A Suspicion Correlation Analysis Method Based on Fuzzy Scene Matching

Abstract

The present invention provides a suspicion degree association analysis method based on fuzzy scene matching, comprising: obtaining original security alarm event data, assigning dynamic weights to multiple factors such as event quantity and level, and a time attenuation factor; performing a multi-dimensional comprehensive analysis, calculating the attenuation factor in combination with the timestamp, and accumulating the weighted results to generate a source IP attack threat suspicion degree value of 0-1; setting thresholds for the number of event repetitions and the number of IP relationships, and processing data exceeding the threshold; displaying suspicion degree rankings from three dimensions, such as the same source and the same destination, and supporting IP tracing; performing incremental calculations according to a preset calculation cycle, integrating new data with historical data, setting the effective time range of the event, and setting configurable items to adjust the correlation coefficient; the present invention significantly improves the accuracy, flexibility, and efficiency of network security threat detection and analysis by comprehensively calculating suspicion degrees from multiple factors, dynamically adjusting weight coefficients, optimizing data processing and display, enhancing tracing capabilities, and enriching configurable items.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a suspicion degree association analysis method based on fuzzy scene matching. Background Art

[0002] With the rapid development of the Internet, the network environment is becoming increasingly complex, and network attack methods are emerging in an endless stream. Network security threat detection and analysis has become a key link in ensuring network security. In the field of network security technology, network attack detection technology has experienced a development process from simple to complex, and from single function to comprehensive analysis. In the early days, it mainly relied on simple port scanning and intrusion detection systems (IDS). These systems are based on the basic principles of rule matching or anomaly detection and can identify some known simple attack patterns. However, when faced with diversified and complex attack methods, their detection capabilities are limited. With the rise of technologies such as big data and artificial intelligence, network security analysis has gradually developed in the direction of intelligence and integration. Big data technology enables security analysis systems to process massive amounts of network data and explore potential security threats. Artificial intelligence algorithms, such as machine learning and deep learning, are widely used in the classification and prediction of attack behaviors, significantly improving the accuracy and efficiency of detection. However, current network security threat detection and analysis technologies still have some problems that need to be solved.

[0003] Existing technologies often focus on a single or a few factors when analyzing network attack threats. For example, they judge the threat level based solely on the number of events or event levels, failing to fully consider multiple factors in network security alerts, such as the number of source IP addresses, the number of destination IP addresses, and the status of event processing. This results in an incomplete and inaccurate assessment of attack threats. In actual network environments, the impact of different factors on network security threats varies with time, network topology, business needs, and other factors. However, most existing technologies use fixed weights to calculate each factor, making it difficult to dynamically adjust the weights based on actual conditions. This makes it difficult to adapt to complex and changing network environments, reducing the flexibility and adaptability of the detection system.

[0004] With the explosive growth of network data, efficiently processing and displaying massive amounts of security data has become a challenge. Existing technologies lack effective threshold processing and data display strategies when processing large amounts of security alarm data. For data exceeding a certain scale, problems such as low analysis efficiency and confusing display are prone to occur, making it difficult for security managers to quickly and accurately obtain key information and make timely decisions. Different network environments and business scenarios have different requirements for network security detection and analysis, but existing technologies have limited configuration options, making it difficult to flexibly configure the system according to specific needs. This makes it difficult to fully meet diverse security needs, limiting the application effectiveness of network security technology in different scenarios.

[0005] Therefore, this field urgently needs a suspicion correlation analysis method based on fuzzy scene matching to solve the above problems. Summary of the Invention

[0006] The present invention provides a suspicion degree association analysis method based on fuzzy scene matching. By integrating multiple factors to calculate suspicion degree, dynamically adjusting weight coefficients, optimizing data processing and display, enhancing traceability capabilities, and enriching configurable items, it effectively solves the problems existing in the above-mentioned existing technologies and significantly improves the accuracy, flexibility, and efficiency of network security threat detection and analysis.

[0007] The present invention provides a suspicion degree association analysis method based on fuzzy scene matching, comprising:

[0008] Step 1: Obtain the original event data of the security alarm, including source IP, destination IP, event number, event level, event processing status, event type, and event timestamp;

[0009] Step 2: assign dynamically adjustable weight coefficients to the number of events, event level, event processing status, event type, number of source IPs, number of destination IPs, and time decay factor;

[0010] Step 3: Based on the weight coefficients from step 2, a multi-dimensional comprehensive analysis is performed on the association between the source IP and the destination IP. The time decay factor is calculated based on the event timestamp. The weighted results of each factor are accumulated and normalized to generate a suspicion value in the range of 0-1. The suspicion value represents the suspicion of the attack threat at the source IP.

[0011] Step 4: Set the maximum threshold for the number of event repetitions and the number of source IP and destination IP relationships, and perform segmented weighting or truncation processing on data that exceeds the threshold;

[0012] Step 5: Display suspicion rankings based on three dimensions: same source and same purpose, same source but different purposes, and different sources but same purpose. Enable forward or backward IP tracing through clickable interactions.

[0013] Step 6: Perform incremental calculations according to the preset calculation cycle, only process new events within the cycle and integrate them with historical data. At the same time, set the event validity time range to exclude expired data, and set configurable items to configure the correlation coefficient.

[0014] According to a suspicion degree association analysis method based on fuzzy scene matching provided by the present invention, in step three, the weight calculation method of the number of events is:

[0015] When the number of events x≤max, the weight f(x)=a*x; when the number of events x>max, the weight f(x)=a*max;

[0016] Where a is the weight coefficient of a single event, and max is the preset maximum number of event repetition thresholds.

[0017] According to a suspicion degree association analysis method based on fuzzy scene matching provided by the present invention, in step three, the weight calculation method of the event level is:

[0018] The event level is divided into multiple predefined levels, each corresponding to a different weight level, and multiplied by the weight f(x) of the number of events to obtain the weighted result of the event level f(x)*level; the value varies depending on the event level, and the weight is the same when the level is not considered.

[0019] According to a suspicion degree association analysis method based on fuzzy scene matching provided by the present invention, in step three, the weight calculation method of the event processing status is:

[0020] Different weights are assigned based on the event processing status: processed, unprocessed, ignored, or unaggregated. The formula E for calculating the suspicion of a single piece of data between two IP addresses is:

[0021] E=f(x)*level*state

[0022] Among them, state is the weight of the event processing state.

[0023] According to a suspicion degree association analysis method based on fuzzy scene matching provided by the present invention, in step three, the process of calculating the time decay factor in combination with the event timestamp, accumulating the weighted results of each factor and normalizing them is as follows:

[0024] Based on the difference Δt between the event timestamp and the current time, define the time decay function D(Δt)=e -λΔt , where λ is a preset attenuation rate coefficient; the attenuation rate coefficient λ is set to a fixed value through configuration, and the value range is 0.001-0.1;

[0025] The time decay factor is combined with the weighted results of the number of events, level, processing status and type to calculate the suspicion level I. The calculation formula is:

[0026]

[0027] Among them, E k is the basic suspicion of the kth event, that is, E = f(x)*level*state; n is the total number of events, T k is the pre-set event type weight, F is the global adjustment coefficient, Δt kThe time difference for the k-th event; the hyperbolic tangent function tanh is used to control the value of the suspicion degree I between 0 and 1.

[0028] According to a suspicion degree correlation analysis method based on fuzzy scenario matching provided by the present invention, the time decay function further introduces a segmented correction strategy, including:

[0029] When Δt ≤ T1, D(Δt) = 1;

[0030] When T1 < Δt ≤ T2,

[0031] When Δt > T2, D(Δt) = βe -λΔt ;

[0032] Where, T1 and T2 are event segmentation thresholds, and T1 < T2; α and β are preset correction coefficients, and α > 0, 0 < β < 1.

[0033] According to a suspicion degree correlation analysis method based on fuzzy scenario matching provided by the present invention, in step four, the process of performing segmented weighting or truncation processing on data exceeding the threshold is as follows:

[0034] For the suspicion degree I of the number of source IPs in a many-to-one relationship, set the minimum value I min and the maximum value I max , when I < I min take I min , when I > I max take I max , and take the actual value I in other cases.

[0035] According to a suspicion degree correlation analysis method based on fuzzy scenario matching provided by the present invention, in step five, the process of displaying the suspicion degree ranking in the three dimensions specifically includes:

[0036] The event status of the same source and the same destination is distinguished by colors, red for unprocessed, green for processed, yellow for ignored, and blue for unaggregated;

[0037] When the number of events or IPs exceeds the preset threshold, an ellipsis icon is used for display, and detailed information can be expanded after clicking.

[0038] According to a suspicion degree correlation analysis method based on fuzzy scenario matching provided by the present invention, in step five, the IP traceability layer is limited to 3 - 7 layers, and when it exceeds, the data of the earliest or farthest layer is automatically truncated.

[0039] According to a suspicion association analysis method based on fuzzy scene matching provided by the present invention, in step five, the configurable items include the weight of a single event, the number of repetitions of a single event, the weight of each event level, the weight of the event processing status, the weight of the event type, the suspicion coefficient, the value range of each relationship in one-to-many and many-to-one, the maximum number of displayed events, the maximum number of relationships, the number of IP tracing layers, the event display name, the calculation cycle, and the event range; wherein the calculation cycle is an integer multiple of 5-60 minutes, and the event effective time range is configured synchronously with the calculation cycle.

[0040] Compared with the prior art, the present invention has the following advantages:

[0041] 1. Existing technologies often focus on a single or a few factors in assessing network attack threats. This invention calculates suspicion by integrating multiple factors, including source IP, destination IP, number of events, level, processing status, and type. It also considers the timeliness of events by incorporating a time decay factor. For example, when calculating the weight of the number of events, different calculation rules are used for different number ranges, allowing for a comprehensive and accurate assessment of attack threats and reducing false positives and missed detections.

[0042] 2. The existing technology has fixed weights and is difficult to adapt to complex and changing network environments; the present invention assigns dynamic and adjustable weight coefficients to each factor, which can be adjusted in real time according to changes in network topology and business needs, thereby improving the flexibility and adaptability of the detection system and better responding to security threats in different scenarios.

[0043] 3. Faced with massive amounts of security data, the present invention sets thresholds to handle excess data, such as setting a maximum stable data value for the suspicion level of the number of source IP addresses in a many-to-one relationship; in terms of display, the suspicion level ranking is displayed from multiple dimensions, and event status is distinguished by color. Exceeding the threshold is handled with an omission icon, and click to view details, making it easier for security managers to quickly obtain key information.

[0044] 4. Existing tracing technology is insufficient in depth and breadth. This invention supports forward and backward IP tracing, and limits the number of reasonable tracing layers. It can comprehensively track attack paths from multiple dimensions, accurately locate the source of threats, and help users take targeted protective measures.

[0045] 5. The existing technology has limited configuration options and cannot meet diverse needs. The present invention provides a rich set of configurable items, covering various weights, value ranges, calculation cycles, etc. Users can flexibly configure the system according to actual needs to improve the application effect in different network environments and business scenarios.

[0046] Other features and advantages of the present invention will be described in the following description, and in part will become apparent from the description, or will be understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description and the accompanying drawings.

[0047] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention.

[0049] In the attached figure:

[0050] Figure 1 The figure is a flow chart of a method for suspicion correlation analysis based on fuzzy scene matching provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0051] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0052] Example 1:

[0053] The embodiment of the present invention provides a suspicion degree association analysis method based on fuzzy scene matching, please refer to Figure 1 ,include:

[0054] Step 1: Obtain the original event data of the security alarm, including source IP, destination IP, event number, event level, event processing status, event type, and event timestamp;

[0055] Step 2: assign dynamically adjustable weight coefficients to the number of events, event level, event processing status, event type, number of source IPs, number of destination IPs, and time decay factor;

[0056] Step 3: Based on the weight coefficients from Step 2, a multi-dimensional comprehensive analysis of the relationship between the source IP and the destination IP is performed. The time decay factor is calculated based on the event timestamp. The weighted results of each factor are accumulated and normalized to generate a suspicion value in the range of 0-1. The suspicion value represents the suspicion of the attack threat at the source IP.

[0057] Step 4: Set the maximum threshold for the number of event repetitions and the number of source IP and destination IP relationships, and perform segmented weighting or truncation processing on data that exceeds the threshold;

[0058] Step 5: Display suspicion rankings based on three dimensions: same source and same purpose, same source but different purposes, and different sources but same purpose. Enable forward or backward IP tracing through clickable interactions.

[0059] Step 6: Perform incremental calculations according to the preset calculation cycle, only process new events within the cycle and integrate them with historical data. At the same time, set the event validity time range to exclude expired data, and set configurable items to configure the correlation coefficient.

[0060] The principle and beneficial effects of this embodiment are: based on a comprehensive consideration of multiple factors and a dynamic analysis mechanism. First, the original event data of security alarms covering a variety of key information is obtained to provide a comprehensive basis for subsequent analysis. Then, dynamically adjustable weight coefficients are assigned to multiple factors related to security threats so that the importance of each factor can be flexibly adjusted according to the actual network environment. Then, the correlation between the source IP and the destination IP is comprehensively analyzed from multiple dimensions, the time decay factor is calculated in combination with the event timestamp, and the weighted results of each factor are accumulated and normalized to obtain a suspicion value representing the threat level of the source IP attack. During the data processing process, a threshold is set to perform segmented weighting or truncation processing on data that exceeds the range to ensure the stability of the analysis results. The suspicion ranking is displayed through specific dimensions, and an IP tracing function is provided to facilitate users to understand the network security status and threat path. Finally, an incremental calculation method is adopted to process new events and integrate historical data on a periodic basis. At the same time, a time range is set to exclude expired data, and configurable items are set to enhance the adaptability and flexibility of the system.

[0061] To further optimize the above embodiment, in step 3, the weight of the number of events is calculated as follows:

[0062] When the number of events x≤max, the weight f(x)=a*x; when the number of events x>max, the weight f(x)=a*max;

[0063] Where a is the weight coefficient of a single event, and max is the preset maximum number of event repetition thresholds.

[0064] It should be noted that in the network security threat analysis scenario, the determination of the weight coefficient a of a single event and the preset maximum event repetition threshold max requires comprehensive consideration of multiple factors, aiming to allow the event quantity factor to more accurately reflect the actual threat level in the suspicion calculation.

[0065] Determining the weight coefficient a for a single event requires first analyzing the event type. Different types of security incidents have varying degrees of harm and potential threats. For example, attacks targeting core data pose a significant threat, so the weight coefficient a should be set high. Common port scans, however, pose relatively little risk, so the weight coefficient a can be set low. Furthermore, considering the network environment, high-security networks, such as financial and military networks, are highly sensitive to security incidents, so a should be increased. Common office networks, with lower security requirements, can appropriately reduce a. Historical data can also be used to analyze the severity of security issues caused by similar incidents. If a particular type of incident frequently leads to serious consequences, the weight coefficient a should be increased; otherwise, it should be reduced.

[0066] The preset maximum event repetition threshold (max) should be determined based on network traffic characteristics. For networks with high traffic and frequent events, the max value can be set high; for networks with low traffic and few events, the max value can be set low. System performance should also be considered. If the system has limited computing resources, the max value should not be set too high to avoid excessive computational overhead that could impact performance. If computing resources are sufficient, the max value can be appropriately increased. Furthermore, consider industry standards and best practices, draw on successful experiences and standard settings in similar network environments or business scenarios, and then fine-tune the value based on the actual situation of your network to determine an appropriate max value.

[0067] To further optimize the above embodiment, in step 3, the weight of the event level is calculated as follows:

[0068] The event level is divided into multiple predefined levels, each corresponding to a different weight level, and multiplied by the weight f(x) of the number of events to obtain the weighted result of the event level f(x)*level; the value varies depending on the event level, and the weight is the same when the level is not considered.

[0069] It should be noted that the weights corresponding to different levels of incidents need to be determined based on a comprehensive consideration of multiple factors to accurately reflect the impact of incidents of different levels on network security threats. The details are as follows:

[0070] Consider the actual harm an incident poses to network security. If an incident can directly lead to system downtime or the leakage of sensitive information, such as a high-level hacker intrusion, the incident's severity is high, and its weight should be higher. Low-risk, general warning incidents, which merely indicate a potential security risk but haven't yet caused actual damage, should have a lower weight. This way, the weight is proportional to the severity of the incident, highlighting the importance of serious incidents in the suspicion calculation.

[0071] Referencing common industry standards, different industries have their own grading standards for cybersecurity incidents, such as the financial industry's grading of data breaches and the healthcare industry's grading of patient information security incidents. You can refer to the definitions and descriptions of incidents at different levels in these industry standards and determine appropriate weights based on your own cybersecurity analysis needs. This ensures that the weights are universal and comparable across the industry, making the analysis results more valuable.

[0072] Based on historical data and experience, we review various cybersecurity incidents that have occurred throughout history and analyze the actual consequences and frequency of incidents at different levels. If incidents of a certain level frequently cause serious security incidents, the corresponding weight should be appropriately increased; conversely, if incidents of a certain level rarely cause serious problems, the weight can be reduced. By analyzing historical data and summarizing experience, we can make weight settings more relevant to the actual network environment, enhancing their rationality and effectiveness.

[0073] Consider the criticality of the business system where the incident occurred, taking into account business criticality. Security incidents in systems supporting core business operations have a greater impact, and their weight should be higher than incidents in non-critical business systems of the same level. For example, a security incident in an e-commerce platform's transaction processing system would be weighted higher than a similar incident in an internal office automation system, ensuring stronger security protection for critical business operations.

[0074] To further optimize the above embodiment, in step 3, the weight of the event processing status is calculated as follows:

[0075] Different weights are assigned based on the event processing status: processed, unprocessed, ignored, or unaggregated. The formula E for calculating the suspicion of a single piece of data between two IP addresses is:

[0076] E=f(x)*level*state

[0077] Among them, state is the weight of the event processing state.

[0078] It should be noted that unprocessed events have not yet been addressed and pose a greater potential threat, so their weight should be higher, such as 4; processed events have their risks under control and their weight is lower, set to 3; ignored events are actively chosen not to be processed and may have a lower risk, so their weight can be set to 1; unaggregated events have incomplete data integration and are difficult to assess risks, so their weight is set to 2;

[0079] The weight is determined by the urgency of the processing. Unprocessed events are the most urgent to be processed, have the highest priority, and have a large weight; processed events have the lowest priority, and have a small weight; ignored events are actively shelved, have a low priority, and have a small weight; unaggregated events have a lower priority than unprocessed events due to insufficient information, and have a weight in the middle range.

[0080] Unprocessed events will have a greater impact on subsequent analysis because of their high uncertainty and high weight; processed events have less impact and low weight; ignored events are ignored but may hide risks and have moderate weight; unaggregated events have incomplete data and their impact is between unprocessed and processed events, so the weight is set accordingly.

[0081] To further optimize the above embodiment, in step 3, the time decay factor is calculated in combination with the event timestamp, and the weighted results of each factor are accumulated and normalized as follows:

[0082] Based on the difference Δt between the event timestamp and the current time, define the time decay function D(Δt)=e -λΔt , where λ is a preset attenuation rate coefficient; the attenuation rate coefficient λ is set to a fixed value through configuration, and the value range is 0.001-0.1;

[0083] The time decay factor is combined with the weighted results of the number of events, level, processing status and type to calculate the suspicion level I. The calculation formula is:

[0084]

[0085] Among them, E k is the basic suspicion of the kth event, that is, E = f(x)*level*state; n is the total number of events, T k is the pre-set event type weight, F is the global adjustment coefficient, Δt k is the time difference of the kth event; the hyperbolic tangent function tanh is used to control the value of the suspicion degree I between 0 and 1.

[0086] It should be noted that the configuration rules for the decay rate coefficient are as follows: the stability of the network environment is an important basis for configuration; in a stable network environment, security threats change slowly, and the decay rate coefficient can be set to a small value, such as 0.001-0.01, to ensure that historical events retain a certain impact for a longer period of time; in cases where the network environment changes frequently and attack methods are updated quickly, the coefficient should be increased to 0.05-0.1 to quickly decay the impact of events and pay more attention to recent events; the average frequency of events must also be considered; if events occur frequently, the decay rate coefficient should be large to highlight the importance of new events; if events occur less frequently, the coefficient can be appropriately reduced to avoid excessively weakening the impact of historical events;

[0087] The global adjustment coefficient is determined by first determining it based on the security sensitivity of the business. For businesses with extremely high security requirements, such as finance and the military, the global adjustment coefficient should be larger to make the suspicion level more accurately reflect the threat. In ordinary business scenarios, the coefficient can be appropriately reduced. Simulation calculations and verification can also be performed using a large amount of historical data. The coefficient value is changed in different scenarios, and the calculation results are compared with the actual security situation to select the coefficient value that best matches the actual threat situation.

[0088] The method for determining the preset event type weights is as follows: The potential harm level of the event type is the key to determining the weights. For events that may cause serious consequences, such as malware propagation and data theft, the weights should be set high; for events with relatively minor harms, such as abnormal network connections, the weights can be set low. At the same time, refer to the general standards and experiences in the industry; draw on the weight settings of different event types in the same industry under similar network environments, and adjust them in combination with the characteristics of its own network and security policies.

[0089] To further optimize the above embodiments, the time decay function further introduces a piecewise correction strategy, including:

[0090] When Δt ≤ T1, D(Δt) = 1;

[0091] When T1 < Δt ≤ T2,

[0092] When Δt > T2, D(Δt) = βe -λΔt ;

[0093] where, T1 and T2 are event segmentation thresholds, and T1 < T2; α and β are preset correction coefficients, and α > 0, 0 < β < 1.

[0094] It should be noted that the method for determining the event segmentation thresholds is to first rely on the time characteristics of the impact of network security events. For different types of network security events, the impact changes over time differently. For example, for some bursty DDoS attacks, the harm is extremely large in a short time and then rapidly weakens. The first segmentation threshold T1 can be set as the relatively short duration that the attack usually lasts; for the information dissemination after data leakage, the harm lasts for a long time, and the second segmentation threshold T2 should be determined in combination with the duration during which the data may be disseminated and utilized. It is also necessary to refer to the stability of the network environment. In a stable network environment, the change of the event impact is relatively gentle, and the interval of the segmentation thresholds can be appropriately enlarged; when the network environment fluctuates greatly, the threshold interval should be reduced to adjust the time decay effect in a timely manner.

[0095] The method for determining the preset correction coefficients is to consider the decay speed of the event impact over time. If the event impact weakens rapidly in the time period from T1 to T2, α should be set larger to make the decay function value drop rapidly; if the decay is relatively gentle, α is set smaller. When determining β, mainly consider the residual impact degree of the event after a long time. If the event still has a certain threat even after a long time, β can be appropriately increased; if there is basically no threat after a long time, β should be reduced to ensure that the time decay function is more in line with the actual situation.

[0096] To further optimize the above embodiments, in step four, the process of performing piecewise weighting or truncation processing on the data exceeding the threshold is as follows:

[0097] For the suspicion degree I of the number of source IPs in a many-to-one relationship, set a minimum value I min With the maximum value I max , when I min Time I min , when I>I max Time I max , otherwise take the actual value I.

[0098] It should be noted that, from the perspective of network security risk, the minimum value I min It should be set to the lowest acceptable risk suspicion value. For example, when a small number of source IPs initiate normal connection requests to a destination IP, even if there is a certain risk, within the scope of normal business, the suspicion level should be close to or slightly higher than I. min Maximum value I max This corresponds to the suspicion level under serious security threats. For example, in a large-scale DDoS attack scenario, many source IPs launch malicious attacks on a destination IP, and the suspicion level reaches an extremely high level. max It is set as the upper limit of suspicion in such extreme attack scenarios to limit abnormally high suspicion values.

[0099] Furthermore, by analyzing historical security event data, we can statistically analyze the distribution of suspicion when different scale source IPs attack the target IP. Find the minimum and maximum suspicion values ​​in common attack scenarios and use them as a reference to set I min and I max If in the past records, the suspicion level of small-scale abnormal connections is as low as 0.3, then I min It can be set to 0.3 or slightly lower; the suspicion level caused by large-scale malicious attacks can reach up to 0.95. max The threshold can be set to 0.95 or slightly higher. Consider practical experience in network security and refer to existing threshold setting examples in similar network environments to adjust based on your network characteristics.

[0100] When setting the threshold, it is necessary to consider both system performance and computing resources. If the threshold is set too loosely, a large amount of abnormal data will be involved in the calculation, which will increase the system burden and reduce the analysis efficiency; if the threshold is too strict, valuable information may be lost. min and I max The setting of I should ensure that the abnormal data can be effectively filtered under the computing pressure that the system can bear, and the stability and accuracy of the analysis results can be guaranteed. For example, when the computing resources of the system are limited, it is appropriate to reduce the I min and I max The value range of can be narrowed to reduce the amount of data processing; if computing resources are sufficient, the threshold can be appropriately relaxed to obtain more comprehensive analysis results.

[0101] ​To further optimize the above embodiment, in step 5, the process of displaying the suspicion rankings in three dimensions specifically includes:

[0102] The status of events with the same source and purpose are distinguished by color: red for unprocessed, green for processed, yellow for ignored, and blue for unaggregated;

[0103] When the number of events or IPs exceeds the preset threshold, an omission icon is used to display the information. Click it to expand the detailed information.

[0104] It should be noted that during implementation, the system first calculates the suspicion level of each combination of the same source and purpose based on the number of events, level, and corresponding weight, and ranks them. When displaying, the system uses colors to distinguish event status. Red represents unprocessed events, which are potential threats and are a prominent reminder for users to pay attention to them first. Green represents processed events, letting users know that the problem has been solved. Yellow ignores events and blue does not aggregate events. If the number of events exceeds the preset threshold, they are omitted from display with a cloud icon. Clicking the cloud icon will load more event data from the database through JavaScript or similar technologies, and convert the original displayed events into cloud icons to facilitate users to view all events.

[0105] The system calculates the cumulative suspicion of the same source IP to different destination IPs and ranks them. When displaying, if the number of events between two IPs is 1, the event name and status color are directly displayed; if the number of events is large, an event cloud is used to represent it. When the number of destination IPs exceeds the threshold, it is also omitted with a cloud icon. Clicking the cloud icon uses asynchronous loading technology to obtain and display more destination IPs and corresponding event information. The display rules are similar to those for the same source and destination, ensuring that users can quickly understand the security status between the source IP and multiple destination IPs.

[0106] The system calculates the cumulative suspicion of different source IPs to the same destination IP and ranks them. When displaying, the different number of events between two IPs is displayed in the same way as the above dimensions. When the number of source IPs exceeds the threshold, it is omitted using the cloud icon. Click the cloud icon to obtain more source IP data from the server through Ajax request, making it easier for users to view the impact of multiple source IPs on the same destination IP, effectively sorting out complex network relationships, and locating security risks.

[0107] In order to further optimize the above embodiment, in step five, the number of IP traceability layers is limited to 3-7 layers, and the data of the earliest or farthest layer is automatically truncated when it exceeds the limit.

[0108] It should be noted that limiting the number of IP tracing layers to 3-7 layers and setting automatic data truncation when exceeding the limit is mainly to seek a balance between the tracing depth requirements, system performance and data accuracy.

[0109] IP traceability involves extensive data query and analysis. With each additional layer of traceability, the computational effort increases exponentially. Unrestricted layers consume significant system resources, such as CPU and memory, leading to extremely slow response times and impacting real-time performance. For example, in large-scale networks, unlimited deep traceability can cause the system to become bogged down in lengthy computations, preventing it from providing timely support for security decisions. Limiting the number of layers to 3-7 effectively controls computing resource usage and processing time, ensuring rapid system response and timely output of traceability results.

[0110] As the number of traceability layers increases, the value of data from earlier or more distant layers for assessing current security threats gradually decreases. Because the network environment is constantly changing, older network connections and events may not be closely related to current security issues. For example, access records from a source IP address from a week ago may no longer reflect the current threat situation in the current network attack detection scenario. Truncating data beyond the specified number of layers can highlight data closely related to the current security issue, allowing security analysts to focus more on recent and critical network activity, and improving the effectiveness and accuracy of traceability results.

[0111] In actual network security analysis, security personnel typically focus on a few network connections and events directly related to the current threat. Generally, tracing at layers 3-7 is sufficient to help them identify the threat's source, propagation path, and potential impact. For example, in common DDoS attack tracing, tracing at layers 3-7 can essentially locate the primary attack node and related abnormal activity. This setup not only meets actual analysis needs but also avoids the waste of resources and information interference caused by excessive tracing.

[0112] In order to further optimize the above embodiment, in step five, the configurable items include the weight of a single event, the number of repetitions of a single event, the weight of each event level, the weight of the event processing status, the weight of the event type, the suspicion coefficient, the value range of each relationship in one-to-many and many-to-one, the maximum number of displayed events, the maximum number of relationships, the number of IP tracing layers, the event display name, the calculation cycle, and the event range; the calculation cycle is an integer multiple of 5-60 minutes, and the event effective time range is configured synchronously with the calculation cycle.

[0113] It should be noted that, assuming an enterprise's network security protection scenario, to meet its specific security needs, the configurable items are set as follows:

[0114] Single event weight: Considering that core business operations involve large amounts of data transmission, data leaks are extremely harmful, so the weight of such single events is set to 4. Ordinary network connection anomalies are relatively less harmful, so the weight is set to 2.

[0115] Single event repetition count: Enterprise networks are generally stable, and abnormal events occur less frequently. The single event repetition count is set to 50. If an abnormal event recurs 50 times, the system will pay close attention and increase its suspicion level.

[0116] Event weighting: Events are categorized into three levels: high, medium, and low. A high-level data tampering event has a weight of 8, a medium-level port scan event has a weight of 5, and a low-level general warning event has a weight of 2.

[0117] Event processing status weight: The weight of unprocessed events is set to 5 to urge security personnel to handle them in a timely manner; the weight of processed events is set to 2; the weight of ignored events is set to 1; the weight of unaggregated events is set to 3 because their information is incomplete and still requires attention.

[0118] Event type weight: Network intrusion events are weighted 8, data anomaly events are weighted 7, and other event types are weighted based on their impact on the enterprise's business.

[0119] Suspicion coefficient: To make the suspicion degree more accurately reflect the threat level, the suspicion degree coefficient is set to 2000 based on the enterprise network scale and security policy.

[0120] The value range for each relationship in one-to-many and many-to-one relationships: In one-to-many relationships, the minimum value for each relationship is set to 40 and the maximum value is set to 1200; the value for many-to-one relationships is the same to adapt to the complex network connection situation of the enterprise.

[0121] Maximum number of display events and maximum number of relationships: In the display of the same source and the same purpose, the maximum number of display events is set to 15; when displaying the same source but different purposes or different sources but the same purpose, the maximum number of relationships is set to 15, ensuring that the display interface is simple and the key points are highlighted.

[0122] Number of IP tracing layers: Given the relatively complex enterprise network architecture, the number of IP tracing layers is set to 6 to enable in-depth analysis of security threats.

[0123] Event display name: Select the event application name to display, which makes it easier for non-professional security personnel to understand the meaning of the event and quickly locate the problem.

[0124] Calculation cycle and event range: The calculation cycle is set to 15 minutes, which can obtain new data in a timely manner without excessively consuming system resources; the event effective time range is synchronously set to the last 30 minutes to ensure the timeliness of analysis data.

[0125] In this embodiment, the system analyzes events within the past 30 minutes using a 15-minute calculation cycle, calculates suspicion based on various weights and value ranges, and presents the results using a predefined display method. Security personnel can use this information, combined with traceability, to quickly identify and address network security threats, ensuring enterprise network security.

[0126] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A suspicion correlation analysis method based on fuzzy scene matching, characterized in that: Including: Step 1: Obtain the original event data of security alarms, including source IP, destination IP, number of events, event level, event handling status, event type, and event timestamp; Step 2: Assign dynamically adjustable weight coefficients to the number of events, event level, event handling status, event type, number of source IPs, number of destination IPs, and time decay factor; Step 3: Based on the weight coefficients in Step 2, conduct a multi-dimensional comprehensive analysis of the association relationship between the source IP and the destination IP, calculate the time decay factor in combination with the event timestamp, accumulate the weighted results of each factor, and perform normalization processing to generate a suspicion value within the range of 0-1; The suspicion value represents the suspicion degree of the source IP as an attack threat; Step 4: Set the maximum threshold for the number of event repetitions and the quantity threshold for the association relationship between the source IP and the destination IP, and perform segmented weighting or truncation processing on the data exceeding the threshold; Step 5: Display the suspicion ranking according to three dimensions of same source and same destination, same source and different destinations, and different sources and same destination, and implement forward or backward tracing of the IP through click interaction; Step 6: Perform incremental calculation according to a preset calculation period, only process the newly added events within the period and integrate them with historical data, and at the same time set the effective time range of the events to exclude expired data, and set configurable items to configure relevant parameters.

2. The method for suspicious degree association analysis based on fuzzy scene matching according to claim 1, characterized in that: In Step 3, the weight calculation method for the number of events is: When the number of events x ≤ max, the weight f(x) = a * x; when the number of events x > max, the weight f(x) = a * max; Where, a is the weight coefficient of a single event, and max is the preset maximum threshold for the number of event repetitions.

3. The method for suspicious degree association analysis based on fuzzy scene matching according to claim 2, characterized in that: In Step 3, the weight calculation method for the event level is: The event level is divided into multiple predefined levels, each level corresponds to a different weight value level, and is multiplied by the weight f(x) of the number of events to obtain the weighted result f(x) * level of the event level; where the values are different according to different event levels, and the weights are the same when the level is not considered.

4. The method for suspicious degree association analysis based on fuzzy scene matching according to claim 3, characterized in that: In Step 3, the weight calculation method for the event handling status is: According to the event handling status being one of processed, unprocessed, ignored, or unaggregated, different weight values are respectively assigned. The formula for the suspicion degree E of a single piece of data between two IPs is: E = f(x) * level * state Where, state is the weight value of the event handling status.

5. The method for suspicious degree association analysis based on fuzzy scene matching according to claim 4, characterized in that: In Step 3, the process of calculating the time decay factor in combination with the event timestamp, accumulating the weighted results of each factor, and performing normalization processing is: Based on the difference Δt between the event timestamp and the current time, define the time decay function D(Δt)=e -λΔt , where λ is a preset attenuation rate coefficient; the attenuation rate coefficient λ is set to a fixed value through configuration, and the value range is 0.001-0.1; Combine the time decay factor with the weighted results of the number of events, level, handling status, and type to calculate the suspicion degree I. The calculation formula is: Among them, E k is the basic suspicion of the kth event, that is, E = f(x)*level*state; n is the total number of events, T k is the pre-set event type weight, F is the global adjustment coefficient, Δt k is the time difference of the kth event; the hyperbolic tangent function tanh is used to control the value of the suspicion degree I between 0 and 1.

6. The method for suspicious degree association analysis based on fuzzy scene matching according to claim 5, characterized in that: The time decay function further introduces a segmented correction strategy, including: When Δt ≤ T1, D(Δt) = 1; When T1<Δt≤T2, When Δt>T2, D(Δt)=βe -λΔt ; Where, T1 and T2 are event segmentation thresholds, and T1 < T2; α and β are preset correction coefficients, and α > 0, 0 < β < 1.

7. The method for suspicious degree association analysis based on fuzzy scene matching according to claim 6, characterized in that: In Step 4, the process of performing segmented weighting or truncation processing on the data exceeding the threshold is: For the suspicion degree I of the number of source IPs in a many-to-one relationship, set a minimum value I min With the maximum value I max , when I min Time I min , when I>I max Time I max , otherwise take the actual value I.​ 8. The method for suspicious degree association analysis based on fuzzy scene matching according to claim 1, characterized in that: In Step 5, the process of displaying the suspicion ranking in the three dimensions specifically includes: First, the suspicion level of each combination of the same source and purpose is calculated and ranked based on the number of events, level, and corresponding weight. When displaying, the event status is distinguished by color. Red represents unprocessed events, which are potential threats and clearly remind users to pay attention to them first. Green represents processed events, letting users know that the problem has been resolved. Yellow ignores events and blue does not aggregate events. If the number of events exceeds the preset threshold, they are omitted from display with a cloud icon. Clicking the cloud icon will load more event data from the database and convert the original displayed events to cloud icons, making it easier for users to view all events. The suspicion levels of connections from the same source IP to different destination IPs are calculated and ranked. When displaying events, if the number of events between two IPs is 1, the event name and status color are directly displayed. If the number of events is large, an event cloud is used to represent it. When the number of destination IPs exceeds the threshold, a cloud icon is used to omit them. Clicking the cloud icon uses asynchronous loading technology to retrieve and display more destination IPs and corresponding event information. The display rules are the same as for the same source and same destination, ensuring that users can quickly understand the security status between the source IP and multiple destination IPs. The suspicion levels of different source IPs to the same destination IP are calculated and ranked. When displaying events between two IPs, the display method is the same as the above dimensions. When the number of source IPs exceeds the threshold, the cloud icon is used to omit them. Clicking the cloud icon will use Ajax requests to obtain more source IP data from the server. This allows users to easily view the impact of multiple source IPs on the same destination IP, effectively sort out complex network relationships, and locate security risks. When the number of events or IPs exceeds the preset threshold, an omission icon is used to display the information. Click it to expand the detailed information.

9. The method for suspicious degree association analysis based on fuzzy scene matching according to claim 8, characterized in that: In step 5, the number of IP traceability layers is limited to 3-7 layers. If the number exceeds the limit, the data of the earliest or farthest layer will be automatically truncated.

10. The method for suspicious degree association analysis based on fuzzy scene matching according to claim 9, characterized in that: In step five, the configurable items include the weight of a single event, the number of repetitions of a single event, the weight of each event level, the weight of the event processing status, the weight of the event type, the suspicion coefficient, the value range of each relationship in one-to-many and many-to-one, the maximum number of displayed events, the maximum number of relationships, the number of IP tracing layers, the event display name, the calculation cycle, and the event range; the calculation cycle is an integer multiple of 5-60 minutes, and the event effective time range is configured synchronously with the calculation cycle.

Images