Suspected degree correlation analysis method based on fuzzy scene matching

Abstract

The invention provides a suspected degree correlation analysis method based on fuzzy scene matching, and the method comprises the steps: obtaining safety alarm original event data, and distributing dynamic weights for multiple factors, such as the number of events, the grade and the like, and a time decay factor; multi-dimensional comprehensive analysis is carried out, attenuation factors are calculated in combination with timestamps, and weighting results are accumulated to generate a 0-1 source IP attack threat suspected degree value; setting an event repetition frequency and an IP relationship quantity threshold, and processing threshold exceeding data; suspected degree ranking is displayed from three dimensions of homology and same purpose, and IP traceability is supported; incremental calculation is carried out according to a preset calculation period, new data and historical data are integrated, an event effective time range is set, and configurable item adjustment correlation coefficients are set; according to the method, the accuracy, the flexibility and the high efficiency of network security threat detection and analysis are remarkably improved by integrating multiple factors to calculate the suspected degree, dynamically adjust the weight coefficient, optimize data processing and display, enhance the traceability and enrich configurable items.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a suspicion degree association analysis method based on fuzzy scene matching. Background Art

[0002] With the rapid development of the Internet, the network environment is becoming increasingly complex, and network attack methods are emerging in an endless stream. Network security threat detection and analysis has become a key link in ensuring network security. In the field of network security technology, network attack detection technology has experienced a development process from simple to complex, from single function to comprehensive analysis. In the early days, it mainly relied on simple port scanning and intrusion detection systems (IDS). These systems are based on the basic principles of rule matching or anomaly detection and can identify some known simple attack patterns, but their detection capabilities are limited when faced with diversified and complex attack methods. With the rise of technologies such as big data and artificial intelligence, network security analysis has gradually developed in the direction of intelligence and integration. Big data technology enables security analysis systems to process massive amounts of network data and mine potential security threats. Artificial intelligence algorithms, such as machine learning and deep learning, are widely used in the classification and prediction of attack behaviors, significantly improving the accuracy and efficiency of detection. However, the current network security threat detection and analysis technology still has some problems that need to be solved.

[0003] When analyzing network attack threats, existing technologies often only focus on a single or a few factors, such as judging the threat level based only on the number of events or event levels, and fail to fully and comprehensively consider multiple factors in network security alarms, such as the number of source IPs, the number of destination IPs, and the event processing status, resulting in an incomplete and inaccurate assessment of attack threats. In actual network environments, the impact of different factors on network security threats will vary with time, network topology, business needs, and other factors. However, most existing technologies use fixed weights to calculate each factor, and are unable to dynamically adjust the weights according to actual conditions, making it difficult to adapt to complex and changing network environments, reducing the flexibility and adaptability of the detection system.

[0004] With the explosive growth of network data, how to efficiently process and display massive amounts of security data has become a challenge; existing technologies lack effective threshold processing and data display strategies when processing large amounts of security alarm data. For data exceeding a certain scale, problems such as low analysis efficiency and chaotic display are prone to occur, making it difficult for security managers to quickly and accurately obtain key information and make timely decisions; different network environments and business scenarios have different requirements for network security detection and analysis, but existing technologies have limited configuration options, making it difficult to flexibly configure the system according to specific needs, and unable to fully meet diverse security needs, limiting the application effect of network security technology in different scenarios;

[0005] Therefore, there is an urgent need in the art for a suspicion degree correlation analysis method based on fuzzy scenario matching to solve the above problems. Summary of the Invention

[0006] The present invention provides a suspicion degree correlation analysis method based on fuzzy scenario matching. Through innovative technologies such as comprehensively calculating the suspicion degree by multiple factors, dynamically adjusting the weight coefficients, optimizing data processing and display, enhancing the traceability ability, and enriching the configurable items, the problems existing in the above-mentioned prior art are effectively solved, and the accuracy, flexibility, and efficiency of network security threat detection and analysis are significantly improved.

[0007] The present invention provides a suspicion degree correlation analysis method based on fuzzy scenario matching, including:

[0008] Step 1: Obtain the original event data of security alarms, including source IP, destination IP, number of events, event level, event processing status, event type, and event timestamp;

[0009] Step 2: Assign dynamically adjustable weight coefficients to the number of events, event level, event processing status, event type, number of source IPs, number of destination IPs, and time decay factor;

[0010] Step 3: Based on the weight coefficients in Step 2, conduct a multi-dimensional comprehensive analysis of the association relationship between the source IP and the destination IP, calculate the time decay factor in combination with the event timestamp, accumulate the weighted results of each factor and perform normalization processing to generate a suspicion degree value within the range of 0-1; the suspicion degree value represents the suspicion degree of the source IP being an attack threat;

[0011] Step 4: Set the maximum threshold for the number of event repetitions and the quantity threshold for the relationship between the source IP and the destination IP, and perform segmented weighting or truncation processing on the data exceeding the threshold;

[0012] Step 5: Display the suspicion degree ranking according to three dimensions of the same source and the same destination, the same source but different destinations, and different sources but the same destination, and achieve forward or backward traceability of the IP through click interaction;

[0013] Step 6: Perform incremental calculation according to a pre-set calculation cycle, only process the newly added events within the cycle and integrate them with the historical data. At the same time, set the effective time range of the events to exclude expired data, and set configurable items to configure the correlation coefficients.

[0014] According to the suspicion degree correlation analysis method based on fuzzy scenario matching provided by the present invention, in Step 3, the weight calculation method for the number of events is:

[0015] When the number of events x ≤ max, the weight f(x) = a * x; when the number of events x > max, the weight f(x) = a * max;

[0016] Among them, a is the weight coefficient of a single event, and max is the preset threshold of the maximum number of event repetitions.

[0017] According to a method for suspected degree correlation analysis based on fuzzy scenario matching provided by the present invention, in step three, the calculation method of the weight of the event level is as follows:

[0018] The event level is divided into multiple predefined levels, each level corresponding to a different weight value level, and multiplied by the weight f(x) of the number of events to obtain the weighted result f(x)*level of the event level; where the value varies according to different event levels, and the weights are the same when the level is not considered.

[0019] According to a method for suspected degree correlation analysis based on fuzzy scenario matching provided by the present invention, in step three, the calculation method of the weight of the event processing status is as follows:

[0020] According to the event processing status being one of processed, unprocessed, ignored, or unaggregated, different weight values are respectively assigned, and the formula E for calculating the suspected degree of a single piece of data between two IPs is:

[0021] E = f(x)*level*state

[0022] Among them, state is the weight value of the event processing status.

[0023] According to a method for suspected degree correlation analysis based on fuzzy scenario matching provided by the present invention, in step three, the process of calculating the time decay factor by combining the event timestamp, accumulating the weighted results of each factor, and performing normalization processing is as follows:

[0024] Based on the difference Δt between the event timestamp and the current time, define the time decay function D(Δt)=e -λΔt , where λ is the preset decay rate coefficient; this decay rate coefficient λ is set to a fixed value through configuration, and the value range is 0.001 - 0.1;

[0025] Combine the time decay factor with the weighted results of the number of events, level, processing status, and type, and calculate the suspected degree I. The calculation formula is:

[0026]

[0027] Among them, E k is the basic suspected degree of the kth event, that is, E = f(x)*level*state; n is the total number of events, T k is the preset weight of the event type, F is the global adjustment coefficient, Δt kThe time difference for the k-th event; the hyperbolic tangent function tanh is used to control the value of the suspicion degree I between 0 and 1.

[0028] According to a suspicion degree correlation analysis method based on fuzzy scenario matching provided by the present invention, the time decay function further introduces a piecewise correction strategy, including:

[0029] When Δt ≤ T1, D(Δt) = 1;

[0030] When T1 < Δt ≤ T2,

[0031] When Δt > T2, D(Δt) = βe -λΔt ;

[0032] Wherein, T1 and T2 are event segmentation thresholds, and T1 < T2; α and β are preset correction coefficients, and α > 0, 0 < β < 1.

[0033] According to a suspicion degree correlation analysis method based on fuzzy scenario matching provided by the present invention, in step four, the process of performing piecewise weighting or truncation processing on data exceeding the threshold is as follows:

[0034] For the suspicion degree I of the number of source IPs in a many-to-one relationship, set the minimum value I min and the maximum value I max , when I < I min take I min , when I > I max take I max , and take the actual value I in other cases.

[0035] According to a suspicion degree correlation analysis method based on fuzzy scenario matching provided by the present invention, in step five, the process of displaying the suspicion degree ranking in the three dimensions specifically includes:

[0036] The event status of the same source and the same destination is distinguished by color, red for unprocessed, green for processed, yellow for ignored, and blue for unaggregated;

[0037] When the number of events or IPs exceeds the preset threshold, an ellipsis icon is used for display, and detailed information can be expanded by clicking.

[0038] According to a suspicion degree correlation analysis method based on fuzzy scenario matching provided by the present invention, in step five, the IP traceability layer is limited to 3 - 7 layers, and when it exceeds, the data of the earliest or farthest layer is automatically truncated.

[0039] According to a suspicion degree correlation analysis method based on fuzzy scenario matching provided by the present invention, in step five, the configurable items include single event weight, single event repetition times, weight of each event level, weight of event processing status, weight of event type, suspicion degree coefficient, value range of each relationship in one-to-many and many-to-one, maximum number of displayed events, maximum number of relationships, IP traceability layer number, event display name, calculation period, event range; wherein the calculation period is an integer multiple of 5 - 60 minutes, and the event valid time range is configured synchronously with the calculation period.

[0040] Compared with the prior art, the beneficial effects of the present application are as follows:

[0041] 1. The prior art mostly focuses on evaluating network attack threats with single or a few factors. The present invention comprehensively calculates the suspicion degree by considering multiple factors such as source IP, destination IP, number of events, level, processing status, type, etc., and also considers the timeliness of events in combination with the time decay factor; for example, when calculating the weight of the number of events, different calculation rules are adopted for different number ranges to comprehensively and accurately evaluate the attack threat and reduce misjudgment and missed judgment.

[0042] 2. The weights in the prior art are fixed and it is difficult to adapt to the complex and changeable network environment; the present invention assigns dynamically adjustable weight coefficients to each factor, which can be adjusted in real time according to changes in network topology and business requirements, improving the flexibility and adaptability of the detection system and better coping with security threats in different scenarios.

[0043] 3. In the face of a large amount of security data, the present invention sets a threshold to process excessive data, such as setting the maximum and minimum values to stabilize the data for the suspicion degree of the number of source IPs in a many-to-one relationship; in terms of display, the suspicion degree ranking is displayed from multiple dimensions, the event status is distinguished by colors, and the omitted icon is used to process the data exceeding the threshold. Click to view the details, which is convenient for security management personnel to quickly obtain key information.

[0044] 4. The prior traceability technology has deficiencies in depth and breadth. The present invention supports IP forward and backward traceability and limits the reasonable number of traceability layers, which can comprehensively track the attack path from multiple dimensions, accurately locate the threat source, and help users take targeted protection measures.

[0045] 5. The prior art has limited configuration options and it is difficult to meet diverse requirements; the present invention sets rich configurable items, covering various weights, value ranges, calculation periods, etc. Users can flexibly configure the system according to actual needs, improving the application effect in different network environments and business scenarios.

[0046] Other features and advantages of the present invention will be described in the following specification, and part of them will become obvious from the specification or be understood by implementing the present invention. The purpose and other advantages of the present invention can be realized and obtained through the structure specifically pointed out in the written specification and the drawings.

[0047] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Description of the Drawings

[0048] The accompanying drawings are used to provide a further understanding of the present invention, and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention, but do not constitute a limitation to the present invention.

[0049] In the accompanying drawings:

[0050] Figure 1 is a schematic flowchart of a suspicion degree correlation analysis method based on fuzzy scenario matching provided by an embodiment of the present invention. Detailed Embodiments

[0051] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0052] Embodiment 1:

[0053] An embodiment of the present invention provides a suspicion degree correlation analysis method based on fuzzy scenario matching. Please refer to Figure 1 , including:

[0054] Step 1: Obtain the original event data of the security alarm, including source IP, destination IP, number of events, event level, event processing status, event type, and event timestamp;

[0055] Step 2: Assign dynamically adjustable weight coefficients to the number of events, event level, event processing status, event type, number of source IPs, number of destination IPs, and time decay factor;

[0056] Step 3: Based on the weight coefficients in Step 2, perform a multi-dimensional comprehensive analysis on the association relationship between the source IP and the destination IP, calculate the time decay factor in combination with the event timestamp, accumulate the weighted results of each factor and perform normalization processing to generate a suspicion degree value within the range of 0-1; the suspicion degree value represents the suspicion degree of the source IP being an attack threat;

[0057] Step 4: Set the maximum threshold for the number of event repetitions and the quantity threshold for the relationship between the source IP and the destination IP, and perform segmented weighting or truncation processing on the data exceeding the threshold;

[0058] Step 5: Display the suspicion degree ranking according to three dimensions of the same source and the same destination, the same source and different destinations, and different sources and the same destination, and realize the forward traceability or backward traceability of the IP through click interaction;

[0059] Step 6: Perform incremental calculation according to the preset calculation cycle, only process newly added events within the cycle and integrate them with historical data. At the same time, set the valid time range of events to exclude expired data, and set configurable items to configure the correlation coefficient.

[0060] The principle and beneficial effects of this embodiment are as follows: Based on multi-factor comprehensive consideration and dynamic analysis mechanism. First, obtain the original security alarm event data covering a variety of key information to provide a comprehensive basis for subsequent analysis. Then, assign dynamically adjustable weight coefficients to multiple factors related to security threats so as to flexibly adjust the importance of each factor according to the actual network environment. Then, through multi-dimensional comprehensive analysis of the correlation relationship between the source IP and the destination IP, calculate the time decay factor in combination with the event timestamp, accumulate and normalize the weighted results of each factor, so as to obtain the suspicion value representing the attack threat degree of the source IP. During the data processing process, set thresholds to perform segmented weighting or truncation processing on data outside the range to ensure the stability of the analysis results. Display the suspicion ranking through specific dimensions and provide the IP traceability function to facilitate users to understand the network security status and threat path. Finally, adopt the incremental calculation method, process newly added events by cycle and integrate historical data. At the same time, set the time range to exclude expired data, and also set configurable items to enhance the adaptability and flexibility of the system.

[0061] To further optimize the above embodiment, in step 3, the weight calculation method for the number of events is:

[0062] When the number of events x ≤ max, the weight f(x) = a * x; when the number of events x > max, the weight f(x) = a * max;

[0063] Among them, a is the weight coefficient of a single event, and max is the preset threshold for the maximum number of event repetitions.

[0064] It should be noted that in the scenario of network security threat analysis, the determination of the weight coefficient a of a single event and the preset threshold max for the maximum number of event repetitions need to consider multiple factors comprehensively, aiming to make the factor of the number of events more accurately reflect the actual threat degree in the suspicion calculation.

[0065] The determination of the weight coefficient a of a single event needs to first analyze the event type. For security events of different types, their harm levels and potential threats are different. For example, for attack events against core data, the harm is great, and the weight coefficient a should be set high; for ordinary port scanning events, the harm is relatively small, and the value of a can be set low. Then refer to the network environment. In networks with high security requirements, such as financial and military networks, the sensitivity to security events is high, and a needs to be increased; for ordinary office networks, the security requirements are slightly lower, and a can be appropriately reduced. It can also be based on historical data to analyze the severity of security problems caused by past similar events. If a certain type of event often causes serious consequences, the involved a should be increased; otherwise, it should be decreased.

[0066] The determination of the preset maximum threshold value max for event repetition needs to be based on the characteristics of network traffic. For a network with large network traffic and frequent event occurrences, max can be set relatively high; for a network with small traffic and few event occurrences, max can be set relatively low. At the same time, considering the system performance, if the system computing resources are limited, in order to avoid excessive computing volume affecting the performance, max should not be set too high; when the computing resources are sufficient, the value of max can be appropriately increased. In addition, referring to industry standards and best practices, drawing on the existing successful experiences and standards in the same type of network environment or similar business scenarios, and then fine-tuning according to the actual situation of its own network to determine an appropriate value of max.

[0067] To further optimize the above embodiments, in step three, the weight calculation method for event levels is as follows:

[0068] The event levels are divided into multiple predefined levels, each level corresponding to a different weight value level, and multiplied by the weight f(x) of the number of events to obtain the weighted result f(x)*level of the event level; where the value varies according to different event levels, and the weights are the same when the levels are not considered.

[0069] It should be noted that to determine the weight values corresponding to different levels of event levels, multiple factors need to be considered comprehensively to accurately reflect the impact degree of events at different levels on network security threats, specifically as follows:

[0070] Starting from the actual harm caused by the event to network security. If an event can directly lead to system paralysis or leakage of sensitive information, such as a high-level hacker intrusion event, this type of event has a high level, and its weight value should be set relatively large; for a low-risk general warning event, which only indicates the existence of potential security risks and has not caused substantial damage, the corresponding weight value should be relatively small. In this way, the weight value is proportional to the degree of event harm, highlighting the importance of serious events in the calculation of suspicion.

[0071] Referring to industry general standards, different industries have their own grading standards for network security events, such as the grading of data leakage events in the financial industry and the grading of patient information security events in the medical industry, etc. The definitions and descriptions of events at different levels in these industry standards can be referred to, and combined with the actual needs of its own network security analysis to determine the corresponding weight values. This can ensure that the setting of weight values has a certain degree of generality and comparability within the industry, making the analysis results more valuable for reference.

[0072] Based on historical data and experience, review various network security incidents that have occurred in history, and count the actual consequences and frequencies of incidents of different levels. If incidents of a certain level frequently trigger serious security accidents, the corresponding weight value should be appropriately increased; conversely, if incidents of a certain level rarely cause serious problems, the weight value can be decreased. Through the analysis of historical data and the summary of experience, the setting of weight values is made more in line with the actual network environment, enhancing the rationality and effectiveness of weight values.

[0073] Combined with the criticality of the business, consider the criticality of the business system where the incident occurs. For systems that support the operation of core businesses, security incidents in them have a greater impact, and their weight values should be higher than those of incidents in non-critical business systems under the same level. For example, if a security incident occurs in the transaction processing system of an e-commerce platform, the weight value should be higher than that of a similar-level incident in the internal office automation system, ensuring stronger security protection for critical businesses.

[0074] To further optimize the above embodiments, in step three, the weight calculation method for the event processing status is as follows:

[0075] According to the event processing status being one of processed, unprocessed, ignored, or unaggregated, different weight values are assigned respectively. The formula E for the suspicion degree of a single piece of data between two IPs is:

[0076] E = f(x) * level * state

[0077] Among them, state is the weight value of the event processing status.

[0078] It should be noted that for unprocessed events, since they have not been dealt with yet and there are relatively large potential threats, the weight value should be relatively high, such as set to 4; for processed events, the risk has been controlled, and the weight value is relatively low, set to 3; for ignored events, which are actively chosen not to be processed, the possible risk is relatively low, and the weight value can be set to 1; for unaggregated events, the data integration is incomplete and it is difficult to evaluate the risk, and the weight value is set to 2;

[0079] Determine the weight value according to the urgency of processing; unprocessed events need to be processed urgently, with the highest priority and a large weight value; processed events have the lowest priority and a small weight value; ignored events have a low priority because they are actively shelved and the weight value is relatively small; unaggregated events have a lower processing priority than unprocessed events due to insufficient information, and the weight value is in the middle range;

[0080] Unprocessed events will have a greater impact on subsequent analysis because of their high uncertainty and a high weight value; processed events have a smaller impact and a low weight value; ignored events, although ignored, may hide risks and the weight value is moderate; unaggregated events have an impact degree between unprocessed and processed events due to incomplete data, and the weight value is also set accordingly.

[0081] To further optimize the above embodiments, in step three, the process of calculating the time decay factor in combination with the event timestamp, accumulating the weighted results of various factors, and performing normalization is as follows:

[0082] Based on the time difference Δt between the event timestamp and the current time, define the time decay function D(Δt) = e -λΔt , where λ is a preset decay rate coefficient; this decay rate coefficient λ is set to a fixed value through configuration, and its value range is 0.001 - 0.1;

[0083] Combine the time decay factor with the weighted results of the number of events, level, processing status, and type, and calculate the suspicion degree I. The calculation formula is:

[0084]

[0085] where E k is the basic suspicion degree of the kth event, that is, E = f(x) * level * state; n is the total number of events, T k is the preset event type weight, F is the global adjustment coefficient, and Δt k is the time difference of the kth event; the hyperbolic tangent function tanh is used to control the value of the suspicion degree I between 0 and 1.

[0086] It should be noted that the configuration rule of the decay rate coefficient is as follows: The stability of the network environment is an important basis for configuration; in a stable network environment, security threats change slowly, and the decay rate coefficient can be set to a relatively small value, such as 0.001 - 0.01, to ensure that historical events can retain a certain influence for a long time; in a network environment with frequent changes and fast - updated attack methods, the coefficient should be increased to 0.05 - 0.1 to make the event impact decay quickly and pay more attention to recent events; the average occurrence frequency of events also needs to be considered; if events occur frequently, in order to highlight the importance of new events, the decay rate coefficient should be large; if events occur less frequently, the coefficient can be appropriately reduced to avoid overly weakening the impact of historical events;

[0087] The determination method of the global adjustment coefficient is as follows: First, it is determined according to the sensitivity of the business to security; for businesses with extremely high security requirements such as finance and military, in order to make the suspicion degree more accurately reflect threats, the global adjustment coefficient should be large; in ordinary business scenarios, the coefficient can be appropriately reduced; it can also be determined through simulation calculation and verification of a large amount of historical data; change the coefficient value in different scenarios, compare the calculation results with the actual security situation, and select the coefficient value that can make the suspicion degree most in line with the actual threat situation;

[0088] The way to determine the pre-set event type weights is as follows: The potential harm level of the event type is the key to determining the weights. For events that may cause serious consequences such as malware propagation and data theft, the weights should be set high; for events with relatively minor harms such as abnormal network connections, the weights can be set low. At the same time, refer to the general standards and experiences in the industry; draw on the weight settings of different event types in the same industry in a similar network environment and adjust them in combination with the characteristics of its own network and security policies.

[0089] To further optimize the above embodiments, the time decay function further introduces a segmented correction strategy, including:

[0090] When Δt ≤ T1, D(Δt) = 1;

[0091] When T1 < Δt ≤ T2,

[0092] When Δt > T2, D(Δt) = βe -λΔt ;

[0093] Wherein, T1 and T2 are event segmentation thresholds, and T1 < T2; α and β are preset correction coefficients, and α > 0, 0 < β < 1.

[0094] It should be noted that the way to determine the event segmentation thresholds is to first rely on the time characteristics of the impact of network security events. For different types of network security events, the changes in their impacts over time are different. For example, for some bursty DDoS attacks, the harm is extremely large in a short time and then quickly weakens. The first segmentation threshold T1 can be set to the relatively short duration that the attack usually lasts; for information dissemination after data leakage, the harm lasts for a long time, and the second segmentation threshold T2 should be determined in combination with the duration during which the data may be disseminated and utilized. It is also necessary to refer to the stability of the network environment. In a stable network environment, the changes in event impacts are relatively gentle, and the interval between segmentation thresholds can be appropriately widened; when the network environment fluctuates greatly, the threshold interval should be reduced to adjust the time decay effect in a timely manner.

[0095] The way to determine the preset correction coefficients is to consider the decay speed of the event impact over time. If the event impact weakens rapidly in the time period from T1 to T2, α should be set larger to make the decay function value drop rapidly; if the decay is relatively gentle, α is set smaller. When determining β, mainly consider the residual impact degree of the event after a long time. If the event still poses a certain threat even after a long time, β can be appropriately increased; if there is basically no threat after a long time, β should be reduced to ensure that the time decay function is more in line with the actual situation.

[0096] To further optimize the above embodiments, in step four, the process of performing segmented weighting or truncation processing on the data exceeding the threshold is as follows:

[0097] Set the suspicion degree I of the source IP quantity for the many-to-one relationship, with the minimum value I min and the maximum value I max , when I < I min , take I min , when I > I max , take I max , and take the actual value I in other cases.

[0098] It should be noted that from the perspective of network security risks, the minimum value I min should be set to the lowest acceptable risk suspicion degree value. For example, when a small number of source IPs initiate normal connection requests to a destination IP, even if there is a certain risk, but within the scope allowed by normal business, the suspicion degree at this time should be close to or slightly higher than I min . The maximum value I max corresponds to the suspicion degree under serious security threats. In scenarios such as large-scale DDoS attacks, where numerous source IPs maliciously attack a destination IP and the suspicion degree reaches an extremely high level, I max is set as the upper limit of the suspicion degree in such extreme attack scenarios to limit extremely high suspicion degree values.

[0099] Furthermore, by analyzing historical security event data, the distribution of suspicion degrees when source IPs of different scales attack a destination IP can be statistically analyzed. Find the minimum and maximum values of the suspicion degree in common attack scenarios, and use this as a reference to set I min and I max . If in past records, the lowest suspicion degree generated by small-scale abnormal connections is 0.3, then I min can be set to 0.3 or slightly lower; while the highest suspicion degree caused by large-scale malicious attacks reaches 0.95, I max can be set to 0.95 or slightly higher. At the same time, combined with the practical experience in the field of network security, referring to existing threshold setting cases in the same type of network environment, adjust according to the characteristics of its own network.

[0100] When setting the threshold, the system performance and computing resources should be taken into account. If the threshold is set too loosely, a large amount of abnormal data participates in the calculation, which will increase the system burden and reduce the analysis efficiency; if the threshold is too strict, valuable information may be lost. I min and I max should be set to effectively filter abnormal data under the computing pressure that the system can bear, ensuring the stability and accuracy of the analysis results. For example, when the computing resources of the system are limited, appropriately narrow the value range of I min and I max to reduce the amount of data processing; if the computing resources are sufficient, the threshold can be appropriately relaxed to obtain a more comprehensive analysis result.

[0101] To further optimize the above embodiments, in step five, the process of displaying the suspicion degree ranking in three dimensions specifically includes:

[0102] The event statuses of the same source and the same purpose are distinguished by colors. Red indicates unprocessed, green indicates processed, yellow indicates ignored, and blue indicates unaggregated;

[0103] When the number of events or IPs exceeds a preset threshold, an ellipsis icon is used for display, and detailed information can be expanded by clicking.

[0104] It should be noted that during implementation, the system first calculates the suspicion degree of each combination of the same source and the same purpose according to the number of events, levels, and corresponding weights and ranks them; during display, the event statuses are distinguished by colors. Red represents unprocessed events, which are highlighted to prompt users to pay attention first because of their potential threats; green indicates processed events, allowing users to understand the problems that have been solved; the yellow ignored events and blue unaggregated events also have their respective meanings; if the number of events exceeds the preset threshold, they are displayed as cloud icons in an ellipsis. Clicking on the cloud icon, through JavaScript or similar technologies, more event data is retrieved from the database for loading and display, and the original displayed events are converted into cloud icons to facilitate users to view all events;

[0105] The system calculates the cumulative sum of the suspicion degrees from the same source IP to different destination IPs and ranks them; during display, when the number of events between two IPs is 1, the event name and status color are directly displayed; if there are many events, they are represented by an event cloud; when the number of destination IPs exceeds the threshold, it is also omitted with a cloud icon. Clicking on the cloud icon, more destination IPs and corresponding event information are obtained and displayed through asynchronous loading technology. The display rules are similar to those of the same source and the same purpose, ensuring that users can quickly understand the security status between the source IP and multiple destination IPs;

[0106] The system calculates the cumulative sum of the suspicion degrees from different source IPs to the same destination IP and ranks them; during display, the display methods for different numbers of events between two IPs are the same as those in the above dimension; when the number of source IPs exceeds the threshold, a cloud icon is used for omission. Clicking on the cloud icon, more source IP data is obtained from the server for display through an Ajax request, facilitating users to view the impact of numerous source IPs on the same destination IP, effectively sorting out complex network relationships, and locating security risks.

[0107] To further optimize the above embodiments, in step five, the IP traceability layer is limited to 3 - 7 layers, and when it exceeds, the data of the earliest or farthest layer is automatically truncated.

[0108] It should be noted that limiting the IP traceability layer to 3 - 7 layers and setting automatic truncation of data when it exceeds is mainly to seek a balance among the requirements for traceability depth, system performance, and data accuracy.

[0109] IP traceability involves a large amount of data querying and analysis. With each additional layer of traceability, the computational complexity grows exponentially. Without restricting the number of layers, it consumes a huge amount of system resources such as CPU and memory, leading to an extremely slow response speed and affecting real-time performance. For example, in a large-scale network environment, if deep traceability is carried out without limitation, the system may be trapped in long-term calculations and unable to provide timely support for security decision-making. Limiting the number of layers to 3 - 7 can effectively control the occupation of computing resources and processing time, ensuring that the system can respond quickly and output traceability results in a timely manner.

[0110] As the number of traceability layers increases, the value of data from earlier or more distant layers for judging current security threats gradually decreases. Because the network environment is constantly changing, the network connections and events generated earlier may have little relevance to the current security issues. For example, a source IP access record from a week ago may no longer be able to reflect the current threat situation in the current network attack detection scenario. Truncating data beyond the number of layers can highlight the data closely related to the current security issues, enabling security analysts to focus more on recent and critical network activities and improving the effectiveness and accuracy of traceability results.

[0111] In actual network security analysis, security personnel usually focus on a few layers of network connections and events directly related to the current threat. Generally, a traceability depth of 3 - 7 layers is sufficient to help them discover the source, propagation path, and possible impact scope of the threat. For example, in the traceability of common DDoS attacks, through 3 - 7 layers of traceability, the main nodes initiating the attack and related abnormal activities can basically be located. This setting can not only meet the actual analysis needs but also avoid resource waste and information interference caused by excessive traceability.

[0112] To further optimize the above embodiments, in step five, the configurable items include single event weight, single event repetition times, weight of each event level, weight of event processing status, weight of event types, suspicion coefficient, value range of each relationship in one-to-many and many-to-one, maximum number of displayed events, maximum number of relationships, IP traceability layers, event display name, calculation period, event range; where the calculation period is an integer multiple of 5 - 60 minutes, and the event valid time range is configured synchronously with the calculation period.

[0113] It should be noted that assuming a network security protection scenario of an enterprise, to meet its specific security requirements, the following settings are made for the configurable items:

[0114] Single event weight: Considering that the core business of the enterprise involves a large amount of data transmission and data leakage events are extremely harmful, the weight of such single events is set to 4. Ordinary network connection anomaly events have relatively less harm, and the weight is set to 2.

[0115] Number of repetitions of a single event: Since the enterprise network is relatively stable in daily operations and the frequency of abnormal events is low, the number of repetitions of a single event is set to 50 times. If a certain abnormal event repeats 50 times, the system will pay special attention and increase its suspicion level.

[0116] Weights of each event level: The event levels are divided into three levels: high, medium, and low. The weight of a high-level data tampering event is set to 8, the weight of a medium-level port scanning event is set to 5, and the weight of a low-level general warning event is set to 2.

[0117] Weights of event handling status: The weight of an unhandled event is set to 5 to urge security personnel to handle it in a timely manner; the weight of a handled event is set to 2; the weight of an ignored event is set to 1; the weight of an unaggregated event is set to 3 because its information is incomplete and still needs attention.

[0118] Weights of event types: The weight of network intrusion events is set to 8, the weight of data anomaly events is set to 7, and the weights of other event types are set according to their impact on the enterprise's business.

[0119] Suspicion coefficient: To make the suspicion level more accurately reflect the threat level, considering the enterprise network scale and security policies, the suspicion coefficient is set to 2000.

[0120] Value range of each relationship in one-to-many and many-to-one: In a one-to-many relationship, the minimum value of each relationship is set to 40, and the maximum value is set to 1200; the value range of the many-to-one relationship is the same to adapt to the complex network connection situation of the enterprise.

[0121] Maximum number of displayed events and maximum number of relationships: In the display of the same source and the same destination, the maximum number of displayed events is set to 15; when displaying the same source but different destinations and different sources but the same destination, the maximum number of relationships is set to 15 to ensure a simple and prominent display interface.

[0122] Number of IP traceability layers: Considering the relatively complex enterprise network architecture, to deeply analyze security threats, the number of IP traceability layers is set to 6 layers.

[0123] Event display name: Select the event application name for display to facilitate non-professional security personnel to understand the meaning of the event and quickly locate problems.

[0124] Calculation period and event scope: The calculation period is set to 15 minutes, which can obtain new data in a timely manner without over-consuming system resources; the effective time range of events is synchronously set to the most recent 30 minutes to ensure the timeliness of the analysis data.

[0125] In this embodiment, the system analyzes events within the last 30 minutes with a 15-minute calculation cycle, calculates the suspicion degree according to each weight and value range, and presents the results through the set display method. Security personnel can quickly discover and handle network security threats based on the display information in combination with the traceability function, ensuring the network security of the enterprise.

[0126] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or perform equivalent replacements on some of the technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for suspected degree correlation analysis based on fuzzy scenario matching, characterized in that Including: Step 1: Obtain the original event data of security alarms, including source IP, destination IP, number of events, event level, event handling status, event type, and event timestamp; Step 2: Assign dynamically adjustable weight coefficients to the number of events, event level, event handling status, event type, number of source IPs, number of destination IPs, and time decay factor; Step 3: Based on the weight coefficients in Step 2, conduct a multi-dimensional comprehensive analysis of the association relationship between the source IP and the destination IP, calculate the time decay factor in combination with the event timestamp, accumulate the weighted results of each factor, and perform normalization processing to generate a suspicion value within the range of 0-1; the suspicion value represents the suspicion degree of the source IP for an attack threat; Step 4: Set the maximum threshold for the number of event repetitions and the quantity threshold for the relationship between the source IP and the destination IP, and perform segmented weighting or truncation processing on the data exceeding the threshold; Step 5: Display the suspicion ranking according to three dimensions of same source and same destination, same source and different destinations, and different sources and same destination, and implement forward traceability or backward traceability of the IP through click interaction; Step 6: Conduct incremental calculations according to a pre-set calculation cycle, only process newly added events within the cycle and integrate them with historical data, simultaneously set the valid time range of events to exclude expired data, and set configurable items to configure the correlation coefficients.

2. The method for analyzing the association of suspicion degree based on fuzzy scenario matching according to claim 1, wherein In Step 3, the weight calculation method for the number of events is as follows: When the number of events x ≤ max, the weight f(x) = a * x; when the number of events x > max, the weight f(x) = a * max; Where a is the weight coefficient of a single event, and max is the pre-set maximum threshold for the number of event repetitions.

3. The method for suspected degree correlation analysis based on fuzzy scenario matching according to claim 2, characterized in that, In Step 3, the weight calculation method for the event level is as follows: The event level is divided into multiple predefined levels, each level corresponds to a different weight value level, and is multiplied by the weight f(x) of the number of events to obtain the weighted result f(x) * level; where the values vary according to different event levels, and the weights are the same when the level is not considered.

4. A method for suspected degree correlation analysis based on fuzzy scenario matching according to claim 3, characterized in that In Step 3, the weight calculation method for the event handling status is as follows: According to the event handling status being one of processed, unprocessed, ignored, or unaggregated, different weight values are respectively assigned. The formula for the suspicion degree E of a single piece of data between two IPs is: E = f(x) * level * state Where state is the weight value of the event handling status.

5. The method for suspected degree correlation analysis based on fuzzy scenario matching according to claim 4, characterized in that, In Step 3, the process of calculating the time decay factor in combination with the event timestamp, accumulating the weighted results of each factor, and performing normalization processing is as follows: Based on the difference Δt between the event timestamp and the current time, define the time decay function D(Δt) = e -λΔt , where λ is a preset decay rate coefficient; this decay rate coefficient λ is set to a fixed value through configuration, and its value range is 0.001 - 0.1; Combine the time decay factor with the weighted results of the number of events, level, handling status, and type to calculate the suspicion degree I. The calculation formula is: Among them, E k is the basic suspicion degree of the k-th event, that is, E = f(x) * level * state; n is the total number of events, T k is the preset weight of the event type, F is the global adjustment coefficient, Δt k is the time difference of the k-th event; the hyperbolic tangent function tanh is used to control the value of the suspicion degree I between 0 and 1.

6. The method for suspected degree correlation analysis based on fuzzy scenario matching according to claim 5, wherein The time decay function further introduces a segmented correction strategy, including: When Δt ≤ T1, D(Δt) = 1; When T1 < Δt ≤ T2, When Δt > T2, D(Δt) = βe -λΔt ; Where T1 and T2 are event segmentation thresholds, and T1 < T2; α and β are pre-set correction coefficients, and α > 0, 0 < β < 1.

7. The suspected degree correlation analysis method based on fuzzy scenario matching according to claim 6, wherein In Step 4, the process of performing segmented weighting or truncation processing on the data exceeding the threshold is: Set the suspicion degree I of the source IP quantity for the many-to-one relationship to the minimum value I min and the maximum value I max When I < I min take I min When I > I max take I max and take the actual value I in other cases.

8. The method for analyzing the association of suspicion degrees based on fuzzy scenario matching according to claim 1, wherein In Step 5, the process of displaying the suspicion ranking in the three dimensions specifically includes: The event status of the same source and the same purpose is distinguished by colors: red for unprocessed, green for processed, yellow for ignored, and blue for unaggregated; When the number of events or IPs exceeds the preset threshold, an ellipsis icon is used for display, and the detailed information can be expanded by clicking.

9. A method for analyzing the association of suspicion degrees based on fuzzy scenario matching according to claim 8, characterized in that In Step 5, the IP traceability layer is limited to 3 - 7 layers, and when it exceeds, the data of the earliest or farthest layer is automatically truncated.

10. A method for suspected degree correlation analysis based on fuzzy scenario matching according to claim 9, characterized in that, In Step 5, the configurable items include single event weight, single event repetition times, weight of each event level, weight of event processing status, weight of event types, suspicion coefficient, value range of each relationship in one-to-many and many-to-one, maximum number of displayed events, maximum number of relationships, IP traceability layer, event display name, calculation period, event range; where the calculation period is an integer multiple of 5 - 60 minutes, and the event valid time range is configured synchronously with the calculation period.

Images