Network security threat awareness knowledge identification response method based on security knowledge graph

Abstract

The present application relates to the technical field of network security, and especially relates to a network security threat awareness identification and response method based on a security knowledge graph, which comprises the following steps: acquiring data; determining temporary nodes and focus nodes; determining marker nodes; determining risk nodes and suspicious nodes; obtaining modified risk nodes; connecting graph edges; determining abnormal nodes; adjusting thresholds; and issuing an alarm. The present application acquires various key indicators in real time, determines marker nodes according to the traffic change rate in combination with the in-out traffic ratio and source IP address, further determines risk nodes and suspicious nodes, modifies the suspicious nodes through the in-out traffic ratio, connects the graph edges, and determines abnormal nodes, then dynamically adjusts the thresholds, and finally issues an alarm based on the abnormal nodes. The present application optimizes the determination criteria in real time according to the changes in the network environment, and effectively solves the problems of low risk identification accuracy and slow response speed caused by excessive data and excessive dependence on models.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a network security threat awareness identification and response method based on a security knowledge graph. BACKGROUND

[0002] In an enterprise internal network environment, there are usually a large number of business systems and complex network topologies. Employees access enterprise internal applications and data resources through various terminal devices, and the enterprise also needs to interact with external partners. This complex network environment provides more opportunities for network security threats and hiding spaces. Traditional network security protection can resist some common network attacks to a certain extent, but its limitations gradually appear in the face of increasingly complex new threats.

[0003] The patent document with publication number CN117834282A discloses a network security dynamic early warning system and method based on a knowledge graph and a storage medium. The system includes: a network data acquisition module for acquiring data from a network environment; a data processing and analysis module for processing and analyzing the collected data; a knowledge graph construction module for converting the processed data into a structured knowledge graph; a deep learning and pattern recognition module for analyzing the data in the knowledge graph to identify and learn network security related patterns and behaviors, and obtain identification results; a warning and response module for generating and issuing network security warnings according to the identification results; and a data storage module for storing data, as well as the knowledge graph and the identification results.

[0004] As can be seen, the network security dynamic early warning system based on the knowledge graph has the following problems: the network data volume is large, especially in a high-traffic network environment, the data acquisition module faces a performance bottleneck and cannot efficiently collect data in real time; a large amount of data can cause the system processing speed to decrease, making it unable to respond in real time; the machine learning algorithm requires a large amount of labeled data for training, and the training time is long; the limited model generalization ability can cause the system to fail to effectively identify new network security threats, reducing the accuracy and reliability of the early warning. SUMMARY

[0005] To this end, the present application provides a network security threat awareness identification and response method based on a security knowledge graph, which overcomes the problems of low danger identification accuracy and slow response speed caused by excessive data volume and excessive reliance on models in the prior art by using a security knowledge graph, multi-level traffic index analysis, and a dynamic adjustment mechanism.

[0006] To achieve the above object, the application provides a network security threat awareness response method based on a security knowledge graph, comprising:

[0007] Real-time acquisition of the traffic change rate, the in-out traffic ratio, the source IP address, the request success rate and the session interruption rate of each monitoring node in the security knowledge graph constructed by the enterprise with each network device as the monitoring node;

[0008] Determination of a plurality of temporary nodes and a focus node according to the traffic change rate and a preset traffic threshold;

[0009] Determination of a plurality of marked nodes according to the in-out traffic ratio and the source IP address of the focus node and any temporary node within a preset marking duration;

[0010] Determination of a plurality of risk nodes and a plurality of suspicious nodes according to the request success rate and the session interruption rate of each marked node;

[0011] Determination of a plurality of risk nodes according to the in-out traffic ratio of the focus node and any suspicious node within a preset correction duration;

[0012] Connection of two risk nodes according to the source IP address of any two risk nodes to obtain a plurality of graph edges;

[0013] Determination of a plurality of abnormal nodes according to the number of connections of each risk node by the graph edges and a preset number threshold;

[0014] Adjustment of the preset traffic threshold to obtain an adjusted traffic threshold or adjustment of the preset number threshold to obtain an adjusted number threshold according to the traffic change rate, the in-out traffic ratio and the number of each abnormal node;

[0015] Issuance of an alarm to all abnormal nodes re-determined based on the adjusted traffic threshold or the adjusted number threshold.

[0016] Further, determination of a plurality of temporary nodes and a focus node according to the traffic change rate and a preset traffic threshold comprises:

[0017] When the traffic change rate is greater than the preset traffic threshold, the monitoring node is determined to be the temporary node, and a plurality of temporary nodes are obtained;

[0018] Determination of the temporary node with the largest traffic change rate as the focus node by comparing the traffic change rates of all temporary nodes.

[0019] Further, determination of a plurality of marked nodes according to the in-out traffic ratio and the source IP address of the focus node and any temporary node within a preset marking duration comprises:

[0020] Calculate the standard deviation of the in-out traffic ratio of the concerned node to obtain a concerned traffic ratio fluctuation value;

[0021] Calculate the number of different source IP addresses among all source IP addresses of the concerned node, calculate the probability of occurrence of each source IP address, calculate the Shannon entropy according to all probabilities, and calculate the standard deviation of the Shannon entropy to obtain a concerned dispersion fluctuation value;

[0022] Normalize the concerned traffic ratio fluctuation value to obtain a concerned traffic normalization value, and normalize the concerned dispersion fluctuation value to obtain a concerned dispersion normalization value;

[0023] Calculate the correlation coefficient of the concerned traffic normalization value and the concerned dispersion normalization value to obtain a concerned correlation degree;

[0024] When the concerned correlation degree is greater than a preset correlation degree threshold, calculate the standard deviation of the in-out traffic ratio of each temporary node to obtain a temporary traffic ratio fluctuation value;

[0025] Calculate the number of different source IP addresses among all source IP addresses of the temporary node, calculate the probability of occurrence of each source IP address, calculate the Shannon entropy according to all probabilities, and calculate the standard deviation of the Shannon entropy to obtain a temporary dispersion fluctuation value;

[0026] Normalize the temporary traffic ratio fluctuation value to obtain a temporary traffic normalization value, and normalize the temporary dispersion fluctuation value to obtain a temporary dispersion normalization value;

[0027] Calculate the correlation coefficient of the temporary traffic normalization value and the temporary dispersion normalization value to obtain a temporary correlation degree;

[0028] When the temporary correlation degree is greater than the concerned correlation degree, determine that the temporary node and the concerned node are the marked nodes to determine a plurality of marked nodes.

[0029] Further, according to the request success rate and the session interruption rate of each marked node, a plurality of risk nodes and a plurality of suspicious nodes are determined, comprising:

[0030] Draw a change curve of the request success rate within a preset determination duration to obtain a request change curve;

[0031] Calculate the slope change rate of the request change curve at a preset time distance to obtain a plurality of request slope change rates;

[0032] When the number of times that the request slope change rate is less than zero is greater than a preset number threshold, draw a change curve of the session interruption rate within a preset determination duration to obtain an interruption change curve;

[0033] Calculate a slope change rate of the interruption change curve of the preset time distance to obtain a plurality of interruption slope change rates;

[0034] When the number of times that the interruption slope change rate is greater than zero is greater than the preset number threshold, calculate a mean value of all the request slope change rates to obtain an average request change rate, and calculate a mean value of all the interruption slope change rates to obtain an average interruption change rate;

[0035] Calculate a relative deviation between an absolute value of the average request change rate and an absolute value of the average interruption change rate to obtain a slope deviation;

[0036] When the slope deviation is less than a preset slope deviation threshold, determine a plurality of risk nodes and a plurality of suspicious nodes according to the request success rate, the session interruption rate, and a preset consistency threshold.

[0037] Further, determining a plurality of risk nodes and a plurality of suspicious nodes according to the request success rate, the session interruption rate, and a preset consistency threshold comprises:

[0038] Calculate a standard deviation of the request success rate in the preset determination duration to obtain a request fluctuation value;

[0039] Calculate a standard deviation of the session interruption rate in the preset determination duration to obtain an interruption fluctuation value;

[0040] Perform normalization processing on the request fluctuation value in the preset determination duration to obtain a standard request fluctuation value, and perform normalization processing on the interruption fluctuation value in the preset determination duration to obtain a standard interruption fluctuation value;

[0041] Calculate a correlation coefficient of the standard request fluctuation value and the standard interruption fluctuation value to obtain a change consistency;

[0042] When the change consistency is less than zero and an absolute value of the change consistency is greater than the preset consistency threshold, determine the focus node as the risk node to determine a plurality of risk nodes;

[0043] When the change consistency is greater than zero and an absolute value of the change consistency is greater than the preset consistency threshold, determine the focus node as the suspicious node to determine a plurality of suspicious nodes.

[0044] Further, determining a plurality of risk nodes according to an in-out traffic ratio of the focus node and any suspicious node in a preset correction duration comprises:

[0045] Calculate a standard deviation of the in-out traffic ratio of the focus node to obtain a focus in-out ratio fluctuation value;

[0046] Calculate a standard deviation of the in-out traffic ratio of the suspicious node to obtain a suspicious in-out ratio fluctuation value;

[0047] Normalize the attention in-out ratio fluctuation value to obtain an attention in-out ratio normalized value, and normalize the suspicious in-out ratio fluctuation value to obtain a suspicious in-out ratio normalized value;

[0048] Calculate a relative deviation of the attention in-out ratio normalized value and the suspicious in-out ratio normalized value to obtain an in-out ratio deviation value;

[0049] When the in-out ratio deviation value is less than a preset in-out ratio deviation threshold, determine that the suspicious node is the risk node, to determine a plurality of risk nodes.

[0050] Further, connect two risk nodes according to the source IP addresses of any two risk nodes to obtain a plurality of graph edges, including:

[0051] Count the occurrence times of all the source IP addresses of each risk node to obtain a source IP number;

[0052] When the ratio of the source IP numbers of any two risk nodes is less than a preset ratio threshold, calculate the coincidence rate of the source IP addresses of the two risk nodes to obtain an IP coincidence rate;

[0053] When the IP coincidence rate is greater than a preset coincidence rate threshold, connect the two risk nodes to obtain a plurality of graph edges.

[0054] Further, determine a plurality of abnormal nodes according to the number of connections of each risk node by the graph edges and a preset number threshold, including:

[0055] When the number is greater than the preset number threshold, determine that the risk node is the abnormal node, to determine a plurality of abnormal nodes.

[0056] Further, adjust the preset traffic threshold according to the traffic change rate, the in-out traffic ratio and the number of each abnormal node to obtain an adjusted traffic threshold, or adjust the preset number threshold to obtain an adjusted number threshold, including:

[0057] Calculate a relative deviation of the traffic change rate and the preset traffic threshold to obtain a change deviation;

[0058] Calculate a relative deviation of the in-out traffic ratio and a preset traffic ratio threshold to obtain a traffic ratio deviation;

[0059] Weighted sum the change deviation, a preset traffic change weight, the traffic ratio deviation and a preset traffic ratio weight to obtain a deviation index;

[0060] According to the deviation index, a preset deviation index range, and the quantity, the preset traffic threshold is adjusted to obtain an adjusted traffic threshold, or the preset quantity threshold is adjusted to obtain an adjusted quantity threshold.

[0061] Further, according to the deviation index, a preset deviation index range, and the quantity, the preset traffic threshold is adjusted to obtain an adjusted traffic threshold, or the preset quantity threshold is adjusted to obtain an adjusted quantity threshold, including:

[0062] When the deviation index is greater than the maximum value of the preset deviation index range, the preset traffic threshold is increased according to the relative deviation of the deviation index and the maximum value of the preset deviation index range and a preset first adjustment coefficient to obtain an adjusted traffic threshold;

[0063] When the deviation index is less than the minimum value of the preset deviation index range, the relative deviation of the deviation index and the minimum value of the preset deviation index range is calculated to obtain an index deviation;

[0064] The absolute value of the relative deviation of the quantity and the preset quantity threshold is calculated to obtain a quantity deviation;

[0065] The quantity deviation, a preset quantity deviation weight, the index deviation, and a preset index deviation weight are weighted and summed to obtain an adjustment factor;

[0066] According to the adjustment factor and a preset second adjustment coefficient, the preset quantity threshold is increased to obtain an adjusted quantity threshold.

[0067] Compared with the prior art, the beneficial effects of the present application are that by real-time acquisition of key indicators of each network device monitoring node of an enterprise, temporary nodes and attention nodes are screened out according to a traffic change rate and a preset traffic threshold, further combined with an in-out traffic ratio and a source IP address to determine marked nodes, based on a request success rate and a session interruption rate to determine risk nodes and suspicious nodes, effectively distinguishing normal network fluctuations from malicious attack behaviors, through the in-out traffic ratio to determine risk nodes again, the determination of risk nodes can be dynamically adjusted, avoiding misjudgment caused by short-term traffic fluctuations, through the source IP address to connect risk nodes to form a graph edge, and according to the connection quantity and the quantity threshold to determine abnormal nodes, using the correlation analysis capability of the knowledge graph to identify complex attack paths and cooperative attack behaviors, finally, by dynamically adjusting the preset traffic threshold and the quantity threshold, the determination standard is optimized in real time according to the change of the network environment, ensuring the long-term effectiveness and adaptability of the system, effectively solving the problems of low risk identification accuracy and slow response speed caused by excessive data and excessive dependence on models.

[0068] Further, by flow change rate threshold judgment and comparative analysis, potential temporary nodes can be quickly screened out. Traffic abnormal changes are usually associated with network attacks or abnormal behaviors. Among many abnormal nodes, the node with the most significant traffic change is often the most potential threat source that deserves attention. This not only quickly narrows down the monitoring range and improves the analysis efficiency of the system, but also ensures that the most possible threat is prioritized, thereby achieving efficient perception and accurate identification of network security threats.

[0069] Further, by combining flow ratio fluctuation, source IP address dispersion, and correlation coefficient indicators, temporary nodes that are similar to the behavior pattern of the focus node and may have a correlation can be accurately identified, thereby determining the marker node. The flow ratio fluctuation value reflects the stability of the node traffic change, the dispersion measures the diversity of the traffic source, and the correlation coefficient further quantifies the correlation between the traffic fluctuation and the source IP address dispersion. Through normalization processing and correlation calculation, the system can objectively compare the behavior characteristics of different nodes and avoid misjudgment due to the contingency of a single indicator. When the correlation degree of the temporary node is higher than the preset threshold and greater than the correlation degree of the focus node, it indicates that the behavior pattern of the temporary node is highly similar to that of the focus node and may be involved in similar network activities, thereby marking it as a marker node. This can effectively filter noise data and accurately locate potential threat nodes.

[0070] Further, by drawing the change curve of the request success rate and the session interruption rate, and calculating the slope change rate, the change trend of these key indicators can be dynamically monitored. A request slope change rate less than zero indicates a decrease in request success rate, which may imply a service availability problem. An interruption slope change rate greater than zero indicates an increase in session interruption rate, which may imply a connection stability problem. By setting a preset number threshold, nodes that frequently exhibit these changes can be screened out, further focusing on potential problem nodes. By calculating the average request change rate and the average interruption change rate, and evaluating the relative deviation (slope deviation) between them, it can be determined whether the change trends of the request success rate and the session interruption rate are consistent. If the slope deviation is less than the preset threshold, it indicates that the change trends of the two are related, which may be a manifestation of the same network problem, thereby more accurately identifying risk nodes and suspicious nodes.

[0071] Further, by quantifying the fluctuation of request success rate and session interruption rate and calculating the correlation coefficient of the two, the risk nodes and suspicious nodes can be accurately distinguished. The fluctuation values of request success rate and session interruption rate reflect the stability of the nodes within the preset judgment duration. When the change consistency is less than zero and the absolute value is greater than the preset consistency threshold, it means that the change trend of the two is negatively correlated and the difference is significant, which usually implies potential network attacks or failures, so the node is determined as a risk node. On the contrary, when the change consistency is greater than zero and the absolute value is greater than the preset consistency threshold, it means that the change trend of the two is positively correlated and the difference is significant, which may be abnormal, so the node is determined as a suspicious node. Different types of abnormal nodes can be effectively distinguished, improving the accuracy and reliability of network security threat identification.

[0072] Further, by quantifying and comparing the in-out traffic ratio fluctuation of the focus nodes and suspicious nodes, it can dynamically identify whether the suspicious nodes with potential threats should be further determined as risk nodes. By calculating the standard deviation of the in-out traffic ratio, the respective fluctuation values are obtained, which can capture the change stability of the traffic ratio; the relative deviation between the normalized values is further quantified to quantify the difference degree of the traffic ratio fluctuation of the focus nodes and suspicious nodes; when the in-out ratio deviation value is less than the preset threshold, it means that the traffic ratio fluctuation of the suspicious node is similar to that of the focus node, which means that the behavior pattern of the suspicious node is similar to the known risk pattern, so it is determined as a risk node. The evaluation of suspicious nodes can be dynamically adjusted to avoid misjudgment caused by short-term traffic fluctuation, while ensuring timely discovery and accurate identification of potential threats.

[0073] Further, by analyzing the coincidence of source IP addresses between risk nodes, potential associations can be effectively identified, and a knowledge graph reflecting network threat propagation paths and collaborative behaviors can be constructed; the number of occurrences of each risk node's source IP address can be counted to understand the diversity of each node's traffic source; by comparing the source IP ratio of any two risk nodes, node pairs with similar traffic source size can be selected; similar traffic source size may imply similar network behavior patterns. Further calculate the coincidence rate of source IP addresses to quantify the traffic source similarity between two nodes. When the coincidence rate exceeds the preset threshold, it means that the two risk nodes may share a large number of similar traffic sources, and this high degree of coincidence is likely due to their participation in the same attack path or collaborative attack behavior; at this time, the two nodes are connected to form a graph edge, which can intuitively show their association; effectively mining potential threat associations hidden in massive data.

[0074] Further, by counting the number of connections of the risk nodes connected by the graph edges and comparing it with the preset number threshold, the nodes with significant correlation in the network can be effectively identified, so as to accurately locate the abnormal nodes. The number of connections of the graph edges reflects the correlation degree between the risk nodes. If a risk node is connected by a large number of other risk nodes, it means that its behavior pattern in the network is highly related to other risk nodes, and it may be a key node or attack source in the attack path. By setting the preset number threshold, the nodes with more connections and stronger correlation can be distinguished and determined as abnormal nodes. This avoids the limitation of relying on a single node indicator and improves the identification ability of complex attack paths and cooperative attack behaviors.

[0075] Further, by calculating the relative deviation of the flow change rate and the in-out flow ratio, the abnormal fluctuations of network traffic can be captured sensitively, and the deviation index obtained by weighted summation further quantifies the degree of these abnormalities, providing a scientific basis for dynamic adjustment of the threshold. Combined with the threshold adjustment of the number of abnormal nodes, the system can automatically optimize the monitoring parameters according to the actual traffic situation under different network environments, thereby improving the identification accuracy and response efficiency of potential threats.

[0076] Further, by comprehensively considering the deviation index, the preset deviation index range, and the number of multi-dimensional data, the deviation index reflects the deviation degree of the current network traffic from the preset range. By comparing it with the maximum and minimum values of the preset range, it can be judged whether the network traffic is abnormal. When the deviation index exceeds the preset range, the flow threshold is moderately increased by the preset first adjustment coefficient, avoiding false positives caused by excessive threshold adjustment, and ensuring that the flow threshold can adapt to the dynamic changes of network traffic. Secondly, when the deviation index is lower than the preset range, the adjustment factor is obtained by weighted summation of the index deviation and the number deviation, and then the number threshold is adjusted. This not only allows the threshold to be adjusted flexibly according to the actual changes of network traffic, but also effectively reduces the false positive rate, improving the accuracy and adaptability of network security monitoring. BRIEF DESCRIPTION OF DRAWINGS

[0077] Figure 1 Flowchart of the network security threat identification and response method based on the security knowledge graph of the present embodiment;

[0078] Figure 2 Determination logic diagram for determining temporary nodes of the present embodiment;

[0079] Figure 3 Determination logic diagram for determining marked nodes of the present embodiment;

[0080] Figure 4 Determination logic diagram for determining risk nodes and suspicious nodes of the present embodiment. DETAILED DESCRIPTION

[0081] In order to make the objects and advantages of the present application clearer, the following further describes the present application with reference to examples; it should be understood that the specific examples described herein are only used to explain the present application and do not limit the present application.

[0082] The preferred embodiments of the present application are described below with reference to the accompanying drawings. Those skilled in the art should understand that these embodiments are only used to explain the technical principles of the present application and are not intended to limit the protection scope of the present application.

[0083] Please refer to Figure 1 The flowchart of the network security threat awareness identification response method based on a security knowledge graph in the present embodiment is shown in FIG. 1, which is a flowchart of the network security threat awareness identification response method based on a security knowledge graph in the present embodiment.

[0084] The present embodiment provides a network security threat awareness identification response method based on a security knowledge graph, which comprises the following steps.

[0085] Real-time acquisition of the traffic change rate, the in-out traffic ratio, the source IP address, the request success rate and the session interruption rate of each monitoring node in the security knowledge graph constructed by the enterprise with each network device as a monitoring node;

[0086] Determination of a plurality of temporary nodes and a focus node according to the traffic change rate and a preset traffic threshold value;

[0087] Determination of a plurality of marked nodes according to the in-out traffic ratio and the source IP address of the focus node and any temporary node within a preset marking duration;

[0088] Determination of a plurality of risk nodes and a plurality of suspicious nodes according to the request success rate and the session interruption rate of each marked node;

[0089] Determination of a plurality of risk nodes according to the in-out traffic ratio of the focus node and any suspicious node within a preset correction duration;

[0090] Connection of two risk nodes according to the source IP address of any two risk nodes to obtain a plurality of graph edges;

[0091] Determination of a plurality of abnormal nodes according to the number of graph edges connected to each risk node and a preset number threshold value;

[0092] Adjustment of the preset traffic threshold value according to the traffic change rate, the in-out traffic ratio and the number of each abnormal node to obtain an adjusted traffic threshold value, or adjustment of the preset number threshold value to obtain an adjusted number threshold value;

[0093] Issuing of an alarm for all abnormal nodes re-determined based on the adjusted traffic threshold value or the adjusted number threshold value.

[0094] In an enterprise network environment, network devices serve as monitoring nodes to build a security knowledge graph for real-time monitoring of network traffic and behavior. Network devices refer to hardware or software components that make up the enterprise network infrastructure, including but not limited to routers, switches, firewalls, load balancers, intrusion detection / prevention systems (IDS / IPS), gateways, proxy servers; traffic change rate refers to the degree of change in network traffic per unit time, used to detect abnormal growth or decline in traffic, collected through traffic monitoring tools; ingress / egress traffic ratio is the proportion of traffic entering and leaving network nodes, used to identify abnormal traffic flow direction, analyzed using network traffic analysis software (such as Wireshark or PRTG); source IP address is the IP address initiating network requests, used to trace data sources, obtained through firewall logs or network intrusion detection system (IDS) logs; request success rate is the ratio of the number of successful responses to the total number of requests, reflecting the availability of network services, monitored through application performance monitoring tools (such as APM tools) to monitor application request response; session interruption rate is the ratio of the number of abnormal session interruptions to the total number of sessions, used to detect potential attack behavior, monitored using network session monitoring tools (such as TCPdump or specialized session analysis software) to monitor network session interruptions.

[0095] The preset traffic threshold is a reference value for determining whether the traffic change is abnormal, and depends on the normal traffic characteristics, business types, historical data statistics, and security policies of the network, and is usually set between 2 and 3 times the standard deviation of the historical average traffic. In this embodiment, it is set to 2.5 times the standard deviation of the historical average traffic, which can effectively distinguish between normal traffic fluctuations and abnormal traffic, avoid false positives while promptly detecting traffic anomalies, and improve the sensitivity and accuracy of the system.

[0096] The historical average traffic refers to the average value of network traffic in the past week, which is obtained by statistical analysis of historical traffic data, and is used to reflect the traffic level of the network under normal operating conditions.

[0097] The preset correction duration refers to the time window for re-evaluating the traffic data of the concerned nodes and suspicious nodes within a certain period of time, and depends on the dynamic change characteristics of network traffic, real-time requirements of business, and security policies, and is usually set between 10 minutes and 30 minutes. In this embodiment, it is set to 15 minutes, which can timely correct the misjudgment caused by short-term fluctuations while ensuring the real-time performance and response speed of the system.

[0098] The preset threshold is used to determine whether the number of graph edges connecting a risky node exceeds a normal baseline value. It depends on the network topology, the statistical patterns of normal business connections, and security policies, and is usually set between 3 and 5. In this embodiment, it is set to 4, which can effectively identify abnormal nodes associated with multiple risky nodes and avoid isolating the risk of a single node.

[0099] By acquiring key metrics from monitoring nodes across an enterprise's network devices in real time, the system identifies several temporary nodes and nodes of interest based on traffic change rates and preset traffic thresholds. Subsequently, the system further identifies several marked nodes by combining the inbound and outbound traffic ratios and source IP addresses of the nodes of interest and temporary nodes. Risk nodes and suspicious nodes are identified based on the request success rates and session interruption rates of the marked nodes. Risk nodes are further adjusted and identified based on the inbound and outbound traffic ratios of the nodes of interest and suspicious nodes. Next, any two risk nodes are connected by their source IP addresses to form graph edges. Finally, several abnormal nodes are identified based on the number of graph edges connecting the risk nodes and a preset threshold. Furthermore, the system dynamically adjusts the preset traffic threshold or threshold based on the traffic change rate, inbound and outbound traffic ratio, and the number of graph edges connecting the risk nodes. Alerts are then issued for all abnormal nodes that have been re-identified based on the adjusted thresholds.

[0100] By obtaining the key indicators of the monitoring nodes of each enterprise's network equipment in real time, temporary nodes and focus nodes are screened out according to the traffic change rate and the preset traffic threshold, and the inbound and outbound traffic ratio and source IP address are further combined to determine the marked nodes. The risk nodes and suspicious nodes are determined based on the request success rate and session interruption rate, which effectively distinguishes normal network fluctuations from malicious attack behaviors. The risk nodes are re-determined by the inbound and outbound traffic ratio. The judgment of risk nodes can be dynamically adjusted to avoid misjudgment caused by short-term traffic fluctuations. The risk nodes are connected by the source IP address to form a graph edge, and the abnormal nodes are determined according to the number of connections and the number threshold. The association analysis capability of the knowledge graph is utilized to identify complex attack paths and coordinated attack behaviors. Finally, by dynamically adjusting the preset traffic threshold and number threshold, the judgment criteria are optimized in real time according to changes in the network environment to ensure the long-term effectiveness and adaptability of the system, and effectively solve the problems of low hazard identification accuracy and slow response speed caused by excessive data volume and over-reliance on models.

[0101] Please continue reading Figure 2 As shown, it is a decision logic diagram for determining a temporary node in this embodiment;

[0102] According to the traffic change rate and the preset traffic threshold, several temporary nodes and focus nodes are determined, including:

[0103] When the flow change rate is greater than the preset flow threshold, determining the monitoring node as the temporary node, and obtaining a plurality of the temporary nodes;

[0104] The temporary node with the largest traffic change rate is determined as the target node by comparing the traffic change rates of all the temporary nodes.

[0105] The temporary nodes are obtained by determining a node as a temporary node when the traffic change rate of the node exceeds a preset traffic threshold. Then, the target node is found by comparing the traffic change rates of the temporary nodes and determining the node with the largest traffic change rate as the target node.

[0106] The potential temporary nodes can be quickly screened out by the traffic change rate threshold judgment and comparison analysis. The abnormal traffic change is usually related to network attacks or abnormal behaviors. Among the numerous abnormal nodes, the node with the most significant traffic change is often the most potential threat source that is worth paying attention to. This can not only quickly narrow the monitoring range and improve the analysis efficiency of the system, but also ensure that the most possible threat is processed in priority, thereby achieving efficient perception and accurate identification of network security threats.

[0107] Please continue to refer to Figure 3 The determination logic diagram for determining the marked nodes is shown in FIG. 2;

[0108] A plurality of marked nodes are determined according to the in-out traffic ratio and the source IP address of the target node and any temporary node within a preset marking duration, including:

[0109] The standard deviation of the in-out traffic ratio of the target node is calculated to obtain a target traffic ratio fluctuation value;

[0110] The number of different source IP addresses among all the source IP addresses of the target node is counted, the probability of each source IP address is calculated, the Shannon entropy is calculated according to all the probabilities, and the standard deviation of the Shannon entropy is calculated to obtain a target dispersion fluctuation value;

[0111] The target traffic ratio fluctuation value is normalized to obtain a target traffic normalization value, and the target dispersion fluctuation value is normalized to obtain a target dispersion normalization value;

[0112] The correlation coefficient of the target traffic normalization value and the target dispersion normalization value is calculated to obtain a target correlation degree;

[0113] When the target correlation degree is greater than a preset correlation threshold, the standard deviation of the in-out traffic ratio of each temporary node is calculated to obtain a temporary traffic ratio fluctuation value;

[0114] The number of different source IP addresses among all the source IP addresses of the temporary node is counted, the probability of each source IP address is calculated, the Shannon entropy is calculated according to all the probabilities, and the standard deviation of the Shannon entropy is calculated to obtain a temporary dispersion fluctuation value;

[0115] normalizing the temporary flow ratio fluctuation value to obtain a temporary flow normalization value, and normalizing the temporary dispersion fluctuation value to obtain a temporary dispersion normalization value;

[0116] calculating a correlation coefficient of the temporary flow normalization value and the temporary dispersion normalization value to obtain a temporary correlation degree;

[0117] when the temporary correlation degree is greater than a concerned correlation degree, determining that the temporary node and the concerned node are the marked nodes to determine a plurality of marked nodes.

[0118] The preset marking duration is a time window for calculating the flow ratio fluctuation value and the dispersion fluctuation value, and depends on the dynamic characteristics of network flow, real-time requirements of services, and security policies, and is usually set between 5 minutes and 20 minutes. In the embodiment, the preset marking duration is set to 10 minutes, which can effectively capture short-term fluctuations of network flow, and avoid misjudgment caused by too short time.

[0119] The preset correlation degree threshold is a reference value for judging the correlation between the flow ratio and the dispersion, and depends on the statistical law of normal network behavior, service logic, and security requirements, and is usually set between 0.7 and 0.9. In the embodiment, the preset correlation degree threshold is set to 0.8, which can more accurately screen out potential threat nodes and avoid false positives and false negatives.

[0120] The standard deviation of the in-out flow ratio of the concerned node is calculated to obtain the flow ratio fluctuation value, and the number of all source IP addresses of the node is counted and the probability of each address is calculated to obtain the Shannon entropy and its standard deviation, i.e. the dispersion fluctuation value. Then, the two fluctuation values are normalized to obtain the flow normalization value and the dispersion normalization value, and the correlation coefficient thereof is calculated, which is called the concerned correlation degree. If the correlation degree of the concerned node exceeds the preset correlation degree threshold, the same calculation process is performed on the temporary node to obtain the temporary flow ratio fluctuation value, the temporary dispersion fluctuation value, the flow normalization value, the dispersion normalization value, and the temporary correlation degree. Finally, if the temporary correlation degree of the temporary node is higher than the correlation degree of the concerned node, the temporary node is marked together with the concerned node as a marked node, thereby determining a plurality of marked nodes.

[0121] By combining the flow ratio fluctuation, source IP address dispersion and correlation coefficient, etc. indexes, the temporary nodes similar to the behavior mode of the concerned node and possibly having correlation can be accurately identified, so as to determine the marker nodes; the flow ratio fluctuation value reflects the stability of the node flow change, the dispersion measures the diversity of the flow source, and the correlation coefficient further quantifies the correlation between the flow fluctuation and the source IP address dispersion; through normalization processing and correlation calculation, the system can objectively compare the behavior characteristics of different nodes, avoiding misjudgment due to the contingency of a single index. When the correlation degree of the temporary node is higher than the preset threshold and greater than the correlation degree of the concerned node, it indicates that the behavior mode of the temporary node is highly similar to that of the concerned node, and it may participate in similar network activities, so as to be marked as a marker node. It can effectively filter noise data and accurately locate potential threat nodes.

[0122] Specifically, a plurality of risk nodes and a plurality of suspicious nodes are determined according to the request success rate and the session interruption rate of each of the marker nodes, including:

[0123] A change curve of the request success rate within a preset determination duration is drawn to obtain a request change curve;

[0124] A slope change rate of the request change curve within a preset time distance is calculated to obtain a plurality of request slope change rates;

[0125] When the number of times that the request slope change rate is less than zero is greater than a preset number threshold, a change curve of the session interruption rate within a preset determination duration is drawn to obtain an interruption change curve;

[0126] A slope change rate of the interruption change curve within the preset time distance is calculated to obtain a plurality of interruption slope change rates;

[0127] When the number of times that the interruption slope change rate is greater than zero is greater than the preset number threshold, a mean value of all the request slope change rates is calculated to obtain an average request change rate, and a mean value of all the interruption slope change rates is calculated to obtain an average interruption change rate;

[0128] A relative deviation between the absolute value of the average request change rate and the absolute value of the average interruption change rate is calculated to obtain a slope deviation;

[0129] When the slope deviation is less than a preset slope deviation threshold, a plurality of risk nodes and a plurality of suspicious nodes are determined according to the request success rate, the session interruption rate and a preset consistency degree threshold.

[0130] The preset determination duration refers to a time window for analyzing the change of the request success rate and the session interruption rate, which depends on the dynamic characteristics of network traffic, the real-time requirements of services, and the security policy, and is usually set between 5 minutes and 30 minutes. In this embodiment, it is set to 10 minutes, which can timely capture short-term changes and avoid misjudgment caused by too short time.

[0131] The preset time distance refers to a time interval used when calculating the slope change rate, which depends on the dynamic characteristics of network traffic, service requirements, and the response speed of the monitoring system, and is usually set between 1 minute and 10 minutes. In this embodiment, it is set to 3 minutes, which can significantly improve the sensitivity of monitoring, timely capture rapid changes in network traffic, and avoid increased complexity of calculation and false positive rate caused by too short time intervals.

[0132] The preset slope deviation threshold refers to the maximum allowed deviation between the absolute value of the request slope change rate and the absolute value of the interruption slope change rate, which depends on the statistical law of normal network behavior, service logic, and security policy, and is usually set in the range of 0.1 to 0.3. In this embodiment, it is set to 0.2, which can effectively distinguish between normal traffic fluctuations and abnormal behavior, avoid misjudgment caused by the contingency of a single indicator, and improve the accuracy and reliability of identification.

[0133] The preset consistency threshold is a reference value for determining whether the change trends of the request success rate and the session interruption rate are consistent, which depends on the statistical law of normal network behavior, service logic, and security requirements, and is usually set between 0.8 and 0.5. In this embodiment, it is set to 0.65, which can effectively distinguish between normal network fluctuations and abnormal behavior, and avoid misjudgment caused by the contingency of a single indicator.

[0134] By drawing the change curve of the request success rate, the slope change rate of the curve in the preset time interval is calculated, obtaining a plurality of request slope change rates. If the number of times that the request slope change rate is less than zero exceeds the preset number threshold, then the change curve of the session interruption rate is drawn, and the slope change rate in the same time interval is calculated, obtaining a plurality of interruption slope change rates. When the number of times that the interruption slope change rate is greater than zero also exceeds the preset number threshold, the mean values of all request slope change rates and interruption slope change rates are calculated, respectively obtaining the average request change rate and the average interruption change rate. Subsequently, the relative deviation between the absolute values of the two average values is calculated, obtaining the slope deviation. If the slope deviation is less than the preset slope deviation threshold, then a number of risk nodes and a number of suspicious nodes are determined according to the request success rate, the session interruption rate, and the preset consistency threshold.

[0135] By drawing the change curve of request success rate and session interruption rate, and calculating the slope change rate, the change trend of these key indicators can be dynamically monitored. The request slope change rate less than zero indicates that the request success rate is declining, which may imply service availability problems; the interruption slope change rate greater than zero indicates that the session interruption rate is rising, which may imply connection stability problems. By setting a preset number threshold, nodes that frequently appear these changes are screened out, further focusing on potential problem nodes. By calculating the average request change rate and the average interruption change rate, and evaluating the relative deviation (slope deviation) between them, it can be judged whether the change trend of request success rate and session interruption rate has consistency. If the slope deviation is less than a preset threshold, it means that the change trend of the two has correlation, which may be the embodiment of the same network problem, so that the risk nodes and suspicious nodes can be more accurately identified.

[0136] Please continue to refer to Figure 4 Fig. 4 shows a determination logic diagram for determining risk nodes and suspicious nodes in the embodiment, and

[0137] According to the request success rate, the session interruption rate, and a preset consistency threshold, a plurality of risk nodes and a plurality of suspicious nodes are determined, comprising:

[0138] The standard deviation of the request success rate in the preset determination duration is calculated to obtain a request fluctuation value;

[0139] The standard deviation of the session interruption rate in the preset determination duration is calculated to obtain an interruption fluctuation value;

[0140] The request fluctuation value in the preset determination duration is normalized to obtain a standard request fluctuation value, and the interruption fluctuation value in the preset determination duration is normalized to obtain a standard interruption fluctuation value;

[0141] The correlation coefficient of the standard request fluctuation value and the standard interruption fluctuation value is calculated to obtain a change consistency;

[0142] When the change consistency is less than zero, and the absolute value of the change consistency is greater than the preset consistency threshold, the concerned node is determined as the risk node to determine a plurality of risk nodes;

[0143] When the change consistency is greater than zero, and the absolute value of the change consistency is greater than the preset consistency threshold, the concerned node is determined as the suspicious node to determine a plurality of suspicious nodes.

[0144] The standard deviation of the request success rate in the preset judgment duration is calculated to obtain a request fluctuation value, and the standard deviation of the session interruption rate is calculated to obtain an interruption fluctuation value. Then, normalization processing is performed on all request fluctuation values and interruption fluctuation values respectively, so as to obtain standard request fluctuation values and standard interruption fluctuation values. Subsequently, the correlation coefficient between the two standard fluctuation values is calculated to obtain a change consistency degree. If the change consistency degree is less than zero and the absolute value is higher than a preset consistency threshold, the marked node is determined as a risk node, so as to determine a plurality of risk nodes; otherwise, if the change consistency degree is greater than zero and the absolute value is greater than the preset consistency threshold, the marked node is determined as a suspicious node, so as to determine a plurality of suspicious nodes.

[0145] By quantifying the fluctuation of the request success rate and the session interruption rate, and calculating the correlation coefficient of the two, the risk nodes and suspicious nodes can be accurately distinguished. The fluctuation values of the request success rate and the session interruption rate reflect the stability of the node in the preset judgment duration. When the change consistency degree is less than zero and the absolute value is greater than the preset consistency threshold, it indicates that the change trends of the two are negatively correlated and significantly different, which usually implies potential network attacks or failures, so the node is determined as a risk node. On the contrary, when the change consistency degree is greater than zero and the absolute value is greater than the preset consistency threshold, it indicates that the change trends of the two are positively correlated and significantly different, which may be abnormal, so the node is determined as a suspicious node. Different types of abnormal nodes can be effectively distinguished, improving the accuracy and reliability of network security threat identification.

[0146] Specifically, a plurality of risk nodes are determined according to the in-out traffic ratio of the concerned node and any suspicious node in a preset correction duration, comprising:

[0147] The standard deviation of the in-out traffic ratio of the concerned node is calculated to obtain a concerned in-out ratio fluctuation value;

[0148] The standard deviation of the in-out traffic ratio of the suspicious node is calculated to obtain a suspicious in-out ratio fluctuation value;

[0149] The concerned in-out ratio fluctuation value is normalized to obtain a concerned in-out ratio normalized value, and the suspicious in-out ratio fluctuation value is normalized to obtain a suspicious in-out ratio normalized value;

[0150] The relative deviation of the concerned in-out ratio normalized value and the suspicious in-out ratio normalized value is calculated to obtain an in-out ratio deviation value;

[0151] When the in-out ratio deviation value is less than a preset in-out ratio deviation threshold, the suspicious node is determined as the risk node, so as to determine a plurality of risk nodes.

[0152] The preset in-out ratio deviation threshold is a reference value for judging whether the normalized relative deviation of the in-out flow ratio fluctuation value is within a normal range, and is determined by the normal fluctuation range of network flow, business logic and security policy, and is usually set between 0.1 and 0.3. In this embodiment, it is set to 0.2, which can ensure the sensitivity of the system to abnormal flow while avoiding misjudgment due to small differences in flow fluctuations.

[0153] The standard deviation of the in-out flow ratio of the focus node is calculated to obtain a focus in-out ratio fluctuation value, and the standard deviation of the in-out flow ratio of the suspicious node is calculated to obtain a suspicious in-out ratio fluctuation value. Then, the focus in-out ratio fluctuation value is normalized to obtain a focus in-out ratio normalized value, and the suspicious in-out ratio fluctuation value is also normalized to obtain a suspicious in-out ratio normalized value. Then, the relative deviation between the focus in-out ratio normalized value and the suspicious in-out ratio normalized value is calculated to obtain an in-out ratio deviation value. If the in-out ratio deviation value is less than the preset in-out ratio deviation threshold, the suspicious node is determined to be a risk node, thereby determining a plurality of risk nodes.

[0154] By quantifying and comparing the in-out flow ratio fluctuations of the focus node and the suspicious node, it can be dynamically determined whether the suspicious node with potential threat should be further determined as a risk node. By calculating the standard deviation of the in-out flow ratio, the respective fluctuation values are obtained, which can capture the stability of the flow ratio. The relative deviation between the normalized values further quantifies the difference between the flow ratio fluctuations of the focus node and the suspicious node. When the in-out ratio deviation value is less than the preset threshold, it indicates that the flow ratio fluctuation of the suspicious node is similar to that of the focus node, which means that the behavior pattern of the suspicious node is similar to the known risk pattern, and therefore the suspicious node is determined to be a risk node. The evaluation of the suspicious node can be dynamically adjusted to avoid misjudgment due to short-term flow fluctuations, while ensuring timely discovery and accurate identification of potential threats.

[0155] Specifically, two risk nodes are connected according to the source IP addresses of any two of the risk nodes to obtain a plurality of graph edges, including:

[0156] The number of occurrences of all the source IP addresses of each of the risk nodes is counted to obtain a source IP number;

[0157] When the ratio of the source IP numbers of any two of the risk nodes is less than a preset ratio threshold, the coincidence rate of the source IP addresses of the two risk nodes is calculated to obtain an IP coincidence rate;

[0158] When the IP coincidence rate is greater than a preset coincidence rate threshold, the two risk nodes are connected to obtain a plurality of graph edges.

[0159] The preset ratio threshold value is a reference value for determining whether the IP numbers of two risk nodes are comparable, which depends on the topology of the network, the IP distribution characteristics of normal traffic, and the security policy, and is usually set between 1.5 and 3. In this embodiment, it is set to 2, which can effectively filter out node pairs with too large differences in source IP numbers and avoid false positives due to too large differences in IP numbers.

[0160] The preset coincidence rate threshold value is a reference value for determining whether there is an association between two risk nodes, which depends on the IP address distribution law of normal traffic in the network environment, the characteristics of attack behavior, and the strictness of the security policy, and is usually set between 30% and 50%. In this embodiment, it is set to 40%, which can effectively identify nodes with obvious associations and avoid false positives due to accidental coincidence.

[0161] By counting the number of occurrences of all source IP addresses of each risk node, the source IP number of each node is obtained. Then, for any two risk nodes, if their source IP number ratio is less than the preset IP number threshold value, the coincidence rate of the source IP addresses of the two nodes is further calculated. When the calculated IP coincidence rate is greater than the preset coincidence rate threshold value, the two risk nodes are connected, thereby forming a number of graph edges.

[0162] By analyzing the coincidence of source IP addresses between risk nodes, potential associations can be effectively identified, thereby constructing a knowledge graph reflecting the propagation path and cooperative behavior of network threats; by counting the number of occurrences of source IP addresses of each risk node, the diversity of the traffic sources of each node can be understood; by comparing the source IP number ratio of any two risk nodes, node pairs with similar traffic source sizes can be selected; similar traffic source sizes may imply similar network behavior patterns. Further calculating the coincidence rate of source IP addresses quantifies the similarity of traffic sources between two nodes. When the coincidence rate exceeds the preset threshold value, it indicates that the two risk nodes may share a large number of similar traffic sources, and this high degree of coincidence is likely due to their participation in the same attack path or cooperative attack behavior; at this time, the two nodes are connected to form a graph edge, which can intuitively show the association between them; effectively mining potential threat associations hidden in massive data.

[0163] Specifically, a number of abnormal nodes are determined according to the number of connections of each risk node to the graph edges and a preset number threshold value, including:

[0164] When the number is greater than the preset number threshold value, the risk node is determined to be the abnormal node, thereby determining a number of abnormal nodes.

[0165] By counting the number of graph edges connecting each risk node, and then comparing this number with a preset threshold, if the number of connections to a risk node exceeds the preset threshold, the risk node is determined to be an abnormal node, thereby determining a number of abnormal nodes.

[0166] By counting the number of graph edges connecting risk nodes and comparing them with a preset threshold, we can effectively identify nodes with significant correlations in the network, thereby accurately locating anomalous nodes. The number of graph edge connections reflects the closeness of the connections between risk nodes. If a risk node is connected to a large number of other risk nodes, its behavior in the network is highly correlated with other risk nodes, making it a potential key node or source of attack. By setting a preset threshold, we can distinguish nodes with a high number of connections and strong correlations and identify them as anomalous nodes. This avoids the limitations of relying solely on single node metrics and improves the ability to identify complex attack paths and coordinated attack behaviors.

[0167] Specifically, adjusting the preset flow threshold according to the flow change rate, the inflow / outflow ratio, and the number of each abnormal node to obtain an adjusted flow threshold, or adjusting the preset number threshold to obtain an adjusted number threshold, includes:

[0168] Calculating a relative deviation between the flow rate change rate and the preset flow threshold to obtain a change deviation;

[0169] Calculating a relative deviation between the inlet and outlet flow ratio and a preset flow ratio threshold to obtain a flow ratio deviation;

[0170] Performing weighted summation on the change deviation, the preset flow change weight, the flow ratio deviation, and the preset flow ratio weight to obtain a deviation index;

[0171] The preset flow threshold is adjusted according to the deviation index, the preset deviation index range, and the quantity to obtain an adjusted flow threshold, or the preset quantity threshold is adjusted to obtain an adjusted quantity threshold.

[0172] The preset traffic change weight is used to measure the importance of the traffic change rate deviation in the overall deviation. It depends on the importance of the traffic change rate in network security threat identification and the needs of the business scenario, and is usually set between 0.3 and 0.7. In this embodiment, it is set to 0.5 to balance the contribution of the traffic change rate and other indicators.

[0173] The preset flow ratio weight is used to measure the importance coefficient of the contribution of the deviation of the in-out flow ratio to the overall deviation when calculating the deviation index. The preset flow ratio weight is usually set between 0.3 and 0.7, depending on the importance of the in-out flow ratio in network security threat identification and the demand of the business scenario. In the embodiment, the preset flow ratio weight is set to 0.5, which can balance the contribution of the in-out flow ratio and other indicators

[0174] The preset deviation index range is a reference interval for determining whether the deviation index is within the normal range. The preset deviation index range is usually set between [0.1, 0.9], depending on the statistical characteristics of normal network flow changes and flow ratio changes and security policies. In the embodiment, the preset deviation index range is set to [0.3, 0.7], which can effectively distinguish between normal network fluctuations and abnormal flow changes, ensure that the system does not frequently adjust the threshold in normal conditions, and respond in time in abnormal conditions, thereby improving the stability and sensitivity of the system.

[0175] The change deviation is obtained by calculating the relative deviation between the flow change rate and the preset flow threshold. Then, the flow ratio deviation is obtained by calculating the relative deviation between the in-out flow ratio and the preset flow ratio threshold. Then, the change deviation and the preset flow change weight, and the flow ratio deviation and the preset flow ratio weight are weighted and summed to obtain the deviation index. The preset flow threshold is adjusted according to the deviation index, the preset deviation index range, and the number to obtain an adjusted flow threshold, or the preset number threshold is adjusted to obtain an adjusted number threshold.

[0176] By calculating the relative deviations of the flow change rate and the in-out flow ratio, the abnormal fluctuations of the network flow can be captured sensitively, and the deviation index obtained by weighted summation further quantifies the degree of these abnormalities, providing a scientific basis for the dynamic adjustment of the threshold. The threshold is adjusted in combination with the number of abnormal nodes, so that the system can automatically optimize the monitoring parameters according to the actual flow conditions under different network environments, thereby improving the identification accuracy and response efficiency of potential threats.

[0177] Specifically, the preset flow threshold is adjusted according to the deviation index, the preset deviation index range, and the number to obtain an adjusted flow threshold, or the preset number threshold is adjusted to obtain an adjusted number threshold, including:

[0178] When the deviation index is greater than the maximum value of the preset deviation index range, the preset flow threshold is increased according to the relative deviation between the deviation index and the maximum value of the preset deviation index range and a preset first adjustment coefficient to obtain an adjusted flow threshold;

[0179] When the deviation index is less than the minimum value of the preset deviation index range, the relative deviation between the deviation index and the minimum value of the preset deviation index range is calculated to obtain an index deviation;

[0180] An absolute value of a relative deviation of the quantity and the preset quantity threshold is calculated to obtain a quantity deviation;

[0181] The quantity deviation, a preset quantity deviation weight, the index deviation, and a preset index deviation weight are weighted and summed to obtain an adjustment factor;

[0182] The preset quantity threshold is increased according to the adjustment factor and a preset second adjustment coefficient to obtain an adjusted quantity threshold.

[0183] The preset first adjustment coefficient is a coefficient for adjusting the preset flow threshold when the deviation index exceeds a preset range, and is determined by dynamic characteristics of network flow changes and flexibility of a security policy, and is usually set to be between 1.1 and 1.5. In the embodiment, the preset first adjustment coefficient is set to be 1.2, which can ensure that the flow threshold can be moderately increased when the deviation index exceeds a normal range, and avoid misjudgment caused by an excessively large adjustment range of the threshold.

[0184] The preset quantity deviation weight is a weight coefficient for adjusting an influence degree of the quantity deviation on the final adjustment factor when the adjustment factor is calculated, and is determined by importance of the quantity deviation in overall anomaly detection and sensitivity of the system to changes in the number of node associations, and is usually set to be between 0.3 and 0.7. In the embodiment, the preset quantity deviation weight is set to be 0.5, which can balance contributions of the quantity deviation and other factors to the adjustment factor.

[0185] The preset index deviation weight is a weight coefficient for adjusting an influence degree of the deviation index on the final adjustment factor when the adjustment factor is calculated, and is determined by importance of the deviation index in overall anomaly detection and sensitivity of the system to an abnormal degree of flow changes, and is usually set to be between 0.3 and 0.7. In the embodiment, the preset index deviation weight is set to be 0.5, which can balance contributions of the deviation index and other factors to the adjustment factor.

[0186] The preset second adjustment coefficient is a proportional coefficient for adjusting the preset quantity threshold according to the adjustment factor, and is determined by sensitivity and stability requirements of the system for quantity threshold adjustment and dynamic change characteristics of a network environment, and is usually set to be between 0.1 and 0.3. In the embodiment, the preset second adjustment coefficient is set to be 0.2, which can ensure that adjustment of the quantity threshold can reflect changes in the network environment, and also can not cause instability of the system due to an excessively large adjustment range.

[0187] By comparing the deviation index and the preset deviation index range, when the deviation index is greater than the maximum value of the preset range, the preset flow threshold is moderately increased according to the relative deviation of the deviation index and the maximum value of the preset range, combined with the preset first adjustment coefficient, so as to obtain the adjusted flow threshold; when the deviation index is less than the minimum value of the preset range, the relative deviation between the deviation index and the minimum value of the preset deviation index range is calculated to obtain the index deviation, then the absolute value of the relative deviation between the current connection quantity and the preset quantity threshold is calculated to obtain the quantity deviation, then the quantity deviation and the index deviation are weighted and summed respectively with the preset weights corresponding to them, so as to obtain the adjustment factor, finally, the preset quantity threshold is adjusted according to the adjustment factor and the preset second adjustment coefficient to obtain the new adjusted quantity threshold.

[0188] By comprehensively considering the deviation index, the preset deviation index range and the quantity and other multi-dimensional data, the deviation index reflects the deviation degree of the current network flow from the preset range, and by comparing with the maximum value and the minimum value of the preset range, it can be judged whether the network flow is abnormal. When the deviation index exceeds the preset range, the flow threshold is moderately increased by the preset first adjustment coefficient, so as to avoid misjudgment caused by too large adjustment range of the threshold, and to ensure that the flow threshold can adapt to the dynamic change of the network flow. Secondly, when the deviation index is lower than the preset range, the index deviation and the quantity deviation are weighted and summed to obtain the adjustment factor, and then the quantity threshold is adjusted, which not only can flexibly adjust the threshold according to the actual change of the network flow, but also can effectively reduce the false positive rate and improve the accuracy and adaptability of network security monitoring.

[0189] So far, the technical scheme of the present application has been described in combination with the preferred embodiments shown in the drawings, but it is easy for those skilled in the art to understand that the protection scope of the present application is obviously not limited to these specific embodiments. Those skilled in the art can make equivalent changes or replacements to the related technical features without departing from the principles of the present application, and the technical scheme after the changes or replacements will fall within the protection scope of the present application.

Claims

1. A network security threat perception, identification and response method based on security knowledge graph, characterized in that: include: Real-time acquisition of traffic change rate, inbound and outbound traffic ratio, source IP address, request success rate, and session interruption rate of each monitoring node in the enterprise's security knowledge graph built with each network device as the monitoring node; Determine a number of temporary nodes and focus nodes according to the traffic change rate and a preset traffic threshold; Determine a number of marked nodes according to the inbound and outbound traffic ratios and the source IP addresses of the focus node and any temporary node within a preset marking time period; Determine a number of risk nodes and a number of suspicious nodes according to the request success rate and the session interruption rate of each marked node; Determine a number of risk nodes based on the inflow and outflow ratios of the concerned node and any of the suspicious nodes within a preset correction time period; Connecting two risk nodes according to the source IP addresses of any two risk nodes to obtain a plurality of graph edges; Determine a number of abnormal nodes based on the number of graph edges connecting each of the risk nodes and a preset number threshold; Adjusting the preset flow threshold according to the flow change rate, the inflow / outflow ratio, and the number of each abnormal node to obtain an adjusted flow threshold, or adjusting the preset number threshold to obtain an adjusted number threshold; Alarms are issued for all abnormal nodes that are re-determined based on the adjusted flow threshold or the adjusted quantity threshold.

2. The network security threat perception, identification and response method based on security knowledge graph according to claim 1 is characterized in that: According to the traffic change rate and the preset traffic threshold, several temporary nodes and focus nodes are determined, including: When the flow change rate is greater than the preset flow threshold, determining the monitoring node as the temporary node, and obtaining a plurality of the temporary nodes; The flow change rates of all the temporary nodes are compared, and the temporary node with the largest flow change rate is determined as the focus node.

3. The network security threat perception, identification and response method based on security knowledge graph according to claim 2 is characterized in that: Determining a number of marked nodes according to the inbound and outbound traffic ratios and the source IP addresses of the focused node and any temporary node within a preset marking time period includes: Calculating the standard deviation of the inflow and outflow ratio of the node of interest to obtain a fluctuation value of the interest ratio; Counting the number of different source IP addresses among all source IP addresses of the node of interest, calculating the probability of each source IP address appearing, calculating the Shannon entropy based on all the probabilities, and calculating the standard deviation of the Shannon entropy to obtain the attention dispersion fluctuation value; Normalizing the attention flow ratio fluctuation value to obtain an attention flow normalized value, and normalizing the attention dispersion fluctuation value to obtain an attention dispersion normalized value; Calculating the correlation coefficient between the normalized value of the attention flow and the normalized value of the attention dispersion to obtain the attention correlation; When the attention correlation is greater than a preset correlation threshold, calculating the standard deviation of the inbound and outbound flow ratios of each of the temporary nodes to obtain a temporary flow ratio fluctuation value; Counting the number of different source IP addresses among all source IP addresses of the temporary node, calculating the probability of each source IP address appearing, calculating the Shannon entropy based on all the probabilities, and calculating the standard deviation of the Shannon entropy to obtain a temporary dispersion fluctuation value; Normalizing the temporary flow ratio fluctuation value to obtain a temporary flow normalized value, and normalizing the temporary dispersion fluctuation value to obtain a temporary dispersion normalized value; Calculating a correlation coefficient between the temporary flow normalized value and the temporary dispersion normalized value to obtain a temporary correlation degree; When the temporary relevance is greater than the attention relevance, the temporary node and the attention node are determined to be the marked nodes, so as to determine a plurality of marked nodes.

4. The network security threat perception, identification and response method based on security knowledge graph according to claim 3 is characterized in that: Determining a number of risk nodes and a number of suspicious nodes according to the request success rate and the session interruption rate of each marked node includes: Draw a change curve of the request success rate within a preset determination time to obtain a request change curve; Calculating a slope change rate of the request change curve at a preset time distance to obtain a plurality of request slope change rates; When the number of times that the request slope change rate is less than zero is greater than a preset number threshold, a change curve of the session interruption rate within a preset determination time period is plotted to obtain an interruption change curve; Calculating the slope change rate of the interruption change curve at the preset time distance to obtain a plurality of interruption slope change rates; When the number of times that the interruption slope change rate is greater than zero is greater than the preset number threshold, calculating the average of all the request slope change rates to obtain the average request change rate, and calculating the average of all the interruption slope change rates to obtain the average interruption change rate; Calculating a relative deviation between an absolute value of the average request change rate and an absolute value of the average interrupt change rate to obtain a slope deviation; When the slope deviation is less than a preset slope deviation threshold, a number of risk nodes and a number of suspicious nodes are determined according to the request success rate, the session interruption rate, and a preset consistency threshold.

5. The network security threat perception, identification and response method based on security knowledge graph according to claim 4 is characterized in that: Determining a number of risk nodes and a number of suspicious nodes based on the request success rate, the session interruption rate, and a preset consistency threshold includes: Calculate the standard deviation of the request success rate within the preset determination time to obtain a request fluctuation value; Calculating the standard deviation of the session interruption rate within the preset determination time to obtain an interruption fluctuation value; Normalizing the request fluctuation value within the preset determination time to obtain a standard request fluctuation value, and normalizing the interruption fluctuation value within the preset determination time to obtain a standard interruption fluctuation value; Calculating the correlation coefficient between the standard request fluctuation value and the standard interruption fluctuation value to obtain the change consistency; When the change consistency is less than zero and the absolute value of the change consistency is greater than the preset consistency threshold, determining the focus node as the risk node to determine a number of risk nodes; When the change consistency is greater than zero and the absolute value of the change consistency is greater than the preset consistency threshold, the focus node is determined to be the suspicious node, so as to determine a number of suspicious nodes.

6. The network security threat perception, identification and response method based on security knowledge graph according to claim 5 is characterized in that: Several risk nodes are determined based on the inbound and outbound traffic ratios of the focus node and any of the suspicious nodes within the preset correction time, including: Calculating the standard deviation of the inflow and outflow ratio of the node of interest to obtain a fluctuation value of the inflow and outflow ratio of interest; Calculating the standard deviation of the inbound and outbound traffic ratio of the suspicious node to obtain a suspicious inbound and outbound ratio fluctuation value; Normalizing the fluctuation value of the attention-in / out ratio to obtain a normalized value of the attention-in / out ratio, and normalizing the fluctuation value of the suspicious in / out ratio to obtain a normalized value of the suspicious in / out ratio; Calculating the relative deviation between the normalized value of the attention input-output ratio and the normalized value of the suspicious input-output ratio to obtain an input-output ratio deviation value; When the input-output ratio deviation value is less than a preset input-output ratio deviation threshold, the suspicious node is determined to be the risk node, so as to determine a number of risk nodes.

7. The network security threat perception, identification and response method based on security knowledge graph according to claim 6 is characterized in that: Connect any two risk nodes according to their source IP addresses to obtain several graph edges, including: Counting the number of occurrences of all the source IP addresses of each risk node to obtain the number of source IP addresses; When the ratio of the number of source IP addresses of any two risk nodes is less than a preset ratio threshold, calculating the overlap rate of the source IP addresses of the two risk nodes to obtain the IP overlap rate; When the IP overlap rate is greater than a preset overlap rate threshold, two risk nodes are connected to obtain a plurality of graph edges.

8. The network security threat perception, identification and response method based on security knowledge graph according to claim 7 is characterized in that: Determining a number of abnormal nodes based on the number of graph edges connecting each of the risk nodes and a preset number threshold includes: When the number is greater than a preset number threshold, the risk node is determined to be the abnormal node, so as to determine a number of abnormal nodes.

9. The network security threat perception, identification and response method based on security knowledge graph according to claim 8 is characterized in that: Adjusting the preset flow threshold according to the flow change rate, the inflow / outflow ratio, and the number of each abnormal node to obtain an adjusted flow threshold, or adjusting the preset number threshold to obtain an adjusted number threshold, includes: Calculating a relative deviation between the flow rate change rate and the preset flow threshold to obtain a change deviation; Calculating a relative deviation between the inlet and outlet flow ratio and a preset flow ratio threshold to obtain a flow ratio deviation; Performing weighted summation on the change deviation, the preset flow change weight, the flow ratio deviation, and the preset flow ratio weight to obtain a deviation index; The preset flow threshold is adjusted according to the deviation index, the preset deviation index range, and the quantity to obtain an adjusted flow threshold, or the preset quantity threshold is adjusted to obtain an adjusted quantity threshold.

10. The network security threat perception, identification and response method based on security knowledge graph according to claim 9 is characterized in that: Adjusting the preset flow threshold according to the deviation index, the preset deviation index range, and the quantity to obtain an adjusted flow threshold, or adjusting the preset quantity threshold to obtain an adjusted quantity threshold, includes: When the deviation index is greater than the maximum value of the preset deviation index range, the preset flow threshold is increased according to the relative deviation between the deviation index and the maximum value of the preset deviation index range and a preset first adjustment coefficient to obtain an adjusted flow threshold; When the deviation index is less than the minimum value of the preset deviation index range, calculating the relative deviation between the deviation index and the minimum value of the preset deviation index range to obtain the index deviation; Calculating an absolute value of a relative deviation between the quantity and the preset quantity threshold to obtain a quantity deviation; Performing a weighted summation on the quantity deviation, the preset quantity deviation weight, the index deviation, and the preset index deviation weight to obtain an adjustment factor; The preset quantity threshold is increased according to the adjustment factor and the preset second adjustment coefficient to obtain the adjustment quantity threshold.

Images