Visual-based threat alert display method

Abstract

The application discloses a threat alarm display method based on visualization and relates to the technical field of information visualization. The application constructs an adaptive dynamic network by related information between various servers. When a threat alarm is generated, the IP and timestamp of the alarm information are captured by a security monitoring system. The timestamp is used to screen out key suspected servers. The positions of the key suspected servers in the adaptive dynamic network are found according to the IP. The similarity between the server abnormalities and the current threat characteristics and previous security events is determined to determine the servers threatened. The identification information, threat type, threat details, real-time performance indicators and business association information of the servers threatened are encrypted. The encrypted information is transmitted to the corresponding servers of the adaptive dynamic network for display. Only when an operator inputs a correct key can real threat alarm information be obtained, so that the security and confidentiality of data are effectively ensured.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information visualization, in particular to a threat alarm display method based on visualization. BACKGROUND

[0002] Under the current environment of rapid development of network technology, the number of servers is growing explosively, and the network architecture is becoming increasingly complex. The traditional threat alarm display method exposes many drawbacks. In the vast amount of network information, it is difficult to quickly and accurately lock the threat source, so that the security risks cannot be detected and handled in time. At the same time, due to the difficulty of directly and intuitively presenting the complex association between servers, it is not conducive for security personnel to fully grasp the network situation. In addition, when a threat occurs, the protection of sensitive data is crucial, but the existing technology has obvious shortcomings in the safe display of encrypted data, and cannot effectively guarantee the security and confidentiality of data, posing a serious threat to the data security of users and enterprises. SUMMARY

[0003] In view of the deficiencies of the prior art, the present application provides a threat alarm display method based on visualization, which solves the problems that the existing method cannot quickly and accurately lock the threat source and cannot effectively guarantee the security and confidentiality of the displayed data.

[0004] To achieve the above purpose, the present application is realized by the following technical scheme: a threat alarm display method based on visualization, comprising:

[0005] For each server, the information of its data transmission volume, connection stability and business stability is extracted, the corresponding weights of the three aspects are calculated, and an adaptive dynamic network is constructed accordingly. When a threat alarm occurs, the IP and timestamp of the alarm information are captured by a security monitoring system, and the key suspected servers are filtered out using the timestamp. According to the IP, the positions of the key suspected servers in the adaptive dynamic network are found out, and the servers with threats are determined by associating the server anomalies and the current threat characteristics with the similarity of previous security events.

[0006] The system obtains the identification information, threat type, threat details, real-time performance metrics, and business-related information of servers posing a threat. The identification information includes the server's IP address, room number, and rack number. The threat type includes network attack threats, malware threats, physical security threats, internal threats, and other threats. The threat details include the attack source, attack time, and attack intensity. The real-time performance metrics include CPU utilization, memory utilization, disk I / O rate, and bandwidth utilization. The business-related information includes the associated business system and business impact assessment. The raw information to be displayed is divided into numeric and character categories. Numeric information is not processed. For character information, the code point corresponding to each character is obtained according to the Unicode table and converted into a decimal number. The length of the numeric sequence L_character i is calculated. If L_character i... i >Lth character i Then, lossless compression of the digital sequence is required, and the input dimension of the autoencoder, Linput = sum(L), needs to be determined. 数字j )+sum(Lth 字符i The algorithm combines numeric and converted character sequences, uses a tent mapping to generate a key sequence of dimension Linput, and adds the combined data and key one-to-one to obtain the input data for the autoencoder. After multiple iterations, a trained autoencoder is obtained. The original data to be displayed is then substituted into the autoencoder to obtain the combined data, which is then displayed on the server corresponding to the adaptive dynamic network. Only when the operator enters the correct key can a real threat alert be obtained. Here, i represents the character identifier of the i-th type of threat, j represents the j-th quantization index of that type of threat, and Lth... 字符i The character identifier length threshold representing the i-th type of threat.

[0007] As a further aspect of the present invention, the specific steps for constructing an adaptive dynamic network are as follows:

[0008] Collect the data transfer volume between the servers, according to the formula W ij1 =(T ij +T ji ) / T total Calculate the weights of data transfer volume between servers, where T ij Indicates from server s i to s j Data transmission volume, T ji Indicates from server s j to s i Data transmission volume, T total This represents the total amount of data transmitted between all servers in the network.

[0009] Record the time of each connection establishment, the time of each connection termination, and the number of connection interruptions, according to the formula W.ij2 = sum(D k ) / n*max(D) to calculate the connection stability weight between servers, wherein D k represents the duration of the kth connection, n represents the total number of connections in the statistical period, and max(D) represents the maximum value in all connection durations;

[0010] The mutual relationship of different servers in the service is determined, and the service correlation weight W ij3 is determined by combining the expert scoring and the analytic hierarchy process;

[0011] According to the formula W ij = nbd1*W ij1 +nbd2*W ij2 +nbd3*W ij3 , the connection weight between the servers in the adaptive dynamic network is obtained, wherein nbd1, nbd2 and nbd3 are weight coefficients.

[0012] As a further scheme of the application, the method for screening the key suspected servers by using the time stamp is as follows:

[0013] The time point T of threat occurrence is accurately recorded according to the time stamp in the alarm information;

[0014] A reasonable time floating number ±t is set;

[0015] The historical running state parameters of the servers are collected, including the CPU usage, the memory occupancy, the network flow and the number of vulnerabilities, and the behavior baseline of each server under normal conditions is established;

[0016] The running state parameters of each server in the range of [T-t, T+t] are obtained, and are compared with the pre-set baseline, and the number of parameters marked as abnormal is recorded;

[0017] If the number of abnormal parameters exceeds two, it is judged that the server is abnormal, and the server is marked as a key suspected server.

[0018] As a further scheme of the application, the method for judging the correlation of server abnormality is as follows:

[0019] The position of the key suspected server in the adaptive dynamic network is determined;

[0020] The weight W t between the other servers directly connected with the key suspected server is found according to the connection matrix, t [1, a], and a represents the total number of the other servers directly connected with the key suspected server;

[0021] If W t > W thThen, the abnormal state of the associated server is determined.

[0022] If the number of abnormal servers is greater than [0.8a], it is determined that the associated server is abnormal, wherein W th is a weight threshold, and [] is a rounding symbol.

[0023] As a further scheme of the present application, the specific steps of calculating the similarity between the current threat and the previous security event are as follows:

[0024] The features of the current threat and the previous security event are extracted, including the attack time, attack means, affected server type, and involved IP address range.

[0025] The weight of each feature is set according to its importance.

[0026] Each feature of the current threat is compared with the corresponding feature of the previous security event. If they are completely the same, 1 point is given; if they are completely different, 0 point is given; and if they are similar, 0.5 point is given.

[0027] The score of each feature is multiplied by its corresponding weight, and the products are added up. The result is the similarity S between the current threat and the previous security event.

[0028] As a further scheme of the present application, if the suspected server satisfies the associated server abnormality and S>S th , it is determined that the server is under threat, wherein S th is a similarity threshold.

[0029] As a further scheme of the present application, the specific steps of lossless compression of the digital sequence are as follows:

[0030] The initial position of each number in the original digital sequence is recorded to form a position-number pair.

[0031] The position-number pairs are sorted according to the number size to obtain a sorted digital sequence and a corresponding sorted position index.

[0032] The difference between adjacent numbers in the sorted digital sequence is calculated to obtain a difference sequence.

[0033] The difference sequence is traversed to count the number of consecutive same differences. The same differences and their occurrence numbers are combined into an element to form a run-length encoded sequence. According to the range of the differences, a specific character is specified for each range as an encoding.

[0034] The differences in the run-length encoding are replaced by the corresponding characters, and the occurrence numbers are retained to obtain a self-defined encoded sequence.

[0035] The self-defined coded character coding part is converted into corresponding hexadecimal numbers according to the Unicode table, and then converted into decimal numbers, combined with the following number part to obtain the compressed numbers.

[0036] As a further scheme of the present application, if the number sequence is losslessly compressed, the length of the compressed sequence is L' 字符i A number with sequence is added to the back of the compressed number sequence, and the length of the added number is Lth 字符i Lth 字符i For the number sequence that has not been losslessly compressed, the length of the sequence is L1 i If L1 i L1

[0037] The present application provides a visual-based threat alarm display method.

[0038] (1) The present application constructs an adaptive dynamic network from the data transmission amount, connection stability and service stability of each server, which can more fully display the connection relationship between the servers and lay the foundation for further determination of server threats.

[0039] (2) The identification information, threat type, threat details, real-time performance indicators and business association information of the server with threats are encrypted, and the encrypted information is transmitted to the corresponding server of the adaptive dynamic network for display, effectively ensuring the security and confidentiality of the data, and helping the operator quickly locate the server position with threats for timely and effective handling of the threats. BRIEF DESCRIPTION OF DRAWINGS

[0040] Figure 1 The present application provides a visual-based threat alarm display method. DETAILED DESCRIPTION

[0041] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0042] As Figure 1 The present application provides a visual-based threat alarm display method, which includes:

[0043] S101. Extract information on the data transmission volume, connection stability, and service stability of each server, and calculate the respective weights to construct an adaptive dynamic network;

[0044] With the help of network traffic monitoring tools, collect the data transmission volume between each server in a certain time period (such as every 5 minutes). In addition to recording the number of transmitted bytes, it is also necessary to distinguish between upload and download data volume, as bidirectional data interaction is important for measuring the degree of close relationship between servers. According to the formula W ij1 =(T ij +T ji ) / T total , calculate the weight of data transmission volume between servers, where T ij represents the data transmission volume from server s i to s j , T ji represents the data transmission volume from server s j to s i , and T total is the total data transmission volume between all servers in the network.

[0045] Using network monitoring programs, record the time of each connection establishment, disconnection, and the number of connection interruptions. For example, for some real-time communication servers, they need to maintain long-term stable connections to ensure real-time data transmission, so connection stability is very important. According to the formula W ij2 =sum(D k ) / n*max(D), calculate the weight of connection stability between servers, where D k represents the duration of the kth connection, n represents the total number of connections within the statistical period, and max(D) represents the maximum value of all connection durations.

[0046] Organize business architecture documents, business process design diagrams, and other materials to clarify the mutual relationship of different servers in the business. For example, in a large online education platform, the course video playback server and the user authentication server may have small data transmission volume, but they have a close dependence in business, as only after authentication can access course videos. Expert scoring can be combined with the analytic hierarchy process to determine the business relevance weight W ij3 . First, use experts familiar with the business to score the business relevance between each pair of servers, with scores set to 0-10, 0 indicating no relevance and 10 indicating strong relevance. Then use the analytic hierarchy process to process expert scoring to determine the relative weight of business relevance between servers.

[0047] The weight values of the above three aspects are weighted and summed to obtain a weight value W which comprehensively reflects the tightness of the connection between the servers ij = nbd1 * W ij1 + nbd2 * W ij2 + nbd3 * W ij3 wherein nbd1, nbd2, and nbd3 are weight coefficients adjusted according to actual conditions.

[0048] S102. When a threat alert is generated, the IP and timestamp of the alert information are captured by the security monitoring system, and the key suspected servers are screened out through the timestamp;

[0049] When a threat alert is generated, the timestamp in the alert information accurately records the time point at which the threat occurs. The security monitoring system will set a reasonable time range based on this, which can cover the time period in which the server state may change abnormally before and after the threat occurs. For example, if the alert time is 10:00:00, and the time range set is 9:55:00-10:05:00 before and after the alert time point.

[0050] By collecting and analyzing the historical running state parameters of the servers, including CPU usage, memory occupancy, network traffic, and vulnerability quantity, a behavior baseline of each server under normal conditions is established. This behavior baseline is a specific reference range, representing the fluctuation interval of each parameter of the server under normal working conditions. For example, for a certain server, its normal network traffic is between 100-200MB per hour.

[0051] The system will collect the running state parameters of the servers within the above time range and compare them with the pre-set baseline. Taking network traffic as an example, if the network traffic of a certain server suddenly rises to 500MB per hour within the time period of 9:55:00-10:05:00, far exceeding the normal traffic baseline range, then this server will be marked as abnormal in this parameter.

[0052] If only the abnormal change of a certain parameter may not be sufficient to determine whether the server has truly abnormal behavior, it is necessary to judge comprehensively based on the above four parameters. If the number of abnormal parameters exceeds two, it is judged that the server has abnormal behavior. For example, when the network traffic of a certain server abnormally increases, its CPU usage also significantly increases, and the memory usage also exceeds the normal range. Therefore, this server is likely to have abnormal behavior in the threat, and becomes a key suspect of the threat source.

[0053] S103. For the key suspect object screened out by the time stamp, its IP address is obtained, and in the adaptive dynamic network, the IP address is used for accurate matching, because the IP addresses of all servers and their connection relationships are recorded in detail in the adaptive dynamic network, the corresponding server node of the IP address can be quickly located by querying in the IP address database of the network. For example, in the server information table associated with the adjacency matrix of the adaptive dynamic network, the corresponding server record is found with the IP address of the suspected server as the index, the position of the server in the network topology and other servers directly connected thereto are determined, and the approximate position of the threat in the network is preliminarily determined;

[0054] After determining the position of the key suspected server in the adaptive dynamic network, the connection relationship thereof with other servers is analyzed in depth, the weight W between other servers directly connected thereto is found according to the connection matrix, and the weight W is determined according to the following formula: t (t∈[1,a], a represents the total amount of other servers directly connected to the key suspected server), if W t >W th , the above abnormal state judgment is performed on the associated server, that is, whether the associated server is abnormal is judged from the CPU usage, memory occupancy, network traffic and vulnerability quantity within a specified time range, if the number of abnormal associated servers is greater than [0.8a], it is indicated that the associated server is abnormal, and the associated server is taken as the judgment condition 1, wherein [] represents the integer operation;

[0055] The adaptive dynamic network will accumulate a large amount of historical data in the continuous running process, including historical connection records of servers and abnormal situations that have ever occurred, for the key suspected server, the historical connection data thereof is viewed, the similarity S between the current threat characteristics and previous security events is calculated;

[0056] The calculation method for determining the similarity of threat features and previous security events includes: (1) extracting features of the current threat and the previous security events, including attack time, attack means (such as DDoS attack, SQL injection, etc.), affected server type, and involved IP address range; (2) setting a certain weight for each feature to represent its importance, for example, the damage degree and influence range of SQL injection and DDoS attack are different, SQL injection is mainly aimed at databases, and DDoS attack can cause the entire network to be paralyzed, so the weight of the DDoS attack means will be higher than that of the SQL injection; (3) comparing each feature of the current threat with the corresponding feature of the previous security event, if they are exactly the same, scoring 1, if they are completely different, scoring 0, if they have similarity, scoring 0.5, for example, if the current threat is SQL injection attack, and the previous security event is also SQL injection attack, then score 1 on the attack means feature, if the previous security event is DDoS attack, then score 0; if the current threat affected server type is web server, and the previous security event affected database server, they have some similarity, then score 0.5 on the affected server type feature; (4) multiplying the score of each feature by its corresponding weight, and then adding up the products, the result is the similarity S of the current threat and the previous security event;

[0057] If S> similarity S th , it indicates that the current threat features are similar to the previous security events, and the association of the server with the threat can be further determined as judgment condition 2. For example, a key suspected server has once connected with a server marked as a malicious software propagation source in the past, and the abnormal situation screened out by the time stamp this time is similar to the features of the previous malicious software propagation, which provides strong historical data support for determining that the server is a threat source;

[0058] If the key suspected server meets both judgment condition 1 and judgment condition 2, it can be determined that the server is a threat.

[0059] S104. After determining the server with threat, the identification information, threat type, threat details, real-time performance indicators, and business association information of the server need to be encrypted, and the encrypted information is transmitted to the corresponding server node in the adaptive dynamic network for display. Only when the administrator inputs the correct key can the real threat alarm information be obtained;

[0060] The specific steps of encryption are as follows: (1) the relevant original information required to be displayed by the server is divided into digital categories (for example, the IP address of the server, the machine room and rack to which it belongs) and character categories (for example, the business impact evaluation of the e-commerce system, including the page being blocked and unable to select a payment method when the user places an order, and the data query function being abnormal); (2) the information in the digital category is no longer changed to prevent destroying its own attributes, while the data in the character category needs to determine the code point corresponding to each character according to the Unicode table, and the code point at this time is a number represented by hexadecimal, which still contains letters (for example, the values from 10 to 15 are represented by A to F respectively), so the number represented by hexadecimal needs to be converted into a decimal number; (3) after the conversion, the length L of the number sequence is counted 字符i , if L 字符i >Lth 字符i (Lth is the length of the character type specified in advance), the number sequence needs to be losslessly compressed;

[0061] The specific method of lossless compression is as follows: record the initial position of each number in the original number sequence to form a position-number pair; sort these position-number pairs according to the size of the numbers to obtain a sorted number sequence and a corresponding sorted position index, which prepares for the subsequent restoration of the original sequence order; calculate the difference between adjacent numbers in the sorted number sequence to obtain a difference sequence; traverse the difference sequence and count the number of consecutive same differences; combine the same differences and their occurrence numbers into an element to form a run-length encoded sequence, for example, if the difference sequence is [5, 5, 10, 10, 10, 15], the run-length encoded sequence is [(5, 2), (10, 3), (15, 1)]; according to the range of the difference, a specific character is specified for each range as the code, for example, the range of 0-100 corresponds to the character 'A', the range of 101-500 corresponds to the character 'B', etc.; replace the difference in the run-length encoded sequence with the corresponding character and retain the occurrence number to obtain the self-defined encoded sequence, for example, the run-length encoded element (5, 2) becomes 'A2' and (1000, 1) becomes 'C1'; encode the character code part of the self-defined encoded sequence according to the Unicode table to obtain the corresponding hexadecimal number, and then convert it into a decimal number, and then combine it with the following number part to obtain the compressed number, for example, 'A2' is converted into 652 and 'C1' is converted into 671;

[0062] The length of the compressed sequence is L' 字符i (To make L' 字符i <Lth 字符i ), add a number with an order (usually 1, 2, 3,...) to the back of the compressed number sequence to mark that the group of numbers is compressed, and the length of the number with an order added is Lth字符i -L’ character i, but for the digital sequence without lossless compression, the length of the sequence is L1 character i, if L1 character i i < Lth character i, then add 0 to the back of the digital sequence to mark that the digital sequence is not compressed, and the length of the added 0 is Lth character i i -L1 character i; (4) determine the input dimension Linput of the autoencoder = sum(L 数字j )+sum(Lth 字符i ), and combine the digital classes and the converted character classes to obtain combined data; (5) generate a chaotic sequence with a dimension of Linput by introducing a tent mapping, and use the sequence as a key. The combined data and the key are added one by one to obtain a new digital sequence, which is used as input data of the autoencoder. The trained autoencoder is obtained by training multiple sets of input data; (6) the original data to be displayed is processed by steps (1)-(5) and input into the trained autoencoder. The output is transmitted to the server that appears to be threatened in the adaptive dynamic network. If the operator does not have the corresponding key, he can only view the encrypted display information, effectively preventing the leakage of related server information. On the contrary, if the operator has the corresponding key, he can quickly locate the position of the threatened server and effectively handle the threat according to the related information;

[0063] For example, a server needs to display the following information: IP address 192.168.1.100, belonging to machine room No. 3, belonging to rack No. 12, threat type DDoS attack, threat details including attack source (IP) 99.100.101.102, attack time 2025-02-08, attack intensity 10000, real-time performance indicators including CPU usage 90, memory usage 80, disk I / O rate 50, 35, network bandwidth utilization 95, belonging to business system e-commerce management system, business impact assessment user page crashes when ordering and cannot choose payment method; First, divide the digital classes, i.e. IP address, belonging to machine room, belonging to machine number, attack source, attack time, attack intensity, CPU usage, memory usage, disk I / O rate, network bandwidth utilization, and divide the character classes, i.e. threat type, belonging to business system, business impact assessment; The digital class is not processed, and the length of each character class is L 数字j 4, 1, 1, 4, 3, 1, 1, 1, 2, 1 respectively, then sum(L 数字j) = 4 + 1 + 1 + 4 + 3 + 1 + 1 + 1 + 2 + 1 = 19; the character class needs to be converted by using the Unicode table, and the decimal numbers corresponding to each character in the "DDoS attack" are 68, 68, 111, 83, 25915, 20987, and the total number sequence length is L 字符1 = 6, which corresponds to the Lth 字符1 = 10, because L 字符1 <Lth 字符1 , it is necessary to add 0 to the back of the number sequence, that is, {68, 68, 111, 83, 25915, 20987, 0, 0, 0, 0}, the decimal numbers corresponding to each character in the "E-commerce management system" are 30005, 21830, 31649, 29702, 31995, 32479, and the total number sequence length is L 字符2 = 6, which corresponds to the Lth character 2 = 10, because L 字符3 = 20, which corresponds to the Lth 字符3 = 18, because L 字符3 >Lth 字符3 , lossless compression is needed, that is, 652, 663, 651, 681, 651, 681, 671, 661, 661, 661, 681, 681, 691, 681, 671, 671, 1, 2, it is necessary to add a sequence of numbers to the back of the number sequence, that is, {652, 663, 651, 681, 651, 681, 671, 661, 661, 661, 681, 681, 691, 681, 671, 671, 1, 2}; the input dimension of the autoencoder is determined = 19 + 10 + 10 + 18 = 57; a set of number sequences with a dimension of 57 is generated by tent mapping, which is used as a key and the number sequence combined above to add one by one, to obtain input data, and the input data is substituted into the autoencoder for training to obtain the final trained encryption model.

[0064] Some data in the above formula are dimensionless numerical calculations, and the contents not described in detail in the specification all belong to the prior art known to those skilled in the art.

[0065] The above embodiments are used to illustrate the technical solutions of the present application but not to limit the present application. Although the present application is described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or equivalent replaced without departing from the spirit and scope of the technical solutions of the present application.

Claims

1. A threat alert display method based on visualization, characterized in that, Includes the following steps: For each server, information on its data transmission volume, connection stability, and business stability is extracted, and the corresponding weights for the three aspects are calculated. Based on this, an adaptive dynamic network is constructed. When a threat alarm is generated, the IP address and timestamp of the alarm information are captured through the security monitoring system, and the timestamp is used to filter out the servers that are most suspected. Identify the location of key suspected servers in the adaptive dynamic network based on their IP addresses, and determine the servers with threats by correlating server anomalies and the similarity between current threat characteristics and previous security incidents. The system acquires the identification information, threat type, threat details, real-time performance metrics, and business association information of servers posing a threat. The identification information includes the server's IP address, room number, and rack number. The threat type includes network attack threats, malware threats, physical security threats, and internal threats. The threat details include the attack source, attack time, and attack intensity. The real-time performance metrics include CPU utilization, memory utilization, disk I / O rate, and bandwidth utilization. The business association information includes the associated business system and business impact assessment. The raw information to be displayed is divided into numeric and character categories. Numeric information is not processed. For character information, the code point corresponding to each character is obtained according to the Unicode table and converted into a decimal number. The length L of the numeric sequence is then calculated. 字符i If L 字符i >Lth 字符i Then, lossless compression of the digital sequence is required, and the input dimension of the autoencoder, Linput=sum(L), needs to be determined. 数字j )+sum(Lth 字符i The algorithm combines numeric and converted character sequences and uses a tent mapping to generate a key sequence of dimension Linput. The combined data and the key are added one-to-one to obtain the input data for the autoencoder. After multiple iterations, a trained autoencoder is obtained. The original data to be displayed is substituted into the autoencoder to obtain the combined data, which is then displayed on the server corresponding to the adaptive dynamic network. Only when the operator enters the correct key can the real threat alarm information be obtained.

2. The threat alert display method based on visualization according to claim 1, characterized in that, The specific steps for constructing an adaptive dynamic network are as follows: Collect the data transfer volume between the servers, according to the formula W ij1 =(T ij +T ji ) / T total Calculate the weights of data transfer volume between servers, where T ij Indicates from server s i to s j Data transmission volume, T ji Indicates from server s j to s i Data transmission volume, T total This represents the total amount of data transmitted between all servers in the network. Record the time of each connection establishment, the time of each connection termination, and the number of connection interruptions, according to the formula W. ij2 =sum(D k The function ) / n*max(D) calculates the connection stability weights between servers, where D k Let represent the duration of the k-th connection, n represent the total number of connections within the statistical period, and max(D) represent the maximum value among all connection durations. By clarifying the interrelationships between different servers in the business process, and combining expert scoring with the analytic hierarchy process (AHP), the business relevance weights W are determined. ij3 ; According to formula W ij =nbd1*W ij1 +nbd2*W ij2 +nbd3*W ij3 The connection weights between servers in the adaptive dynamic network are obtained, where nbd1, nbd2, and nbd3 are weight coefficients.

3. The threat alert display method based on visualization according to claim 1, characterized in that, The method for filtering out key suspected servers using timestamps is as follows: Accurately record the time T when the threat occurred based on the timestamp in the alarm information; Set a reasonable time fluctuation value ±t; Collect historical operational status parameters of the servers, including CPU utilization, memory usage, network traffic, and number of vulnerabilities, to establish a baseline of behavior for each server under normal conditions; Obtain the running status parameters of each server within the range of [Tt, T+t], compare them with a pre-set baseline, and record the number of parameters marked as abnormal; If the number of abnormal parameters exceeds two, the server is judged to be abnormal and marked as a server of high suspicion.

4. The threat alert display method based on visualization according to claim 1, characterized in that, The method for determining server anomalies is as follows: Determine the location of the suspected servers in the adaptive dynamic network; Find the weights W between the server and other servers directly connected to it based on the connection matrix. t t∈[1,a], where a represents the total number of other servers directly connected to the server under suspicion; If W t >W th If so, an abnormal status check is performed on the associated server; If the total number of abnormal servers across all associated servers exceeds [0.8a], it indicates that the associated servers are abnormal, where W th [ ] represents the weight threshold, and [ ] represents the rounding symbol.

5. The threat alert display method based on visualization according to claim 1, characterized in that, The specific steps for calculating the similarity between the current threat characteristics and previous security events are as follows: Extract the characteristics of current threats and previous security incidents, including attack time, attack methods, types of servers affected, and range of IP addresses involved; Weights are assigned based on the importance of each feature; Compare each feature of the current threat with the corresponding feature of a previous security incident. If they are exactly the same, score 1 point; if they are completely different, score 0 points; if they are similar, score 0.5 points. Multiply the score of each feature by its corresponding weight, and sum these multiplications together to obtain the similarity S between the current threat and previous security events.

6. The threat alert display method based on visualization according to claim 1, characterized in that, If the server of primary suspicion also satisfies the conditions of associated server anomalies and S>S th If so, it can be determined that it is a server that poses a threat, where S th This is the similarity threshold.

7. The threat alert display method based on visualization according to claim 1, characterized in that, The specific steps for lossless compression of digital sequences are as follows: Record the initial position of each number in the original number sequence to form position-number pairs; Sort these position-number pairs according to their numerical size to obtain a sorted sequence of numbers and their corresponding sorted position indices. For the sorted sequence of numbers, calculate the difference between adjacent numbers to obtain a difference sequence; Traverse the difference sequence and count the number of consecutive identical differences. The same difference and its frequency are combined into an element to form a sequence after run-length encoding; according to the range of the difference, a specific character is assigned as the code for each range; Replace the differences in the run-length encoding with the corresponding characters and retain the occurrence counts to obtain the sequence after custom encoding; The character encoding part of the custom encoding is used to obtain the corresponding hexadecimal number according to the Unicode table, then converted to a decimal number, and combined with the following number part to obtain the compressed number.

8. The threat alert display method based on visualization according to claim 1, characterized in that, If a digital sequence is losslessly compressed, then the length of the compressed sequence is L'. 字符i Add sequential numbers to the end of the compressed number sequence, with the added numbers having a length of Lth. 字符i -L' 字符i For a digital sequence that has not undergone lossless compression, its sequence length is L1. 字符i If L1 字符i <Lth 字符i Then, 0s need to be added to the end of the sequence of numbers, with the length of the added numbers being Lth. 字符i -L1 字符i .

Images