A computer network information security monitoring method, system, device and medium

Abstract

The application relates to the technical field of network security, in particular to a computer network information security monitoring method, system, device and medium, which comprises the following steps: acquiring encrypted traffic data and application log data in a network environment, constructing a time-space correlated original data set based on the encrypted traffic data and the application log data; performing protocol analysis on the time-space correlated original data set to generate a protocol fingerprint feature vector; inputting the protocol fingerprint feature vector and the application log data into a preset heterogeneous multi-modal analysis model to acquire a multi-dimensional security situation assessment result containing a threat level and an attack path; and based on the multi-dimensional security situation assessment result, generating a dynamic defense strategy instruction set through a reinforcement learning algorithm, and real-time issuing the strategy instruction to a network execution node. The application has the effects of realizing real-time and accurate detection of encrypted threats and constructing a dynamic defense system balancing security and efficiency.

Images