A network security situation awareness system

Abstract

The present invention relates to the field of network security, and more specifically to a network security situation awareness system. The present invention includes a feature dictionary module for presetting a keyword library; a situation awareness module for monitoring publicly available network information and extracting, through the keyword library, target information and network attack information from network attack events occurring in the publicly available network information; a self-identification module for capturing network data in a network system, extracting target keywords from the network data through the keyword library, and determining network system information; and an analysis module for obtaining network attack events for the situation awareness module. The analysis module also includes a trained BP neural network that inputs network system information and outputs the causal relationship between each network attack information occurrence based on historical network attack events. The technical solution of the present invention can perceive the characteristics of existing reported network attacks and, combined with the characteristics of the network system itself, predict the causal relationship between network attacks.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a network security situation awareness system. Background Art

[0002] The Cybersecurity Situational Awareness System is an intelligent security protection system based on big data and artificial intelligence technologies. It collects multi-source data such as network traffic, device logs, and threat intelligence in real time, combines machine learning with rule engines for in-depth analysis, and dynamically identifies abnormal behaviors, attack patterns, and potential risks. Its core value lies in transforming fragmented security information into a global visual situation. For example, through attack path tracking and risk heat maps, it helps managers quickly locate the source of threats, assess asset vulnerabilities, and predict attack trends, thereby supporting the transition from passive response to active defense. The system is widely used in finance, energy, government affairs, and other fields. It can not only improve threat response efficiency and reduce losses from security incidents, but also meet regulatory requirements through automated compliance reporting, becoming a key infrastructure for building a resilient security architecture in the digital age.

[0003] In the prior art, for example, patent announcement number CN110049015B discloses a network security situational awareness system, which monitors the network security of the power monitoring system by collecting data from the power monitoring system in real time and analyzing the data. Patent publication number CN117097539A discloses a network security status perception method and system based on situational awareness, which evaluates the current security status of each device according to the attack process currently corresponding to each device in the network, and generates a real-time security status perception result of the network in combination with the current security status of all devices. However, the prior art collects data generated by the attack itself, and it is difficult to predict the attack. Network attacks are man-made events and often have a certain degree of targeting, such as attacks on enterprises in the same industry, scale or location. Therefore, by perceiving the characteristics of existing reported network attacks and combining the characteristics of its own network system, it is possible to effectively warn and prevent network attacks. Summary of the Invention

[0004] To solve the above problems, the present invention provides a network security situation awareness system for perceiving the characteristics of existing reported network attacks and predicting the causality of network attacks based on the characteristics of its own network system.

[0005] In order to achieve the above-mentioned purpose, the technical solution of the present invention is as follows: A network security situation awareness system, comprising:

[0006] Feature dictionary module: used to preset a keyword library, which includes several target keywords and attack keywords. The target keywords are bound to the industry, system type, and region where the target keywords appear. The attack keywords are bound to the attack method, source, time, and purpose corresponding to the attack keywords.

[0007] Situational Awareness Module: This module monitors public network information and uses a keyword library to extract information about the target and attack in cyberattack incidents. Target information includes industry, system type, and region, while cyberattack information includes attack method, source, time, and purpose.

[0008] Self-identification module: used to capture network data in the network system, extract target keywords from the network data through the keyword library, and determine the industry, system type and regional information of the network system;

[0009] Analysis module: used to obtain network attack events from the situation awareness module, and divide network attack events into new network attack events and historical network attack events based on time nodes; the analysis module is equipped with a similarity judgment function, which is used to judge the similarity between two network attack events; the analysis module is used to calculate the number of network attack events in historical network attack events that are similar to new network attack events within a preset value range, and calculate causality based on the number and time node distribution of network attack events within the preset value range; the analysis module also includes a trained BP neural network, which is used to train based on new network attack events and historical network attack events and their causal relationship samples. The BP neural network is used to input industry, system type and regional information of the network system, and output the causality of each network attack information based on historical network attack events.

[0010] The above scheme has the following beneficial effects:

[0011] In this solution, the self-identification module effectively identifies the user's network system by capturing network data, extracting keywords, and determining the characteristics of the user's network system. The situational awareness module obtains information from public networks, such as news, reports, or professional websites, and extracts network attack events from this public network information and analyzes the information of each network attack event.

[0012] 2. In this solution, since cyberattacks are human actions with a certain purpose, attacks may be launched when the target meets their purpose. Therefore, the purpose of cyberattacks can be analyzed through the big data accumulated from public network information. First, it is necessary to determine which cyberattacks have the same purpose. The analysis module can analyze the similarity between two cyberattacks. A high similarity indicates that the two cyberattacks have the same purpose. In addition, the same purpose does not necessarily mean there is a correlation. Therefore, the analysis module is also used to calculate causality based on the number and time node distribution of cyberattack events. A high causality indicates that multiple attacks are indeed driven by the same purpose. It can be used to determine whether the user's network system is also the target of potential attackers based on the characteristics of related cases.

[0013] 3. In this solution, the BP neural network can form a mapping between various features and network attacks through training, bring in the characteristics of the user's network system, and judge the causality of each network attack information based on the characteristics of the user's network system, so that the user can carry out relevant protection or resolve network attacks.

[0014] Furthermore, the attacked target information and network attack information extracted from the situation awareness module are both tree-structured data, and the parent node data in the tree-structured data is the parent class of the child node data.

[0015] Beneficial effects: Usually network systems have multiple sub-modules, and the sub-modules provide services in different fields. Therefore, the extracted features are also represented by tree-structured data that can represent the parent-child relationship, and each parent node data is the parent class of the child node data. In this way, the parent-child relationship can be well summarized and the consistency of the parent-child relationship can be maintained, which is convenient for subsequent similarity judgment.

[0016] Furthermore, the industry, system type and regional information of the network system determined by the self-identification module are also tree-structured data, and the target keyword extraction of the self-identification module includes variable names and variable values ​​in the network data.

[0017] Beneficial effect: When the self-identification module extracts target keywords, in addition to extracting variable values, according to the naming conventions during system design, the variable names can also reflect the relationship between the network system and the industry, system type and regional information to a certain extent.

[0018] Furthermore, the keyword library in the feature dictionary module includes Chinese words and English words.

[0019] Beneficial effects: The network system is mixed with Chinese, English and other languages, so the feature dictionary module needs to include at least Chinese words and English words.

[0020] Furthermore, in the analysis module, both new network attack events and historical network attack events are deduplicated.

[0021] Beneficial effect: The same network attack events may appear repeatedly in public network information, so it is necessary to deduplicate new network attack events and historical network attack events.

[0022] Furthermore, cyberattack events occurring within one month are considered new cyberattack events, and cyberattack events occurring between one month and three years are considered historical cyberattack events.

[0023] Beneficial effect: Both new cyber attack events and historical cyber attack events can be multiple events within a period of time, and thus can be classified based on one month and three years as time points, respectively.

[0024] Furthermore, in the analysis module, the network attack event with the largest time node value is a new network attack event, and all the events before the new network attack event are historical network attack events.

[0025] Beneficial effect: There can be only one new cyber attack event, so more cyber attack events can be taken into account when calculating causality.

[0026] Furthermore, the similarity judgment function judges the similarity based on the attacked target information and network attack information of the two network attack events. When the tree structure data of the two network attack events do not have the same nodes, the similarity is 0; when the tree structure data of the two network attack events have the same nodes, the similarity is proportional to the number of the same nodes.

[0027] Beneficial effect: Since tree-structured data is used, various events under the same parent class can be traced back to the same parent node. Therefore, comparing tree-structured data will directly consider whether the same parent class exists. Therefore, it is only necessary to determine whether the same nodes exist to know whether the network attack events are similar, and the similarity is proportional to the number of the same nodes.

[0028] Furthermore, when the similarity judgment function judges the similarity of the regional information, the similarity value is also corrected based on the spatial distance between the regions of the two network attack events.

[0029] Beneficial effects: The tree-structured data of regional information can provide feedback on regional affiliation. However, for example, cities located on provincial borders may have a small spatial distance but belong to different provinces. Therefore, when judging the similarity of regional information, the spatial distance between the regions of two cyber attack events must also be considered to better evaluate the correlation between the two cyber attack events.

[0030] Furthermore, causality is proportional to the number of cyber attack events with similarity within a preset value range, and causality is proportional to the size of the time node.

[0031] Beneficial effect: Causality represents the probability that cyber-attack events are driven by the same purpose. Therefore, it is proportional to the number of cyber-attack events, and the closer the time of occurrence is to the new cyber-attack event, the greater the causality.

[0032] Additional aspects and advantages of the present invention will be set forth in part in the description which follows and, in part, will be obvious from the description which follows, or may be learned by practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 This is a module diagram of an embodiment of a network security situation awareness system according to the present invention;

[0034] Figure 2 This is a logical diagram of an embodiment of the network security situation awareness system of the present invention. DETAILED DESCRIPTION

[0035] The technical solution of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0036] In the description of the present invention, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicating orientations or positional relationships, are based on the orientations or positional relationships shown in the accompanying drawings and are intended solely to facilitate and simplify the description of the present invention. They are not intended to indicate or imply that the devices or components referred to must have, be constructed, or operate in a specific orientation, and therefore should not be construed as limitations on the present invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0037] In the description of the present invention, it should be noted that, unless otherwise expressly specified or limited, the terms "mounted," "connected," and "connected" should be understood in a broad sense. For example, they may refer to fixed, detachable, or integral connections; mechanical or electrical connections; direct or indirect connections through an intermediate medium; and internal communication between two components. Those skilled in the art will understand the specific meanings of the above terms in the present invention based on the specific circumstances.

[0038] The following is further described in detail through specific implementation methods:

[0039] Example 1:

[0040] As attached Figure 1-Figure 2Shown: A network security situation awareness system, comprising:

[0041] Feature Dictionary Module: This module is used to pre-set a keyword library. This library includes several target keywords and attack keywords. Target keywords are associated with the industry, system type, and region in which they appear. Attack keywords are associated with the attack method, source, time, and purpose associated with the attack keyword. The keyword library in the feature dictionary module includes both Chinese and English terms.

[0042] Situational Awareness Module: This module monitors publicly available network information and uses a keyword library to extract information about targets and attacks from cyberattacks. This information includes industry, system type, and region, while attack information includes attack method, source, time, and purpose. The target and attack information extracted by the Situational Awareness Module are tree-structured data, where the parent node is the parent class of the child node. For example, industry information is represented as: Dairy Farming - Cattle Farming - Animal Husbandry - Agriculture.

[0043] Self-identification module: used to capture network data in the network system, extract target keywords from the network data through the keyword library, and determine the industry, system type and regional information of the network system. The industry, system type and regional information of the network system determined by the self-identification module are also tree-structured data. The target keyword extraction of the self-identification module includes the variable name and variable value in the network data.

[0044] The analysis module is used to obtain cyberattack events from the situational awareness module. It classifies cyberattack events into new and historical events based on time nodes. Both new and historical events are deduplicated. The event with the largest time node value is considered a new event, while all events preceding the new event are historical events. The analysis module includes a similarity determination function, which determines the similarity between two cyberattack events. This function determines similarity based on the target information and attack information of the two events. If the tree structure data of the two events do not contain identical nodes, the similarity is zero. If the tree structure data of the two events contain identical nodes, the similarity is proportional to the number of identical nodes. When determining geographic similarity, the similarity function also adjusts the similarity value based on the spatial distance between the two events.

[0045] The analysis module calculates the number of historical cyberattack events with a similarity within a preset range to the new cyberattack event. Causality is calculated based on the number of cyberattack events within the preset range and the time node distribution. Causality is proportional to the number of cyberattack events with a similarity within the preset range, and causality is proportional to the size of the time node.

[0046] The analysis module also includes a trained BP neural network, which is used to be trained based on new network attack events and historical network attack events and their causal relationship samples. The BP neural network is used to input the industry, system type and regional information of the network system, and output the causal relationship of each network attack information based on historical network attack events.

[0047] The self-identification module can effectively identify the user's network system. Based on the capture of network data, it extracts keywords and determines the characteristics of the user's network system. The situational awareness module obtains information from the public network, which can be news, reports, or professional websites. It extracts network attack events that occur in the public network information and parses the information of each network attack event. Since network systems have multiple sub-modules, and the sub-modules provide services in different fields, the extracted features are also represented by tree-structured data that can represent parent-child relationships. In addition, each parent node data is the parent class of the child node data. In this way, the parent-child relationship can be well summarized and the consistency of the parent-child relationship can be maintained, which facilitates subsequent similarity judgment.

[0048] When the self-identification module extracts target keywords, in addition to extracting variable values, according to the naming conventions during system design, the variable name usually summarizes the type represented by the variable value. For example, the variable name ID for uploading user information is usually named UserID, and the variable name for uploading object information is also named with the English name of the object + the attribute name of the object. The captured network data is usually a KEY-VALUE pair, so the variable name can be easily obtained. The variable name can also reflect the relationship between the network system and the industry, system type and regional information to a certain extent.

[0049] The network system is a mixture of Chinese, English and other languages, so the feature dictionary module needs to include at least Chinese words and English words. For example, variable names are usually expressed in English, while variable values ​​are expressed in Chinese. Therefore, the feature dictionary module adapts Chinese words and English words to effectively extract target keywords.

[0050] Because cyberattacks are human-generated and purposeful, they are likely to launch attacks when the target meets their objectives. Therefore, it is possible to analyze the purpose of cyberattacks through the big data accumulated from publicly available online information. Publicly available online information often describes the target of the attack, as well as the losses and impacts incurred. Keywords can be extracted from the reports to assess the target information and cyberattack information, forming a data set for analysis.

[0051] When conducting analysis, the first step is to determine which cyberattacks share common objectives. The analysis module analyzes the similarity between two cyberattacks. A high degree of similarity indicates that the two cyberattacks share the same objective. Because tree-structured data is used, all events under the same parent category are traced back to the same parent node. Therefore, comparing tree-structured data directly considers whether the parent category exists. Therefore, simply determining whether there are identical nodes is sufficient to determine whether cyberattack events are similar, and the degree of similarity is proportional to the number of identical nodes. While tree-structured data on geographic information can provide information on geographic affiliation, cities located on provincial borders, for example, may have a small spatial distance but different provincial affiliations. Therefore, when determining geographic similarity, the spatial distance between two cyberattack events must also be considered to better assess their correlation.

[0052] In addition, the same purpose does not necessarily mean there is a correlation. For example, if the number of similar events is rare, it is very likely that the attack was just a coincidence, or if the time interval is long, the correlation between the two network attack events will also be small. Therefore, the analysis module is also used to calculate causality based on the number and time node distribution of network attack events. High causality indicates that multiple attacks are indeed driven by the same purpose. The characteristics of related cases can be used to determine whether the user's network system is also the target of potential attackers to achieve their goals.

[0053] The BP neural network can form a mapping between various features and network attacks through training, bring in the characteristics of the user's network system, and judge the causality of each network attack information based on the characteristics of the user's network system. When the causality is strong, it indicates that there is a potential source of attack that will launch a network attack, so that the user can carry out relevant protection or means to resolve the network attack.

[0054] Example 2:

[0055] The difference from the above embodiment is that network attack events within one month are new network attack events, and network attack events between one month and three years are historical network attack events.

[0056] Both new cyber attack incidents and historical cyber attack incidents can be multiple incidents within a period of time, so they can be classified based on the time points of one month and three years respectively.

[0057] Obviously, the above embodiments are merely examples for clarity of explanation and are not intended to limit the implementation methods. Those skilled in the art will readily appreciate that other variations or modifications based on the above descriptions are possible. It is not necessary and impossible to enumerate all implementation methods here. Obvious variations or modifications arising therefrom remain within the scope of protection of the present invention.

Claims

1. A network security situation awareness system, characterized in that: include: Feature dictionary module: used to preset a keyword library, which includes several target keywords and attack keywords. The target keywords are bound to the industry, system type, and region where the target keywords appear. The attack keywords are bound to the attack method, source, time, and purpose corresponding to the attack keywords. Situational Awareness Module: This module monitors public network information and uses a keyword library to extract information about the target and attack in cyberattack incidents. Target information includes industry, system type, and region, while cyberattack information includes attack method, source, time, and purpose. Self-identification module: used to capture network data in the network system, extract target keywords from the network data through the keyword library, and determine the industry, system type and regional information of the network system; Analysis module: used to obtain network attack events from the situation awareness module and classify network attack events into new network attack events and historical network attack events based on time nodes; the analysis module has a similarity judgment function, which is used to determine the similarity between two network attack events; The analysis module is used to calculate the number of network attack events in historical network attack events whose similarity with new network attack events is within a preset value range, and calculate causality based on the number and time node distribution of network attack events within the preset value range; the analysis module also includes a trained BP neural network, which is used to be trained based on new network attack events and historical network attack events and their causal relationship samples. The BP neural network is used to input the industry, system type and regional information of the network system, and output the causality of each network attack information based on historical network attack events.

2. The network security situation awareness system according to claim 1, characterized in that: The attacked target information and network attack information extracted from the situation awareness module are both tree-structured data, and the parent node data in the tree-structured data is the parent class of the child node data.

3. The network security situation awareness system according to claim 2, characterized in that: The industry, system type and regional information of the network system determined by the self-identification module are also tree-structured data. The target keyword extraction of the self-identification module includes the variable names and variable values ​​in the network data.

4. The network security situation awareness system according to claim 3, characterized in that: The keyword library in the feature dictionary module includes Chinese words and English words.

5. The network security situation awareness system according to claim 4, characterized in that: In the analysis module, both new and historical network attack events are deduplicated.

6. The network security situation awareness system according to claim 5, characterized in that: Cyber ​​attack events within one month are considered new cyber attack events, and cyber attack events between one month and three years are considered historical cyber attack events.

7. The network security situation awareness system according to claim 5, characterized in that: In the analysis module, the network attack event with the largest time node value is the new network attack event, and all events before the new network attack event are historical network attack events.

8. The network security situation awareness system according to claim 7, characterized in that: The similarity judgment function judges the similarity based on the attacked target information and network attack information of two network attack events. When the tree structure data of two network attack events do not have the same nodes, the similarity is 0; when the tree structure data of two network attack events have the same nodes, the similarity is proportional to the number of the same nodes.

9. The network security situation awareness system according to claim 8, characterized in that: When the similarity judgment function judges the similarity of regional information, it also corrects the similarity value based on the spatial distance between the regions of two network attack events.

10. The network security situation awareness system according to claim 9, characterized in that: Causality is proportional to the number of network attack events with similarity within the preset value range, and causality is proportional to the size of the time node.

Images