Network security monitoring method and system based on dynamic vulnerability verification

Abstract

The application belongs to the field of network security, and particularly relates to a network security monitoring method and system based on dynamic verification of vulnerabilities, aiming to solve the problems of high false alarm rate of vulnerability verification during system operation and lack of defense. When a client requests an administrator vulnerability verification request, the method generates an administrator dynamic key to encrypt the to-be-verified data based on real-time system indicators, defense state parameters and a supply chain trust score corresponding to the client request; the encrypted to-be-verified data is verified; if the to-be-verified data is suspicious or abnormal, the defense level of the to-be-verified data is calculated and defense is performed; and the vulnerability library, verification parameters and / or defense parameters are updated according to the defense effect. The key generated by the application can resist supply chain pollution and quantum attacks, and improve the security of vulnerability verification during system operation; the vulnerability library is used to reduce the false negative rate through verification; and the vulnerability verification result is combined with real-time defense to realize a closed-loop vulnerability verification and defense evolution system.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of network security, and particularly relates to a network security monitoring method and system based on dynamic vulnerability verification, a computing device cluster, and a computer readable storage medium. BACKGROUND

[0002] Existing vulnerability verification technologies are usually performed when the system is not running, and cannot detect vulnerabilities in real time when the system is working normally, causing network security risks. To solve this problem, the Chinese patent document with publication number CN117240609B, "Network security monitoring method and system based on dynamic vulnerability verification", discloses a solution, which mainly uses different encryption methods for communication interactions of different users when the system is working normally, thereby preventing data leakage when sending vulnerability verification messages and ensuring the security of vulnerability verification when the system is running, so that vulnerability detection can also be performed under the system running state. In addition, the patent also discloses a way to improve security using a consistent key.

[0003] Although the above technical solution can differentiate the encryption of ordinary users and administrators, it uses a traditional hash algorithm to generate a key, which is a static encryption algorithm and is easy to be cracked by quantum computing. Moreover, it only completes encrypted communication and does not combine vulnerability verification results with real-time defense. In addition, in network systems, there are cases of open source library supply chain pollution attacks, in which attackers tamper with the automatic update mechanism of a popular open source library and implant hidden memory destruction vulnerabilities in legal software update packages, and the attack payload has no explicit malicious features, resulting in the failure of traditional feature matching in existing systems. Therefore, the above technical solution has the problems of insufficient encryption security and high vulnerability verification false positive rate.

[0004] In summary, how to perform vulnerability verification when the system is running and reduce vulnerability false positives and false negatives and perform defense is a problem that needs to be solved. SUMMARY

[0005] To solve the above problems in the prior art, i.e., high vulnerability verification false positive and false negative rates when the system is running and lack of defense, the present application provides a network security monitoring method and system based on dynamic vulnerability verification.

[0006] In a first aspect of the present application, a network security monitoring method based on dynamic vulnerability verification is provided, which includes receiving a client request, if the client request is an administrator vulnerability verification request, generating an administrator dynamic key K SC based on real-time system indicators, defense state parameters, and a supply chain trust score T t of the client request, and performing vulnerability verification based on the administrator dynamic key K tEncrypting the to-be-verified data; verifying the encrypted to-be-verified data based on the vulnerability library; if the to-be-verified data is suspicious or abnormal after verification, calculating a defense level of the to-be-verified data and performing defense according to the defense level; updating the vulnerability library, updating the verification parameter and / or updating the defense parameter according to the defense effect data.

[0007] Optionally, in the network security monitoring method, the network security monitoring method further comprises:

[0008] , wherein ω1, ω2, ω3 are weight coefficients, ω1=0.5, ω1=0.3, ω1=0.2, SignScore is signature validity, SignScore=1 if the signature is valid, and SignScore=0 if the signature is invalid, RepoScore is maintainer reputation, RepoScore∈[0,1], Channelcore is transmission protocol security, Channelcore=1 if the transmission protocol is HTTPS, Channelcore=0.5 if the transmission protocol is HTTP, and Channelcore=0 if the transmission protocol is other;

[0009] , wherein V1 is the number of registered users, V2 is the access volume, F a is attack frequency; N b is the number of banned IPs, QC_Hash is a quantum random walk-based anti-quantum hash function, outputting a 256-bit hash value, (Fa·Nb) is a current defense state code, Chaos(V2,t) is a chaotic sequence generation function with the access volume V2 as an initial value, and the expression of Chaos(V2,t) is: , wherein r represents a Logistic mapping, r=3.99, x n =V2 / 10 6 , and t is a current timestamp, which is iterated once per second.

[0010] Optionally, in the network security monitoring method, the verifying the encrypted to-be-verified data based on the vulnerability library comprises:

[0011] Decrypting the to-be-verified data, extracting a feature construction vector V of the to-be-verified data, matching the feature construction vector V with the vulnerability library, and calculating a feature similarity S;

[0012] Performing a taint propagation tracking on the to-be-verified data;

[0013] If S<S1, calculating a behavior deviation degree D of the to-be-verified data;

[0014] If S<S1 and D<D1, and the to-be-verified data does not trigger a dangerous function, determining that the to-be-verified data is normal.

[0015] If S1≤S<S2, or D1≤D<D2, or the taint propagation path of the to-be-verified data has no result, it is determined that the to-be-verified data is suspicious;

[0016] If S≥S2, or D≥D2, or the to-be-verified data triggers a dangerous function, it is determined that the to-be-verified data is abnormal, wherein S1 and S2 are preset feature similarity thresholds, and D1 and D2 are preset behavior deviation thresholds.

[0017] Optionally, in the network security monitoring method, the calculation of the feature similarity S comprises: , wherein V i is the ith dimension value of the flow feature of the to-be-verified data, n is the dimension value of the flow feature, the flow feature is a feature corresponding to a real-time flow indicator in a feature construction vector of the to-be-verified data, C i is the ith dimension standard value of the feature in the vulnerability library corresponding to the flow feature;

[0018] The calculation of the behavior deviation D of the to-be-verified data comprises:

[0019] , wherein T is a time window length, the default value is 60 seconds, x t is the flow feature of the to-be-verified data, λ is an entropy weight coefficient, λ=0.2, H IB is the implicit behavior entropy of the flow feature, , wherein x is an implicit behavior event.

[0020] Optionally, in the network security monitoring method, the encrypted to-be-verified data is verified based on the vulnerability library, and the method further comprises:

[0021] If T sc is less than a preset first threshold value, the thresholds D1 and D2 corresponding to the behavior deviation D are reduced, and the taint propagation tracking adds dynamic memory boundary checking;

[0022] If T sc is less than a preset first threshold value and if H IB is greater than a preset third threshold value, the taint propagation tracking adds dynamic memory boundary checking;

[0023] If T sc is less than a preset second threshold value, the thresholds D1 and D2 corresponding to the behavior deviation D are continuously reduced, and the taint propagation tracking adds dynamic memory boundary checking;

[0024] If T sc is less than a preset second threshold value or if H IBif the third threshold value is greater than a preset third threshold value, the to-be-verified data is put into a sandbox for verification;

[0025] if the result of the sandbox verification is abnormal, the to-be-verified data is determined to be abnormal, and if the result of the sandbox verification is not abnormal, the to-be-verified data is determined to be suspicious.

[0026] Optionally, in the network security monitoring method, if the to-be-verified data is suspicious or abnormal after verification, a defense level of the to-be-verified data is calculated, including: calculating a ban weight W: wherein, α, β, γ are preset dynamic weight coefficients, δ is a defense tolerance, and the key strength is an entropy value of K t if the to-be-verified data is suspicious, the threat level is a preset first level value, and if the to-be-verified data is abnormal, the threat level is a preset second level value.

[0027] Optionally, in the network security monitoring method, if the to-be-verified data is suspicious or abnormal after verification, before the defense level of the to-be-verified data is calculated, the to-be-verified data is further detected, and the secondary detection includes:

[0028] if the to-be-verified data is suspicious data after verification, the suspicious encrypted data is replayed in a sandbox and the to-be-verified data is executed, if there is no dangerous behavior in the sandbox, the to-be-verified data is determined to be normal, if an irregular operation is detected and no attack is detected, the to-be-verified data is determined to be suspicious, and if a vulnerability is triggered, the to-be-verified data is determined to be abnormal.

[0029] if the to-be-verified data is abnormal data after verification, the to-be-verified data is subjected to probe interaction analysis, if an attacker does not trigger a probe, the to-be-verified data is determined to be normal, if an attacker submits a probe and the payload is invalid, the to-be-verified data is determined to be suspicious, and if an attacker submits a valid attack payload, the to-be-verified data is determined to be abnormal.

[0030] the defense level of the to-be-verified data is calculated, including: calculating the defense level of the to-be-verified data which is suspicious or abnormal after secondary detection.

[0031] Optionally, in the network security monitoring method, the defense according to the defense level includes: if the ban weight W is less than W1, no action is taken.

[0032] if W1≤W

[0033] if W2≤W

[0034] If W≥W3, the IP corresponding to the request of the to-be-verified data is blocked and the blocking duration reaches a preset second duration, and a high-level trap is generated, wherein W1, W2, and W3 are preset level thresholds, and the second duration is greater than the first duration.

[0035] Optionally, the network security monitoring method further comprises: if T sc is less than a preset second threshold, blocking the IP corresponding to the request of the to-be-verified data.

[0036] Optionally, the network security monitoring method, the defense effect data comprises a false positive rate, a false negative rate, a traffic baseline smoothness, and a key update frequency, and the updating of the defense parameter according to the defense effect data comprises: if the false positive rate is greater than a preset fourth threshold, reducing the value of α in the calculation of the blocking weight W, if the false negative rate is greater than a preset fifth threshold, increasing the value of α, if the traffic baseline smoothness is within a preset range, increasing the value of β in the calculation of the blocking weight W, if the traffic baseline smoothness is outside the preset range, reducing the value of β, if the key update frequency is less than or equal to a preset sixth threshold, keeping the value of γ in the calculation of the blocking weight W, and if the key update frequency is greater than the preset sixth threshold, increasing the value of γ, wherein α, β, and γ are values greater than 0.

[0037] Optionally, the network security monitoring method, the defense effect data comprises a false positive rate and a false negative rate, and the verification parameter comprises a feature similarity threshold and a behavior deviation threshold, and the updating of the verification parameter according to the defense effect data comprises: if the false positive rate R FP is greater than a preset false positive threshold, calculating a new behavior deviation threshold D th new ,

[0038] wherein η D is a preset behavior deviation learning rate, is a preset behavior deviation loss value, D th new comprises the new behavior deviation thresholds D1 and D2, and D th old is a current behavior deviation threshold, and D th old comprises the behavior deviation thresholds D1 and D2 before the new behavior deviation threshold is calculated;

[0039] If the false negative rate R FN is greater than a preset false negative threshold, a new feature similarity threshold S th new ,

[0040] , where η S The preset feature similarity learning rate, S is the preset feature similarity loss value. th new Including new feature similarity thresholds S1 and S2, S th old S is the current feature similarity threshold. th old This includes feature similarity thresholds S1 and S2 before calculating the new feature similarity threshold.

[0041] Optionally, in the network security monitoring method, updating the vulnerability database based on defense effectiveness data includes: capturing attack payloads and obtaining a standardized feature vector V corresponding to the attack payloads. new ; Calculate V new Maximum similarity S with existing features in the vulnerability database max , , where C j Let S be the feature vector of the j-th vulnerability already existing in the vulnerability database, and m be the number of vulnerabilities in the vulnerability database. max If the value is less than the preset matching threshold, V will be... new Add to the vulnerability database.

[0042] Optionally, the network security monitoring method, in which the verification parameters are updated based on the defense effectiveness data, further includes: obtaining the verification parameters and implicit behavioral entropy statistics of all network nodes; and aggregating and calculating the global verification parameter θ. global :

[0043] , among which, DT i Let DT be the amount of data at node i. total Let N be the total amount of data across all nodes, and θ be the number of nodes. i Let θ be the verification parameter for node i. i This includes feature similarity thresholds and behavior deviation thresholds, where μ is a preset correction coefficient and η is a preset learning rate. The gradient of the loss function. Based on V new Calculate H IBN,i Let be the implicit behavioral entropy statistic for node i.

[0044] Where T is the statistical period, and H is the statistical period. IBN (t) represents the real-time implicit behavioral entropy of node i at time t. in, y represents the implicit behavior event of node i;

[0045] global verification parameter θglobal Distributed to each node, each node will globally verify the parameter θ global As a new verification parameter.

[0046] Optionally, the network security monitoring method, when using the global verification parameter θ global Before distributing to each node, the process also includes: obtaining the false alarm count and total number of detections across all nodes, and calculating the global false alarm rate R. FP,global , If R FP,global If the false alarm exceeds the preset global false alarm threshold, adjust the global verification parameter θ. global , making , where θ global old To adjust the previous global verification parameters; the adjusted global verification parameters θ global Distribute to each node.

[0047] Optionally, the network security monitoring method further includes: updating the supply chain trust score T. SC : Where ν is the preset learning rate, and R attack R is based on the historical frequency of supply chain attacks. normal =Number of normal client requests / Total number of client requests, T SC,old For the previous supply chain trust score; update key parameter V2: , where V2' is the updated V2 value.

[0048] A second aspect of this application provides a network security monitoring system based on dynamic vulnerability verification, the system comprising:

[0049] The traffic classification and processing module is used to receive client requests and distinguish whether the client request is an administrator vulnerability verification request.

[0050] The encryption module is used to, if the client request is an administrator vulnerability verification request, base its encryption on real-time system metrics, defense status parameters, and the supply chain trust score T corresponding to the client request. SC Generate administrator dynamic key K t And based on the administrator dynamic key K t Encrypt the data to be verified;

[0051] The verification engine module is used to verify the encrypted data to be verified based on a vulnerability database.

[0052] The defense linkage module is used to calculate the defense level of the data to be verified if the data to be verified is suspicious or abnormal after verification, and to carry out defense according to the defense level.

[0053] a feedback optimization module configured to update the vulnerability library, update the verification parameters, and / or update the defense parameters according to the defense effect data.

[0054] Optionally, in the network security monitoring system, the verification engine module comprises:

[0055] a decryption module configured to decrypt the to-be-verified data and extract a feature construction vector V of the to-be-verified data;

[0056] a matching module configured to match the feature construction vector V with the vulnerability library and calculate a feature similarity S;

[0057] a behavior deviation detection module configured to calculate a behavior deviation degree D of the to-be-verified data if S

[0058] a taint propagation tracking module configured to perform taint propagation tracking on the to-be-verified data;

[0059] a verification module configured to determine that the to-be-verified data is normal if S

[0060] Optionally, in the network security monitoring system, the defense linkage module comprises:

[0061] a defense level calculation module configured to calculate a ban weight W: wherein, a, b, g are preset dynamic weight coefficients, and d is a defense tolerance, and the key strength is an entropy value of K t if the to-be-verified data is suspicious, the threat level is a preset first level value, and if the to-be-verified data is abnormal, the threat level is a preset second level value.

[0062] Optionally, in the network security monitoring system, the defense linkage module further comprises a secondary detection module, the secondary detection module being configured to perform secondary detection on the to-be-verified data before the defense level calculation module calculates the defense level of the to-be-verified data if the verification engine module verifies that the to-be-verified data is suspicious or abnormal, the secondary detection module comprising:

[0063] a suspicious data secondary detection module, configured to, if the verification engine module verifies that the to-be-verified data is suspicious data, replay the to-be-verified data in a sandbox and execute the to-be-verified data, and if no dangerous behavior is detected in the sandbox, determine that the to-be-verified data is normal, if a non-conventional operation is detected and no attack is detected, determine that the to-be-verified data is suspicious, and if a vulnerability is triggered, determine that the to-be-verified data is abnormal;

[0064] an abnormal data secondary detection module, configured to, if the verification engine module verifies that the to-be-verified data is abnormal data, perform probe interaction analysis on the to-be-verified data, and if an attacker does not trigger a probe, determine that the to-be-verified data is normal, if an attacker submits a probe and a payload is invalid, determine that the to-be-verified data is suspicious, and if an attacker submits a valid attack payload, determine that the to-be-verified data is abnormal;

[0065] the defense level calculation module is configured to calculate a ban weight W of the to-be-verified data that is suspicious or abnormal after being detected by the secondary detection module.

[0066] Optionally, in the network security monitoring system, the defense linkage module further includes:

[0067] a defense module, configured to perform defense according to the defense level, including:

[0068] a first execution module, configured to, if W1≤W

[0069] a second execution module, configured to, if W2≤W

[0070] a third execution module, configured to, if W≥W3, ban an IP of a request corresponding to the to-be-verified data for a second preset time length and generate a high-level trap, wherein W1, W2 and W3 are preset threshold values, and the second time length is greater than the first time length.

[0071] Optionally, in the network security monitoring system, the defense effect data includes a false positive rate, a false negative rate, a traffic baseline smoothness and a key update frequency, and the feedback optimization module includes a defense parameter adjustment module, and the defense parameter adjustment module includes:

[0072] a first weight adjustment module, configured to, if the false positive rate is greater than a fourth preset threshold value, reduce an α value in the ban weight W calculation, and if the false negative rate is greater than a fifth preset threshold value, increase the α value.

[0073] The second weight adjustment module is configured to increase the value of β in the calculation of the ban weight W if the traffic baseline smoothness is within a preset range, and to decrease the value of β if the traffic baseline smoothness is outside the preset range.

[0074] The third weight adjustment module is configured to keep the value of γ in the calculation of the ban weight W if the key update frequency is less than or equal to a preset sixth threshold, and to increase the value of γ if the key update frequency is greater than the preset sixth threshold.

[0075] Optionally, in the network security monitoring system, the defense effect data includes a false alarm rate and a missed alarm rate, the verified parameters include a feature similarity threshold and a behavior deviation threshold, and the feedback optimization module includes a verified parameter adjustment module, which includes:

[0076] The behavior deviation threshold adjustment module is configured to calculate a new behavior deviation threshold D FP if the false alarm rate R th is greater than a preset false alarm threshold. new , wherein η D is a preset behavior deviation learning rate, D th is a preset behavior deviation loss value, and D new includes behavior deviation thresholds D1 and D2.

[0077] The feature similarity threshold adjustment module is configured to calculate a new feature similarity threshold S FN if the missed alarm rate R th is greater than a preset missed alarm threshold. new , wherein η S is a preset feature similarity learning rate, S th is a preset feature similarity loss value, and S new includes feature similarity thresholds S1 and S2.

[0078] Optionally, in the network security monitoring system, the feedback optimization module includes a vulnerability library updating module, and the vulnerability library updating module includes:

[0079] The attack payload vector generation module is configured to capture an attack payload to obtain a standardized feature vector V new corresponding to the attack payload.

[0080] The attack payload vector evaluation module is configured to calculate the maximum similarity S new between V max and an existing feature in the vulnerability library. wherein C jis the feature vector of the jth vulnerability in the vulnerability library, and m is the number of vulnerabilities in the vulnerability library;

[0081] The updating module is configured to update the vulnerability library if S max is less than a preset matching threshold, and V new is added to the vulnerability library.

[0082] Optionally, in the network security monitoring system, the feedback optimization module further comprises a global optimization module, and the global optimization module comprises:

[0083] The first node data acquisition module is configured to acquire verification parameters and implicit behavior entropy statistics of all nodes in the network.

[0084] The global aggregation module is configured to aggregate the verification parameters to obtain global verification parameters θ global . , wherein DT i is the data volume of the node i, DT total is the data volume of all nodes, N is the number of nodes, θ i is the verification parameter of the node i, and θ i includes a feature similarity threshold and a behavior deviation threshold, μ is a preset correction coefficient, η is a preset learning rate, is a loss function gradient, is calculated based on V new , and H IBN,i is the implicit behavior entropy statistics of the node i.

[0085] , wherein T is a statistical period, H IBN (t) is the real-time implicit behavior entropy of the node i at time t, , wherein y is an implicit behavior event of the node i.

[0086] The distribution module is configured to distribute the global verification parameters θ global to each node, and each node takes the global verification parameters θ global as new verification parameters.

[0087] Optionally, in the network security monitoring system, the feedback optimization module further comprises a global adjustment module, and the global adjustment module comprises:

[0088] The second node data acquisition module is configured to acquire the number of false alarms and the total number of detections of all nodes before the global verification parameters θ global are distributed to each node.

[0089] The global false alarm rate calculation module is configured to calculate a global false alarm rate R FP,global . ​, the adjusting module is configured to adjust the global verification parameter θ FP,global if the global false positive rate is greater than a preset global false positive threshold, adjust the global verification parameter θ global , so that:

[0090] wherein θ global old is the global verification parameter before adjustment;

[0091] the distribution module is configured to distribute the adjusted global verification parameter θ global to each node.

[0092] Optionally, the network security monitoring system further comprises:

[0093] a vulnerability library configured to store known vulnerability features and attack features captured by the trap;

[0094] a supply chain trust evaluation module configured to obtain a supply chain trust score T SC corresponding to the client request.

[0095] In a third aspect, the present application provides a computing device cluster, comprising at least one computing device, each computing device comprising a processor and a memory; the processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the network security monitoring method based on dynamic vulnerability verification as described above.

[0096] In a fourth aspect, the present application provides a computer readable storage medium, which stores computer instructions for executing the network security monitoring method based on dynamic vulnerability verification as described above.

[0097] The network security monitoring method and system based on dynamic vulnerability verification provided in the application distinguish client requests, and for administrator vulnerability verification requests, generate key encrypted request data based on real-time system indicators, defense state parameters and supply chain trust scores, so that the generated key can resist supply chain pollution, quantum attacks, reverse engineering and resist future computing power threats, effectively prevent data leakage, and greatly improve the security of system runtime vulnerability verification. For encrypted data, the vulnerability library can also verify based on feature similarity, and can also combine behavior deviation and stain tracking verification to reduce vulnerability verification false negative rate; Furthermore, the method and system provided in the application combine vulnerability verification results with real-time defense, and update the vulnerability library, optimize verification parameters and / or optimize defense parameters according to the defense effect, realize a closed-loop vulnerability verification and defense evolution system, further improve the security, real-time performance and dynamic adaptability of system runtime vulnerability verification, reduce vulnerability false positive rate and false negative rate, and realize a stronger defense ecology. BRIEF DESCRIPTION OF DRAWINGS

[0098] Other features, objects and advantages of the application will become more apparent from the following detailed description of non-limiting embodiments made with reference to the attached drawings:

[0099] Figure 1 A flowchart of a network security monitoring method based on dynamic vulnerability verification according to the application;

[0100] Figure 2 A flowchart of step S102 in an embodiment of the network security monitoring method according to the application;

[0101] Figure 3 A flowchart of step S103 in an embodiment of the network security monitoring method according to the application;

[0102] Figure 4 A structural diagram of an embodiment of a network security monitoring system based on dynamic vulnerability verification according to the application;

[0103] Figure 5 A structural diagram of another embodiment of a network security monitoring system based on dynamic vulnerability verification according to the application;

[0104] Figure 6 A structural diagram of a computer system of a server for implementing the method, system and device embodiments according to the application. DETAILED DESCRIPTION

[0105] The application will be further described in detail below with reference to the drawings and embodiments. It can be understood that the specific embodiments described herein are only used to explain the related application, and not to limit the application. In addition, it should be noted that, in order to facilitate description, only the parts related to the application are shown in the drawings.

[0106] It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict. The present application will be described in detail below with reference to the drawings and in combination with the embodiments.

[0107] The present application provides a network security monitoring method based on dynamic verification of vulnerabilities, applied to a network node or a central server, as shown in the following figure: Figure 1 The method comprises the following steps:

[0108] Step S101: receiving a client request, if the client request is an administrator vulnerability verification request, generating an administrator dynamic key Kt based on real-time system indicators, defense state parameters and a supply chain trust score TSC corresponding to the client request, and encrypting the to-be-verified data based on the administrator dynamic key Kt;

[0109] Step S102: verifying the encrypted to-be-verified data based on a vulnerability library;

[0110] Step S103: if the to-be-verified data is suspicious or abnormal after verification, calculating the defense level of the to-be-verified data, and performing defense according to the defense level;

[0111] Step S104: updating the vulnerability library according to the defense effect data, and updating the verification parameters and / or the defense parameters.

[0112] Specifically, step S101 receives a client request and distinguishes the client request. Specifically, the request type can be obtained by analyzing the client original message request protocol, so as to distinguish the client request. If the client request is a normal user request, a normal user key can be generated for the data of the normal user request to be encrypted. The normal user key can be a fixed AES (Advanced Encryption Standard) -128 key, and the encrypted data can be responded to the client. If the client request is an administrator vulnerability verification request, step S101 generates an administrator dynamic key Kt based on real-time system indicators (such as the number of registered users V1, the access volume V2), defense state parameters (such as the attack frequency F a , the number of banned IPs N b and the supply chain trust score T SC corresponding to the client request, and encrypts the to-be-verified data of the administrator vulnerability verification request based on the administrator dynamic key Kt. t t

[0113] ​​Specifically, the trustworthiness of the supply chain corresponding to the client request can be evaluated according to the code signing certificate validity (such as whether it is issued by a trusted CA), the open source library maintainer reputation score (such as the number of GitHub stars, the contributor activity), and the update channel security (such as whether it is distributed through HTTPS), and the following formula is used for calculation:

[0114]

[0115] wherein ω1, ω2, ω3 are weight coefficients, ω1 can be set to 0.5, ω1 can be set to 0.3, and ω1 can be set to 0.2; SignScore is the signature validity, and SignScore = 1 when the signature is valid, and SignScore = 0 when the signature is invalid; RepoScore is the maintainer reputation, which can be normalized to a value in the range [0, 1]; Channelcore is the transmission protocol security, and Channelcore = 1 when the transmission protocol is HTTPS, Channelcore = 0.5 when the transmission protocol is HTTP, and Channelcore = 0 when the transmission protocol is other.

[0116] Specifically, the administrator dynamic key K t is calculated by the following formula:

[0117] ,

[0118] wherein V1 is the number of registered users, V2 is the access volume, F a is the attack frequency; N b is the number of banned IPs, QC_Hash is a quantum-resistant hash function based on quantum random walk, outputting a 256-bit hash value, (Fa·Nb) is the current defense state code, Chaos(V2, t) is a chaotic sequence generation function with the access volume V2 as the initial value, and the expression of Chaos(V2, t) is: wherein r represents the Logistic mapping, r = 3.99, x n = V2 / 10 6 , and t is the current timestamp, which is iterated once per second.

[0119] The present application generates a key based on real-time system indicators, defense state parameters, and supply chain trust scores, so that the generated key can resist supply chain pollution, quantum attacks, reverse engineering, and resist future computing power threats, effectively prevent data leakage, so that it is possible to perform vulnerability verification during system operation, and greatly improve the security of vulnerability verification during system operation.

[0120] The administrator dynamic key K tAfter encryption, step S102 verifies the encrypted to-be-verified data based on the vulnerability library, which is performed by a verification engine module. Specifically, as shown in FIG. 8, step S102 includes: Figure 2

[0121] Step S1021 decrypts the to-be-verified data and extracts a feature construction vector V of the to-be-verified data.

[0122] Specifically, the administrator dynamic key K t After decryption of the to-be-verified data, a feature construction vector V of the to-be-verified data can be extracted according to features of the to-be-verified data, such as a request parameter length, a special character ratio, a keyword density (such as a frequency of UNION and SELECT in SQL), a request time interval, a geographical location entropy value of a source IP, and the like.

[0123] Step S1022 matches the feature construction vector V with the vulnerability library and calculates a feature similarity S.

[0124] Specifically, in an embodiment, wherein V i is an ith-dimensional value of a traffic feature of the to-be-verified data, the traffic feature being a feature corresponding to a real-time traffic index in the feature construction vector of the to-be-verified data, and the traffic feature specifically can include a request parameter length, a special character ratio, a keyword density, a request frequency, an encrypted traffic entropy value, an API call chain depth, and a geographical location dispersion degree, C i is an ith-dimensional standard value of a feature in the vulnerability library corresponding to the traffic feature, that is, an ith-dimensional feature value of a feature in the vulnerability library corresponding to C i .

[0125] Step S1023 calculates a behavior deviation degree D of the to-be-verified data if S < S1.

[0126] Specifically, S1 is a preset similarity threshold, for example, S1 is set to 0.8, and if S < S1, it indicates that there is no feature in the vulnerability library that matches the feature construction vector, and thus the behavior deviation degree is further calculated for verification. In an embodiment, the calculation of the behavior deviation degree D can also not be subject to the condition S < S1, that is, the calculation of the behavior deviation degree D and the calculation of the feature similarity can be performed synchronously.

[0127] Specifically, wherein T is a time window length, a default value of which is 60 seconds, x t is a traffic feature of the to-be-verified data, LSTM is a pre-trained LSTM (Long Short-Term Memory) prediction model, and λ is an entropy weight coefficient, which can be set to λ = 0.2, and H IB ​an implicit behavior entropy of the flow feature, wherein x is an implicit behavior event, which can be an irregular memory access pattern (such as an abnormal jump of a stack pointer), a reflective API call (such as dynamically loading a malicious module through dlopen), and / or a resource state dependent operation (such as modifying a sensitive memory region when the load is high), etc.

[0128] In step S1024, the to-be-verified data is subjected to a taint propagation trace.

[0129] In the above steps, step S1024 and step S1022, and step S1024 and step S1023 can be executed synchronously, and the order of the texts is not limited to the execution order.

[0130] In step S1025, if S

[0131] In step S1026, if S1≤S

[0132] In step S1027, if S≥S2, or D≥D2, or the to-be-verified data triggers a dangerous function, it is determined that the to-be-verified data is abnormal, wherein S1, S2 are preset feature similarity thresholds, S1

[0133] Specifically, if the feature similarity is less than the preset threshold S1, that is, there is no feature in the vulnerability library that matches the feature construction vector, and the behavior deviation degree is less than the preset threshold D1, that is, the behavior deviation degree is within the allowable range, and the result of the taint propagation trace is that the to-be-verified data does not trigger a dangerous function, it is determined that the to-be-verified data is normal.

[0134] If the feature similarity is between the lower threshold S1 and the upper threshold S2 (including equal to S1), that is, there is a feature in the vulnerability library that is similar to the feature construction vector, or the behavior deviation degree is between the lower threshold D1 and the upper threshold D2 (including equal to D1), that is, the behavior deviation degree exceeds the allowable range but does not exceed the upper limit, or the result of the taint propagation trace is not clear, it is determined that the to-be-verified data is suspicious.

[0135] If the feature similarity is greater than or equal to the upper threshold S2, that is, there is a feature in the vulnerability library that is highly similar to the feature construction vector, or the behavior deviation degree is greater than or equal to the upper threshold D2, that is, the behavior deviation is serious, or the result of the taint propagation trace is that the to-be-verified data triggers a dangerous function, it is determined that the to-be-verified data is abnormal.

[0136] In an embodiment, before performing the taint propagation tracking and the behavior deviation degree judgment, the step S102 further comprises:

[0137] If T sc is less than a preset first threshold value, the threshold values D1 and D2 corresponding to the behavior deviation degree D are reduced, and the taint propagation tracking increases the dynamic memory boundary check;

[0138] If T sc is less than the preset first threshold value and H IB is greater than a preset third threshold value 2.0, the taint propagation tracking increases the dynamic memory boundary check;

[0139] If T sc is less than a preset second threshold value, the threshold values D1 and D2 corresponding to the behavior deviation degree D are continuously reduced, and the taint propagation tracking increases the dynamic memory boundary check;

[0140] If T sc is less than the preset second threshold value or if H IB is greater than the preset third threshold value, the to-be-verified data is put into a sandbox for verification, and the second threshold value is less than the first threshold value;

[0141] If the result of the sandbox verification is abnormal, it is determined that the to-be-verified data is abnormal, and if the result of the sandbox verification is non-abnormal, it is determined that the to-be-verified data is suspicious.

[0142] Specifically, the step S102 can further first judge the supply chain trust score T sc and H IB corresponding to the request, if T sc is less than a preset first threshold value (for example, 0.6), that is, the supply chain trust score is low, verification is strengthened, the detection sensitivity is improved, for example, the threshold values D1 and D2 corresponding to the behavior deviation degree D are reduced, and the taint propagation tracking increases the dynamic memory boundary check;

[0143] If T sc is less than the preset first threshold value and H IB is greater than a preset third threshold value (for example, 2.0), that is, the supply chain trust score is low and the implicit behavior entropy is too high (the behavior mode deviates from the normal baseline), verification is strengthened, for example, the taint propagation tracking increases the dynamic memory boundary check.

[0144] If T scIf the second threshold value (e.g., set to 0.4) is less than the first threshold value, the second threshold value is less than the supply chain trust score, and the second threshold value further enhances verification and improves detection sensitivity, the threshold values D1 and D2 corresponding to the behavior deviation degree D continue to decrease, and the second threshold value is less than the first threshold value. The existing technology can be referred to for the taint propagation tracking, and details are not described herein.

[0145] Further, if T sc is less than a preset second threshold value or if H IB is greater than a preset third threshold value, the to-be-verified data is placed in a sandbox for verification, that is, the supply chain trust score is too low or the implicit behavior entropy is too high, and sandbox replay verification is forcibly performed on the to-be-verified data. If the sandbox verification result is abnormal, it is determined that the to-be-verified data is abnormal, and if the sandbox verification result is not abnormal, it is determined that the to-be-verified data is suspicious. In an embodiment, the result of the sandbox replay verification has a higher priority than the results of the feature similarity, behavior deviation degree, and taint propagation tracking verification, that is, after the sandbox replay verification, the feature similarity, behavior deviation degree, and taint propagation tracking verification do not need to be performed. In another embodiment, the result of the sandbox replay verification and the results of the feature similarity, behavior deviation degree, and taint propagation tracking verification mutually confirm each other. If there is a conflict, the more serious result is taken, for example, the result of the sandbox replay verification is suspicious, and the results of the feature similarity, behavior deviation degree, and taint propagation tracking verification are abnormal, and the verification result is taken as abnormal.

[0146] If the to-be-verified data is normal, no processing is performed and no defense is performed. Otherwise, step S103 is performed: if the to-be-verified data is suspicious or abnormal after verification, the defense level of the to-be-verified data is calculated, and defense is performed according to the defense level. Specifically, as shown in FIG. 10, step S103 includes: Figure 3

[0147] Step S1031, the defense level is represented by a ban weight W, and the ban weight W is calculated.

[0148] wherein a, β, and γ are preset dynamic weight coefficients, D is the behavior deviation degree, and δ is a preset defense tolerance. The value of δ is fixed and does not change with T sc . The value of δ can be 0.1, and δ is greater than 0. The lower T sc is, the higher the ban weight W is. The key strength is an entropy value K t . If the to-be-verified data is suspicious, the threat level is a preset first level value, and if the to-be-verified data is abnormal, the threat level is a preset second level value. In an embodiment, a is greater than 0, the first level value is less than the second level value, for example, the first level value can be 1-2, and the second level value can be 3-4. If the verification result is normal, the threat level is 0.​

[0149] Step S1032, if the ban weight W < W1, that is, the defense level is extremely low, belonging to the range that does not need to be defended, no defense action is performed;

[0150] Step S1033, if W1≤W

[0151] Step S1034, if W2≤W

[0152] Step S1035, if W≥W3, that is, the defense level belongs to the third level of defense range, the defense means is upgraded again, the IP of the request corresponding to the to-be-verified data is banned, and the ban duration reaches a preset second duration, and the second duration (for example, 24 hours) is greater than the first duration (for example, 6 hours), and a high-level trap is generated, and threat intelligence can also be synchronized;

[0153] Wherein, W1, W2, W3 are preset level thresholds, W1

[0154] In an embodiment, before defense according to the ban weight, the network security monitoring method provided by the application further comprises: according to the attack frequency F a The preliminary defense level is divided, and the defense resources are allocated according to the preliminary defense level.

[0155] Specifically, if F a If F1≤F a If F2, the preliminary defense level is high. F1 a According to the preliminary defense level, the defense resources can be allocated, for example, more defense resources are allocated when the defense level is high, and then specific defense actions are performed according to the ban weight, which can prevent unnecessary waste of resources and ensure sufficient defense resources to complete the defense actions.

[0156] In an embodiment, before the defense according to the defense level, it further comprises: if T sc is less than a preset second threshold, that is, if the trust score of the request corresponding to the supply chain is too low, more stringent defense is performed, and the IP of the request corresponding to the to-be-verified data is banned.

[0157] In one embodiment, if the to-be-verified data is suspicious or abnormal after the foregoing verification, before calculating the defense level of the to-be-verified data, the network security monitoring method provided by the application further comprises performing secondary detection on the to-be-verified data, and the secondary detection comprises:

[0158] If the to-be-verified data is suspicious data after the verification, the suspicious encrypted data is replayed in a sandbox (replayed in an isolated environment, and behaviors such as memory modification, system call, network connection, etc. are monitored) and executed (executed in a virtual environment), if there is no dangerous behavior in the sandbox, it is determined that the to-be-verified data is normal, and the data can be recorded as a false alarm; if a non-regular operation is detected and no attack (for example, temporary file creation) is detected, it is determined that the to-be-verified data is suspicious; if a vulnerability exploitation (for example, buffer overflow) is triggered, it is determined that the to-be-verified data is abnormal;

[0159] If the to-be-verified data is abnormal data after the verification, probe interaction analysis (for example, a false vulnerability page containing a dynamic probe is returned, and the subsequent behavior of the attacker is monitored) is performed on the to-be-verified data, if the attacker does not trigger the probe (for example, only scanning is submitted), it is determined that the to-be-verified data is normal; if the attacker submits the probe and the payload is invalid (for example, test input), it is determined that the to-be-verified data is suspicious; if the attacker submits a valid attack payload (for example, exploits the fake vulnerability in the probe), it is determined that the to-be-verified data is abnormal;

[0160] Then, the defense level of the to-be-verified data determined as suspicious or abnormal after the secondary detection is calculated, that is, the ban weight W is calculated.

[0161] In one embodiment, the probe interaction analysis can use existing technologies. In one embodiment, a trap probe can be generated according to the following formula: Wherein, “||” is a byte splicing operation, and QC_Hash is an anti-quantum hash function.

[0162] In one embodiment, the verification of the encrypted to-be-verified data based on the vulnerability database can only be feature similarity verification; in another embodiment, feature similarity verification and behavior deviation verification can be combined; in yet another embodiment, feature similarity verification, behavior deviation verification and taint tracking verification can be combined.

[0163] The network security monitoring method provided in the application can effectively reduce the false positive rate and false negative rate of vulnerability verification for encrypted data based on the vulnerability library through feature similarity verification, combined with behavior deviation and stain tracking verification. Furthermore, the method provided in the application combines the vulnerability verification result with real-time defense to ensure the real-time safety of system operation, and quantifies multi-dimensional attack features (threat level, behavior deviation, key security) into a single index through a ban weight, selects different defense actions according to the weight value, realizes defense grading, and thus guides accurate defense, improves the problem of “one-size-fits-all” defense in the traditional scheme, and balances system security and usability.

[0164] After defense according to the defense level, step S104 updates the vulnerability library, updates the verification parameter and / or updates the defense parameter according to the defense effect data.

[0165] Specifically, in an embodiment, the defense effect data includes a false positive rate, a false negative rate, a traffic baseline smoothness and a key update frequency, and the updating of the defense parameter according to the defense effect data includes:

[0166] If the false positive rate is greater than a preset fourth threshold, the value of a in the ban weight calculation is reduced; if the false negative rate is greater than a preset fifth threshold, the value of a is increased;

[0167] If the traffic baseline smoothness is within a preset range, the value of β in the ban weight calculation is increased; if the traffic baseline smoothness is outside the preset range, the value of β is reduced;

[0168] If the key update frequency is less than or equal to a preset sixth threshold, the value of γ in the ban weight calculation is maintained; if the key update frequency is greater than the preset sixth threshold, the value of γ is increased, wherein a, β and γ are all values greater than 0.

[0169] That is, if the false positive rate is too large, the value of a is reduced to reduce the ban weight and thus reduce the defense level, thereby reducing the false positive rate; if the false negative rate is too large, the value of a is increased to increase the ban weight and thus increase the defense level, thereby reducing the false negative rate. The above a is greater than 0, if a is negative, if the false positive rate is too large, the value of a is increased; if the false negative rate is too large, the value of a is reduced.

[0170] If the traffic baseline smoothness is within a preset range, the value of β can be appropriately increased to appropriately increase the ban weight and increase the detection sensitivity; if the traffic baseline smoothness is outside the preset range, that is, the traffic baseline fluctuates greatly, the value of β can be appropriately reduced to reduce the ban weight and reduce false judgments. The above β is greater than 0, if β is negative, if the traffic baseline smoothness is within a preset range, the value of β is reduced; if the traffic baseline fluctuates greatly, the value of β is increased.

[0171] If the key update frequency is less than or equal to a preset sixth threshold, that is, the key is not updated frequently, the value of γ can be maintained, that is, the ban weight is maintained; if the key update frequency is greater than the preset sixth threshold, that is, the key is updated frequently and the risk of leakage is high, the value of γ is increased, that is., the ban weight is increased to improve the detection sensitivity. The above γ is greater than 0, if γ is negative, if the key is updated frequently, the value of γ is reduced; if the false negative rate is too large, the value of γ is increased

[0172] The defense effect data can be calculated and obtained according to the prior art.

[0173] Specifically, in an embodiment, the defense effect data includes a false positive rate and a false negative rate, the verified parameters include a feature similarity threshold and a behavior deviation threshold, and the updating of the verified parameters according to the defense effect data includes:

[0174] If the false positive rate R FP is greater than a preset false positive threshold, a new behavior deviation threshold D th is calculated. new :

[0175] ,

[0176] wherein η D is a preset behavior deviation learning rate, which can be set to 0.1, is a preset behavior deviation loss value, which can be set to 0.05, and D th new is the updated behavior deviation threshold, including a new behavior deviation threshold D1 and D2, and D th old is the current behavior deviation threshold, that is, the behavior deviation threshold before updating (calculating the new behavior deviation threshold), and D th old Also includes behavior deviation thresholds D1 and D2, that is, the upper and lower behavior deviation thresholds are updated by the above formula (that is, D th in the formula is D1 or D2), when the false positive rate R FP is too high, it means that the system is too sensitive, and the judgment condition needs to be relaxed and the behavior deviation threshold needs to be increased to reduce false positives.

[0177] If the false negative rate R FN is greater than a preset false negative threshold, a new feature similarity threshold S th new : wherein η S is a preset feature similarity learning rate, which can be set to 0.1, is a preset feature similarity loss value, which can be set to 0.05, and S thnew For the updated behavior deviation threshold, including new feature similarity thresholds S1 and S2, S th old For the current feature similarity threshold, that is, the feature similarity threshold before updating (calculating the new feature similarity threshold), S th old Both the feature similarity thresholds S1 and S2, that is, the upper and lower limits of the feature similarity thresholds, are updated by the above formula (that is, S th For S1 or S2), when the false negative rate R FN is too high, it means that the system sensitivity is insufficient, and the feature similarity threshold is reduced to improve the detection sensitivity.

[0178] Specifically, in an embodiment, the updating of the vulnerability library according to the defense effect data comprises:

[0179] Capturing an attack payload to obtain a standardized feature vector V new corresponding to the attack payload. The capturing of the attack payload and the obtaining of the standardized feature vector corresponding to the attack payload can refer to the prior art, which will not be described here.

[0180] Calculating the maximum similarity S new between V max and the features of the existing vulnerabilities in the vulnerability library,

[0181] wherein C j is the feature vector of the jth vulnerability in the vulnerability library, and m is the number of vulnerabilities in the vulnerability library.

[0182] If S max is less than a preset matching threshold, V new is added to the vulnerability library. The network security monitoring method provided by the present application writes the captured attack features into the vulnerability library, and the attack features have real-time performance from capture to storage in the library, which not only improves the detection coverage and realizes self-updating of the vulnerability library, but also improves the dynamic adaptability and security of the system.

[0183] The above updating of the vulnerability library, updating of the verification parameter, and updating of the defense parameter can be selected to perform only one of them, or to perform any two of them, or to perform all of them. The updating of the vulnerability library, the updating of the verification parameter, and the updating of the defense parameter can be performed in sequence or synchronously.

[0184] The network security monitoring method provided by the application updates the vulnerability library, optimizes the verification parameters and / or optimizes the defense parameters according to the defense effect, realizes a closed-loop vulnerability verification and defense evolution system, further improves the security, real-time performance and dynamic adaptability of vulnerability verification during system operation, reduces the false positive rate and false negative rate of vulnerabilities, and realizes a defense ecology that becomes stronger with use.

[0185] In an embodiment, the network security monitoring method provided by the application is not limited to updating the feature similarity threshold and the behavior deviation threshold according to the defense effect, but can also update other verification parameters, such as the LSTM model parameters and the implicit behavior entropy calculation model parameters, according to the defense effect. The updating algorithm can refer to the calculation of the feature similarity threshold and the behavior deviation threshold described above.

[0186] In an embodiment, the network security monitoring method provided by the application can further include updating the supply chain trust score T SC : , wherein v is a preset learning rate, R attack is the supply chain attack historical frequency, R normal = number of normal client requests / total number of client requests, T SC,new is the updated supply chain trust score, T SC,old is the supply chain trust score before updating; T SC can be updated when the supply chain attack historical frequency is greater than a preset threshold, or T SC is periodically updated. By dynamically optimizing T SC , the real-time performance and security of the administrator dynamic key and the ban weight calculation can be improved, and the security and accuracy of vulnerability verification and defense during system operation can be ensured.

[0187] Further, in an embodiment, the network security monitoring method provided by the application can further include updating the administrator dynamic key generation parameter V2 (access volume) according to the number of attacks:

[0188] , wherein V2' is the updated V2 value. The higher the attack frequency, the greater the perturbation amplitude of V2, the greater the randomness of the key, and the security of the key can be improved by updating V2.

[0189] The network security monitoring method provided by the application can also update the key parameters (such as the supply chain trust score T SC and the access volume V2) according to the defense effect data (such as the number of attacks and the supply chain attack historical frequency), realize dynamic binding of the key and the vulnerability, make the key generation parameters strongly associated with the vulnerability verification and defense results, realize the adaptability of attack defense, and solve the lag problem of traditional systems relying on fixed rules.

[0190] The network security monitoring method provided by the application can be applied to each node of a distributed system. When applied to a central server or an aggregation node of the distributed system, the network security monitoring method can further include the following steps of:

[0191] obtaining verification parameters and implicit behavior entropy statistics of all nodes in the network, wherein the verification parameters of the nodes are the same as the verification parameters of the central server, such as feature similarity threshold and behavior deviation threshold.

[0192] aggregating and calculating a global verification parameter θ global .

[0193] wherein DT i is the data volume of the node i, DT total is the data volume of all nodes, N is the number of nodes, θ i is the verification parameter of the node i, and θ i may be a feature similarity threshold and / or a behavior deviation threshold (in the formula, θ global and θ i are S1, S2, D1 or D2), and θ i may also be other verification parameters, μ is a preset correction coefficient, η is a preset learning rate, is a loss function gradient, based on V new , H IBN,i is the implicit behavior entropy statistics of the node i, and H IBN,i only participates in the calculation of the global verification parameter,

[0194] wherein T is a statistical period, H IBN (t) is the real-time implicit behavior entropy of the node i at time t, wherein, y is the implicit behavior event of the node i.

[0195] The global verification parameter θ global is calculated by aggregating the verification parameters and the implicit behavior entropy statistics of all nodes. global After that, the global verification parameter θ global is distributed to each node (including the central server itself), and each node takes the global verification parameter θ global as a new verification parameter.

[0196] Specifically, the aggregation and distribution of the global verification parameter can be performed periodically or when a new feature V newThe network security monitoring method provided in the application can dynamically optimize global parameters in a global aggregation federated learning manner, and verify and optimize parameters in a multi-node cooperative manner, so that more extensive attack modes can be covered and distributed attacks can be resisted.

[0197] Further, the network security monitoring method provided in the application can further include, before the global verification parameter θ global is distributed to each node:

[0198] obtaining the false alarm times and the total detection times of all nodes, and calculating a global false alarm rate R FP,global , If R FP,global is greater than a preset global false alarm threshold (for example, 5%), the global verification parameter θ global is adjusted so that:

[0199]

[0200] wherein θ global old is the global verification parameter before adjustment;

[0201] The adjusted global verification parameter θ global is distributed to each node, and each node uses the global verification parameter θ global as a new verification parameter.

[0202] The embodiment comprehensively considers the global false alarm rate, and adjusts the global verification parameter when the global false alarm rate is too large, so that the global verification parameter is further optimized, the global false alarm rate is effectively reduced, and the global verification and defense effect is improved.

[0203] Correspondingly, the network security monitoring method provided in the application, when applied to a node, can further include: reporting the verification parameter and the implicit behavior entropy statistic to the central server in response to an instruction of the central server, in an embodiment, the false alarm times and the total detection times can also be reported to the central server in response to an instruction of the central server; and receiving the global verification parameter θ global issued by the central server, and updating the local verification parameter according to the global verification parameter θ global .

[0204] Although the steps are described in the above order in the above embodiments, those skilled in the art can understand that, in order to achieve the effects of the embodiments, the steps do not have to be executed in such an order, and can be executed simultaneously (in parallel) or in a reversed order, and these simple changes are within the protection scope of the application.

[0205] Secondly, this application provides a network security monitoring system based on dynamic vulnerability verification, such as... Figure 4 As shown, the system includes:

[0206] The traffic classification and processing module is used to receive client requests and distinguish whether the client request is an administrator vulnerability verification request.

[0207] The encryption module is used to, if the client request is an administrator vulnerability verification request, base its encryption on real-time system metrics, defense status parameters, and the supply chain trust score T corresponding to the client request. SC Generate administrator dynamic key K t And based on the administrator dynamic key K t Encrypt the data to be verified;

[0208] The verification engine module is used to verify the encrypted data to be verified based on a vulnerability database.

[0209] The defense linkage module is used to calculate the defense level of the data to be verified if the data to be verified is suspicious or abnormal after verification, and to carry out defense according to the defense level.

[0210] The feedback optimization module is used to update the vulnerability database, verification parameters, and / or defense parameters based on the defense effectiveness data.

[0211] Specifically, the traffic classification and processing module receives client requests and distinguishes between them. If the client request is from a regular user, a regular user key can be generated to encrypt the data, and the encrypted data can be returned to the client. If the client request is from an administrator for vulnerability verification, the encryption module uses real-time system metrics (e.g., number of registered users V1, access volume V2) and defense status parameters (e.g., attack frequency F) to perform encryption. a Number of blocked IPs N b ) and the supply chain trust score T corresponding to the client request. SC Generate administrator dynamic key K t And based on the administrator dynamic key K t The data to be verified in the encryption administrator vulnerability verification request. Specifically,

[0212]

[0213] Wherein, ω1, ω2, ω3 are weight coefficients, ω1 can be set to 0.5, ω1 can be set to 0.3, and ω1 can be set to 0.2; SignScore is the signature validity, and SignScore=1 when the signature is valid, and SignScore=0 when the signature is invalid; RepoScore is the maintainer reputation, which can be normalized to a value in the range [0, 1]; Channelcore is the transmission protocol security, and Channelcore=1 when the transmission protocol is HTTPS, Channelcore=0.5 when the transmission protocol is HTTP, and Channelcore=0 when the transmission protocol is other.

[0214] Specifically,

[0215] ,

[0216] Wherein, V1 is the number of registered users, V2 is the access volume, F a is the attack frequency; N b is the number of banned IPs, QC_Hash is a quantum-resistant hash function based on quantum random walk, outputting a 256-bit hash value, (Fa·Nb) is the current defense state code, Chaos(V2, t) is a chaotic sequence generation function with the access volume V2 as the initial value, and the expression of Chaos(V2, t) is: Wherein, r represents the Logistic mapping, r=3.99, x n =V2 / 10 6 , and t is the current timestamp, which is iterated once per second.

[0217] The system provided in the application generates a key based on real-time system indicators, defense state parameters and supply chain trust scores, so that the generated key can resist threats such as supply chain pollution and quantum attacks, effectively prevent data leakage, thereby realizing vulnerability verification during system operation, and greatly improving the security of vulnerability verification during system operation.

[0218] After encryption by the encryption module, the verification engine module verifies the encrypted to-be-verified data based on the vulnerability library, and in an embodiment, the verification engine module comprises:

[0219] The decryption module is configured to decrypt the to-be-verified data and extract a feature construction vector V of the to-be-verified data, and specifically, the administrator dynamic key K t decrypts the to-be-verified data;

[0220] The matching module is configured to match the feature construction vector V with the vulnerability library and calculate a feature similarity S, and specifically, in an embodiment, Wherein, V iC is the i-th dimension value of the flow feature of the to-be-verified data, the flow feature is a feature corresponding to a real-time flow indicator in a feature construction vector of the to-be-verified data, and S is a feature similarity degree between the feature construction vector and a feature in the vulnerability library corresponding to the flow feature. i C is the i-th dimension value of the flow feature of the to-be-verified data, the flow feature is a feature corresponding to a real-time flow indicator in a feature construction vector of the to-be-verified data, and S is a feature similarity degree between the feature construction vector and a feature in the vulnerability library corresponding to the flow feature.

[0221] The behavior deviation detection module is configured to calculate a behavior deviation degree D of the to-be-verified data if S < S1, wherein S1 is a preset similarity threshold, and if S < S1, it indicates that there is no feature in the vulnerability library that matches the feature construction vector, and thus the behavior deviation degree is further calculated for verification.

[0222] wherein T is a time window length, and a default value of T is 60 seconds, x t C is the i-th dimension value of the flow feature of the to-be-verified data, the flow feature is a feature corresponding to a real-time flow indicator in a feature construction vector of the to-be-verified data, and S is a feature similarity degree between the feature construction vector and a feature in the vulnerability library corresponding to the flow feature. IB C is the i-th dimension value of the flow feature of the to-be-verified data, the flow feature is a feature corresponding to a real-time flow indicator in a feature construction vector of the to-be-verified data, and S is a feature similarity degree between the feature construction vector and a feature in the vulnerability library corresponding to the flow feature. wherein x is an implicit behavior event;

[0223] The taint propagation tracking module is configured to perform taint propagation tracking on the to-be-verified data.

[0224] The verification module is configured to determine that the to-be-verified data is normal if S < S1 and D < D1, and the to-be-verified data does not trigger a dangerous function, and to determine that the to-be-verified data is suspicious if S1 ≤ S < S2 or D1 ≤ D < D2 or the taint propagation path of the to-be-verified data has no result.

[0225] The verification module is configured to determine that the to-be-verified data is normal if S < S1 and D < D1, and the to-be-verified data does not trigger a dangerous function, and to determine that the to-be-verified data is suspicious if S1 ≤ S < S2 or D1 ≤ D < D2 or the taint propagation path of the to-be-verified data has no result.

[0226] The verification module is configured to determine that the to-be-verified data is normal if S < S1 and D < D1, and the to-be-verified data does not trigger a dangerous function, and to determine that the to-be-verified data is suspicious if S1 ≤ S < S2 or D1 ≤ D < D2 or the taint propagation path of the to-be-verified data has no result.

[0227] wherein S1 and S2 are preset feature similarity thresholds, and D1 and D2 are preset behavior deviation thresholds.

[0228] In an embodiment, the taint propagation tracking module is further configured to perform dynamic memory boundary checking if T sc is less than a preset first threshold, and to perform dynamic memory boundary checking if H sc is greater than a preset third threshold. IB is less than a preset second threshold. sc

[0229] ​In an embodiment, the verification module, before making the behavior deviation degree judgment, is further configured to: if T sc is less than a preset first threshold, decrease the threshold D1 and D2 corresponding to the behavior deviation degree D; if T sc is less than a preset second threshold, decrease the threshold D1 and D2 corresponding to the behavior deviation degree D; if T sc is less than a preset second threshold or if H IB is greater than a preset third threshold, put the to-be-verified data into a sandbox for verification; if the result of the sandbox verification is abnormal, determine that the to-be-verified data is abnormal, and if the result of the sandbox verification is not abnormal, determine that the to-be-verified data is suspicious.

[0230] If the to-be-verified data is normal, the system does not process and defend, otherwise, the defense linkage module is used for defense. In an embodiment, the defense linkage module comprises:

[0231] a defense level calculation module configured to calculate a ban weight W:

[0232] wherein, a, β, γ are preset dynamic weight coefficients, and the key strength is an entropy value of K t If the to-be-verified data is suspicious, the threat level is a preset first level value, and if the to-be-verified data is abnormal, the threat level is a preset second level value.

[0233] In an embodiment, the defense linkage module further comprises a secondary detection module, which is configured to, if the verification engine module verifies that the to-be-verified data is suspicious or abnormal, perform secondary detection on the to-be-verified data before the defense level calculation module calculates the defense level of the to-be-verified data. The secondary detection module comprises:

[0234] a suspicious data secondary detection module configured to, if the verification engine module verifies that the to-be-verified data is suspicious data, replay the sandbox of the to-be-verified data and execute the to-be-verified data, if there is no dangerous behavior in the sandbox, determine that the to-be-verified data is normal, if a non-regular operation is detected and no attack is detected, determine that the to-be-verified data is suspicious, and if a vulnerability is triggered, determine that the to-be-verified data is abnormal;

[0235] an abnormal data secondary detection module configured to, if the verification engine module verifies that the to-be-verified data is abnormal data, perform probe interaction analysis on the to-be-verified data, if an attacker does not trigger a probe, determine that the to-be-verified data is normal, if an attacker submits a probe and the payload is invalid, determine that the to-be-verified data is suspicious, and if an attacker submits a valid attack payload, determine that the to-be-verified data is abnormal;

[0236] The defense level calculation module is configured to calculate a ban weight W of the suspicious or abnormal to-be-verified data detected by the secondary detection module.

[0237] The defense linkage module further comprises:

[0238] The defense module is configured to perform defense according to the defense level, and comprises:

[0239] The first execution module is configured to, if W1≤W

[0240] The second execution module is configured to, if W2≤W

[0241] The third execution module is configured to, if W≥W3, ban the IP of the request corresponding to the to-be-verified data for a ban duration reaching a preset second duration, and generate a high-level luring trap,

[0242] W1, W2 and W3 are preset level thresholds, and the second duration is greater than the first duration.

[0243] In an embodiment, the defense module is further configured to: according to the attack frequency F a The preliminary defense level is divided, and defense resources are allocated according to the preliminary defense level.

[0244] Specifically, if F a If F1≤F a If F2≤F a If F≥F2, the preliminary defense level is determined to be high, F1

[0245] In an embodiment, the defense module is further configured to: if T sc is less than a preset second threshold, ban the IP of the request corresponding to the to-be-verified data, that is, if the trust score of the request corresponding to the supply chain is too low, a more stringent defense is performed.

[0246] In an embodiment, the network security monitoring system provided by the present application comprises a defense effect data, and the defense effect data comprises a false positive rate, a false negative rate, a flow baseline smoothness and a key update frequency.

[0247] The first weight adjustment module is configured to decrease the value of a in the calculation of the blocking weight if the false positive rate is greater than a fourth preset threshold value, and to increase the value of a if the false negative rate is greater than a fifth preset threshold value.

[0248] The second weight adjustment module is configured to increase the value of b in the calculation of the blocking weight if the flow baseline smoothness is within a preset range, and to decrease the value of b if the flow baseline smoothness is outside the preset range.

[0249] The third weight adjustment module is configured to keep the value of g in the calculation of the blocking weight if the key update frequency is less than or equal to a sixth preset threshold value, and to increase the value of g if the key update frequency is greater than the sixth preset threshold value.

[0250] That is, if the false positive rate is too large, the value of a is decreased to reduce the blocking weight, that is, to reduce the defense level, so as to reduce the false positive rate; if the false negative rate is too large, the value of a is increased to increase the blocking weight, that is, to increase the defense level, so as to reduce the false negative rate. If a is greater than 0, if a is a negative number, if the false positive rate is too large, the value of a is increased; if the false negative rate is too large, the value of a is decreased, and so on. If the flow baseline smoothness is within a preset range, the value of b can be appropriately increased to appropriately increase the blocking weight and increase the detection sensitivity; if the flow baseline smoothness is outside the preset range, that is, the flow baseline fluctuates greatly, the value of b can be appropriately decreased to decrease the blocking weight and reduce false judgments. If the key update frequency is less than or equal to a sixth preset threshold value, that is, the key is not updated frequently, the value of g can be kept, that is, the blocking weight is kept; if the key update frequency is greater than the sixth preset threshold value, that is, the key is updated frequently and the risk of leakage is high, the value of g is increased, that is, the blocking weight is increased, so as to increase the detection sensitivity.

[0251] In an embodiment, the network security monitoring system provided by the present application, the defense effect data includes false positive rate and false negative rate, the verification parameter includes feature similarity threshold and behavior deviation threshold, and the feedback optimization module includes a verification parameter adjustment module, and the verification parameter adjustment module includes:

[0252] The behavior deviation threshold adjustment module is configured to calculate a new behavior deviation threshold D FP if the false positive rate R th new ,

[0253] wherein, η D is a preset behavior deviation learning rate, is a preset behavior deviation loss value, and D th new includes behavior deviation thresholds D1 and D2.

[0254] The feature similarity threshold adjustment module is configured to calculate a new feature similarity threshold S FN if the false negative rate R th new wherein η S is a preset feature similarity learning rate, is a preset feature similarity loss value, and S th new The feature similarity threshold S1 and S2 are included.

[0255] In an embodiment, the network security monitoring system provided in the present application comprises a feedback optimization module, which comprises a vulnerability library updating module.

[0256] The attack payload vector generation module is configured to capture an attack payload to obtain a standardized feature vector V new

[0257] The attack payload vector evaluation module is configured to calculate the maximum similarity S new between V max

[0258] wherein C j is a feature vector of the jth vulnerability in the vulnerability library, and m is the number of vulnerabilities in the vulnerability library.

[0259] The updating module is configured to add V max to the vulnerability library if S new is less than a preset threshold.

[0260] The defense parameter adjustment module, the verification parameter adjustment module, and the vulnerability library updating module can be selected to run one of them, or any two of them, or all of them according to security needs and resource conditions. The defense parameter adjustment module, the verification parameter adjustment module, and the vulnerability library updating module can be sequentially run or synchronously run.

[0261] The network security monitoring system provided in the present application updates the vulnerability library, optimizes the verification parameter, and / or optimizes the defense parameter according to the defense effect, realizes a closed-loop vulnerability verification and defense evolution system, greatly improves the security, real-time performance, and dynamic adaptability of the vulnerability verification during system operation, and reduces the false positive rate and the false negative rate of the vulnerability.

[0262] ​​​In an embodiment, the network security monitoring system provided by the present application is not limited to updating the feature similarity threshold and / or the behavior deviation threshold according to the defense effect, and the verification parameter adjustment module in the feedback optimization module can also be used to update other verification parameters according to the defense effect. The update algorithm can refer to the calculation of the aforementioned feature similarity threshold and behavior deviation threshold.

[0263] In an embodiment, the network security monitoring system provided by the present application, the feedback optimization module can further include a supply chain trust score updating module for updating a supply chain trust score T according to a supply chain attack history frequency SC :

[0264] wherein v is a preset learning rate: R attack is the supply chain attack history frequency; R normal = number of normal client requests / total number of client requests. The supply chain trust score updating module can update T SC when the supply chain attack history frequency is greater than a preset threshold, or periodically update T SC . By dynamically optimizing T SC , the real-time performance and security of the administrator dynamic key and the ban weight can be improved, and the security and accuracy of the vulnerability verification and defense during system operation can be ensured.

[0265] Further, in an embodiment, the network security monitoring system provided by the present application, the feedback optimization module can further include a dynamic key generation parameter updating module for updating an administrator dynamic key generation parameter V2 (access volume) according to the number of attacks:

[0266] wherein V2' is the updated V2 value. By updating V2, the anti-attack ability of the key can be more effectively improved, and the security of the key can be enhanced.

[0267] In combination with the supply chain trust score updating module and the dynamic key generation parameter updating module, dynamic binding of the key-vulnerability can be achieved, the key generation is strongly associated with the vulnerability verification and defense result, and the adaptability of attack defense is achieved.

[0268] The network security monitoring system provided by the present application can be applied to each node of a distributed system. When the network security monitoring system is applied to a central server or an aggregation node of a distributed system, the feedback optimization module can further include a global optimization module, and the global optimization module includes:

[0269] a first node data acquisition module for acquiring verification parameters and implicit behavior entropy statistics of all nodes in the network;

[0270] a global aggregation module configured to aggregate the calculated global verification parameter θ global :

[0271] wherein DT i is the data volume of the node i, DT total is the data volume of all nodes, N is the number of nodes, θ i is the verification parameter of the node i, θ i includes a feature similarity threshold and a behavior deviation threshold, μ is a preset correction coefficient, η is a preset learning rate, is a loss function gradient, based on V new calculation, H IBN,i is the implicit behavior entropy statistic of the node i, wherein T is a statistical period, H IBN (t) is the real-time implicit behavior entropy of the node i at time t,

[0272] ,

[0273] wherein, y is an implicit behavior event of the node i;

[0274] a distribution module configured to distribute the global verification parameter θ global to each node, and the each node takes the global verification parameter θ global as a new verification parameter.

[0275] Specifically, the global aggregation module and the distribution module can be periodically run or triggered to run when a new feature V new is formed. The network security monitoring system provided in the application can dynamically optimize the global parameter and collaboratively optimize the verification parameter by multiple nodes, so as to cover more extensive attack modes and resist distributed attacks.

[0276] In an embodiment, the feedback optimization module further comprises a global adjustment module, and the global adjustment module comprises:

[0277] a second node data acquisition module configured to acquire the false alarm times and the total detection times of all nodes before the global verification parameter θ global is distributed to each node;

[0278] a global false alarm rate calculation module configured to calculate a global false alarm rate R FP,global ,

[0279] ,

[0280] an adjustment module configured to adjust the global verification parameter θ FP,globalIf the false alarm exceeds the preset global false alarm threshold, adjust the global verification parameter θ. global , so that: ,

[0281] Where, θ global old To adjust the previous global verification parameters;

[0282] The distribution module is used to distribute the adjusted global verification parameter θ global Distribute to each node.

[0283] This implementation method takes into account the global false alarm rate. When the global false alarm rate is too high, the global verification parameters are adjusted to further optimize the global verification parameters, effectively reduce the global false alarm rate, and improve the global verification and defense effect.

[0284] Accordingly, the network security monitoring system provided in this application, when applied to nodes, may further include: a data feedback module, used to respond to instructions from the central server and report verification parameters and implicit behavioral entropy statistics to the central server; in one embodiment, it may also respond to instructions from the central server and report the number of false alarms and the total number of detections to the central server; and a global response update module, used to receive global verification parameters θ issued by the central server. global Based on the global verification parameter θ global Update the local verification parameters.

[0285] In one embodiment, the network security monitoring system provided in this application further includes:

[0286] A vulnerability database is used to store known vulnerability characteristics as well as attack characteristics captured through deception.

[0287] In one embodiment, the network security monitoring system provided in this application further includes:

[0288] The supply chain trust assessment module is used to obtain the supply chain trust score T corresponding to the client request. SC .

[0289] In one implementation, such as Figure 5 As shown, the network security monitoring system provided in this application also includes the vulnerability database and supply chain trust assessment module described above. The vulnerability database and supply chain trust assessment module can be integrated into the network security monitoring system, or they can be located outside the network security monitoring system but communicate with it. The feedback optimization module, as described above, also updates the vulnerability database and supply chain trust assessment values, thereby affecting the vulnerability database and supply chain trust assessment module, and indirectly affecting the encryption module.

[0290] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process and related description of the system described above can refer to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0291] It should be noted that the network security monitoring system based on vulnerability dynamic verification provided in the above embodiments is only exemplified by the division of the above functional modules, and in actual application, the above functions can be completed by different functional modules according to needs, that is, the modules or steps in the embodiments of the present application are further decomposed or combined, for example, the modules of the above embodiments can be combined into one module, or can be further split into multiple sub-modules to complete all or part of the functions described above. The names of the modules and steps involved in the embodiments of the present application are only for distinguishing the respective modules and steps, and should not be considered as an improper limitation of the present application.

[0292] In a third aspect, the present application also provides a computing device cluster, which includes at least one computing device, each computing device including a processor and a memory; the processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the foregoing network security monitoring method based on vulnerability dynamic verification. The computing device cluster can constitute a distributed network system, and the network security monitoring method provided by the present application can be deployed in the nodes and / or central servers of the distributed network system.

[0293] In a fourth aspect, the present application also provides a computer readable storage medium, which stores computer instructions for being executed by a computer to implement the foregoing network security monitoring method based on vulnerability dynamic verification.

[0294] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process and related description of the storage device and the processing device described above can refer to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0295] Those skilled in the art should clearly understand that the modules and method steps of each example described in combination with the embodiments disclosed herein can be realized by electronic hardware, computer software or a combination of both. The programs corresponding to the software modules and method steps can be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. In order to clearly illustrate the interchangeability of electronic hardware and software, the components and steps of each example have been generally described in the above description. Whether the functions are performed by electronic hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0296] Reference is made below to Figure 6 which shows a structural schematic diagram of a computer system of a server for implementing the embodiments of the method, system and device of the present application. Figure 6 The server shown is merely an example and should not impose any limitation on the functions and use range of the embodiments of the present application.

[0297] As Figure 6 shown, the computer system includes a central processing unit (CPU) 601 which can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 602 or loaded from a storage portion 608 into a random access memory (RAM) 603. Various programs and data required for system operation are also stored in the RAM 603. The CPU 601, ROM 602 and RAM 603 are connected to each other through a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0298] The following components are connected to the I / O interface 605: an input section 606 including input devices such as a keyboard and mouse; an output section 607 including output devices such as a cathode ray tube (CRT), a liquid crystal display (LCD), and a speaker; a storage section 608 including a hard disk; and a communication section 609 including a network interface card such as a LAN (Local Area Network) card, a modem, and the like. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as necessary. A removable medium 611 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, and the like is attached to the drive 610 as necessary, so that a computer program read out therefrom is installed in the storage section 608 as necessary.

[0299] In particular, the processes described above with reference to the flow charts can be implemented as a computer software program according to embodiments of the present disclosure. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a computer readable medium, the computer program comprising program code for performing the methods illustrated by the flow charts. In such embodiments, the computer program can be downloaded and installed from a network via the communication section 609, and / or installed from the removable medium 611. When the computer program is executed by the central processing unit (CPU) 601, the above-described functions defined in the methods of the present application are performed. It should be noted that the computer readable medium of the present application can be a computer readable signal medium or a computer readable storage medium or any combination of the two. The computer readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or any suitable combination of the above. More specific examples of the computer readable storage medium can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, the computer readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus or device. In the present application, the computer readable signal medium can include a data signal carried in a baseband or as part of a carrier wave, in which the computer readable program code is carried. Such a propagated data signal can take any of a variety of forms, including but not limited to electro-magnetic, optical, or any suitable combination thereof. The computer readable signal medium can also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate or transport a program for use by or in connection with an instruction execution system, apparatus or device. The program code contained on the computer readable medium can be transmitted by any suitable medium, including but not limited to wireless, wire line, optical fiber cable, RF, etc., or any suitable combination of the above.

[0300] Computer program code for carrying out operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0301] The computer program instructions can also be loaded onto a computer or other programmable information processing apparatus to cause a series of operations to be performed on the computer or other programmable information processing apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable information processing apparatus implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0302] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. For example, singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising," when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0303] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. For example, singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising," when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0304] The technical scheme of the present application has been described in combination with the preferred embodiments shown in the drawings, but it is easy for those skilled in the art to understand that the protection scope of the present application is obviously not limited to these specific embodiments. Those skilled in the art can make equivalent changes or replacements to the related technical features without departing from the principles of the present application, and the technical schemes after the changes or replacements will all fall within the protection scope of the present application.

Claims

1. A network security monitoring method based on vulnerability dynamic verification, characterized in that, The method comprises the following steps: Receiving a client request, if the client request is an administrator vulnerability verification request, based on real-time system indicators, defense state parameters and the supply chain trust score T corresponding to the client request SC , generating an administrator dynamic key K t , and encrypting the data to be verified based on the administrator dynamic key K t ; Based on the vulnerability library, the encrypted to-be-verified data is verified; If the to-be-verified data is suspicious or abnormal after verification, the defense level of the to-be-verified data is calculated, and defense is performed according to the defense level; According to the defense effect data, the vulnerability library is updated, the verification parameter is updated, and / or the defense parameter is updated, wherein the defense effect data comprises a false positive rate, a false negative rate, a traffic baseline smoothness, and a key update frequency; wherein ， Wherein, ω1, ω2, ω3 are weight coefficients, ω1=0.5, ω1=0.3, ω1=0.2, SignScore is the signature validity, SignScore=1 if the signature is valid, and SignScore=0 if the signature is invalid, RepoScore is the maintainer reputation, RepoScore∈[0,1], Channelcore is the transmission protocol security, Channelcore=1 if the transmission protocol is HTTPS, Channelcore=0.5 if the transmission protocol is HTTP, and Channelcore=0 if the transmission protocol is other; ， Wherein, V1 is the number of registered users, V2 is the access volume, F a is the attack frequency; N b is the number of banned IPs, QC_Hash is a quantum random walk-based anti-quantum hash function, outputting a 256-bit hash value, (F a ·N b ) is the current defense state code, Chaos(V2, t) is a chaotic sequence generation function with the access volume V2 as the initial value, and the expression of Chaos(V2, t) is: where r represents the Logistic map, r = 3.99, x n = V2 / 10 6 t is the current time stamp, iterating every second.

2. The network security monitoring method of claim 1, wherein, The method comprises the following steps: Decryption of the to-be-verified data, extraction of the feature vector V of the to-be-verified data; Matching the feature vector V with the vulnerability library, calculating the feature similarity S; The to-be-verified data is subjected to taint propagation tracking; If S<S1, the behavior deviation D of the to-be-verified data is calculated; If S<S1 and D<D1, and the to-be-verified data does not trigger a dangerous function, the to-be-verified data is determined to be normal; If S1≤S<S2, or D1≤D<D2, or the taint propagation path of the to-be-verified data has no result, the to-be-verified data is determined to be suspicious; If S≥S2, or D≥D2, or the to-be-verified data triggers a dangerous function, the to-be-verified data is determined to be abnormal, wherein S1, S2 are preset feature similarity thresholds, and D1, D2 are preset behavior deviation thresholds: The method comprises the following steps: wherein V i is the i-th dimension value of the flow feature of the to-be-verified data, n is the dimension value of the flow feature, the flow feature is a feature corresponding to a real-time flow indicator in a feature construction vector of the to-be-verified data, C i is the i-th dimension standard value of the feature in the vulnerability library corresponding to the flow feature. The method comprises the following steps: wherein T is the length of the time window, the default value is 60 seconds, x t is the flow feature of the data to be verified, λ is the entropy weight coefficient, λ = 0.2, H IB is the implicit behavior entropy of the flow feature, wherein x is the implicit behavior event.

3. The network security monitoring method of claim 1 or 2, wherein, If the to-be-verified data is suspicious, the threat level is a preset first level value, wherein, α, β, γ are preset dynamic weight coefficients, D is the behavior deviation degree, δ is the preset defense tolerance, the key strength is K t , and the entropy value of If the to-be-verified data is abnormal, the threat level is a preset second level value; The method comprises the following steps: If the ban weight W is less than W1, do nothing; If W1≤W<W2, the to-be-verified data corresponding request is subjected to flow limiting and preset time length short-term monitoring; If W2≤W<W3, the IP of the to-be-verified data corresponding request is banned, the ban time length reaches a preset first time length, and a basic trap page is generated; If W≥W3, the IP of the to-be-verified data corresponding request is banned, the ban time length reaches a preset second time length, and a high-level trap is generated; Wherein, W1, W2, W3 are preset level thresholds, and the second time length is greater than the first time length. ​ 4. The network security monitoring method of claim 3, wherein, The updating the defense parameters according to the defense effect data comprises: If the false positive rate is greater than a fourth preset threshold, the value of a is reduced; if the false negative rate is greater than a fifth preset threshold, the value of a is increased; If the flow baseline smoothness is within a preset range, the value of b is increased; if the flow baseline smoothness is outside the preset range, the value of b is reduced; If the key update frequency is less than or equal to a sixth preset threshold, the value of g is maintained; if the key update frequency is greater than the sixth preset threshold, the value of g is increased; wherein a, b, and g are values greater than 0, The verification parameters comprise a feature similarity threshold and a behavior deviation threshold, and the updating the verification parameters according to the defense effect data comprises: If the false positive rate R FP is greater than a preset false positive threshold, a new behavior deviation threshold D th is calculated new , where η D is a preset behavior deviation learning rate, is a preset behavior deviation loss value, and D th new includes the new behavior deviation thresholds D1 and D2, and D th old includes the behavior deviation thresholds D1 and D2 before the new behavior deviation threshold is calculated If the false negative rate R FN is greater than a preset false negative threshold, a new feature similarity threshold S th is calculated new , wherein η S is a preset feature similarity learning rate, is a preset feature similarity loss value, and S th new The feature similarity threshold S1 and S2 include the new feature similarity threshold S1 and S2. th old The feature similarity threshold S1 and S2 include the feature similarity threshold S1 and S2 before the new feature similarity threshold is calculated. The updating the vulnerability library according to the defense effect data comprises: Capture the attack payload, get the standardized eigenvector V corresponding to the attack payload new ; Compute V new Maximum similarity S with existing features in the vulnerability library max , wherein C j is the feature vector of the jth vulnerability in the vulnerability library, m is the number of vulnerabilities in the vulnerability library, if S max is less than a preset matching threshold, V new is added to the vulnerability library.

5. The network security monitoring method of claim 4, wherein, The updating the verification parameters according to the defense effect data further comprises: Obtaining verification parameters and implicit behavior entropy statistics of all nodes in the network; The global verification parameter θ is calculated by aggregation global : wherein DT i is the data amount of node i, DT total is the data amount of all nodes, N is the number of nodes, θ i is the verification parameter of node i, θ i includes a feature similarity threshold and a behavior deviation threshold, μ is a preset correction coefficient, η is a preset learning rate, is the loss function gradient, based on V new calculation, H IBN,i is the implicit behavior entropy statistics of node i, wherein T is a statistical period, H IBN (t) is the real-time implicit behavior entropy of node i at time t, wherein, y is an implicit behavior event of node i; The global validation parameter θ global is distributed to each node, which takes the global validation parameter θ global as a new validation parameter.

6. The network security monitoring method of claim 1, wherein, The method further comprises: updating the supply chain trust score T SC : , where v is a preset learning rate, R attack is a supply chain attack history frequency, R normal = normal client request number / total client request number, T SC,old is a supply chain trust score before updating; Update key parameter V2: where V2' is the updated V2 value.

7. A network security monitoring system based on dynamic verification of vulnerabilities, characterized by, including: The flow classification processing module is configured to receive a client request and distinguish whether the client request is an administrator vulnerability verification request; An encryption module is configured to, if the client request is an administrator vulnerability verification request, encrypt to-be-verified data based on real-time system indexes, defense state parameters, and a supply chain trust score T corresponding to the client request. SC An administrator dynamic key K t is generated, and the to-be-verified data is encrypted based on the administrator dynamic key K t . The verification engine module is configured to verify the encrypted to-be-verified data based on the vulnerability library; The defense linkage module is configured to, if the to-be-verified data is suspicious or abnormal after verification, calculate a defense level of the to-be-verified data and perform defense according to the defense level; The feedback optimization module is configured to update the vulnerability library, update the verification parameters, and / or update the defense parameters according to defense effect data, wherein the defense effect data comprises a false positive rate, a false negative rate, a flow baseline smoothness, and a key update frequency; Further comprising: The vulnerability library is configured to store known vulnerability features and attack features captured by traps; The supply chain trust evaluation module is configured to obtain a supply chain trust score T corresponding to the client request SC ; wherein, ， wherein ω1, ω2, and ω3 are weight coefficients, ω1=0.5, ω1=0.3, and ω1=0.2, SignScore is signature validity, SignScore=1 if the signature is valid, and SignScore=0 if the signature is invalid, RepoScore is maintainer reputation, RepoScore∈[0,1], Channelcore is transmission protocol security, Channelcore=1 if the transmission protocol is HTTPS, Channelcore=0.5 if the transmission protocol is HTTP, and Channelcore=0 if the transmission protocol is other; ， Wherein, V1 is the number of registered users, V2 is the access volume, F a is the attack frequency; N b is the number of banned IPs, QC_Hash is a quantum random walk-based anti-quantum hash function, outputting a 256-bit hash value, (F a ·N b ) is the current defense state code, Chaos(V2, t) is a chaotic sequence generation function with the access volume V2 as the initial value, and the expression of Chaos(V2, t) is: where r represents the Logistic map, r = 3.99, x n = V2 / 10 6 t is the current time stamp, iterating every second.

8. A cluster of computing devices, characterized in that, The at least one computing device each includes a processor and a memory; the processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions for being executed by the computer to implement the method according to any one of claims 1-6.

Images