Network security detection system based on data visualization

Abstract

The invention relates to the technical field of network security detection, and discloses a network security detection system based on data visualization, which comprises a data acquisition and processing module used for acquiring a flow log, a system log, user behavior data and external threat intelligence data in a multi-data-source network, cleaning, standardization and data enhancement operations are executed before the data are transmitted to the data storage and management module; and the data storage and management module is used for receiving the standardized data from the data acquisition and processing module, carrying out hierarchical storage on the processed data, and providing a basis for real-time query and batch data access for the detection and analysis module. A mixed detection model based on rules, statistics and machine learning is adopted, known and unknown threats can be recognized, then the detection comprehensiveness is improved, the adaptability of the system to different types of threats is enhanced, and it is ensured that the efficient threat recognition capacity is maintained in a complex and changeable network environment.

Description

Technical Field

[0001] The present invention relates to the technical field of network security detection, and specifically provides a network security detection system based on data visualization. Background Art

[0002] With the development of network technology, network attack means have become increasingly complex and diverse, and the threats faced by network security have become more severe. Traditional network security detection systems mainly rely on detection methods based on rules or signature matching, which have good effects in dealing with known threats, but have limited ability to identify new or unknown threats. In addition, with the expansion of the scale of the network environment and the sharp increase in traffic, the traditional systems face challenges in data processing and real-time response. The current network security detection systems have the following limitations: Most traditional detection systems rely on a single method among rule detection, statistical analysis, or machine learning, resulting in relatively limited detection means; With the upgrading of network threat means, the detection model needs to be continuously updated. However, the existing network security detection systems mostly rely on manual rule or model updates, lack an adaptive learning mechanism, and cannot adapt to new threats in a timely manner, thus increasing the workload of security operation and maintenance personnel and reducing the continuous defense ability of the system in a complex network environment; Traditional network security detection systems usually present detection results through flat tables or simple charts, with a single data dimension and a lack of interactive visualization display, resulting in administrators being unable to understand the full picture of potential threats in a timely and intuitive manner. Facing security data, the traditional display method is prone to information overload, which is not conducive to administrators quickly locating the threat source, increasing the analysis difficulty and decision-making delay; The response mechanisms of existing systems are mostly static configurations, usually adopting a unified processing method for threats of different levels, lacking the ability of hierarchical response, thus increasing the burden on system resources and affecting the rapid processing of high-risk threats.

[0003] Therefore, those skilled in the art provide a network security detection system based on data visualization to solve the above-mentioned problems. Summary of the Invention

[0004] Aiming at the deficiencies of the prior art, the present invention provides a network security detection system based on data visualization to solve the problems raised in the above background art.

[0005] To achieve the above objectives, the present invention is realized through the following technical solutions: A network security detection system based on data visualization includes: A data collection and processing module, which is used to obtain traffic logs, system logs, user behavior data, and external threat intelligence data in a multi-data-source network, and perform cleaning, standardization, and data enhancement operations before the data is transmitted to the data storage and management module; The data storage and management module receives the standardized data from the data collection and processing module, stores the processed data in layers, provides the basis for real-time query and batch data access for the detection and analysis module, and at the same time, provides data support for the intelligent visualization module; The detection and analysis module is used to obtain the data stored in the data storage and management module and apply a hybrid detection model for threat detection. At the same time, combined with an adaptive learning mechanism, the detection model is dynamically adjusted and updated according to new threat features during the detection process; The intelligent visualization module generates a multi-level data visualization display based on the detection results generated by the detection and analysis module and the relevant data provided by the data storage and management module for interactive use by system users; The response and alarm module conducts hierarchical responses based on the threat level information provided by the detection and analysis module, sends alarm information such as emails, text messages or application push notifications to system users, and at the same time, generates and stores event logs to provide a reference basis for subsequent audits and event playback.

[0006] Preferably, the data collection and processing module includes: The data cleaning sub-module is used to receive the collected raw data, perform operations such as filling missing values, removing outliers, and unifying the data format, and transmit the cleaned data to the data enhancement sub-module; The data enhancement sub-module integrates with external threat intelligence data based on the cleaned data output by the data cleaning sub-module to add geographical location information and threat tags, and outputs to the data storage and management module after ensuring that the data has comprehensive context information.

[0007] Preferably, the data storage and management module includes: The real-time storage unit is used to receive the data that has been cleaned and enhanced, store real-time data using a distributed search and analysis engine, provide full-text search and fast query functions, forward the data that needs to be stored for a long time to the long-term storage unit, and cache the data that is frequently queried recently to the cache layer; The long-term storage unit receives the historical data transferred from the real-time storage unit, stores it using the Hadoop distributed file system, facilitates batch processing and long-term behavior pattern analysis, and provides the basis for the detection and analysis module to access historical data; The cache layer receives the data that is frequently queried in the real-time storage unit, performs short-term data caching processing using a remote dictionary server, and ensures that the detection and analysis module obtains an efficient response when accessing the latest data.

[0008] Preferably, the statistics-based detection in the detection and analysis module detects abnormal behaviors by constructing a baseline model, including: Calculating the mean of historical data and standard deviation : , , the mean of the real-time traffic the deviation from the baseline mean When the following conditions are met, it is determined as abnormal: , wherein, is the mean of the baseline data set; N is the total number of data points in the baseline data set, is the i-th data point in the baseline data set, is the standard deviation of the baseline data set, is the absolute difference between the current mean and the baseline mean, is the mean of the current data set, is the threshold for detecting a significant change in the mean.

[0009] Preferably, the rule-based detection in the detection and analysis module uses a predefined rule library for detection, and the rule library is , if the traffic data meets any rule in the rule library, it is determined as a threat and meets the following conditions: , wherein, is the rule set, is the rule item, is the traffic data to be detected, indicates that the traffic data to be detected belongs to the rule set in, indicates that if the traffic data to be detected falls into the rule set in, it is determined as "threat detected".

[0010] Preferably, the machine learning-based detection in the detection and analysis module uses an autoencoder model to detect abnormal traffic behavior, specifically including: Learning and reconstructing the normal traffic pattern through the autoencoder model, and calculating the reconstruction error between the input data x and the reconstructed data : , If the reconstruction error exceeds the set threshold, it is determined as abnormal; wherein, is the i-th eigenvalue of the input data, is the i-th eigenvalue of the reconstructed data, is the number of features, represents the mean squared error between the predicted value and the true value.

[0011] Preferably, the intelligent visualization module displays network traffic and threat data through the following multi-level visualization charts: Traffic heat map, used to display the traffic density at different time periods; Abnormal behavior topology map, used to display the topological structure of abnormal behavior nodes in the network; Multi-dimensional coordinate map, used to display the multi-dimensional features of user behavior; Time series analysis chart, used to analyze the time trend changes of key indicators.

[0012] Preferably, the intelligent visualization module includes an automated association analysis sub-module, which analyzes the correlation between threat events using the association rule mining method and generates association rules that meet the support and confidence : Support: , Confidence: , wherein, and are subsets of events; is the event set; represents the rule in the frequency of the data set; represents simultaneously containing and the set of transactions; meet and the number of transactions that occur simultaneously; is the total number of transactions in the data set; represents the proportion of containing in the transaction that contains ; represents the total number of transactions containing ; represents the association rule.

[0013] Preferably, the response and alarm module includes: A threat grading sub-module, which is used to receive the threat data passed in by the detection and analysis module, grade the threat events according to the severity of the threats, and transfer the grading information to the response sub-module and the alarm sub-module to determine the subsequent response strategies and alarm methods; A response sub-module, which performs corresponding response operations based on the grading information of the threat grading sub-module, and transfers the detailed information of the response operations to the log recording sub-module for subsequent auditing and playback; An alarm sub-module, which determines the alarm method according to the threat level information of the threat grading sub-module, sends the alarm information to the designated administrator via email, SMS or application push, and synchronizes the sent alarm information to the log recording sub-module to form a complete alarm record; A log recording sub-module, which receives the operation records from the response sub-module and the alarm sub-module, uniformly generates and stores event logs, and provides a data basis for subsequent auditing and event playback.

[0014] Preferably, the response and alarm module is divided into low, medium, and high-level responses according to the severity of the threat events, and the response intensities of different levels satisfy the following relationship: , wherein, represents the response intensity of the threat , α is the response intensity factor, is the severity level of the threat.

[0015] The present invention provides a network security detection system based on data visualization. It has the following beneficial effects: 1. The present invention adopts a hybrid detection model based on rules, statistics and machine learning, which can identify known and unknown threats, thereby improving the comprehensiveness of detection, enhancing the adaptability of the system to different types of threats, and ensuring efficient threat recognition ability in a complex and changeable network environment.

[0016] 2. Through the adaptive learning mechanism of the present invention, the system can realize online learning and transfer learning during the detection process, automatically update the model parameters, enabling the system to continuously track the dynamic changes of the network environment, effectively cope with new threats, ensure the real-time and accuracy of the detection model, and enhance the long-term defense ability of the system.

[0017] 3. The present invention provides a multi-level data display form through the intelligent visualization module, including traffic heat maps, abnormal behavior topology maps, multi-dimensional coordinate maps and time series analysis maps, greatly improving the visualization degree of threat information, enabling the administrator to intuitively and efficiently understand and analyze threats, thereby reducing the analysis threshold and enhancing the operability.

[0018] 4. The present invention adopts a threat grading and hierarchical response strategy, determines corresponding response methods according to different threat levels to ensure that high-level threats can be processed in a timely manner. At the same time, it avoids the interference of low-level threats to system resources, improving the response efficiency and the utilization rate of system resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 is the system framework diagram of the present invention; Figure 2 is the schematic diagram of the multi-level visualization representation of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0020] To enable those skilled in the art to understand the solution of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0021] The present invention will be described in detail below with reference to the accompanying drawings: Embodiment: Please refer to Attached Figure 1 and Attached Figure 2 , the embodiment of the present invention provides a network security detection system based on data visualization, including: A data collection and processing module, which is used to obtain traffic logs, system logs, user behavior data, and external threat intelligence data in a multi-data source network, and perform cleaning, standardization, and data enhancement operations before the data is transmitted to the data storage and management module; A data storage and management module, which receives the standardized data from the data collection and processing module, and stores the processed data in layers, providing a basis for real-time query and batch data access for the detection and analysis module. At the same time, it provides data support for the intelligent visualization module; A detection and analysis module, which is used to obtain the data stored in the data storage and management module and apply a hybrid detection model for threat detection. At the same time, combined with an adaptive learning mechanism, the detection model is dynamically adjusted and updated according to new threat features during the detection process; An intelligent visualization module, which generates a multi-level data visualization display based on the detection results generated by the detection and analysis module and the relevant data provided by the data storage and management module for interactive use by system users; A response and alarm module, which performs hierarchical response based on the threat level information provided by the detection and analysis module, sends alarm information such as emails, text messages, or application push notifications to system users. At the same time, it generates and stores event logs, providing a reference basis for subsequent auditing and event playback.

[0022] The data collection and processing module integrates traffic logs, system logs, user behavior data, and external threat intelligence data from multiple data sources, and performs cleaning, standardization, and data enhancement processing before data transmission to ensure the accuracy and consistency of the data, providing a high-quality data foundation for subsequent detection, reducing noise interference, and improving the reliability and efficiency of system detection; The data storage and management module stores the standardized data in layers, supports real-time query and batch data access, can quickly respond to the data requirements of the detection and analysis module, and at the same time provides data support for the intelligent visualization module, enabling historical data and real-time data to coexist efficiently, with the ability of long-term behavior analysis and real-time response; The detection and analysis module applies a hybrid detection model to comprehensively detect threats in the stored data, and combines an adaptive learning mechanism to dynamically update the detection model according to newly emerging threat features, ensuring that the system has a high recognition rate and response speed for both known and unknown threats, and improving the accuracy and adaptability of detection; Based on the detection results of the detection and analysis module and the support provided by the data storage and management module, the intelligent visualization module generates multi-level interactive visual displays, enabling system users to intuitively observe threat situations, quickly analyze the security situation, reduce the analysis difficulty, and improve the work efficiency of system users; The response and alarm module performs hierarchical responses according to the threat level information provided by the detection and analysis module to ensure that high-threat level events are given priority, and notifies system users through multiple channels of alarm, generates detailed event log records, provides a reliable basis for subsequent security audits and event playback, and improves the response ability and traceability of the system.

[0023] The data collection and processing module includes: The data cleaning sub-module is used to receive the collected raw data, perform operations such as filling in missing values, removing outliers, and unifying data formats, and transmit the cleaned data to the data enhancement sub-module; The data enhancement sub-module integrates with external threat intelligence data based on the cleaned data output by the data cleaning sub-module to add geographical location information and threat tags, and outputs the data with comprehensive context information to the data storage and management module.

[0024] The data cleaning sub-module ensures the integrity and consistency of the data by performing operations such as filling in missing values, removing outliers, and unifying data formats on the raw data, significantly reducing data noise and abnormal interference, providing high-quality input data for subsequent data enhancement and threat detection, and improving the reliability and accuracy of the overall system; The data enhancement sub-module integrates the cleaned data with external threat intelligence, adds context information such as geographical location information and threat tags, makes the data more comprehensive and valuable for reference, provides an important threat background for subsequent detection and visualization analysis, and improves the system's recognition depth and accuracy of threats.

[0025] The data storage and management module includes: A real-time storage unit, which is used to receive the cleaned and enhanced data, stores real-time data using a distributed search and analysis engine, provides full-text search and fast query functions, forwards the data that needs to be stored for a long time to the long-term storage unit, and caches the data that is frequently queried recently to the cache layer; A long-term storage unit, which receives the historical data passed from the real-time storage unit and stores it using the Hadoop distributed file system, facilitating batch processing and long-term behavior pattern analysis, and providing a basis for the detection and analysis module to access historical data; A cache layer, which receives the data that is frequently queried in the real-time storage unit and performs short-term data caching processing using a remote dictionary server to ensure that the detection and analysis module obtains an efficient response when accessing the latest data.

[0026] The real-time storage unit stores real-time data through a distributed search and analysis engine, supports full-text search and fast query, can efficiently respond to immediate data requirements. At the same time, this unit forwards the data that needs to be stored for a long time to the long-term storage unit and caches the frequently queried data to the cache layer, effectively balancing the real-time performance and the utilization rate of storage resources, and ensuring the query efficiency and data integrity of the system; The long-term storage unit stores historical data using the Hadoop distributed file system, provides sufficient capacity and flexibility for batch data processing and long-term behavior analysis, can support data analysis requirements, and provides a solid data foundation for the behavior pattern recognition and historical data access of the detection and analysis module; The cache layer uses a remote dictionary server to cache the frequently accessed short-term data, significantly improving the response speed of data access, enabling the detection and analysis module to quickly obtain the required data during high-frequency real-time queries, and enhancing the system's processing ability and real-time performance for sudden data requirements.

[0027] The statistics-based detection in the detection and analysis module detects abnormal behaviors by constructing a baseline model, including: Calculating the mean of historical data And the standard deviation : , , The mean of real-time traffic The deviation from the baseline mean It is judged as an anomaly when the following conditions are met: , wherein, is the mean of the baseline dataset; N is the total number of data points in the baseline dataset, is the i-th data point in the baseline dataset, is the standard deviation of the baseline dataset, is the absolute difference between the current mean and the baseline mean, is the mean of the current dataset, is the threshold for detecting a significant change in the mean.

[0028] By constructing a baseline model to detect abnormal behavior, the system can automatically identify situations where the traffic deviates from the normal baseline, and effectively discover potential abnormal activities. The baseline model established based on the mean and standard deviation of historical data enables the system to perform detection adaptively according to the normal fluctuations of the network, reducing the false alarm rate. At the same time, by calculating the deviation between the current traffic mean and the baseline mean in real time and setting the threshold for significant changes, the system can flexibly and accurately identify abnormal traffic fluctuations, quickly locate potential threats, and thus improve the system's response ability and detection accuracy.

[0029] The rule-based detection in the detection and analysis module uses a predefined rule library for detection. The rule library is , if the traffic data meets any rule in the rule library, it is judged as a threat and meets the following conditions: , wherein, is the rule set, is the rule item, is the traffic data to be detected, indicates that the traffic data to be detected belongs to the rule set in, indicates that if the traffic data to be detected falls into the rule set in, it is determined as "threat detected".

[0030] Rule-based detection matches traffic data using a predefined rule library to quickly identify known threat behaviors, such as specific malicious IPs, port attack patterns, or abnormal usage of specific protocols. Each rule in the rule library is designed for specific threat characteristics. When the traffic data meets any rule, it is immediately determined as a threat, achieving efficient identification of known threats. Especially when dealing with frequently occurring typical attack patterns, it can play a significant role. At the same time, rule-based detection reduces the need for complex calculations, is suitable for real-time monitoring, and can provide basic security guarantees for the system.

[0031] Machine learning-based detection in the detection and analysis module uses an autoencoder model to detect abnormal traffic behaviors, specifically including: The autoencoder model learns and reconstructs the normal traffic pattern, calculates the reconstruction error between the input data x and the reconstructed data : , If the reconstruction error exceeds the set threshold, it is determined as abnormal; Among them, is the i-th feature value of the input data, is the i-th feature value of the reconstructed data, is the number of features, represents the mean squared error between the predicted value and the true value.

[0032] By learning and reconstructing the normal traffic pattern through the autoencoder model, the system can automatically establish the behavior pattern of normal traffic to detect abnormal traffic. The autoencoder effectively identifies abnormal behaviors not in the normal pattern by calculating the reconstruction error between the input data and the reconstructed data. When the reconstruction error exceeds the set threshold, the system can sensitively detect abnormal traffic, achieving the identification of unknown threats, without relying on predefined rules, being able to adapt to changing network environments, improving the detection ability for complex threats and advanced persistent attacks, and significantly enhancing the comprehensiveness and detection accuracy of the system.

[0033] The intelligent visualization module displays network traffic and threat data through the following multi-level visualization charts: Traffic heat map, used to display the traffic density at different time periods; Abnormal behavior topology map, used to display the topology structure of abnormal behavior nodes in the network; Multi-dimensional coordinate map, used to display multi-dimensional characteristics of user behaviors; Time series analysis chart, used to analyze the time trend changes of key indicators; The intelligent visualization module includes an automated correlation analysis sub-module, which analyzes the correlation between threat events using the association rule mining method to generate association rules that meet the support and confidence levels. : Support: , Confidence: , Among them, and are subsets of events; is the set of events; represents the rule in the frequency of the dataset; represents the set of transactions that contain both and ; satisfies and the number of transactions that occur simultaneously; is the total number of transactions in the dataset; represents the proportion of in the transactions that contain ; represents the total number of transactions that contain ; represents the association rule.

[0034] The intelligent visualization module displays network traffic and threat data through multi-level visualization charts, greatly improving the system users' understanding and analysis efficiency of complex security data. The traffic heat map intuitively shows the traffic density at different times, helping users quickly identify abnormal peaks; The abnormal behavior topology map shows the topological structure between abnormal nodes, making the threat sources and propagation paths clearly visible; The multi-dimensional coordinate map presents user behavior characteristics in multiple dimensions, facilitating the identification of abnormal behavior patterns; The time series analysis chart intuitively reflects the trend changes of key indicators, helping with continuous monitoring and detection of progressive threats; The automated correlation analysis sub-module in the intelligent visualization module automatically analyzes the correlation between threat events using the association rule mining method, generates association rules that meet the support and confidence levels, reveals potential association patterns between events, reduces the manual analysis burden, helps users quickly locate potential causal relationships, and improves the efficiency of threat tracking and disposal.

[0035] The response and alarm module includes: A threat grading sub-module, which is used to receive threat data passed in by the detection and analysis module, grade threat events according to the severity of the threats, and transfer the grading information to the response sub-module and the alarm sub-module to determine subsequent response strategies and alarm methods; A response sub-module, which performs corresponding response operations based on the grading information of the threat grading sub-module, and transfers the detailed information of the response operations to the log recording sub-module for subsequent auditing and playback; An alarm sub-module, which determines the alarm method according to the threat level information of the threat grading sub-module, sends the alarm information to the designated administrator via email, SMS or application push, and synchronizes the sent alarm information to the log recording sub-module to form a complete alarm record; A log recording sub-module, which receives operation records from the response sub-module and the alarm sub-module, uniformly generates and stores event logs, and provides a data basis for subsequent auditing and event playback; The response and alarm module is divided into low, medium, and high-level responses according to the severity of threat events. The response intensities of different levels satisfy the following relationship: , where, represents the response intensity of threat , α is the response intensity factor, is the severity level of the threat.

[0036] Through the collaborative work of the threat grading sub-module, the response sub-module, the alarm sub-module and the log recording sub-module, the response and alarm module can implement flexible and graded response strategies according to the severity of threat events; The threat grading sub-module grades according to the severity of the threat, providing a clear basis for subsequent response and alarm methods; The response sub-module performs corresponding response operations based on the threat level and records them in the log recording sub-module to ensure that all operations are traceable; The alarm sub-module flexibly determines the alarm method according to the threat level and notifies the designated administrator in real time through multiple channels to ensure that important alarm information is promptly noticed and processed; The log recording sub-module uniformly stores response and alarm information, providing reliable historical data support for subsequent auditing and event playback. In addition, by reasonably controlling the response intensity, the system can efficiently handle high-risk threats while reducing the resource occupancy of low-risk events, improving the utilization rate of system resources and the pertinence of responses.

[0037] Although embodiments of the present invention have been shown and described, it will be understood by those of ordinary skill in the art that various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principles and spirit of the present invention, and the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A network security detection system based on data visualization, characterized in that: include: The data collection and processing module is used to obtain traffic logs, system logs, user behavior data and external threat intelligence data from multiple data sources, and perform cleaning, standardization and data enhancement operations before transmitting the data to the data storage and management module; The data storage and management module receives standardized data from the data acquisition and processing module, and stores the processed data in layers, providing a basis for real-time query and batch data access for the detection and analysis module, and providing data support for the intelligent visualization module; The detection and analysis module is used to obtain the data stored in the data storage and management module and apply the hybrid detection model to perform threat detection. At the same time, combined with the adaptive learning mechanism, the detection model is dynamically adjusted and updated according to new threat characteristics during the detection process; Intelligent visualization module, based on the test results generated by the detection and analysis module and the relevant data provided by the data storage and management module, generates multi-level data visualization for interactive use by system users; The response and alarm module performs hierarchical response based on the threat level information provided by the detection and analysis module, sends alarm information to system users via email, SMS or application push, and generates and stores event logs to provide reference basis for subsequent audits and event playback.

2. A network security detection system based on data visualization according to claim 1, characterized in that: The data acquisition and processing module includes: The data cleaning submodule is used to receive the collected raw data, perform operations such as filling missing values, removing outliers and unifying data formats, and transmit the cleaned data to the data enhancement submodule; The data enhancement submodule integrates the cleaned data output by the data cleaning submodule with external threat intelligence data to add geographic location information and threat labels, ensuring that the data has comprehensive contextual information before being output to the data storage and management module.

3. A network security detection system based on data visualization according to claim 1, characterized in that: The data storage and management module includes: The real-time storage unit is used to receive cleaned and enhanced data, use a distributed search and analysis engine to store real-time data, provide full-text search and fast query functions, forward data that needs to be stored for a long time to the long-term storage unit, and cache data that is frequently queried recently to the cache layer; The long-term storage unit receives historical data transmitted from the real-time storage unit and uses the Hadoop distributed file system to store it, which is convenient for batch processing and long-term behavior pattern analysis, and provides a basis for the detection and analysis module to access historical data; The cache layer receives frequently queried data from the real-time storage unit and uses a remote dictionary server to perform short-term data cache processing to ensure that the detection and analysis module obtains efficient responses when accessing the latest data.

4. A network security detection system based on data visualization according to claim 1, characterized in that: The statistical-based detection in the detection and analysis module detects abnormal behaviors by building a baseline model, including: Calculate the mean of historical data and standard deviation : ， ， Average of real-time traffic Deviation from baseline mean When the following conditions are met, it is considered abnormal: ， in, is the mean of the baseline data set; N is the total number of data points in the baseline data set, is the i-th data point in the baseline dataset, is the standard deviation of the baseline dataset, is the absolute difference between the current mean and the baseline mean, is the mean of the current data set, is the threshold for detecting significant changes in the mean.

5. A network security detection system based on data visualization according to claim 1, characterized in that: The rule-based detection in the detection and analysis module uses a predefined rule base for detection. The rule base is If the flow data If any rule in the rule base is met, it is considered a threat and meets the following conditions: ， in, is a set of rules, is a rule item, is the flow data to be detected, Indicates the traffic data to be detected Belongs to rule set middle, Indicates that if the traffic data to be detected Falling into the ruleset If the threat is detected, it is considered a "threat detected".

6. A network security detection system based on data visualization according to claim 1, characterized in that: The machine learning-based detection in the detection and analysis module uses an autoencoder model to detect abnormal traffic behavior, specifically including: The normal traffic pattern is learned and reconstructed through the autoencoder model, and the input data x and the reconstructed data are calculated. The reconstruction error : ， If the reconstruction error If it exceeds the set threshold, it is judged as abnormal; in, is the i-th eigenvalue of the input data, is the i-th eigenvalue of the reconstructed data, is the number of features, It represents the mean squared error between the predicted value and the true value.

7. A network security detection system based on data visualization according to claim 1, characterized in that: The intelligent visualization module displays network traffic and threat data through the following multi-level visualization charts: Traffic heat map, used to show traffic density at different time periods; Abnormal behavior topology diagram, used to show the topological structure of abnormal behavior nodes in the network; Multidimensional coordinate graph, used to show the multidimensional characteristics of user behavior; Time series analysis chart is used to analyze the time trend changes of key indicators.

8. A network security detection system based on data visualization according to claim 1, characterized in that: The intelligent visualization module includes an automated association analysis submodule, which uses association rule mining methods to analyze the correlation between threat events and generate association rules that meet support and confidence levels. : Support: , Confidence: , in, and is a subset of events; is the event set; Representation Rules frequency in the dataset; Indicates that it also contains and A collection of transactions; satisfy and The number of transactions occurring simultaneously; is the total number of transactions in the dataset; Including The transaction includes proportion; Indicates that it contains Total number of transactions; Represents association rules.

9. A network security detection system based on data visualization according to claim 1, characterized in that: The response and alarm module includes: The threat classification submodule is used to receive the threat data passed by the detection and analysis module, classify the threat events according to the severity of the threat, and pass the classification information to the response submodule and the alarm submodule to determine the subsequent response strategy and alarm method; The response submodule performs corresponding response operations based on the classification information of the threat classification submodule, and transmits the detailed information of the response operations to the logging submodule for subsequent audit and playback; The alarm submodule determines the alarm method according to the threat level information of the threat classification submodule, sends the alarm information to the designated administrator via email, SMS or application push, and synchronizes the sent alarm information to the log recording submodule to form a complete alarm record; The logging submodule receives operation records from the response submodule and the alarm submodule, generates and stores event logs in a unified manner, and provides data basis for subsequent auditing and event playback.

10. A network security detection system based on data visualization according to claim 1, characterized in that: The response and alarm module is divided into three levels of response: low, medium, and high according to the severity of the threat event. The response strength of different levels meets the following relationship: ， in, Threat The response intensity of α is the response intensity factor. The severity level of the threat.

Images