Network security operation and maintenance method and device, equipment, storage medium and program product

Abstract

The invention provides a network security operation and maintenance method and device, equipment, a storage medium and a program product, and relates to the technical field of network security. The method comprises the following steps: constructing a dynamic network security map based on operation and maintenance related data of a plurality of network devices collected at preset time intervals; according to a pre-trained first model, a pre-trained second model and the dynamic network security atlas, obtaining an anomaly detection result of each network device, the first model being used for performing device anomaly detection on the network device, the second model being used for generating a plurality of simulation attack data, carrying out attack anomaly detection on the network equipment by utilizing the plurality of pieces of simulated attack data; executing a corresponding response scheduling strategy according to the anomaly detection result; according to the scheme of the invention, unified operation and maintenance full-link monitoring of the network equipment is realized, and the stability of network security can be maintained and ensured.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and specifically to a network security operation and maintenance method, apparatus, equipment, storage medium, and program product. Background Art

[0002] Network security operations and maintenance have become a hot topic in current network security management and control. Existing unified operations and maintenance methods based on batch monitoring across multiple terminals, including data collection, log analysis, alarm triggering, and alarm log generation, offer unified operations and maintenance monitoring. While these methods are suitable for traditional equipment operations and maintenance, they are not applicable to network security operations and maintenance. Furthermore, these traditional operations and maintenance management and control methods have limitations in terms of manpower requirements and efficiency. Summary of the Invention

[0003] The present application provides a network security operation and maintenance method, apparatus, equipment, storage medium and program product to solve the problem of lack of network security operation and maintenance methods in the prior art.

[0004] In order to solve the above technical problems, this application is implemented as follows:

[0005] In a first aspect, the present application provides a network security operation and maintenance method, comprising:

[0006] Build a dynamic network security map based on the operation and maintenance data of multiple network devices collected at preset intervals.

[0007] Obtaining an anomaly detection result for each network device based on a pre-trained first model, a pre-trained second model, and the dynamic network security map, wherein the first model is used to perform device anomaly detection on the network device, and the second model is used to generate a plurality of simulated attack data, and use the plurality of simulated attack data to perform attack anomaly detection on the network device;

[0008] According to the anomaly detection result, a corresponding response scheduling strategy is executed.

[0009] Optionally, the network security operation and maintenance method, wherein executing a corresponding response scheduling strategy according to the anomaly detection result, includes:

[0010] Determining, based on the anomaly detection result, a target probability level of occurrence of the network device risk and a target impact level of the network device risk occurrence on the network;

[0011] Obtaining a target response strategy based on the target probability level and the target impact level, and a preset correlation between the probability level, the impact level, and the response strategy;

[0012] The target response strategy is executed.

[0013] Optionally, the network security operation and maintenance method further includes:

[0014] Static segmentation is performed on the dynamic network security graph to obtain multiple static segments after segmentation;

[0015] Performing data conversion on the plurality of static segments to obtain a static atlas matrix;

[0016] Obtaining an anomaly detection result for each network device according to the pre-trained first model, the pre-trained second model, and the dynamic network security map, including:

[0017] According to the pre-trained first model, the pre-trained second model and the static graph matrix, an anomaly detection result of each of the network devices is obtained.

[0018] Optionally, the network security operation and maintenance method further includes:

[0019] Training the generator in the second model according to the historical attack data to generate a plurality of the simulated attack data;

[0020] Splicing each of the simulated attack data with each of the historical static graph matrices to obtain a plurality of spliced matrices;

[0021] The discriminator in the second model is trained according to the spliced multiple matrices to obtain a pre-trained second model.

[0022] Optionally, the network security operation and maintenance method, wherein each of the simulated attack data is spliced with each of the historical static graph matrices to obtain a plurality of spliced matrices, includes:

[0023] Each simulated attack data is spliced with each historical static graph matrix respectively by using a permutation and combination method of Cartesian product to obtain multiple spliced matrices.

[0024] Optionally, in the network security operation and maintenance method, the multiple network devices include network devices at multiple different network levels.

[0025] In a second aspect, the present application also provides a network security operation and maintenance device, comprising:

[0026] A construction module is used to construct a dynamic network security map based on operation and maintenance related data of multiple network devices collected at preset intervals;

[0027] an acquisition module, configured to acquire an anomaly detection result for each network device based on a pre-trained first model, a pre-trained second model, and the dynamic network security map, wherein the first model is used to perform device anomaly detection on the network device, and the second model is used to generate a plurality of simulated attack data, and perform attack anomaly detection on the network device using the plurality of simulated attack data;

[0028] The execution module is used to execute the corresponding response scheduling strategy according to the abnormality detection result.

[0029] In a third aspect, the present application also provides a network security operation and maintenance device, comprising: a processor, a memory, and a program or instruction stored on the memory and executable on the processor, wherein when the processor executes the program or instruction, the network security operation and maintenance method as described in the first aspect is implemented.

[0030] In a fourth aspect, the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the network security operation and maintenance method as described in the first aspect is implemented.

[0031] In a fifth aspect, the present application also provides a computer program product, comprising computer instructions, which, when executed by a processor, implement the network security operation and maintenance method as described in the first aspect.

[0032] Compared with the prior art, the present application provides a network security operation and maintenance method, apparatus, equipment, storage medium and program product, wherein the method includes: constructing a dynamic network security map based on the operation and maintenance related data of multiple network devices collected at each preset time interval; obtaining the anomaly detection result of each network device according to the pre-trained first model, the pre-trained second model and the dynamic network security map, wherein the first model is used to perform device anomaly detection on the network device, and the second model is used to generate multiple simulated attack data, and use the multiple simulated attack data to perform attack anomaly detection on the network device; executing the corresponding response scheduling strategy according to the anomaly detection result. In this way, by constructing a dynamic network security map, using the first model to identify the anomaly of the network device itself, and combining the second model simulated attack data to identify external threats, outputting the anomaly detection results, and performing response scheduling, unified operation and maintenance full-link monitoring of network devices is achieved, which can maintain and ensure the stability of network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Various other advantages and benefits will become apparent to those skilled in the art upon reading the detailed description of the preferred embodiment below. The accompanying drawings are for illustration purposes only and are not to be considered as limiting the present application. The same reference symbols are used throughout the drawings to represent the same components. In the drawings:

[0034] Figure 1 A flowchart of a network security operation and maintenance method provided in an embodiment of the present application;

[0035] Figure 2 A schematic diagram of the structure of the first model provided in an embodiment of the present application;

[0036] Figure 3 A schematic diagram of the encoding and decoding process of the first model provided in an embodiment of the present application;

[0037] Figure 4 A schematic diagram of the structure of the second model provided in an embodiment of the present application;

[0038] Figure 5 A schematic diagram illustrating the correlation between the preset probability level, impact level, and response strategy provided in an embodiment of the present application;

[0039] Figure 6 A schematic diagram of the structure of a network security operation and maintenance device provided in an embodiment of the present application;

[0040] Figure 7 This is a hardware block diagram of the network security operation and maintenance equipment provided in an embodiment of the present application. DETAILED DESCRIPTION

[0041] The terms "first", "second", etc. in this application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the terms used in this way are interchangeable where appropriate, so that the embodiments of the present application can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first" and "second" are generally of the same type, and do not limit the number of objects, for example, the first object can be one or more. In addition, "or" in this application represents at least one of the connected objects. For example, "A or B" covers three options, namely, Option 1: including A but not including B; Option 2: including B but not including A; Option 3: including both A and B. The character " / " generally indicates that the objects associated before and after are in an "or" relationship.

[0042] Please refer to Figure 1 , an embodiment of the present application provides a network security operation and maintenance method, including:

[0043] Step 101: construct a dynamic network security map based on the operation and maintenance related data of multiple network devices collected at each preset time interval. The dynamic network security map includes multiple nodes and edges connecting two of the nodes. The nodes represent the operation and maintenance related data of the network devices, and the edges represent the existence of an association relationship between the two network devices corresponding to the two connected nodes.

[0044] Optionally, the plurality of network devices include network devices at a plurality of different network layers, wherein the network layer includes: a system layer, a network layer or an application layer.

[0045] The embodiment of the present application collects operation and maintenance related data of network devices at multiple different network layers, which can achieve operation and maintenance of different network layers and realize multi-layer security protection or monitoring.

[0046] Optionally, the operation and maintenance related data includes at least one of the following: operation status data; security alarm data; original log data.

[0047] Optionally, the preset duration includes: one minute or one second.

[0048] In one embodiment, optionally, the above method further includes:

[0049] In the form of an interface, operation and maintenance related data of multiple network devices are collected at preset intervals.

[0050] In this embodiment, the operation and maintenance related data of multiple network devices are collected every minute or second in the form of an interface through an API interface, a syslog interface, or a Kafka interface. The operation and maintenance related data are generalized and stored in the graph database Neo4j in a graph relationship structure to construct a dynamic network security graph. Among them, the graph relationship structure is formed with the network as the central body, and the various system layer, network layer, and application layer protection devices within it are constructed around the network central body to form a complete network security protection group, that is, a dynamic network security graph X. Different device types correspond to different network layers of protection, and different device types are named X. i (i=1,2,...), X i Corresponding to different device parameters x i (i=1,2,...), thus forming a complete dynamic network security map.

[0051] The collection list of the above operation and maintenance related data is shown in Table 1 below.

[0052] Table 1: Collection list of operation and maintenance related data

[0053]

[0054]

[0055] In one embodiment, optionally, the method further includes:

[0056] Static segmentation is performed on the dynamic network security graph to obtain multiple static segments after segmentation;

[0057] The plurality of static segments are subjected to data conversion to obtain a static atlas matrix.

[0058] In this embodiment, the dynamic network security map in the map database is dynamically read, and the dynamic network map is statically segmented according to a preset number of frames (such as the preset number of frames is n) to obtain multiple static segments after segmentation, and data conversion is performed on each static segment to obtain the data matrix p corresponding to each static segment. i =[a1,a2,a3...a n ].

[0059] Therefore, after the above static segmentation and data conversion, the dynamic network security graph is converted into an n*n dimensional static graph matrix p[p1,p2,p3...p n ].

[0060] Step 102: Obtain anomaly detection results for each of the network devices based on the pre-trained first model, the pre-trained second model, and the dynamic network security map. The first model is used to perform device anomaly detection on the network device, and the second model is used to generate multiple simulated attack data, and use the multiple simulated attack data to perform attack anomaly detection on the network device.

[0061] Optionally, the first model is an LSTM (Long Short-Term Memory) model based on an attention mechanism; the second model is a GAN (Generative Adversarial Networks) model.

[0062] It should be noted that the LSTM model, based on the attention mechanism, is used to detect anomalies in network devices. This model, combined with the time-series analysis of the long-short-term memory network, uses a scheduled scheduling approach to predict and analyze anomaly detection results. The GAN model simulates attack data to detect anomalies in network devices' ability to resist attacks. It generates simulated attack data in real time and uses simulated attacks to identify vulnerabilities in the dynamic network security landscape, enabling predictive analysis and monitoring.

[0063] In one embodiment, optionally, the method further includes:

[0064] The first model is trained according to the historical dynamic network security graph to obtain a pre-trained first model.

[0065] Figure 2 Schematic diagram of the first model provided by the embodiment of the present application. As Figure 2 shown, the first model is an LSTM model based on the attention mechanism, and the training process includes the following steps:

[0066] (1) Obtain pre-training samples. Collect historical dynamic network security graphs, and the historical dynamic network security graphs are obtained through static slicing and data conversion to obtain a historical static graph matrix, which is the pre-training sample.

[0067] (2) Design a first model that integrates the attention mechanism into the LSTM structure. Among them, the principle of the attention mechanism is to allow the model to dynamically allocate different weights according to the relevance of different positions in the input sequence. When processing sequence data, it can help the model focus on the part that is most relevant to the current prediction or output; and LSTM, as a variant of the recurrent neural network, is specifically used to process sequence data. Therefore, the combination of the two for the training and processing of the static graph matrix with dynamic time series properties has relatively clear interpretability and advantages.

[0068] In the first model, since the Attention layer is better at highlighting useful information and giving more weights to more important information, when data is input, n Attention layers are first used to capture the most useful information in the static graph matrix; and LSTM can be regarded as a process of encoding and decoding. When the feature matrix with a relatively high weight captured by n Attention layers is input into LSTM for re-encoding and decoding, the output value of each neuron obtained through forward calculation is combined with the objective function for backpropagation to iterate the loss function and update the network weight parameters.

[0069] Figure 3 Schematic diagram of the encoding and decoding process of the first model provided by the embodiment of the present application. As Figure 3 shown, in the encoding and decoding process of the first model, the encoding combines the properties of LSTM. If the time step g of the first model is set, the hidden state at any moment j (i - g - 1 < j < i) is affected by the input at the current moment and the hidden state at the past moment. And finally, only the hidden state at the i-th moment is passed to the decoding part, that is:

[0070]

[0071] The decoding part is opposite to the encoding part. The decoding traverses from the i-th moment to the i - g - 1-th moment one by one. Therefore, the hidden state at the current moment is affected by the hidden state at the current moment and the next moment.

[0072] The loss function that is sensitive to outliers is selected for iteration, that is, the self-designed optimized Logistic loss function is as follows:

[0073] L logistic =Log2(1+exp(-f*y) 2 )

[0074] (3) Output of the first pre-trained model. Based on the iteration of the Logistic loss function, the first model with the best output effect is used as the model output.

[0075] During prediction, the static graph matrix is input into the pre-trained first model, and the anomaly detection results are output, including the label value and the label prediction probability p.

[0076] In one embodiment, optionally, the method further includes:

[0077] Training the generator in the second model according to the historical attack data to generate a plurality of the simulated attack data;

[0078] Splicing each of the simulated attack data with each of the historical static graph matrices to obtain a plurality of spliced matrices;

[0079] The discriminator in the second model is trained according to the spliced multiple matrices to obtain a pre-trained second model.

[0080] Optionally, each of the simulated attack data is spliced with each of the historical static graph matrices to obtain multiple spliced matrices, including:

[0081] Each simulated attack data is spliced with each historical static graph matrix respectively by using a permutation and combination method of Cartesian product to obtain multiple spliced matrices.

[0082] Figure 4 This is a schematic diagram of the second model provided in the embodiment of the present application. Figure 4 As shown, the second model is a GAN model, and the training process includes the following steps:

[0083] (1) Obtain pre-training samples. Collect historical attack data and historical dynamic network graph data. The historical attack data needs to be pre-processed, which includes data cleaning, standardization, or normalization. The pre-processed historical attack data is a standardized data matrix, including attack features such as attack source IP, target IP, source port, target port, URL (Uniform Resource Locator) path, etc. The historical dynamic network security graph is statically sliced and converted to obtain a historical static graph matrix.

[0084] (2) Generator training in the second model: The generator generates simulated attack data and combines it with historical attack data to train the discriminator.

[0085] The preprocessed historical attack data is input into the generator to generate simulated attack data, which is then classified and labeled. The historical attack data is labeled as T0, and the simulated attack data generated by the generator is labeled as T1. The loop is iterated N times to output a batch of labeled attack data samples S.

[0086] (3) Discriminator training in the second model. The historical static graph matrix is preprocessed, including data cleaning, to obtain the preprocessed historical static graph matrix. Then, the historical static graph matrix and the attack data sample S are input into the discriminator for training in a collaborative manner. The collaborative manner is a combination of a historical static graph matrix and a matrix of any randomly selected attack data sample spliced up and down, which is input into the discriminator for iterative training. The network training iteration is input multiple times in the form of permutations and combinations of Cartesian products. A self-designed and optimized Hinge Loss loss iteration method is selected to improve and enhance the efficiency and accuracy of the model loss iteration, namely:

[0087]

[0088] (4) Output of the pre-trained second model. Through the training of the second model, combined with the Hinge Loss function iteration, the pre-trained second model is output.

[0089] It should be noted that in the application, when a scheduling occurs, the batch of simulated attack data is fixed but continuously refreshed according to the scheduled scheduling. The generator generates a fixed amount of labeled simulated attack data each time, and combines the static graph matrix input by a scheduling, all of which are data combinations with simulated attack data labels, and input them into the discriminator. Through network calculation, the anomaly detection results are output, including the label value and the label prediction probability p.

[0090] In one embodiment, optionally, obtaining an anomaly detection result for each network device based on the pre-trained first model, the pre-trained second model, and the dynamic network security map includes:

[0091] According to the pre-trained first model, the pre-trained second model and the static graph matrix, an anomaly detection result of each of the network devices is obtained.

[0092] In this embodiment, the static graph matrix is input into the algorithm security component library, which includes two sub-algorithm components involving two dimensions of anomaly detection, one of which is used to execute an anomaly detection algorithm based on the first model, and the other sub-algorithm component is used to execute an anomaly detection algorithm based on the second model.

[0093] In one embodiment, optionally, obtaining an anomaly detection result of each network device according to the pre-trained first model, the pre-trained second model, and the static graph matrix includes:

[0094] Obtaining a first anomaly detection result for each of the network devices according to the pre-trained first model and the static graph matrix;

[0095] Obtaining a second anomaly detection result for each of the network devices according to the pre-trained second model;

[0096] An anomaly detection result of each of the network devices is obtained according to the first anomaly detection result and the second anomaly detection result.

[0097] In this embodiment, when the static graph matrix is input into the algorithm security component library, two sub-algorithm components are called at the same time, and two anomaly detection results are returned respectively. They are summarized into the output layer of the algorithm security component library and output jointly, that is, the anomaly detection results of the two sub-algorithm components in the algorithm security component library are returned respectively, that is, the first anomaly detection result includes label A1 and label prediction probability p1, and the second anomaly detection result includes label A2 and label prediction probability p2. Finally, the anomaly detection result of the network device is output according to these two anomaly detection results, including label A and label prediction probability p. A voting method of probability output is selected to output the probability of network device risk occurrence.

[0098] Specifically, if the first anomaly detection result of the network device is no anomaly in monitoring, label A1 = 0, and the second anomaly detection result is no anomaly in monitoring, label A2 = 0, then the anomaly detection result of the network device is no anomaly, label A = 0, and the label prediction probability p can use the voting method to output the probability of no risk occurrence of the network device;

[0099] If the first anomaly detection result of the network device is no anomaly in monitoring, label A1 = 0, and the second anomaly detection result is an anomaly in monitoring, label A2 = 1, then the anomaly detection result of the network device is abnormal, label A = 1, and the label prediction probability p can be determined based on the label prediction probability p2 corresponding to label A2 = 1, thereby outputting the probability of network device risk occurrence;

[0100] If the first anomaly detection result of the network device is a monitoring anomaly, label A1 = 1, and the second anomaly detection result is a monitoring no anomaly, label A2 = 0, then the anomaly detection result of the network device is abnormal, label A = 1, and the label prediction probability p can be determined based on the label prediction probability p1 corresponding to label A1 = 1, thereby outputting the probability of network device risk occurrence;

[0101] If the first anomaly detection result of the network device is a monitoring anomaly, label A1=1, and the second anomaly detection result is a monitoring anomaly, label A2=1, then the anomaly detection result of the network device is an anomaly, label A=1, and the label prediction probability p can use the voting method to output the probability of network device risk occurrence.

[0102] It should be noted that, for the above abnormal detection results with monitoring anomalies, the network device X with monitoring anomalies is located. i and the network device X i The probability of risk occurrence, the network device X i Associated with the corresponding network protection layer, if there are multiple network devices with monitoring anomalies, the network device with the highest predicted probability is output.

[0103] If both the first anomaly detection result and the second anomaly detection result are monitoring anomalies, the probability output of the voting method can be used to determine the probability of the network device risk occurring.

[0104] Step 103: Execute a corresponding response scheduling strategy based on the anomaly detection result.

[0105] In one embodiment, optionally, executing a corresponding response scheduling strategy based on the anomaly detection result includes:

[0106] Determining, based on the first anomaly detection result and the second anomaly detection result, a target probability level of occurrence of the network device risk and a target impact level of the network device risk on the network;

[0107] Obtaining a target response strategy based on the target probability level and the target impact level, and a preset correlation between the probability level, the impact level, and the response strategy;

[0108] The target response strategy is executed.

[0109] In this embodiment, when the abnormal detection result of the network device indicates that the probability of the network device risk is greater than the risk threshold D, risk backtracking positioning is performed, that is, the risk probability is returned, and the dynamic network security map is output for each network device X. i The probability of risk occurrence, including the risk probability of the device itself and / or the risk probability of network security attacks.

[0110] Response scheduling is performed through the Mini-SIEM (Mini-Information Security and Event Management Module) within the system.

[0111] First, based on the first and second anomaly detection results, the probability of a network device risk occurring is determined. Then, based on the probability of the network device risk occurring, a corresponding target probability level for the network device risk occurrence is determined. Optionally, the probability level for the network device risk occurrence is categorized into five levels: extremely high, high, medium, low, and extremely low.

[0112] Furthermore, based on the impact of the network device risk on the network after it occurs, a target impact level of the network device risk occurrence on the network is determined. Optionally, the impact level of the network device risk occurrence is divided into five levels: extremely high, high, medium, low, and extremely low.

[0113] Furthermore, according to the target probability level and the target impact level, a target response strategy is obtained in a preset correlation relationship between the probability level, the impact level and the response strategy.

[0114] Figure 5 Schematic diagram of the correlation between the preset probability level, impact level and response strategy provided in the embodiment of the present application. Figure 5 As shown in the figure, this correlation is a 5x5 matrix, with impact level as the horizontal coordinate and probability level as the vertical coordinate. It is used to assess and prioritize potential risks. Combining the probability (likelihood) of a risk and its impact (consequences) helps organizations identify, categorize, and manage risks. This helps organizations rationally allocate limited resources and prioritize those risks with the greatest impact. Based on the risk's position in the matrix, corresponding risk response strategies, such as avoidance, mitigation, transfer, or acceptance, are developed.

[0115] Among them, for Figure 5 The red areas in the chart are high-risk areas, encompassing six scenarios: extremely high probability and medium impact; extremely high probability and high impact; extremely high probability and extremely high impact; high probability and high impact; extremely high probability and high impact; and medium probability and extremely high impact. The corresponding response strategies include: Prioritizing designated network devices for prompt investigation and resolution.

[0116] against Figure 5The green areas in the chart represent low-risk areas, encompassing six scenarios: medium probability and very low impact; low probability and very low impact; low probability and low impact; very low probability and very low impact; very low probability and low impact; and very low probability and medium impact. Corresponding response strategies include: waiting for the risk to occur before taking action.

[0117] against Figure 5 The yellow areas in the chart are medium-risk areas, including all areas except the red and green areas mentioned above. The corresponding response strategies include: placing them on the watch list without taking active management measures.

[0118] Optionally, the impact of a network device risk on the network includes technical impact, business impact, and management impact. Based on these three dimensions, the impact level is determined, as shown in Table 2 below.

[0119] Table 2: Schematic diagram of the relationship between impact level and technical response, business impact and management impact

[0120]

[0121]

[0122] It should be noted that the degree of dependence of the enterprise or organization on the network, business characteristics and risk tolerance are also required, and it also supports organizations or enterprises to determine the impact level of the risk on the network based on the relevant fault levels that have been established.

[0123] In summary, the network security operation and maintenance method described in the embodiments of this application first collects network device operation and maintenance data through an API, syslog, or Kafka interface, constructs a dynamic network security graph, and stores it in the Neo4j graph database. Leveraging the unique features of the Neo4j graph database, it connects the internal information of each network, making the security monitoring framework more complete and more accurate. Next, a self-designed LSTM model based on the attention mechanism is used to detect anomalies in the network devices themselves, ensuring the accuracy of risk monitoring while improving the timeliness of risk warnings and enabling device self-monitoring. Combined with a GAN model to simulate attack data, it identifies threats that network devices can defend against, maintains device security stability, and implements external security monitoring. Anomaly detection results, including labels and probabilities, are output. Finally, response scheduling is performed based on the impact level and risk level, prioritizing high-risk threats and observing or delaying low-risk threats, ensuring secure and stable network operation. This embodiment of the application incorporates anomaly detection for both device self-monitoring and external security monitoring, enabling multi-layered simultaneous monitoring and problem location. The entire monitoring process and location are clear, efficient, and timely.

[0124] The present application also provides a network security operation and maintenance device, such as Figure 6 Shown, including:

[0125] A construction module 601 is configured to construct a dynamic network security map based on operation and maintenance related data of multiple network devices collected at preset intervals;

[0126] an acquisition module 602 configured to acquire an anomaly detection result for each network device based on a pre-trained first model, a pre-trained second model, and the dynamic network security map, wherein the first model is configured to perform device anomaly detection on the network device, and the second model is configured to generate a plurality of simulated attack data and perform attack anomaly detection on the network device using the plurality of simulated attack data;

[0127] The execution module 603 is used to execute the corresponding response scheduling strategy according to the abnormality detection result.

[0128] Optionally, in the network security operation and maintenance device, the execution module 603 is specifically configured to:

[0129] Determining, based on the anomaly detection result, a target probability level of occurrence of the network device risk and a target impact level of the network device risk occurrence on the network;

[0130] Obtaining a target response strategy based on the target probability level and the target impact level, and a preset correlation between the probability level, the impact level, and the response strategy;

[0131] The target response strategy is executed.

[0132] Optionally, the network security operation and maintenance device further comprises:

[0133] A first obtaining module is configured to statically segment the dynamic network security graph to obtain a plurality of static segments after segmentation;

[0134] A second acquisition module is used to perform data conversion on the plurality of static segments to obtain a static atlas matrix;

[0135] The acquisition module 602 is specifically configured to:

[0136] According to the pre-trained first model, the pre-trained second model and the static graph matrix, an anomaly detection result of each of the network devices is obtained.

[0137] Optionally, the network security operation and maintenance device further comprises:

[0138] A generating module, configured to train the generator in the second model according to the historical attack data to generate a plurality of the simulated attack data;

[0139] A third obtaining module is used to splice each of the simulated attack data with each of the historical static graph matrices to obtain a plurality of spliced matrices;

[0140] The fourth acquisition module is used to train the discriminator in the second model according to the multiple spliced matrices to obtain a pre-trained second model.

[0141] Optionally, in the network security operation and maintenance device, the third obtaining module is specifically configured to:

[0142] Each simulated attack data is spliced with each historical static graph matrix respectively by using a permutation and combination method of Cartesian product to construct multiple spliced matrices.

[0143] Optionally, in the network security operation and maintenance device, the plurality of network devices include network devices at multiple different network levels.

[0144] It should be noted that the device in this embodiment is a device corresponding to the above-mentioned network security operation and maintenance method, and the implementation methods in the above-mentioned embodiments are all applicable to the embodiments of this device and can achieve the same technical effects.

[0145] The present application also provides a network security operation and maintenance device, such as Figure 7 Shown, including:

[0146] Processor 701, memory 702, transceiver 703 and programs or instructions stored on the memory 702 and executable on the processor 701; when the processor 701 executes the programs or instructions, each process of the above-mentioned network security operation and maintenance method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, they will not be described here.

[0147] The transceiver 703 is configured to receive and send data under the control of the processor 701 .

[0148] Among them, Figure 7In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically various circuits of one or more processors represented by processor 701 and memory represented by memory 702, which are linked together. The bus architecture may also link together various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 703 may be a plurality of components, i.e., a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium. For different user devices, the user interface 704 may also be an interface capable of connecting external or internal devices as required, and the connected devices include but are not limited to a keypad, a display, a speaker, a microphone, a joystick, etc.

[0149] The processor 701 is responsible for managing the bus architecture and general processing, and the memory 702 can store data used by the processor 701 when performing operations.

[0150] The present application also provides a computer-readable storage medium that stores a computer program. When the computer program is executed by a processor, the various processes of the above-mentioned network security operation and maintenance method embodiment are implemented, and the same technical effects are achieved. To avoid repetition, the details are not described here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0151] An embodiment of the present application also provides a computer program product, including computer instructions. When the computer instructions are executed by a processor, the various processes of the above-mentioned network security operation and maintenance method embodiment are implemented, and the same technical effects can be achieved. To avoid repetition, they will not be repeated here.

[0152] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or apparatus comprising the element.

[0153] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, and the computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), including a number of instructions for enabling a terminal (which can be a mobile phone, computer, server, air conditioner, or network equipment, etc.) to execute the methods described in each embodiment of the present application.

[0154] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of this application, ordinary technicians in this field can also make many forms without departing from the purpose of this application and the scope of protection of the claims, all of which fall within the protection of this application.

[0155] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as within the scope of protection of the present invention.

Claims

1. A network security operation and maintenance method, characterized in that: include: Build a dynamic network security map based on the operation and maintenance data of multiple network devices collected at preset intervals. Obtaining an anomaly detection result for each network device based on a pre-trained first model, a pre-trained second model, and the dynamic network security map, wherein the first model is used to perform device anomaly detection on the network device, and the second model is used to generate a plurality of simulated attack data, and use the plurality of simulated attack data to perform attack anomaly detection on the network device; According to the anomaly detection result, a corresponding response scheduling strategy is executed.

2. The network security operation and maintenance method according to claim 1, characterized in that: Based on the anomaly detection results, a corresponding response scheduling strategy is executed, including: Determining, based on the anomaly detection result, a target probability level of occurrence of the network device risk and a target impact level of the network device risk occurrence on the network; Obtaining a target response strategy based on the target probability level and the target impact level, and a preset correlation between the probability level, the impact level, and the response strategy; The target response strategy is executed.

3. The network security operation and maintenance method according to claim 1, characterized in that: The method further comprises: Static segmentation is performed on the dynamic network security graph to obtain multiple static segments after segmentation; Performing data conversion on the plurality of static segments to obtain a static atlas matrix; Obtaining an anomaly detection result for each network device according to the pre-trained first model, the pre-trained second model, and the dynamic network security map, including: According to the pre-trained first model, the pre-trained second model and the static graph matrix, an anomaly detection result of each of the network devices is obtained.

4. The network security operation and maintenance method according to claim 3, characterized in that: The method further comprises: Training the generator in the second model according to the historical attack data to generate a plurality of the simulated attack data; Splicing each of the simulated attack data with each of the historical static graph matrices to obtain a plurality of spliced matrices; The discriminator in the second model is trained according to the spliced multiple matrices to obtain a pre-trained second model.

5. The network security operation and maintenance method according to claim 4, characterized in that: Each simulated attack data is spliced with each historical static graph matrix to obtain multiple spliced matrices, including: Each simulated attack data is spliced with each historical static graph matrix respectively by using a permutation and combination method of Cartesian product to obtain multiple spliced matrices.

6. The network security operation and maintenance method according to claim 1, characterized in that: The plurality of network devices include network devices at a plurality of different network levels.

7. A network security operation and maintenance device, characterized in that: include: A construction module is used to construct a dynamic network security map based on operation and maintenance related data of multiple network devices collected at preset intervals; an acquisition module, configured to acquire an anomaly detection result for each network device based on a pre-trained first model, a pre-trained second model, and the dynamic network security map, wherein the first model is used to perform device anomaly detection on the network device, and the second model is used to generate a plurality of simulated attack data, and perform attack anomaly detection on the network device using the plurality of simulated attack data; The execution module is used to execute the corresponding response scheduling strategy according to the abnormality detection result.

8. A network security operation and maintenance device, characterized in that: include: A processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the processor implements the network security operation and maintenance method according to any one of claims 1 to 6 when executing the program or instruction.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the network security operation and maintenance method according to any one of claims 1 to 6 is implemented.

10. A computer program product, characterized in that The method comprises computer instructions, which, when executed by a processor, implements the network security operation and maintenance method according to any one of claims 1 to 6.

Images