Network security assessment method, equipment and medium

Abstract

The invention relates to the field of network security, and discloses a network security assessment method and device and a medium, and the method comprises the steps: collecting network security data from different sources; preprocessing the network security data to obtain preprocessed network security data; performing modal decomposition on the preprocessed network security data to obtain different network security features; and performing network security evaluation according to different network security features. According to the method, the technical problems of inaccurate evaluation result and low efficiency in the existing network security evaluation are solved.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a network security assessment method. Background Art

[0002] With the rapid development of information technology, network systems are facing increasing and unprecedented network security threats and risks, including hacker intrusions, DDoS attacks, data leakage, and network virus propagation. These threats have seriously affected the network security of network users and enterprises, and may even lead to serious problems such as business interruption, user information leakage, and economic losses.

[0003] Existing network security assessment methods often have the following problems: 1. Vulnerability scanning tools are static. Current vulnerability scanning tools can only detect known vulnerabilities but cannot effectively respond to new attacks. Security policies are static and cannot be adaptively adjusted according to the real-time status of the network and the ever-changing threat environment.

[0004] 2. Data collection issues: The evaluation method cannot comprehensively collect relevant data, and the collected data is erroneous or inconsistent. Insufficient data collection on hidden and intermittent security incidents in the internal network leads to inaccurate results.

[0005] 3. False positives and missed negatives. Current security assessment methods, such as intrusion detection systems and vulnerability scanning tools, have the problem of false positives and missed negatives, which leads to unnecessary alarms and waste of resources, increases the burden on security managers, and even causes potential security issues to go undetected by managers.

[0006] 4. The evaluation methods lack standardization. Most evaluation methods lack standardization and planning in the implementation process, resulting in differences and repeatability in the evaluation results.

[0007] 5. The assessment method is inefficient. The implementation process of most network security assessment methods is lengthy and complicated, resulting in a long time and energy consumption, which affects the normal business operations of enterprises or organizations. Summary of the Invention

[0008] The purpose of the present invention is to propose a network security assessment method, device and medium to solve the technical problems of inaccurate assessment results and low efficiency in existing network security assessments.

[0009] Specifically, the present invention provides a network security assessment method comprising the following steps: S1. Collect cybersecurity data from different sources; S2. Preprocess the network security data to obtain preprocessed network security data; S3. Perform modal decomposition on the pre-processed network security data to obtain different network security features; S4. Conduct network security assessment based on different network security characteristics.

[0010] A storage medium stores instructions and data for implementing a network security assessment method.

[0011] A network security assessment device comprises: a processor and a storage medium; the processor loads and executes instructions and data in the storage medium to implement a network security assessment method.

[0012] The beneficial effects provided by the present invention are: 1. Strong adaptability. Intrinsic mode decomposition can effectively capture the frequency changes of network security data at different times, and can be decomposed into multiple modal components, and then different features of the data can be extracted based on the decomposed modal components.

[0013] 2. Strong noise resistance. Data is often interfered by noise, but intrinsic mode decomposition can effectively separate data and noise components when decomposing network security data, and can decompose more accurate and clear data features.

[0014] 3. Good reconfigurability. The modal components can be superimposed when the intrinsic mode decomposition decomposes and processes network security data, ensuring that the original data will not be lost during the decomposition and processing of the data.

[0015] 4. Highly targeted, the decision tree can divide the features decomposed by the intrinsic mode decomposition model into different risks and formulate different strategies based on different risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a simple flow chart of the method of the present invention; Figure 2 It is a schematic diagram of the data preprocessing process; Figure 3 It is a schematic diagram of the variable mode decomposition process; Figure 4 It is a schematic diagram of the risk assessment process; Figure 5 It is a schematic diagram of the working of the hardware device of an embodiment of the present invention. DETAILED DESCRIPTION

[0017] To make the objectives, technical solutions and advantages of the present invention more clear, the embodiments of the present invention will be further described below with reference to the accompanying drawings.

[0018] Before formally explaining the present invention, the scheme of the present invention is first generally explained for easy understanding.

[0019] Please refer to Figures 1-4 The present invention provides a network security assessment method, comprising: S1. Collect cybersecurity data from different sources; The different sources mentioned in step S1 include: servers, applications, network devices and network nodes; Specifically, the present invention first determines the source of abnormal data and collects relevant data from servers, applications, network devices, and network nodes.

[0020] Secondly, install Python-related libraries, such as requests, Beautiful Soup, selenium, and pandas libraries.

[0021] Requests is used to send HTTP requests to obtain web page content; Beautiful Soup is used to parse HTML and XML content and extract required data from it; Selenium is used to crawl dynamic web page content; Pandas is used for subsequent data processing and storage.

[0022] Use the requests library to send a GET or POST request to the target website to retrieve the HTML source code. Dynamic websites require Selenium to simulate browser behavior and crawl data. Use Beautiful Soup to parse the HTML source code and locate the target data. For example, find content related to network security information by tag, class name, or ID, and extract data fields such as vulnerability description, threat level, and timestamp.

[0023] Ultimately, it can be achieved, for example, by collecting real-time network traffic logs from network devices and collecting alerts and logs generated by IDS, identifying key indicators that need to be monitored and evaluated, and ensuring that the collected data can support the effectiveness of subsequent analysis.

[0024] S2. Preprocess the network security data to obtain preprocessed network security data; It should be noted that the preprocessing in step S2 includes: data cleaning, data formatting and data labeling.

[0025] As an embodiment, step S2 specifically includes the following steps: The purpose of data processing is to improve the accuracy, consistency and integrity of network security data by removing irrelevant or erroneous data and clearing out incorrect and incomplete records in system log files through steps such as cleaning, standardization and normalization.

[0026] Step 1: Identify and classify missing value data First, import the Pandas library functions in the Python language and use the isNull() function to determine whether the network security data collected by the Python crawler has missing values. Then find the network security data with missing values ​​and return this data into a Boolean data frame. Then use the sum() function to count the missing values ​​to understand the differences between different data sources. Finally, classify the missing value data by type, such as classification by the cause of the missing value, classification by the distribution pattern of the missing value, and classification by the variable type where the missing value is located.

[0027] Step 2: Fill in missing values Fill missing values ​​in the classified missing value data, use the mean to fill numerical network security data, calculate the mean of these data, and use the mean to fill missing values; use linear interpolation to fill time series data, find adjacent non-missing value data points, use the linear interpolation formula to calculate the missing value estimate and fill it.

[0028] Step 3: Reduce the weight of the filled data Use sorting to deduplicate data. First, sort the data so that identical data items are adjacent. Then, traverse the sorted data, compare adjacent data, and combine it with the primary key or other unique identifier to find and delete duplicate network security data rows.

[0029] Step 4: Data Standardization Data standardization is performed using the data standard deviation method (Z-score), transforming cybersecurity data into a distribution with a mean of 0 and a standard deviation of 1. This scales the cybersecurity data to a specific range. The Z-score represents the number of standard deviations a data point is from the mean. If a data point is above the mean, the Z-score is positive; if it is below the mean, the Z-score is negative. A larger absolute value of the Z-score indicates a greater deviation from the mean. The Z-score standardization formula is as follows:

[0030] in, is the original data, is the average, is the standard deviation.

[0031]

[0032] Step 5: Data Labeling Using the ELK Stack, we tag the source field of data with the web_log and db_log tags based on log levels and conditions. When the source field or content contains specific keywords or the log level is HTTP-related, the web_log tag is added; when the source field matches the database log path or contains SQL-related information, the db_log tag is added. Subsequent processing can use these tags to distinguish data sources, facilitating visualization and monitoring.

[0033] S3. Perform modal decomposition on the pre-processed network security data to obtain different network security features; It should be noted that extracting key information from raw data to facilitate analysis, detection, and decision-making can help capture important information in the data, such as traffic patterns, attack characteristics, user behavior, etc. The extracted features should also be able to better distinguish normal behavior from abnormal behavior, reducing false positives and missed reports.

[0034] Step S3 is as follows: S31. Determine the number K of decomposed modes based on the preprocessed network security data; First, the dataset is divided into a training set and a validation set. The model is trained for different modal numbers K and its performance on the validation set is evaluated. The appropriate modal number K is determined based on the model performance and the dataset. The signal mainly contains arrive The frequency components of , and it is known that the frequency bandwidth roughly covered by each mode is , the formula for K is as follows:

[0035] S32, determining a balance parameter α; The dataset is divided into a training set and a validation set. Different values ​​of a are used for training and the model performance is evaluated on the validation set. A grid containing multiple candidate a values ​​is defined. The model is systematically trained and the performance of each parameter combination is evaluated. The optimal balance parameters are selected according to the overall modal bandwidth metric formula:

[0036] Among them, B(α) represents the average change amplitude under the parameter α, which is used to measure the overall change trend of the sample or model in K-1 subintervals; and Δ Indicates the change of a variable (such as frequency, weight, eigenvalue, etc.) in the kth subinterval; S33, randomly initializing each modal function using wavelet transform; The present invention uses a wavelet transform initialization method to perform wavelet transform on network security data, extract low-frequency and high-frequency parts in the network security data, and select these parts as initial values ​​of the modal function.

[0037] S34, decomposing into K intrinsic mode functions according to the optimization objective function; Combining the decomposed mode number K, the balance parameter a, and the initialized modal function, an optimization objective function is constructed to minimize the decomposition error, and then combined with the optimization objective function to decompose into K eigenmode functions. The optimization objective function formula is as follows:

[0038] in is a regularization term used to control the smoothness or sparsity of the modal function and balance the parameters Control its weight.

[0039] S35. Extract network security features based on intrinsic mode functions.

[0040] It should be noted that the present invention first collects statistical amplitude characteristics of network security data from each intrinsic mode function, such as mean, variance, maximum, minimum, and peak values. It then uses wavelet transform to analyze the frequency characteristics of the eigenmode function, extract the frequency components, analyze the temporal trends of the eigenmode function, extract the time-related phase characteristics, and identify the instantaneous attack or abnormal behavior corresponding to the eigenmode function.

[0041] S4. Conduct network security assessment based on different network security characteristics.

[0042] It should be noted that the application and strategy of decision trees in network security assessment can effectively improve the performance and accuracy of the model, while enhancing the ability to respond to potential threats. It can also divide sub-nodes with different characteristics, and then perform risk security assessment and strategy modeling based on the sub-nodes with different characteristics.

[0043] Step S4 is specifically as follows: S41. Divide network security features into different types to obtain different training sets; First, key features are extracted from the collected network security data. These features may include traffic characteristics, protocol types, attack behaviors, etc. The extracted features are divided into multiple different training datasets. By extracting and analyzing different datasets multiple times, the data is ensured to be diverse, representative, and usable, thereby improving the robustness and generalization ability of the model.

[0044] S42. Setting a security threshold for each security feature type and determining a threat level based on the security threshold; Collected network security data is categorized based on its status, DDoS, malware attacks, phishing, and other attack methods, with thresholds set for each type. The relationship between the data's characteristic values ​​and the thresholds is calculated to determine the threat level, such as low, medium, high, or severe.

[0045] S43, constructing decision trees based on different training sets; Starting from the root node, using different extracted training data sets, the samples are divided according to the selected features and the corresponding Gini coefficient. The Gini coefficient is used to assess the purity of the data, and the features that make the node with the highest purity (lowest Gini coefficient) are selected for splitting.

[0046] After partitioning the data into different sub-nodes, feature selection and splitting operations are repeated for the samples in each sub-node, optimizing the partitioning process according to the same principle of minimizing the Gini coefficient. The splitting operation continues until the number of samples in the node falls below a specified threshold, the feature cannot be split any further, or the maximum tree depth is reached. This completes the decision tree model, ensuring a balanced tree structure and good generalization ability.

[0047] S44, building a decision tree; Use post-pruning strategies for cross-validation or set evaluation of model performance to remove overfitting data, and set stopping conditions in the process of generating decision trees, such as the minimum number of split samples and the maximum tree depth, to stop splitting in advance and increase the discrimination of child nodes.

[0048] S45. Divide risks and formulate strategies based on the sub-nodes of the decision tree.

[0049] Divide risks and formulate strategies based on sub-nodes Risk Nodes: 1) High-risk sub-nodes: malware attacks originate from well-known malicious IP addresses, which may cause data leakage or business interruption.

[0050] 2) Medium-risk sub-node: phishing attacks, but the target users have been trained and have a certain degree of awareness of prevention. This may lead to user information leakage, but the losses are limited.

[0051] 3) Low-risk subnodes: abnormal traffic originates from the internal network. No malicious behavior was found after inspection. This falls under routine monitoring and requires vigilance but no immediate response.

[0052] Strategy Development: 1) High-risk strategy: Isolate the affected system, cut off network connections and initiate data recovery procedures to ensure that critical data is not lost, record event logs, and conduct a detailed investigation to determine the source of the attack.

[0053] 2) Medium-risk strategy: Set up monitoring, track suspicious activities in real time, set alert thresholds, strengthen user security awareness training, improve the ability to identify phishing attacks, analyze the impact of incidents, and perform system repairs and patch updates when necessary.

[0054] 3) Low-risk strategy: Regularly review network traffic and system logs, remain vigilant, record events and include them in risk reports for subsequent analysis, and ensure that security measures such as firewalls and intrusion detection systems are functioning properly.

[0055] See Figure 5 , Figure 5 4 is a schematic diagram of the working of a hardware device according to an embodiment of the present invention. The hardware device specifically includes: a network security assessment device 401, a processor 402 and a storage medium 403.

[0056] A network security assessment device 401: The network security assessment device 401 implements the network security assessment method.

[0057] Processor 402: The processor 402 loads and executes instructions and data in the storage medium 403 to implement the network security assessment method.

[0058] Storage medium 403: The storage medium 403 stores instructions and data; the storage medium 403 is used to implement the network security assessment method.

[0059] The beneficial effects of the present invention are: 1. Strong adaptability. Intrinsic mode decomposition can effectively capture the frequency changes of network security data at different times, and can be decomposed into multiple modal components, and then different features of the data can be extracted based on the decomposed modal components.

[0060] 2. Strong noise resistance. Data is often interfered by noise, but intrinsic mode decomposition can effectively separate data and noise components when decomposing network security data, and can decompose more accurate and clear data features.

[0061] 3. Good reconfigurability. The modal components can be superimposed when the intrinsic mode decomposition decomposes and processes network security data, ensuring that the original data will not be lost during the decomposition and processing of the data.

[0062] 4. Highly targeted, the decision tree can divide the features decomposed by the intrinsic mode decomposition model into different risks and formulate different strategies based on different risks.

[0063] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A network security assessment method, characterized by: These include: S1. Collect cybersecurity data from different sources; S2. Preprocess the network security data to obtain preprocessed network security data; S3. Perform modal decomposition on the pre-processed network security data to obtain different network security features; S4. Conduct network security assessment based on different network security characteristics.

2. A network security assessment method according to claim 1, characterized in that: The different sources mentioned in step S1 include: servers, applications, network devices and network nodes.

3. A network security assessment method according to claim 2, characterized in that: The preprocessing in step S2 includes: data cleaning, data formatting and data labeling.

4. A network security assessment method according to claim 3, characterized in that: Step S3 is as follows: S31. Determine the number K of decomposed modes based on the preprocessed network security data; S32, determining a balance parameter α; S33, randomly initializing each modal function using wavelet transform; S34, decomposing into K intrinsic mode functions according to the optimization objective function; S35. Extract network security features based on intrinsic mode functions.

5. A network security assessment method according to claim 4, characterized in that: The number of modes in step S31 ,in The frequency bandwidth covered for each mode; 、 is the preset frequency component.

6. A network security assessment method according to claim 1, characterized in that: In step S32, the balance parameter α is as follows: , where B(α) represents the average change amplitude under parameter α, which is used to measure the overall change trend of the sample or model in K−1 subintervals; and Δ Represents the change in the variable in the kth subinterval.

7. A network security assessment method according to claim 1, characterized in that: The optimization objective function in step S34 is as follows: in, is a regularization term used to control the smoothness or sparsity of the modal function and balance the parameters Control its weight, m k (t) represents the reconstructed signal or sub-representation of the kth component at time t.

8. A network security assessment method according to claim 1, characterized in that: Step S4 is specifically as follows: S41. Divide network security features into different types to obtain different training sets; S42. Setting a security threshold for each security feature type and determining a threat level based on the security threshold; S43, constructing decision trees based on different training sets; S44, building a decision tree; S45. Divide risks and formulate strategies based on the sub-nodes of the decision tree.

9. A storage medium, characterized in that: The storage medium stores instructions and data for implementing a network security assessment method as described in any one of claims 1 to 8.

10. A network security assessment device, characterized by: include: A processor and a storage medium; the processor loads and executes instructions and data in the storage medium to implement a network security assessment method according to any one of claims 1 to 8.

Images