layers may have different impacts on the overall attack risk assessment. For example, if there are a large number of high-privileged users, the security risk at that layer may be higher and require a higher weight. The determination of weights typically depends on the complexity and importance of each layer in the network environment. Different weights can be assigned to each model layer through risk assessment methods, expert judgment, or historical data analysis. Weights may be adjusted dynamically as the network environment changes. For example, if the security configuration of a layer is modified or strengthened, its weight may decrease, while if it is not, its weight may increase.

[0063] The network attack coefficient is a numerical value reflecting the network attack risk of each model layer at a specific point in time. It is calculated based on real-time monitoring data. Weighted adjustment refers to multiplying the attack coefficient of each layer by its corresponding predetermined weight to obtain the adjusted attack coefficient. This process makes the assessment of network attack risk more accurate because the attack risks of important layers receive greater attention and weight. The purpose of weighted feedback adjustment is to make the overall network attack risk assessment more flexible and targeted. For example, when a significant change occurs at a network layer, such as an adjustment to the network topology or user permissions, the change in the weight and attack coefficient of that layer is directly reflected in the overall risk assessment. This dynamic adjustment helps to predict network attack risks more accurately and in real time, and provides a higher level of warning for potential high-risk areas.

[0064] Furthermore, the method of dynamically monitoring network data on the first model level further includes:

[0065] Obtain first network environment information of the first model level, wherein the first network environment information has a first time interval identifier; collect environmental evaluation information of the first network environment information through multi-dimensional channels, and perform credibility identification on the collection results, and generate first environmental evaluation feature distribution data based on the identification results; generate first monitoring computing power distribution control parameters based on the first environmental evaluation feature distribution data and the first time interval identifier; and perform computing power control for dynamic monitoring of network data based on the first monitoring computing power distribution control parameters.

[0066] The first network environment information of the first model level refers to the specific data about the first model level extracted from the network environment. For example, these data include network topology, user activities, access records, traffic data, etc. Each piece of network environment information is marked with a time interval identifier, which indicates the validity of the data within a specific time period. The network environment is dynamically changing, so assigning a time interval identifier to each data set can help the system understand the network status at a specific time point or time period. For example, if the network is attacked within a certain period of time, the time interval identifier will help the system identify the time window when the attack occurred so as to perform relevant attack feature analysis.

[0067] Assessment information related to the network environment is collected through multiple channels. These channels include network monitoring tools such as traffic analyzers and intrusion detection systems, which collect real-time information such as network traffic and events; system logs and user activity records, including logins, file accesses, and user permission changes; and external security information such as known attacks, vulnerability information, and network attack trends. Through these multi-dimensional channels, comprehensive data on the network environment can be obtained, including network health, security incidents, and potential threats.

[0068] The collected network environment information comes from different sources, and the quality and accuracy of each data source are different. In order to ensure the reliability of the information, the collection results need to be credibly identified. The credibility identification can be evaluated based on factors such as the historical accuracy of the data source, the timeliness of data collection, and the performance of the data collection tool. For example, data from long-term used and verified security tools may have higher credibility, while data from new, unverified tools may have lower credibility.

[0069] Based on the credibility identification, the collected data is weighted and environmental evaluation feature distribution data is generated. These data can reflect the security status, health status and potential threats of the network environment within a certain time period. The environmental evaluation feature distribution data includes network traffic patterns, attack frequency, system load and other aspects.

[0070] Monitoring computing power allocation refers to the reasonable allocation of computing power to ensure effective monitoring of different network environment characteristics when conducting dynamic monitoring of network data. Different network environments require different computing resources for real-time data analysis. Through environmental evaluation feature distribution data and time interval identification, it is possible to determine which network layers require more monitoring resources within a certain period of time. For example, if the traffic is abnormally high within a certain period of time, more computing power may be required to process this traffic. Based on the environmental evaluation features and time interval data, monitoring computing power distribution control parameters are generated. These parameters determine how the system allocates and schedules monitoring resources. Parameters include resource allocation ratio, priority adjustment, etc. These control parameters ensure that the system can flexibly adjust resource allocation to cope with dynamically changing network environments and real-time attack threats.

[0071] After obtaining the first monitoring computing power distribution control parameters, dynamic monitoring begins. Based on the generated control parameters, computing power allocation is dynamically adjusted during real-time monitoring. For example, during peak traffic periods, more computing resources are allocated to traffic analysis and security testing. Computing power control is not just a simple resource allocation, but also includes dynamic adjustment of computing tasks. For example, if signs of an attack appear within a certain period of time, the monitoring computing power for that area will be automatically increased, further enhancing the ability to detect network security incidents. By dynamically controlling computing power, it is possible to ensure that network data dynamic monitoring tasks are fully supported by resources within different time periods. Potential security threats can be responded to and analyzed in depth in a timely manner to ensure the security of the network environment.

[0072] Furthermore, the method further comprises:

[0073] When the network attack coefficient of the first model level is not at a first predetermined level threshold, network attack warning information is generated; based on the network attack warning information, the network environment simulation model is activated to perform a network attack warning.

[0074] The first model layer's network attack coefficient is a numerical value calculated based on real-time network data, indicating the attack risk faced by the network at that layer. If the risk indicated by the attack coefficient is too high, it indicates that the security status of that layer is abnormal. The first predetermined layer threshold is a standard value set for the network attack coefficient, used to determine whether there is a risk that requires attention. When the network attack coefficient exceeds this threshold, it means that the layer may be under serious attack or threat.

[0075] If the network attack coefficient is not within the predetermined safety range, that is, not within the threshold, a network attack warning information will be generated immediately. The warning information includes the attack type, attack source, affected level or area, risk level, etc.

[0076] The network environment simulation model is activated based on the network attack warning information. The simulation model can simulate the performance of attacks in different environments based on the content of the warning information, such as the level, type and impact range of the attack, to help predict the further development of the attack. After the simulation model is activated, a network attack warning is issued based on the results of the model simulation. This warning can provide attack spread paths, attack impact assessments, defense strategy recommendations, etc. This process provides early warning of network attacks through simulation models, which can help enterprises identify potential attack risks and avoid the spread of attacks or large-scale damage.

[0077] In summary, the big data-based intelligent early warning method for network attacks provided by the embodiments of the present application has the following technical effects:

[0078] By collecting attack events in the enterprise network through big data, attack data can be collected comprehensively and in real time. The network attack minimum cut set database can be obtained through fault tree analysis of these data, effectively identifying the minimum triggering conditions of network attacks, namely the minimum cut set. This analysis provides basic data for subsequent attack detection, helping the system to quickly and accurately identify the root causes of potential attacks. The extraction of the minimum cut set enables the system to understand the key vulnerabilities and loopholes of network attacks, which helps to discover attack patterns in advance and thus take effective precautions before the attack breaks out; building a network environment simulation model and performing multi-dimensional feature hierarchical division provides a comprehensive and detailed digital representation of the enterprise network. Through the simulation and division of the network environment, risk analysis and attack prediction can be carried out at different levels. Attack simulation enables enterprises to take more accurate precautions against various types of attacks; dynamic monitoring and attack feature analysis enable the network system to obtain network data in real time and analyze its features. By extracting network data and combining it with attack feature analysis, network attack risks can be identified and assessed in a timely manner. When the network attack coefficient of the first model level is at a predetermined threshold, the network attack risk is further identified in real time based on the analysis of the minimum cut set database, and an early warning is issued in combination with the network environment simulation model. This process ensures early identification and early warning before the network attack breaks out, thereby providing the network security team with sufficient time to deploy protective measures. Attack early warning based on real-time data analysis is highly timely and accurate, effectively reducing the risk of network attacks.

[0079] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present application. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application is not limited to the embodiments shown herein, but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An intelligent early warning method for network attacks based on big data, characterized in that: The method comprises: Based on big data, a set of network attack events in the enterprise network is collected, and an accident tree analysis is performed on the network attack event set to obtain a network attack minimum cut set database; Constructing a network environment simulation model of the target enterprise network environment, and performing multi-dimensional feature hierarchical division on the network environment simulation model to obtain multiple model hierarchies; Extracting a first model layer, dynamically monitoring network data of the first model layer, and obtaining real-time network data of the first model layer, wherein the first model layer has a first predetermined layer threshold; Performing attack feature analysis on the real-time network data at the first model level, and performing feature weighted calculation on the feature analysis results to obtain a first model level network attack coefficient; When the network attack coefficient of the first model level is at a first predetermined level threshold, analyzing the real-time network data of the first model level based on the network attack minimum cut set database to obtain a real-time network attack risk; In combination with the network environment simulation model, a network attack warning is performed on the target enterprise network environment according to the real-time network attack risk.

2. The network attack intelligent early warning method based on big data according to claim 1, characterized in that: The method of performing an accident tree analysis on the network attack event set to obtain a network attack minimum cut set database includes: Extracting a first network attack event based on the network attack event set; Taking the first network attack event as a top event, and analyzing to obtain an accident factor of the top event; Drawing an accident tree based on the top event and the accident factor, and determining a first network attack minimum cut set of the first network attack event according to the accident tree; Adding the first network attack minimal cut set to the network attack minimal cut set database.

3. The network attack intelligent early warning method based on big data according to claim 1, characterized in that: The method of dividing the network environment simulation model into multi-dimensional feature levels to obtain multiple model levels includes: Acquire multi-dimensional network characteristics of the target enterprise, wherein the multi-dimensional network characteristics of the target enterprise include user authority characteristics, access control characteristics, and network topology characteristics; According to the multi-dimensional network characteristics of the target enterprise, the network environment simulation model is divided into levels to obtain multiple model levels.

4. The network attack intelligent early warning method based on big data according to claim 1, characterized in that: The method of performing attack feature analysis on the first model layer real-time network data includes: Based on predetermined network attack dynamic indicators, performing network attack dynamic feature analysis on the real-time network data of the first model level to obtain a first network attack dynamic feature, wherein the predetermined network attack dynamic indicators include network traffic fluctuation, session duration, connection frequency and density, data packet size and data flow pattern; Based on predetermined network attack static indicators, performing network attack static feature analysis on the first model hierarchical real-time network data to obtain a first network attack static feature, wherein the predetermined network attack static indicators include known security vulnerabilities, access control lists, and system permission configurations; The first network attack dynamic feature and the first network attack static feature constitute the feature analysis result.

5. The network attack intelligent early warning method based on big data according to claim 4 is characterized in that: Obtaining the predetermined network attack dynamic indicator includes: Obtain network attack feature information based on historical network monitoring data; Performing noise reduction on the network attack feature information to obtain a network attack feature frequency; The predetermined network attack dynamic indicator is obtained based on the network attack characteristic frequency.

6. The network attack intelligent early warning method based on big data according to claim 1, characterized in that: After obtaining the first model level network attack coefficient, the method further includes: The first model level also has a first predetermined level weight; A weighted feedback adjustment is performed on the first model level network attack coefficient based on the first predetermined level weight.

7. The network attack intelligent early warning method based on big data according to claim 1, characterized in that: The method of dynamically monitoring network data on the first model level further includes: Acquire first network environment information of the first model level, wherein the first network environment information has a first time interval identifier; Collecting environmental evaluation information of the first network environment information through multi-dimensional channels, marking the credibility of the collected results, and generating first environmental evaluation feature distribution data based on the marking results; generating a first monitoring computing power distribution control parameter according to the first environmental evaluation feature distribution data and the first time interval identifier; Computing power control for dynamic monitoring of network data is performed according to the first monitoring computing power distribution control parameter.

8. The network attack intelligent early warning method based on big data according to claim 1, characterized in that: The method further comprises: When the network attack coefficient of the first model level is not at a first predetermined level threshold, generating network attack warning information; Based on the network attack warning information, the network environment simulation model is activated to perform a network attack warning.

Images