Network security situation awareness and early warning method and system

Abstract

The application discloses a network security situation awareness and early warning method and system, the method comprises the following steps: obtaining a plurality of device communication data of a target network in a preset historical time period; determining dangerous communication information according to the plurality of device communication data based on a first prediction model; determining dangerous device information according to the plurality of device communication data based on a second prediction model; determining a network danger parameter of the target network based on a matching result between the dangerous communication information and the dangerous device information; the network danger parameter is used for indicating a danger possibility of the target network being penetrated or attacked. It can be seen that the application can accurately evaluate the potential risk of the target network being penetrated or attacked, improve the timeliness and accuracy of network security risk identification, and strengthen the network security protection effect.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method and system for network security situation awareness and early warning. Background Technology

[0002] In existing technologies, network security risk assessments typically rely on fixed rules or historical attack samples for detection, primarily using static thresholds or simple pattern recognition to identify abnormal communication behaviors or devices. However, with the increasing complexity of network structures and attack methods, especially the emergence of large-scale network penetration attacks, relying solely on single-dimensional data analysis is insufficient to identify potential penetration or attack risks in a timely and accurate manner. Furthermore, existing technologies often lack effective predictive matching mechanisms when analyzing communication data and device information in large networks, resulting in low accuracy of overall network risk assessments, a high risk of missed detections, and low efficiency. Clearly, existing technologies have shortcomings that urgently need to be addressed. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to provide a network security situation awareness and early warning method and system, which can accurately assess the potential risks of target networks being penetrated or attacked, improve the timeliness and accuracy of network security risk identification, and strengthen the network security protection effect.

[0004] To address the aforementioned technical problems, the first aspect of this invention discloses a method for network security situation awareness and early warning, the method comprising:

[0005] Acquire communication data of multiple devices on the target network within a preset historical time period;

[0006] Based on the first prediction model, dangerous communication information is determined according to the communication data of the multiple devices.

[0007] Based on the second prediction model, hazardous equipment information is determined according to the communication data of the multiple devices.

[0008] Based on the matching results between the dangerous communication information and the dangerous device information, network hazard parameters of the target network are determined; the network hazard parameters are used to indicate the risk of the target network being penetrated or attacked.

[0009] As an optional implementation, in the first aspect of the invention, determining dangerous communication information based on the communication data of the plurality of devices according to the first prediction model includes:

[0010] Each device communication data is input into a trained first prediction model to obtain the first hazard type and first hazard probability corresponding to each device communication data.

[0011] Based on the expected transmission time, all the device communication data is divided into multiple data sets;

[0012] Calculate the average value of the first danger probability corresponding to all device communication data in each data set to obtain the first set danger probability corresponding to each data set;

[0013] Based on the corresponding first set of danger probabilities, the first danger probability corresponding to each device communication data is corrected to obtain the first corrected probability corresponding to each device communication data;

[0014] All device communication data whose first correction probability is greater than the first probability threshold, along with their corresponding first hazard type, are identified as hazardous communication information.

[0015] As an optional implementation, in the first aspect of the invention, the step of dividing all the device communication data into multiple data sets based on the expected transmission time point includes:

[0016] For each piece of device communication data, determine whether there is a transmission time point in the data content of the device communication data, and obtain a first determination result;

[0017] When the first judgment result is yes, the existing transmission time point is determined as the expected transmission time point of the device's communication data;

[0018] If the second judgment result is negative, all time-related information in the data content of the device's communication data is input into the trained transmission time prediction model to obtain the expected transmission time of the device's communication data.

[0019] Based on a clustering grouping algorithm, all device communication data are divided into multiple data sets according to the expected transmission time points; wherein, the time difference between the expected transmission time points of any two device communication data in each data set is less than a time difference threshold; the time difference threshold is proportional to the average time difference between the expected transmission time points of all device communication data.

[0020] As an optional implementation, in a first aspect of the present invention, the step of correcting the first danger probability corresponding to each device communication data according to the corresponding first set of danger probabilities to obtain a first corrected probability corresponding to each device communication data includes:

[0021] For each of the data sets, calculate the first probability difference between the first set danger probability corresponding to that data set and the first probability mean parameter; the first probability mean parameter is the average of the first set danger probabilities of all the data sets.

[0022] Calculate a first correction weight that is proportional to the first probability difference;

[0023] The first corrected probability is obtained by multiplying the first danger probability corresponding to each device communication data in the data set with the first corrected weight.

[0024] As an optional implementation, in the first aspect of the invention, determining the hazardous equipment information based on the communication data of the plurality of devices using a second prediction model includes:

[0025] Device-related information is determined from the data content of all the device communication data to obtain multiple communication device information; the device-related information includes sending device, receiving device, relay device, or firewall device.

[0026] For each piece of communication device information, based on the communication between the device corresponding to the communication device information and / or the communication with the gateway device of the target network, obtain the device parameter data and historical communication data corresponding to the communication device information;

[0027] The device parameter data and historical communication data corresponding to the communication device information are input into the trained second prediction model to obtain the second hazard type and second hazard probability corresponding to the communication device information.

[0028] Based on the second risk probability, multiple dangerous communication devices are identified from all the communication device information;

[0029] All the aforementioned dangerous communication devices and their corresponding second hazard types are identified as dangerous device information.

[0030] As an optional implementation, in a first aspect of the invention, determining a plurality of dangerous communication devices from all the communication device information based on the second danger probability includes:

[0031] Based on a clustering grouping algorithm, all the communication device information is grouped to obtain multiple device sets; wherein, in each device set, the similarity between the device parameter data corresponding to any two pieces of communication device information is greater than a similarity threshold;

[0032] For each set of devices, the average value of the second danger probability corresponding to all the communication device information in the set of devices is calculated to obtain the second set danger probability corresponding to the set of devices;

[0033] Calculate the second probability difference between the second set of danger probability and the second probability mean parameter; the second probability mean parameter is the average of the second set of danger probabilities of all the device sets.

[0034] Calculate the second correction weight that is proportional to the second probability difference;

[0035] Calculate the product of the second danger probability corresponding to each piece of communication device information in the device set and the second correction weight to obtain the second corrected probability corresponding to each piece of communication device information in the device set;

[0036] The communication device information whose second correction probability is greater than the second probability threshold is identified as a dangerous communication device.

[0037] As an optional implementation, in the first aspect of the present invention, both the first prediction model and the second prediction model are CNN network models. The two are first trained together on a common training dataset that includes communication data of multiple training devices and corresponding device parameter annotations and hazard annotations to obtain a base model. Then, the base model is trained on the corresponding fine-tuning training dataset to obtain the first prediction model and the second prediction model respectively.

[0038] As an optional implementation, in the first aspect of the invention, determining the network hazard parameters of the target network based on the matching result between the dangerous communication information and the dangerous device information includes:

[0039] Calculate the type similarity and equipment similarity between the hazardous communication information and the hazardous equipment information;

[0040] Calculate the product of the type similarity and the device similarity to obtain the matching degree parameter;

[0041] The average difference between the prediction accuracy of the first prediction model and the second prediction model on the same validation dataset during the fine-tuning phase is calculated to obtain the prediction difference parameter.

[0042] Calculate the danger reference value that is proportional to the predicted difference parameter;

[0043] The difference between the matching degree parameter and the danger reference value is calculated to obtain the network danger parameter of the target network.

[0044] A second aspect of this invention discloses a network security situation awareness and early warning system, the system comprising:

[0045] The acquisition module is used to acquire communication data of multiple devices in the target network within a preset historical time period;

[0046] The first prediction module is used to determine dangerous communication information based on the communication data of the multiple devices, according to the first prediction model.

[0047] The second prediction module is used to determine hazardous equipment information based on the communication data of the multiple devices, according to the second prediction model.

[0048] The matching module is used to determine the network hazard parameters of the target network based on the matching result between the dangerous communication information and the dangerous device information; the network hazard parameters are used to indicate the risk of the target network being penetrated or attacked.

[0049] As an optional implementation, in a second aspect of the invention, the first prediction module determines the specific method of dangerous communication information based on the communication data of the plurality of devices, according to a first prediction model, including:

[0050] Each device communication data is input into a trained first prediction model to obtain the first hazard type and first hazard probability corresponding to each device communication data.

[0051] Based on the expected transmission time, all the device communication data is divided into multiple data sets;

[0052] Calculate the average value of the first danger probability corresponding to all device communication data in each data set to obtain the first set danger probability corresponding to each data set;

[0053] Based on the corresponding first set of danger probabilities, the first danger probability corresponding to each device communication data is corrected to obtain the first corrected probability corresponding to each device communication data;

[0054] All device communication data whose first correction probability is greater than the first probability threshold, along with their corresponding first hazard type, are identified as hazardous communication information.

[0055] As an optional implementation, in a second aspect of the invention, the specific method by which the first prediction module divides all the device communication data into multiple data sets based on the expected transmission time includes:

[0056] For each piece of device communication data, determine whether there is a transmission time point in the data content of the device communication data, and obtain a first determination result;

[0057] When the first judgment result is yes, the existing transmission time point is determined as the expected transmission time point of the device's communication data;

[0058] If the second judgment result is negative, all time-related information in the data content of the device's communication data is input into the trained transmission time prediction model to obtain the expected transmission time of the device's communication data.

[0059] Based on a clustering grouping algorithm, all device communication data are divided into multiple data sets according to the expected transmission time points; wherein, the time difference between the expected transmission time points of any two device communication data in each data set is less than a time difference threshold; the time difference threshold is proportional to the average time difference between the expected transmission time points of all device communication data.

[0060] As an optional implementation, in a second aspect of the present invention, the specific method by which the first prediction module corrects the first danger probability corresponding to each device communication data according to the corresponding first set of danger probabilities to obtain the first corrected probability corresponding to each device communication data includes:

[0061] For each of the data sets, calculate the first probability difference between the first set danger probability corresponding to that data set and the first probability mean parameter; the first probability mean parameter is the average of the first set danger probabilities of all the data sets.

[0062] Calculate a first correction weight that is proportional to the first probability difference;

[0063] The first corrected probability is obtained by multiplying the first danger probability corresponding to each device communication data in the data set with the first corrected weight.

[0064] As an optional implementation, in a second aspect of the invention, the second prediction module determines the specific method of hazardous equipment information based on the communication data of the plurality of devices, according to a second prediction model, including:

[0065] Device-related information is determined from the data content of all the device communication data to obtain multiple communication device information; the device-related information includes sending device, receiving device, relay device, or firewall device.

[0066] For each piece of communication device information, based on the communication between the device corresponding to the communication device information and / or the communication with the gateway device of the target network, obtain the device parameter data and historical communication data corresponding to the communication device information;

[0067] The device parameter data and historical communication data corresponding to the communication device information are input into the trained second prediction model to obtain the second hazard type and second hazard probability corresponding to the communication device information.

[0068] Based on the second risk probability, multiple dangerous communication devices are identified from all the communication device information;

[0069] All the aforementioned dangerous communication devices and their corresponding second hazard types are identified as dangerous device information.

[0070] As an optional implementation, in a second aspect of the invention, the second prediction module determines the specific method by which it identifies a plurality of dangerous communication devices from all the communication device information based on the second danger probability, including:

[0071] Based on a clustering grouping algorithm, all the communication device information is grouped to obtain multiple device sets; wherein, in each device set, the similarity between the device parameter data corresponding to any two pieces of communication device information is greater than a similarity threshold;

[0072] For each set of devices, the average value of the second danger probability corresponding to all the communication device information in the set of devices is calculated to obtain the second set danger probability corresponding to the set of devices;

[0073] Calculate the second probability difference between the second set of danger probability and the second probability mean parameter; the second probability mean parameter is the average of the second set of danger probabilities of all the device sets.

[0074] Calculate the second correction weight that is proportional to the second probability difference;

[0075] Calculate the product of the second danger probability corresponding to each piece of communication device information in the device set and the second correction weight to obtain the second corrected probability corresponding to each piece of communication device information in the device set;

[0076] The communication device information whose second correction probability is greater than the second probability threshold is identified as a dangerous communication device.

[0077] As an optional implementation, in the second aspect of the present invention, both the first prediction model and the second prediction model are CNN network models. The two are first trained together on a common training dataset that includes communication data of multiple training devices and corresponding device parameter annotations and hazard annotations to obtain a base model. Then, the base model is trained on the corresponding fine-tuning training dataset to obtain the first prediction model and the second prediction model respectively.

[0078] As an optional implementation, in a second aspect of the invention, the matching module determines the network hazard parameters of the target network based on the matching result between the dangerous communication information and the dangerous device information in a specific manner, including:

[0079] Calculate the type similarity and equipment similarity between the hazardous communication information and the hazardous equipment information;

[0080] Calculate the product of the type similarity and the device similarity to obtain the matching degree parameter;

[0081] The average difference between the prediction accuracy of the first prediction model and the second prediction model on the same validation dataset during the fine-tuning phase is calculated to obtain the prediction difference parameter.

[0082] Calculate the danger reference value that is proportional to the predicted difference parameter;

[0083] The difference between the matching degree parameter and the danger reference value is calculated to obtain the network danger parameter of the target network.

[0084] A third aspect of this invention discloses another network security situation awareness and early warning system, the system comprising:

[0085] Memory containing executable program code;

[0086] A processor coupled to the memory;

[0087] The processor calls the executable program code stored in the memory to execute some or all of the steps in the network security situation awareness and early warning method disclosed in the first aspect of the present invention.

[0088] The fourth aspect of the present invention discloses a computer storage medium storing computer instructions, which, when invoked, are used to execute some or all of the steps in the network security situation awareness and early warning method disclosed in the first aspect of the present invention.

[0089] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0090] This invention acquires communication data from multiple devices in a target network within a preset historical time period, processes the communication data based on a first prediction model to determine dangerous communication information, further processes the communication data based on a second prediction model to determine dangerous device information, and determines network hazard parameters of the target network based on the matching results between dangerous communication information and dangerous device information. This enables accurate assessment of the potential risks of the target network being penetrated or attacked, improves the timeliness and accuracy of network security risk identification, and strengthens the effectiveness of network security protection. Attached Figure Description

[0091] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0092] Figure 1 This is a flowchart illustrating a network security situation awareness and early warning method disclosed in an embodiment of the present invention.

[0093] Figure 2 This is a schematic diagram of the structure of a network security situation awareness and early warning system disclosed in an embodiment of the present invention.

[0094] Figure 3 This is a schematic diagram of another network security situation awareness and early warning system disclosed in an embodiment of the present invention. Detailed Implementation

[0095] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0096] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish different objects, not to describe a specific order. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, apparatus, product, or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or devices.

[0097] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0098] This invention discloses a network security situation awareness and early warning method and system. By acquiring communication data from multiple devices within a preset historical time period of a target network, the system processes this data using a first prediction model to identify dangerous communication information. Further processing using a second prediction model identifies dangerous device information. Based on the matching results between the dangerous communication information and the dangerous device information, network hazard parameters of the target network are determined. This enables accurate assessment of the potential risks of a target network being penetrated or attacked, improving the timeliness and accuracy of network security risk identification and strengthening network security protection. Detailed descriptions follow.

[0099] Example 1

[0100] Please see Figure 1 , Figure 1 This is a flowchart illustrating a network security situation awareness and early warning method disclosed in an embodiment of the present invention. Wherein, Figure 1 The described network security situational awareness and early warning methods can be applied to data processing systems / data processing equipment / data processing servers (wherein, the server includes local processing servers or cloud processing servers). For example... Figure 1 As shown, this network security situation awareness and early warning method may include the following operations:

[0101] 101. Obtain communication data of multiple devices in the target network within a preset historical time period.

[0102] 102. Based on the first prediction model, dangerous communication information is determined according to communication data from multiple devices.

[0103] 103. Based on the second prediction model, determine the information of dangerous equipment according to the communication data of multiple devices.

[0104] 104. Based on the matching results between dangerous communication information and dangerous equipment information, determine the network hazard parameters of the target network.

[0105] Optionally, network hazard parameters are used to indicate the likelihood of a target network being penetrated or attacked.

[0106] As can be seen, the above-described embodiments of the invention acquire communication data of multiple devices in the target network within a preset historical time period, process the communication data of multiple devices based on a first prediction model to determine dangerous communication information, further process the communication data of multiple devices based on a second prediction model to determine dangerous device information, and determine the network hazard parameters of the target network based on the matching results between dangerous communication information and dangerous device information. This enables accurate assessment of the potential risks of the target network being penetrated or attacked, improves the timeliness and accuracy of network security risk identification, and strengthens the effectiveness of network security protection.

[0107] As an optional embodiment, the step described above, determining dangerous communication information based on the first prediction model and multiple device communication data, includes:

[0108] Each device's communication data is input into the trained first prediction model to obtain the first hazard type and the first hazard probability corresponding to each device's communication data;

[0109] Based on the expected transmission time, all device communication data is divided into multiple data sets;

[0110] Calculate the average of the first danger probabilities corresponding to all device communication data in each data set to obtain the first set danger probability corresponding to each data set;

[0111] Based on the corresponding first set of danger probabilities, the first danger probability corresponding to each device communication data is corrected to obtain the first corrected probability corresponding to each device communication data;

[0112] All device communication data with a first correction probability greater than a first probability threshold, along with their corresponding first hazard type, are identified as hazardous communication information.

[0113] As can be seen, through the above optional embodiments, the accuracy and robustness of dangerous communication data identification can be improved by predicting the prediction model and correcting the probability of the grouping algorithm, thereby improving the screening efficiency and early warning effect of potential dangerous communication behaviors, assisting in the accurate assessment of the potential risks of target networks being penetrated or attacked, improving the timeliness and accuracy of network security risk identification, and strengthening the network security protection effect.

[0114] As an optional embodiment, in the above steps, based on the expected transmission time, all device communication data is divided into multiple data sets, including:

[0115] For each device communication data, determine whether there is a transmission time point in the data content of the device communication data, and obtain the first judgment result;

[0116] If the first judgment result is yes, the existing transmission time point is determined as the expected transmission time point of the device's communication data;

[0117] If the second judgment result is negative, all time-related information in the data content of the device's communication data is input into the trained transmission time prediction model to obtain the expected transmission time of the device's communication data.

[0118] Based on a clustering grouping algorithm, all device communication data are divided into multiple data sets according to the expected transmission time. Optionally, the time difference between the expected transmission time of any two device communication data in each data set is less than a time difference threshold. The time difference threshold is proportional to the average time difference between the expected transmission time of all device communication data.

[0119] Optionally, the time-related information can be a timestamp, communication trigger time, or data generation time; this invention does not impose any limitations.

[0120] Optionally, the transmission time prediction model can be a convolutional neural network model, a recurrent neural network model, or a time series prediction model; this invention does not impose any limitations.

[0121] As can be seen, through the above optional embodiments, the expected transmission time is extracted or predicted based on the device communication data content, and the communication data is divided into multiple sets according to time proximity using a clustering grouping algorithm. This achieves the completion and reasonable grouping of time information, providing an accurate data foundation for subsequent identification of communication data risks. It also helps to accurately assess the potential risks of target networks being penetrated or attacked, improves the timeliness and accuracy of network security risk identification, and strengthens the effectiveness of network security protection.

[0122] As an optional embodiment, the step described above, correcting the first danger probability corresponding to each device communication data based on the corresponding first set of danger probabilities to obtain the first corrected probability corresponding to each device communication data, includes:

[0123] For each data set, calculate the first probability difference between the first set hazard probability corresponding to that data set and the first probability mean parameter; optionally, the first probability mean parameter is the average of the first set hazard probabilities of all data sets;

[0124] Calculate the first correction weight, which is proportional to the first probability difference;

[0125] The first corrected probability is obtained by multiplying the first danger probability corresponding to the communication data of each device in the dataset with the first corrected weight.

[0126] As can be seen, through the above optional embodiments, the degree of danger deviation of a single set can be measured based on the difference between the set danger probability and the average set probability for each data set, and a proportional correction weight can be calculated based on this to achieve accurate correction of the probability of communication data of each device. This provides an accurate data basis for subsequent communication data danger identification, helps to accurately assess the potential risk of the target network being penetrated or attacked, improves the timeliness and accuracy of network security risk identification, and strengthens the network security protection effect.

[0127] As an optional embodiment, the step described above, determining hazardous equipment information based on the second prediction model and multiple device communication data, includes:

[0128] Device-related information is identified from the data content of all device communication data to obtain information on multiple communication devices; optionally, the device-related information can be a sending device, receiving device, relay device, or firewall device.

[0129] For each communication device information, based on the communication of the device corresponding to the communication device information and / or the communication of the gateway device of the target network, obtain the device parameter data and historical communication data corresponding to the communication device information;

[0130] The device parameter data and historical communication data corresponding to the communication device information are input into the trained second prediction model to obtain the second hazard type and second hazard probability corresponding to the communication device information.

[0131] Based on the second probability of danger, multiple dangerous communication devices were identified from all communication device information;

[0132] All dangerous communication devices and their corresponding secondary hazard types are identified as dangerous equipment information.

[0133] Optionally, the communication device information can be extracted from metadata, protocol fields, or log records in the data content; this invention is not limited thereto. Optionally, the process of determining the communication device information can be based on regular expression matching, feature extraction algorithms, or preset rule parsing; this invention is not limited thereto.

[0134] As can be seen, through the above optional embodiments, it is possible to identify all relevant devices in communication based on the analysis of the data content of device communication data, and to screen out dangerous devices based on the prediction of device parameters and historical communication based on the second prediction model, providing an accurate data foundation for subsequent network risk analysis, assisting in the accurate assessment of the potential risks of target networks being penetrated or attacked, improving the timeliness and accuracy of network security risk identification, and strengthening the effectiveness of network security protection.

[0135] As an optional embodiment, the step described above, identifying multiple dangerous communication devices from all communication device information based on a second risk probability, includes:

[0136] Based on a clustering grouping algorithm, all communication device information is grouped to obtain multiple device sets; optionally, the similarity between the device parameter data corresponding to any two communication device information in each device set is greater than a similarity threshold.

[0137] For each set of devices, calculate the average of the second danger probabilities corresponding to all communication device information in the set of devices to obtain the second set danger probability corresponding to the set of devices;

[0138] Calculate the second probability difference between the second set of hazard probabilities and the second probability mean parameter; optionally, the second probability mean parameter is the average of the second set of hazard probabilities for all device sets;

[0139] Calculate the second correction weight, which is proportional to the second probability difference;

[0140] Calculate the product of the second danger probability and the second correction weight for each piece of communication device information in the device set to obtain the second correction probability for each piece of communication device information in the device set;

[0141] Communication devices whose second modified probability is greater than the second probability threshold are identified as dangerous communication devices.

[0142] Optionally, the clustering algorithm can be K-means clustering, hierarchical clustering, or density clustering algorithm, and this invention does not limit it.

[0143] Optionally, the device parameter data can be device performance parameters, communication protocol parameters, or operating status parameters; this invention does not impose any limitations.

[0144] Optionally, the similarity threshold can be a fixed threshold, a dynamic threshold, or a threshold that is adaptively adjusted based on the application scenario; this invention does not impose any limitations on this.

[0145] As can be seen, through the above optional embodiments, it is possible to identify all relevant devices in communication based on the analysis of the data content of device communication data, and to screen out dangerous devices based on the prediction of device parameters and historical communication based on the second prediction model, providing an accurate data foundation for subsequent network risk analysis, assisting in the accurate assessment of the potential risks of target networks being penetrated or attacked, improving the timeliness and accuracy of network security risk identification, and strengthening the effectiveness of network security protection.

[0146] As an optional embodiment, in the above steps, both the first prediction model and the second prediction model are CNN network models. The two are first trained together on a common training dataset that includes communication data from multiple training devices and corresponding device parameter annotations and hazard annotations to obtain a base model. Then, the base model is trained on the corresponding fine-tuning training dataset to obtain the first prediction model and the second prediction model respectively.

[0147] Optionally, the CNN network model can be a deep convolutional network, a residual network, or an efficient network; this invention does not impose any limitations.

[0148] Optionally, the common training dataset may include simulated data, historical data, or real-time collected data, and this invention does not impose any limitations.

[0149] Optionally, the fine-tuned training dataset can be customized based on specific tasks, device types, or environmental conditions; this invention does not impose any limitations on this.

[0150] As can be seen, the training details of the first and second prediction models are defined through the above optional embodiments. Two models with comparable and accurate prediction results can be obtained based on joint training and separate fine-tuning training. This provides accurate prediction results for subsequent network risk analysis, helps to accurately assess the potential risks of target networks being penetrated or attacked, improves the timeliness and accuracy of network security risk identification, and strengthens the effectiveness of network security protection.

[0151] As an optional embodiment, the step above, determining the network hazard parameters of the target network based on the matching results between hazardous communication information and hazardous device information, includes:

[0152] Calculate the type similarity and equipment similarity between hazardous communication information and hazardous equipment information;

[0153] The matching degree parameter is obtained by multiplying the type similarity and device similarity.

[0154] The average difference between the prediction accuracy of the first prediction model and the second prediction model on the same validation dataset during the fine-tuning phase is calculated to obtain the prediction difference parameter.

[0155] Calculate and predict risk reference values ​​that are proportional to the degree of difference parameters;

[0156] The difference between the matching degree parameter and the hazard reference value is calculated to obtain the network hazard parameter of the target network.

[0157] Specifically, type similarity can be calculated by comparing the similarity between the hazard types in hazard communication information and hazard equipment information. For example, all first hazard types in hazard communication information can be identified as the first hazard type set, and all second hazard types in hazard equipment information can be identified as the second hazard type set. Then, the vector distance, intersection size, or intersection ratio between the first hazard type set and the second hazard type set can be calculated to obtain the type similarity.

[0158] Specifically, device similarity can be calculated by comparing the similarity between corresponding devices in hazardous communication information and hazardous device information. For example, it can identify the relevant devices corresponding to all device communication data in the hazardous communication information, and then calculate the similarity between all relevant devices and the hazardous device information to determine the device similarity. Optionally, the identification of relevant devices can be obtained by analyzing the device-related information corresponding to all device communication data in the hazardous communication information.

[0159] As can be seen, through the above optional embodiments, the matching degree between two prediction results can be accurately measured based on the calculation of type similarity and device similarity between dangerous communications and dangerous devices, and the danger reference value can be determined based on the prediction difference between prediction models, so as to accurately calculate the parameters that can characterize the risk of network attack or penetration, and finally achieve accurate assessment of the potential risk of target network penetration or attack, improve the timeliness and accuracy of network security risk identification, and strengthen the network security protection effect.

[0160] Example 2

[0161] Please see Figure 2 , Figure 2 This is a schematic diagram of the structure of a network security situation awareness and early warning system disclosed in an embodiment of the present invention. Figure 2 The described network security situation awareness and early warning system can be applied to data processing systems / data processing equipment / data processing servers (wherein, the server includes local processing servers or cloud processing servers). For example... Figure 2 As shown, the network security situation awareness and early warning system may include:

[0162] The acquisition module 201 is used to acquire communication data of multiple devices in the target network within a preset historical time period.

[0163] The first prediction module 202 is used to determine dangerous communication information based on the first prediction model and communication data from multiple devices.

[0164] The second prediction module 203 is used to determine hazardous equipment information based on the second prediction model and communication data from multiple devices.

[0165] Matching module 204 is used to determine network hazard parameters of the target network based on the matching results between hazardous communication information and hazardous equipment information.

[0166] Optionally, network hazard parameters are used to indicate the likelihood of a target network being penetrated or attacked.

[0167] As can be seen, the above-described embodiments of the invention acquire communication data of multiple devices in the target network within a preset historical time period, process the communication data of multiple devices based on a first prediction model to determine dangerous communication information, further process the communication data of multiple devices based on a second prediction model to determine dangerous device information, and determine the network hazard parameters of the target network based on the matching results between dangerous communication information and dangerous device information. This enables accurate assessment of the potential risks of the target network being penetrated or attacked, improves the timeliness and accuracy of network security risk identification, and strengthens the effectiveness of network security protection.

[0168] As an optional embodiment, the first prediction module determines the specific method of dangerous communication information based on a first prediction model and multiple device communication data, including:

[0169] Each device's communication data is input into the trained first prediction model to obtain the first hazard type and the first hazard probability corresponding to each device's communication data;

[0170] Based on the expected transmission time, all device communication data is divided into multiple data sets;

[0171] Calculate the average of the first danger probabilities corresponding to all device communication data in each data set to obtain the first set danger probability corresponding to each data set;

[0172] Based on the corresponding first set of danger probabilities, the first danger probability corresponding to each device communication data is corrected to obtain the first corrected probability corresponding to each device communication data;

[0173] All device communication data with a first correction probability greater than a first probability threshold, along with their corresponding first hazard type, are identified as hazardous communication information.

[0174] As can be seen, through the above optional embodiments, the accuracy and robustness of dangerous communication data identification can be improved by predicting the prediction model and correcting the probability of the grouping algorithm, thereby improving the screening efficiency and early warning effect of potential dangerous communication behaviors, assisting in the accurate assessment of the potential risks of target networks being penetrated or attacked, improving the timeliness and accuracy of network security risk identification, and strengthening the network security protection effect.

[0175] As an optional embodiment, the first prediction module divides all device communication data into multiple data sets based on the expected transmission time, including the following specific methods:

[0176] For each device communication data, determine whether there is a transmission time point in the data content of the device communication data, and obtain the first judgment result;

[0177] If the first judgment result is yes, the existing transmission time point is determined as the expected transmission time point of the device's communication data;

[0178] If the second judgment result is negative, all time-related information in the data content of the device's communication data is input into the trained transmission time prediction model to obtain the expected transmission time of the device's communication data.

[0179] Based on a clustering grouping algorithm, all device communication data are divided into multiple data sets according to the expected transmission time. Optionally, the time difference between the expected transmission time of any two device communication data in each data set is less than a time difference threshold. The time difference threshold is proportional to the average time difference between the expected transmission time of all device communication data.

[0180] As can be seen, through the above optional embodiments, the expected transmission time is extracted or predicted based on the device communication data content, and the communication data is divided into multiple sets according to time proximity using a clustering grouping algorithm. This achieves the completion and reasonable grouping of time information, providing an accurate data foundation for subsequent identification of communication data risks. It also helps to accurately assess the potential risks of target networks being penetrated or attacked, improves the timeliness and accuracy of network security risk identification, and strengthens the effectiveness of network security protection.

[0181] As an optional embodiment, the first prediction module corrects the first danger probability corresponding to each device communication data according to the corresponding first set of danger probabilities, and obtains the specific method of the first corrected probability corresponding to each device communication data, including:

[0182] For each data set, calculate the first probability difference between the first set hazard probability corresponding to that data set and the first probability mean parameter; optionally, the first probability mean parameter is the average of the first set hazard probabilities of all data sets;

[0183] Calculate the first correction weight, which is proportional to the first probability difference;

[0184] The first corrected probability is obtained by multiplying the first danger probability corresponding to the communication data of each device in the dataset with the first corrected weight.

[0185] As can be seen, through the above optional embodiments, the degree of danger deviation of a single set can be measured based on the difference between the set danger probability and the average set probability for each data set, and a proportional correction weight can be calculated based on this to achieve accurate correction of the probability of communication data of each device. This provides an accurate data basis for subsequent communication data danger identification, helps to accurately assess the potential risk of the target network being penetrated or attacked, improves the timeliness and accuracy of network security risk identification, and strengthens the network security protection effect.

[0186] As an optional embodiment, the second prediction module determines the specific method of hazardous equipment information based on the second prediction model and multiple device communication data, including:

[0187] Device-related information is identified from the data content of all device communication data to obtain information on multiple communication devices; optionally, the device-related information can be a sending device, receiving device, relay device, or firewall device.

[0188] For each communication device information, based on the communication of the device corresponding to the communication device information and / or the communication of the gateway device of the target network, obtain the device parameter data and historical communication data corresponding to the communication device information;

[0189] The device parameter data and historical communication data corresponding to the communication device information are input into the trained second prediction model to obtain the second hazard type and second hazard probability corresponding to the communication device information.

[0190] Based on the second probability of danger, multiple dangerous communication devices were identified from all communication device information;

[0191] All dangerous communication devices and their corresponding secondary hazard types are identified as dangerous equipment information.

[0192] As can be seen, through the above optional embodiments, it is possible to identify all relevant devices in communication based on the analysis of the data content of device communication data, and to screen out dangerous devices based on the prediction of device parameters and historical communication based on the second prediction model, providing an accurate data foundation for subsequent network risk analysis, assisting in the accurate assessment of the potential risks of target networks being penetrated or attacked, improving the timeliness and accuracy of network security risk identification, and strengthening the effectiveness of network security protection.

[0193] As an optional embodiment, the second prediction module determines the specific method of multiple dangerous communication devices from all communication device information based on a second danger probability, including:

[0194] Based on a clustering grouping algorithm, all communication device information is grouped to obtain multiple device sets; optionally, the similarity between the device parameter data corresponding to any two communication device information in each device set is greater than a similarity threshold.

[0195] For each set of devices, calculate the average of the second danger probabilities corresponding to all communication device information in the set of devices to obtain the second set danger probability corresponding to the set of devices;

[0196] Calculate the second probability difference between the second set of hazard probabilities and the second probability mean parameter; optionally, the second probability mean parameter is the average of the second set of hazard probabilities for all device sets;

[0197] Calculate the second correction weight, which is proportional to the second probability difference;

[0198] Calculate the product of the second danger probability and the second correction weight for each piece of communication device information in the device set to obtain the second correction probability for each piece of communication device information in the device set;

[0199] Communication devices whose second modified probability is greater than the second probability threshold are identified as dangerous communication devices.

[0200] As can be seen, through the above optional embodiments, it is possible to identify all relevant devices in communication based on the analysis of the data content of device communication data, and to screen out dangerous devices based on the prediction of device parameters and historical communication based on the second prediction model, providing an accurate data foundation for subsequent network risk analysis, assisting in the accurate assessment of the potential risks of target networks being penetrated or attacked, improving the timeliness and accuracy of network security risk identification, and strengthening the effectiveness of network security protection.

[0201] As an optional embodiment, both the first prediction model and the second prediction model are CNN network models. The two are first trained together on a common training dataset that includes communication data from multiple training devices and corresponding device parameter annotations and hazard annotations to obtain a base model. Then, the base model is trained on the corresponding fine-tuning training dataset to obtain the first prediction model and the second prediction model respectively.

[0202] As can be seen, the training details of the first and second prediction models are defined through the above optional embodiments. Two models with comparable and accurate prediction results can be obtained based on joint training and separate fine-tuning training. This provides accurate prediction results for subsequent network risk analysis, helps to accurately assess the potential risks of target networks being penetrated or attacked, improves the timeliness and accuracy of network security risk identification, and strengthens the effectiveness of network security protection.

[0203] As an optional embodiment, the matching module determines the specific method of network hazard parameters of the target network based on the matching results between hazardous communication information and hazardous device information, including:

[0204] Calculate the type similarity and equipment similarity between hazardous communication information and hazardous equipment information;

[0205] The matching degree parameter is obtained by multiplying the type similarity and device similarity.

[0206] The average difference between the prediction accuracy of the first prediction model and the second prediction model on the same validation dataset during the fine-tuning phase is calculated to obtain the prediction difference parameter.

[0207] Calculate and predict risk reference values ​​that are proportional to the degree of difference parameters;

[0208] The difference between the matching degree parameter and the hazard reference value is calculated to obtain the network hazard parameter of the target network.

[0209] As can be seen, through the above optional embodiments, the matching degree between two prediction results can be accurately measured based on the calculation of type similarity and device similarity between dangerous communications and dangerous devices, and the danger reference value can be determined based on the prediction difference between prediction models, so as to accurately calculate the parameters that can characterize the risk of network attack or penetration, and finally achieve accurate assessment of the potential risk of target network penetration or attack, improve the timeliness and accuracy of network security risk identification, and strengthen the network security protection effect.

[0210] Example 3

[0211] Please see Figure 3 , Figure 3 This is another network security situation awareness and early warning system disclosed in the embodiments of the present invention. Figure 3 The described network security situation awareness and early warning system is applied in data processing systems / data processing equipment / data processing servers (wherein, the server includes local processing servers or cloud processing servers). For example... Figure 3 As shown, the network security situation awareness and early warning system may include:

[0212] Memory 301 storing executable program code;

[0213] Processor 302 coupled to memory 301;

[0214] The processor 302 calls the executable program code stored in the memory 301 to execute the steps of the network security situation awareness and early warning method described in Embodiment 1.

[0215] Example 4

[0216] This invention discloses a computer read storage medium that stores a computer program for electronic data interchange, wherein the computer program causes a computer to execute the steps of the network security situation awareness and early warning method described in Embodiment 1.

[0217] Example 5

[0218] This invention discloses a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to cause a computer to perform the steps of the network security situation awareness and early warning method described in Embodiment 1.

[0219] The foregoing has described specific embodiments of this specification; other embodiments are within the scope of the appended claims. In some cases, the actions or steps described in the claims may be performed in a different order than those shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily have to follow the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0220] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0221] For ease of description, the above devices are described in terms of function, divided into various units. Of course, in implementing this specification, the functions of each unit can be implemented in one or more software and / or hardware.

[0222] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, the embodiments of this specification can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the embodiments of this specification can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0223] This specification is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0224] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0225] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0226] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0227] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0228] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0229] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0230] This specification can be described in the general context of computer-executable instructions that are executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This specification can also be practiced in distributed computing environments, where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0231] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0232] Finally, it should be noted that the network security situation awareness and early warning method and system disclosed in the embodiments of the present invention are merely preferred embodiments of the present invention, and are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for network security situation awareness and early warning, characterized in that, The method includes: Acquire communication data of multiple devices on the target network within a preset historical time period; Based on the first prediction model, dangerous communication information is determined according to the communication data of the multiple devices. Based on the second prediction model, dangerous equipment information is determined according to the communication data of the multiple devices. Both the first prediction model and the second prediction model are CNN network models. The two are first trained together on a common training dataset that includes communication data of multiple training devices and corresponding device parameter labels and hazard labels to obtain a basic model. Then, the basic model is trained on the corresponding fine-tuning training dataset to obtain the first prediction model and the second prediction model respectively. Based on the matching results between the dangerous communication information and the dangerous equipment information, the network hazard parameters of the target network are determined, including: Calculate the type similarity and equipment similarity between the hazardous communication information and the hazardous equipment information; Calculate the product of the type similarity and the device similarity to obtain the matching degree parameter; The average difference between the prediction accuracy of the first prediction model and the second prediction model on the same validation dataset during the fine-tuning phase is calculated to obtain the prediction difference parameter. Calculate the danger reference value that is proportional to the predicted difference parameter; The difference between the matching degree parameter and the danger reference value is calculated to obtain the network danger parameter of the target network; the network danger parameter is used to indicate the risk of the target network being penetrated or attacked.

2. The network security situation awareness and early warning method according to claim 1, characterized in that, The determination of dangerous communication information based on the communication data of the multiple devices, according to the first prediction model, includes: Each device communication data is input into a trained first prediction model to obtain a first hazard type and a first hazard probability corresponding to each device communication data. Based on the expected transmission time, all the device communication data is divided into multiple data sets; Calculate the average value of the first danger probability corresponding to all device communication data in each data set to obtain the first set danger probability corresponding to each data set; Based on the corresponding first set of danger probabilities, the first danger probability corresponding to each device communication data is corrected to obtain the first corrected probability corresponding to each device communication data; All device communication data whose first correction probability is greater than the first probability threshold, along with their corresponding first hazard type, are identified as hazardous communication information.

3. The network security situation awareness and early warning method according to claim 2, characterized in that, Based on the expected transmission time, all device communication data is divided into multiple data sets, including: For each piece of device communication data, determine whether there is a transmission time point in the data content of the device communication data, and obtain a first determination result; When the first judgment result is yes, the existing transmission time point is determined as the expected transmission time point of the device's communication data; If the first judgment result is negative, all time-related information in the data content of the device's communication data is input into the trained transmission time prediction model to obtain the expected transmission time of the device's communication data. Based on a clustering grouping algorithm, all device communication data are divided into multiple data sets according to the expected transmission time points; wherein, the time difference between the expected transmission time points of any two device communication data in each data set is less than a time difference threshold; the time difference threshold is proportional to the average time difference between the expected transmission time points of all device communication data.

4. The network security situation awareness and early warning method according to claim 2, characterized in that, The step of correcting the first danger probability corresponding to each device communication data according to the corresponding first set of danger probabilities to obtain the first corrected probability corresponding to each device communication data includes: For each of the data sets, calculate the first probability difference between the first set danger probability corresponding to that data set and the first probability mean parameter; the first probability mean parameter is the average of the first set danger probabilities of all the data sets. Calculate a first correction weight that is proportional to the first probability difference; The first corrected probability is obtained by multiplying the first danger probability corresponding to each device communication data in the data set with the first corrected weight.

5. The network security situation awareness and early warning method according to claim 1, characterized in that, The determination of hazardous equipment information based on the second prediction model and the communication data of the multiple devices includes: Device-related information is determined from the data content of all the device communication data to obtain multiple communication device information; the device-related information includes sending device, receiving device, relay device, or firewall device. For each piece of communication device information, based on the communication between the device corresponding to the communication device information and / or the communication with the gateway device of the target network, obtain the device parameter data and historical communication data corresponding to the communication device information; The device parameter data and historical communication data corresponding to the communication device information are input into the trained second prediction model to obtain the second hazard type and second hazard probability corresponding to the communication device information. Based on the second risk probability, multiple dangerous communication devices are identified from all the communication device information; All the aforementioned dangerous communication devices and their corresponding second hazard types are identified as dangerous device information.

6. The network security situation awareness and early warning method according to claim 5, characterized in that, The determination of multiple dangerous communication devices from all the communication device information based on the second danger probability includes: Based on a clustering grouping algorithm, all the communication device information is grouped to obtain multiple device sets; wherein, in each device set, the similarity between the device parameter data corresponding to any two pieces of communication device information is greater than a similarity threshold; For each set of devices, the average value of the second danger probability corresponding to all the communication device information in the set of devices is calculated to obtain the second set danger probability corresponding to the set of devices; Calculate the second probability difference between the second set of danger probability and the second probability mean parameter; the second probability mean parameter is the average of the second set of danger probabilities of all the device sets. Calculate the second correction weight that is proportional to the second probability difference; Calculate the product of the second danger probability corresponding to each piece of communication device information in the device set and the second correction weight to obtain the second corrected probability corresponding to each piece of communication device information in the device set; The communication device information whose second correction probability is greater than the second probability threshold is identified as a dangerous communication device.

7. A network security situation awareness and early warning system, characterized in that, The system includes: The acquisition module is used to acquire communication data of multiple devices in the target network within a preset historical time period; The first prediction module is used to determine dangerous communication information based on the communication data of the multiple devices, according to the first prediction model. The second prediction module is used to determine hazardous equipment information based on the communication data of the multiple devices according to the second prediction model. Both the first prediction model and the second prediction model are CNN network models. The two are first trained together on a common training dataset that includes communication data of multiple training devices and corresponding device parameter labels and hazard labels to obtain a basic model. Then, the basic model is trained on the corresponding fine-tuning training dataset to obtain the first prediction model and the second prediction model respectively. A matching module is used to determine network hazard parameters of the target network based on the matching result between the dangerous communication information and the dangerous device information, including: Calculate the type similarity and equipment similarity between the hazardous communication information and the hazardous equipment information; Calculate the product of the type similarity and the device similarity to obtain the matching degree parameter; The average difference between the prediction accuracy of the first prediction model and the second prediction model on the same validation dataset during the fine-tuning phase is calculated to obtain the prediction difference parameter. Calculate the danger reference value that is proportional to the predicted difference parameter; The difference between the matching degree parameter and the danger reference value is calculated to obtain the network danger parameter of the target network; the network danger parameter is used to indicate the risk of the target network being penetrated or attacked.

8. A network security situation awareness and early warning system, characterized in that, The system includes: Memory containing executable program code; A processor coupled to the memory; The processor calls the executable program code stored in the memory to execute the network security situation awareness and early warning method as described in any one of claims 1-6.

Images