A network security situation awareness method based on cross-domain data sharing

Abstract

The scheme belongs to the field of cross-domain data transmission, and specifically relates to a network security situation awareness method based on cross-domain data sharing. The method comprises the following steps: S10: collecting log data including network traffic data and access request records from network equipment; analyzing the log data, extracting an event set constituted by dangerous events according to the network traffic data and the access request records, and the event set containing a timestamp, an event address, a source address and a target address; S20: receiving request information sent by a client, taking a client communication address as a first address, obtaining a network domain address where request data corresponding to the request information as a second address, and combining other network domains or nodes to establish a cross-domain topology structure. Through the collection and analysis of logs, the establishment of a cross-domain topology, the dynamic risk evaluation and the planning of a path, the scheme solves the balance problem of security, efficiency and dynamic adaptability in cross-domain sharing, and has the advantages of optimal resource, strong expansion, privacy protection and experience improvement.

Description

Technical Field

[0001] This solution belongs to the field of cross-domain data transmission, specifically involving a network security situation awareness method based on cross-domain data sharing. Background Technology

[0002] Cybersecurity situational awareness refers to the technology of collecting and analyzing various types of data in the network to grasp the network security status in real time, identify potential threats, and assess risk trends. Its core features include real-time capture of network events, correlation analysis, and dynamic assessment of security status, aiming to provide a basis for cybersecurity decision-making.

[0003] Currently, Chinese patent application CN117097539A generates event sets by collecting network device logs and data. After preprocessing and aggregation, these sets are identified as security events and attack processes to assess the network security status of devices and networks. This demonstrates the progressive analysis characteristics from event to attack chain, allowing for the tracking of security situation development. Chinese patent application CN119420547A extracts network topology, node attributes, and interaction relationship features. Based on a neural network model, it converts the feature matrix into a situation vector and combines it with optimization algorithms to quantify risk. This demonstrates the characteristics of risk assessment achieved through feature learning and model inference, improving perception accuracy.

[0004] Cross-domain data sharing refers to data interaction between different network domains according to rules, requiring a balance between breaking down data silos and ensuring secure access and access control between domains. While cross-domain data sharing breaks down data silos, data flowing between different security domains faces unique risks such as cross-domain attacks. Currently, most network security situational awareness methods are designed for single domains and are ill-suited to the complexity of cross-domain scenarios. To address this, Chinese patent CN119577813A discloses a cross-domain data sharing method. This method generates an authorization license file through an authorization management platform, and the sharing server determines permissions based on the client's domain, providing data access for the client to launch an independent microservice container. This approach achieves controllable sharing of data between domains, ensuring data security and access control during cross-domain data sharing. However, the widespread use of microservice containers increases hardware resource consumption and operational costs, especially in large-scale cross-domain data sharing scenarios, where the pressure on hardware resources is even more significant. While strict permission restrictions ensure data security, they may impact the scope and efficiency of data sharing, limiting data flow and availability. Furthermore, during cross-domain data sharing, the network environment and security threats are dynamically changing, and the aforementioned methods are insufficient in dynamically adjusting permissions and adapting to the dynamic changes in cross-domain data flow, making it difficult to respond in real-time to unique risks such as cross-domain attacks. Therefore, although some progress has been made in network security situational awareness and cross-domain data sharing, it remains difficult to effectively balance the security, efficiency, and dynamic adaptability of data sharing in cross-domain scenarios. Summary of the Invention

[0005] The purpose of this solution is to provide a network security situation awareness method based on cross-domain data sharing, in order to solve the problem of balancing the security, efficiency and dynamic adaptability of data sharing in the process of realizing network security situation awareness under cross-domain data sharing.

[0006] To achieve the above objectives, this solution provides a network security situation awareness method based on cross-domain data sharing, comprising the following steps:

[0007] S10: Collect log data including network traffic data and access request records from network devices; parse the log data, and extract an event set consisting of dangerous events based on the network traffic data and access request records, wherein the event set includes timestamps, event addresses, source addresses, and destination addresses;

[0008] S20: Receive the request information sent by the client, take the client's communication address as the first address, obtain the network domain address where the request data is located corresponding to the request information as the second address, and establish a cross-domain topology structure in combination with other network domains or nodes;

[0009] S30: Establish an analysis model and train the analysis model with an event set. The analysis model analyzes dangerous events in the current log data based on the current network traffic data and access request records as risk prediction results. The current time is used as the timestamp, the second address is the source address, and the first address is the target address. The analysis model is combined to calculate the event address and the corresponding dangerous event. The risk level of the node is dynamically assessed based on the number of dangerous events existing in the network domain or node.

[0010] S40: Use the node where the second address is located as the first node for network security situation awareness; obtain the next node of the first node in the cross-domain topology; if the risk level of the next node is less than the preset maximum risk threshold, establish a transmission path between the first node and the next node, and use the next node as the first node for network security situation awareness; if the risk level of the next node is not less than the preset maximum risk threshold, use the minimum risk level of the next node as the risk level of the first node, and use the previous node of the first node as the first node for network security situation awareness.

[0011] S50: When a transmission path is established between the first address and the second address, send request data to the client; when the risk level of the next node after the second address is not less than the preset maximum risk threshold, cancel sending request data.

[0012] The principle and technical effects of this solution are as follows: First, by collecting log data from network devices and extracting a set of dangerous events containing key information, combined with the cross-domain topology, this solution uses an analytical model to dynamically assess the risk level of each node. Based on the risk assessment results, it plans secure data transmission paths and monitors path risks in real time to dynamically adjust or cancel data transmission, thereby achieving network security situational awareness in cross-domain data sharing scenarios. This method not only improves the security and efficiency of data sharing but also effectively balances security, efficiency, and dynamic adaptability by dynamically adapting to changes in the network environment, overcoming the limitations of existing technologies under cross-domain complexity.

[0013] Secondly, this solution extracts dangerous events to form event sets and dynamically assesses risk levels, combining this with real-time log data collection and analysis models to create a closed loop from accurate identification to rapid response. By associating event addresses in the cross-domain topology with source and target addresses, the analysis model can more accurately pinpoint the source of threats, while dynamic risk level assessment ensures the timeliness of threat response. For example, when a cross-domain attack originates from multiple nodes, this solution can upgrade the risk level in real time based on the number of dangerous events and then adjust the path to avoid the attack chain. Compared to simple event collection and analysis, this further shortens the response window, enabling rapid interception of unauthorized access caused by phishing attacks in cross-domain financial data sharing.

[0014] Furthermore, in terms of optimizing resource utilization, the system constructs a cross-domain topology and dynamically iterative risk-aware node logic, allowing path planning to be based on both global topology and real-time risk. Simultaneously, by filtering the risk of the next node and iteratively sensing the risk of the previous node, it avoids resource waste caused by blindly selecting paths, and determines data transmission based on whether a path is established, reducing bandwidth consumption from invalid transmissions. In cross-domain sharing within the government cloud, this design can avoid high-risk government private network nodes, directing data to low-load edge nodes, ensuring security while improving transmission efficiency, and reducing resource redundancy compared to fixed path planning.

[0015] Furthermore, regarding scalability, this solution dynamically updates the cross-domain topology along with the network domain and nodes, and the path adjustment mechanism adapts to new node additions without requiring a complete architecture refactoring. When a new computing power center domain is added, the topology automatically incorporates the new node, and risk assessment quickly integrates it into available paths, flexibly starting and stopping data transmission based on path status. In cross-domain scenarios of the Industrial Internet, newly connected IoT terminals can be automatically identified and their risks assessed, allowing for coverage expansion without downtime upgrades, thus reducing expansion costs compared to static topology designs.

[0016] Finally, regarding enhancing privacy protection and improving user experience, this solution focuses on high-risk events rather than the entire dataset when extracting event sets, reducing the exposure of sensitive information. Simultaneously, it dynamically assesses risk based on the number of high-risk events, avoiding the blurring of privacy boundaries caused by over-reliance on fixed rules. Furthermore, the solution's path stability guarantee allows users to quickly access data across domains without worrying about privacy leaks. For example, in cross-domain sharing of medical data, transmitting patient information through low-risk paths complies with privacy regulations while allowing doctors to access data in real time, achieving a dual improvement in security and user experience.

[0017] In summary, this solution addresses the balance between security, efficiency, and dynamic adaptability in cross-domain sharing by collecting and analyzing logs, building cross-domain topologies, dynamically assessing risks, and planning paths. It also offers advantages such as optimized resources, strong scalability, privacy protection, and improved user experience.

[0018] Furthermore, when dynamically assessing the risk level of a node, the number of neighboring nodes of the node is analyzed. Neighboring nodes in different network domains from the node are considered cross-domain nodes. The network domain of the cross-domain node is obtained as the cross-domain network type. Cross-domain nodes are classified according to the cross-domain network type. The number of cross-domain nodes corresponding to different cross-domain network types is counted. The transmission association weight of the node is analyzed based on the cross-domain network type and the proportion of the corresponding number of cross-domain nodes in the neighboring nodes. The risk level of the node is dynamically adjusted based on the transmission association weight.

[0019] This solution adjusts node risk levels by analyzing the network type, quantity ratio, and transmission association weights of cross-domain nodes. This not only improves the cross-domain adaptability of risk assessment but also strengthens the identification of cross-domain threat correlations, while optimizing the balance between security and efficiency in path planning. For example, in cross-domain data sharing between the financial and government domains, the risk characteristics of the two domains differ significantly. By classifying and statistically analyzing the types of cross-domain nodes, the risk levels of nodes can be adjusted accordingly, avoiding misjudgments caused by using single-domain assessment standards. Simply assessing based on the number of dangerous events might mistakenly classify financial nodes that frequently interact with the government domain as high-risk. However, by introducing type differences, the risk level of the government domain can be appropriately lowered, taking into account its lower attack rate.

[0020] More importantly, this approach can identify hidden cross-domain collaborative threats. For example, when a company's node suddenly experiences concentrated access from multiple low-risk cross-domain nodes from anonymous network domains, educational domains, and commercial domains, by statistically analyzing the proportion of different types of nodes, it can promptly detect that this may be a precursor to a distributed attack. That is, concentrated access from a single type of node is easy to identify, while low-risk access from multiple mixed types is often overlooked, thus providing an early warning.

[0021] Furthermore, this approach enables the lightweight implementation of implicit cross-domain trust mechanisms. For example, nodes in research institution domains inherently possess high trustworthiness due to their type characteristics. When sharing data with medical domains, this solution automatically reduces the risk level weight based on the cross-domain network type, eliminating the need for additional complex cross-domain trust protocols and significantly reducing system resource consumption. Simultaneously, in cross-domain data sharing scenarios on e-commerce platforms, a core node may have a high transmission association weight due to its association with multiple downstream domain nodes. If judged solely by the number of dangerous events, it might be over-classified as high-risk. Weight adjustment can reasonably reduce its risk level, guiding data to that node and preventing transmission congestion on other nodes due to excessive load. This indirectly achieves load balancing across domain networks, improving overall data flow efficiency.

[0022] Furthermore, when calculating the transmission association weight, different initial weights are first set for different network types, and then the proportion of the number of nodes corresponding to the cross-domain network type in the number of adjacent nodes is counted. Based on the counted proportion of the number of nodes, the weight of the corresponding network type is dynamically adjusted.

[0023] First, this method accurately assesses the transmission association weight of each node, avoiding misjudgments caused by single-indicator evaluation and ensuring the accuracy and reliability of weight assessment. Second, the dynamic weight adjustment mechanism enables the system to respond in real time to changes in the network environment, adapting to dynamic changes in network topology and security threats, thereby optimizing data transmission path planning and improving data transmission security and efficiency. Furthermore, by statistically analyzing the proportion of different types of nodes, this solution can promptly detect hidden cross-domain collaborative threats, strengthening the identification of cross-domain threat correlations. Simultaneously, for high-trust network types, its risk level weight is automatically reduced, achieving a lightweight implementation of the implicit cross-domain trust mechanism and reducing resource consumption. More importantly, by rationally adjusting the transmission association weight of core nodes, data is guided to those nodes, preventing transmission congestion caused by excessive load on other nodes, indirectly achieving load balancing in cross-domain networks and improving overall data flow efficiency. These effects work together to significantly improve the security and efficiency of cross-domain data sharing while optimizing resource utilization.

[0024] Furthermore, step S30 also includes the following steps:

[0025] S31a: Initialize the dangerous area and the set of adjacent nodes, and calculate the diffusion risk value of the nodes based on the transmission association weight and risk level of the nodes;

[0026] S31b: When the risk of a node's spread exceeds a preset spread threshold, the node is added to the danger zone;

[0027] S31c: Perform network security situational awareness on nodes within the danger zone, identify nodes directly connected to nodes within the danger zone as neighboring nodes and add them to the neighboring node set, and remove nodes within the danger zone from the neighboring node set. If:

[0028] S31c-1: If the set of adjacent nodes is empty, then execute step S31d;

[0029] S31c-2: If the set of adjacent nodes is not empty, take one node from the set of adjacent nodes and return S31b;

[0030] S31d: Avoid dangerous areas when planning data transmission paths.

[0031] Transmission association weight plays a multi-dimensional and core role in this solution, not only providing crucial evidence for risk level assessment but also significantly improving the accuracy of cross-domain risk perception through deep integration with risk diffusion calculation. In dangerous zone delineation, transmission association weight, as a diffusion coefficient, directly affects the calculation of node diffusion risk values: nodes with high association weight (such as cross-domain data gateways) have amplified diffusion risks due to frequent interactions, and even if their initial risk level is moderate, they can be promptly included in dangerous zones. When a base station is attacked, the diffusion risk value of scheduling nodes quickly exceeds the limit due to weight amplification. This solution uses S31b-S31c to include both in the dangerous zone, proactively blocking the spread of viruses to the energy storage center and reducing the scope of cross-domain faults compared to simply relying on risk levels.

[0032] Meanwhile, this weighting supports dual optimization of path planning: it precisely avoids high-risk links by circumventing dangerous areas in S31d, and prioritizes combinations of highly correlated and low-risk nodes based on weight ranking. For example, in cross-domain financial scenarios, data is transmitted primarily through highly correlated nodes between payment institutions and banks, balancing security and efficiency. More notably, it can serve as a benchmark for abnormal behavior. When the interaction frequency between e-commerce platform nodes and anonymous domains exceeds the weight matching range, it provides rapid early warning, detecting APT attacks two hours earlier than traditional traffic detection. While ensuring transmission security, it avoids resource waste caused by over-protection through precise risk identification, achieving deep synergy between cross-domain security and circulation efficiency.

[0033] Furthermore, nodes on the boundary of the dangerous area are designated as boundary nodes. When dynamically assessing the risk level, the risk level and diffusion risk value of the boundary nodes are calculated first. If the risk level is less than the highest risk threshold and the diffusion risk value is less than the diffusion threshold, the boundary nodes are removed from the dangerous area to reduce the range of the dangerous area.

[0034] This solution achieves multiple benefits through dynamic assessment and adjustment of boundary nodes in hazardous areas. The core lies in leveraging the synergy of boundary nodes, risk levels, and diffusion risk values. It first accurately identifies boundary nodes in hazardous areas, then uses dual threshold verification (risk level < highest threshold and diffusion risk value < diffusion threshold) to determine whether to remove them. This mechanism allows hazardous areas to shrink as risk changes, avoiding over-protection caused by static delineation and reducing wasted path resources. Simultaneously, this mechanism allows hazardous areas to shrink rapidly with risk changes. In dynamic risk level assessment and adjustment, it eliminates the complex multi-level approval processes of traditional solutions, directly updating boundary node status based on real-time calculated risk parameters, significantly improving adjustment speed and efficiency. For example, in cross-domain e-commerce scenarios, nodes that experience brief anomalies can be removed after recovery, reducing wasted path resources. Furthermore, boundary node removal expands available paths in real time. In medical data sharing, removing hospital nodes shortens transmission distance and reduces detour losses. More importantly, it releases occupied protection resources, improving resource utilization in edge computing scenarios, and can also cut off the chain reaction of risk misjudgment, ensuring the stability of financial transaction channels and balancing cross-domain security and transmission efficiency.

[0035] Furthermore, step S20 also includes the following steps:

[0036] S20a: Introducing a real-time topology evolution algorithm in cross-domain topology structures, the real-time topology evolution algorithm can automatically identify newly added and offline nodes in the network and update the association relationship between nodes in real time;

[0037] S20b: Combining edge computing technology, lightweight sensing nodes are deployed at the edge of the network domain for real-time collection and analysis of local network data;

[0038] S20c: When the real-time topology evolution algorithm detects a new node or a node that has gone offline, it automatically updates the cross-domain topology. For nodes newly added to the network domain, it incorporates them into the cross-domain topology; it automatically detects and removes nodes that have gone offline; and then updates the connection relationships and data transmission paths between nodes in real time based on the new or offline nodes.

[0039] S20d: Combines the real-time updated topology and synchronously updates the transmission path.

[0040] By combining real-time topology evolution algorithms with edge computing technology, this solution brings multiple benefits to network security situational awareness for cross-domain data sharing. The real-time topology evolution algorithm can automatically identify newly added or de-connected nodes and update the relationships between nodes in real time, ensuring that the cross-domain topology is always synchronized with the actual network state. For example, in a vehicle-to-everything (V2X) scenario, when a new autonomous vehicle node is added, the algorithm can quickly update its association with surrounding road network nodes, avoiding data interaction interruptions caused by topology lag. Simultaneously, the deployment of lightweight edge sensing nodes allows data collection and analysis to be completed locally, reducing the amount of data transmitted to the central node, lowering cross-domain transmission bandwidth consumption, and improving the overall performance of this solution.

[0041] Furthermore, the real-time topology evolution algorithm provides dynamic foundational data for subsequent risk assessment and path planning, avoiding misjudgments due to outdated topology information and improving assessment accuracy. Edge nodes, acting as distributed risk detection points, implement a hierarchical detection mode combining initial edge screening with precise central assessment. This improves the response speed for risk detection of sensitive data while reducing the data processing load on central nodes, indirectly extending equipment lifespan and lowering maintenance costs. These effects collectively enhance the real-time performance, efficiency, and scalability of cross-domain network security situational awareness, enabling this solution to quickly adapt to dynamic network changes, support rapid expansion and frequent changes in network domains, optimize resource allocation, improve robustness and response speed, and is suitable for various complex network environments and application scenarios.

[0042] Furthermore, step S40 also includes the following steps:

[0043] S40a: It adopts a distributed architecture, distributing network security situation awareness functions to multiple nodes. Each node is responsible for monitoring and analyzing the lowest risk level among the nodes in its local network domain.

[0044] S40b: The central node assigns specific network security situation awareness to each node, including but not limited to data collection, event analysis, risk assessment and path planning. Each node independently executes the network security situation awareness tasks assigned by the central node according to the characteristics and needs of its local network domain, and reports the results to the central node or adjacent nodes.

[0045] S40c: The central node integrates the minimum risk level and situational awareness results reported by each distributed node. Based on the integrated information, the central node dynamically adjusts the security policy of the cross-domain network. The security policy includes the dynamic assessment method of risk level, the division of risk assessment levels, and the calculation method of diffusion risk value. Based on the decision results, the central node dynamically adjusts the network security situational awareness function and task allocation of the distributed nodes.

[0046] By adopting a distributed architecture, this solution enables each node to monitor and analyze the lowest risk level of its local network domain, while the central node allocates tasks and integrates results to adjust strategies. This achieves significant multiple benefits. First, the core lies in the synergy between the distributed nodes and the central node. The independent execution of tasks by distributed nodes significantly reduces the computational burden on the central node. For example, in a cross-domain government network, each sub-domain node handles data collection and risk assessment locally, reporting results only to the central node, drastically reducing data transmission volume. Simultaneously, the central node integrates information and dynamically adjusts strategies, allowing security policies to adapt to the differences between domains. For instance, in the risk-sensitive financial domain, the central node can adjust its risk assessment level classification to be more refined. Second, distributed nodes can directly share results, enabling proactive cross-domain risk warnings. For example, in an industrial cross-domain scenario, if a factory node detects a low-risk equipment anomaly, it can quickly synchronize this information to neighboring factory nodes. Furthermore, the central node dynamically adjusts task allocation, enhancing the overall flexibility of the solution. For instance, during peak e-commerce promotional periods, the path planning tasks of payment domain nodes can be distributed to logistics domain nodes with lower loads. Finally, each node focuses on monitoring the lowest risk level locally, enabling timely detection of low-risk vulnerabilities masked by high-risk nodes. For example, in the education domain, a research node may have been at low risk for a long time but exhibit a tendency to leak data; distributed monitoring can accurately detect this, providing earlier warnings compared to centralized monitoring, thus balancing the accuracy and efficiency of cross-domain security management. These combined effects significantly improve the real-time nature, efficiency, and adaptability of network security situational awareness in cross-domain data sharing, optimize resource utilization, enhance cross-domain risk early warning capabilities, and improve the accuracy and timeliness of warnings, making it suitable for various complex network environments and application scenarios.

[0047] Furthermore, in step S30, when dynamically assessing the risk level of a node, a monitoring set is established to obtain the number of current dangerous events in a network domain or node. Based on a preset monitoring time and the current time, the number of newly added dangerous events within the monitoring time is calculated, and the growth rate of dangerous events is calculated based on the monitoring time. Nodes or network domains with a current number of dangerous events greater than the preset monitoring number or a growth rate greater than the preset monitoring rate are added to the monitoring set. For nodes or network domains within the monitoring set, the risk level is adjusted based on the current number of dangerous events and the growth rate. The monitoring time is adjusted as the re-listening time based on the adjusted risk level. The changes in the number and growth rate of dangerous events are monitored within the re-listening time. When the growth rate of dangerous events within the re-listening time exceeds the preset re-listening rate, the content and transmission path of the dangerous event are obtained. The re-listening time is adjusted again based on the content distribution and transmission path similarity of the dangerous event, or the node or network domain is added to the event set.

[0048] This solution achieves multiple technical effects by introducing a refined monitoring mechanism when dynamically assessing the risk level of nodes. It establishes a monitoring set to focus on nodes or network domains where the number or growth rate of dangerous events exceeds a certain threshold, accurately identifying potential high-risk targets, shortening the risk response window, and improving the real-time performance and accuracy of risk identification. This solution adjusts risk levels based on both the number and growth rate of dangerous events, dynamically adapting the re-listening time according to the risk level. High-risk nodes are tracked frequently, while low-risk nodes receive less redundant monitoring, making the risk level more closely reflect the actual threat situation and avoiding bias caused by a one-size-fits-all assessment. When the growth rate exceeds a preset threshold within the re-listening time, analyzing the distribution of dangerous event content and the similarity of transmission paths can identify covert coordinated attacks, strengthening threat correlation and tracing capabilities. Simultaneously, it focuses on monitoring only nodes within the monitoring set, with differentiated re-listening times, reducing indiscriminate monitoring of all nodes, optimizing cross-domain resource allocation, and reducing edge device computing power consumption and cross-domain data transmission volume. Combined with a distributed node real-time risk synchronization mode, monitoring set and event set information are quickly synchronized to related domains, enhancing cross-domain collaborative defense capabilities. Multi-round verification mechanisms reduce misjudgments caused by single indicators, avoid over-protection, and make protection strategies more accurate.

[0049] Furthermore, relationships are established between different network domains. When performing network security situation awareness tasks, the distributed nodes synchronize locally identified risk patterns to distributed nodes in the same and related domains in real time. The growing dangerous events within the same network domain are mapped and associated with node locations in the cross-domain topology, and distribution and growth data of dangerous events are collected along the duration dimension. By analyzing the trend of the number of dangerous events and the spatial correlation of their distribution locations, the growth trend and the correlation strength between dangerous events are assessed. Based on the growth threshold and distribution dispersion of dangerous events, network domains are initially classified. The network domain categories are dynamically adjusted by combining the relationships between network domains and the continuous growth data of dangerous events. Based on the adjusted network domain categories, preset transmission path rules are matched, and cross-domain data transmission paths are updated in real time.

[0050] Each domain node can quickly acquire risk characteristics of related domains. For example, after a financial domain node synchronizes new abnormal data patterns from the commercial domain, it can deploy protection strategies in advance, accelerating the response speed to cross-domain risks. Furthermore, it can improve the comprehensiveness of risk identification, avoiding the limitations of a single domain's understanding of cross-domain risks. This mechanism can form a cross-domain risk immunity system. If an education domain node identifies a pattern of data theft targeting academic data and synchronizes it, related research institution domain nodes can directly reuse this pattern for detection, shortening the identification time for similar attacks in cross-domain data sharing between universities and research institutions. Simultaneously, the relationships between network domains provide cross-domain clues for risk tracing. When an e-commerce domain discovers abnormal transactions, it can trace back to related payment domain nodes through these relationships, quickly locating the source of the risk, which is more efficient than traditional single-domain tracing. In addition, this synchronization mechanism can reduce the cost of repeated risk identification across domains. For example, when government and medical domains share patient data, synchronizing risk patterns can avoid each domain investing resources in developing similar detection rules, reducing the cost of cross-domain collaboration.

[0051] By mapping and associating growing hazardous events within the same network domain with node locations in the cross-domain topology, and collecting distribution and growth data of hazardous events along the duration dimension, this solution can accurately assess the growth trend and correlation strength of hazardous events, thereby enabling dynamic classification and adjustment of network domains. This dynamic mechanism not only ensures that the classification of network domains reflects the current security status in real time, avoiding misjudgments caused by static classification, but also ensures the security and efficiency of data transmission by optimizing transmission paths and bypassing high-risk areas. Simultaneously, this solution can quickly adapt to changes in the network environment, especially in the face of sudden security incidents, adjusting strategies promptly to reduce misjudgments and resource waste, and improving overall adaptability and resilience. Furthermore, by analyzing the spatial correlation of hazardous events, potential threats between network domains can be identified, promoting cross-domain collaborative defense, further enhancing the accuracy and timeliness of early warnings, and ensuring the security and stability of cross-domain data sharing.

[0052] Furthermore, in the time dimension analysis of the distribution and growth of dangerous events, a dynamic time window adjustment mechanism is adopted. When the growth rate of dangerous events exceeds the preset growth threshold, the time window is automatically shortened to the preset time. When the network domain category is dynamically adjusted, the risk impact coefficient of the associated domain is introduced. The risk impact coefficient of the associated domain is determined based on the historical data interaction frequency between the associated domain and the current domain. When the sum of the risk impact coefficients of the associated domains of the risk domain exceeds the preset threshold, the risk level of the associated domain is simultaneously increased.

[0053] The dynamic time window shortens when the rate of increase in a dangerous event exceeds a threshold. For example, during an e-commerce promotional period, a surge in abnormal orders reduces the window from one hour to 30 minutes, accelerating risk response by 50%. The risk impact coefficient of related domains is determined by the frequency of interaction. For instance, the financial and payment domains interact frequently, resulting in a high coefficient. When the sum of the risk domain coefficients exceeds a threshold, the related domains are simultaneously upgraded. This mechanism prevents the spread of risk from a single domain. For example, if a logistics domain becomes a risk domain, the warehousing domain, which interacts frequently, is simultaneously upgraded, providing early protection. It also makes risk assessment more accurate, reducing misjudgments and improving the security and efficiency of cross-domain data transmission by combining inter-domain correlations. Attached Figure Description

[0054] Figure 1 This is a flowchart illustrating a network security situation awareness method based on cross-domain data sharing, as described in an embodiment of the present invention. Detailed Implementation

[0055] The following will describe the concept and technical effects of the present invention clearly and completely with reference to embodiments, so as to fully understand the purpose, features and effects of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are all within the scope of protection of the present invention.

[0056] like Figure 1 As shown, a network security situation awareness method based on cross-domain data sharing includes the following steps:

[0057] S10: Collect log data including network traffic data and access request records from network devices; parse the log data, and extract an event set consisting of dangerous events based on the network traffic data and access request records, wherein the event set includes timestamps, event addresses, source addresses, and destination addresses;

[0058] S20: Receive the request information sent by the client, take the client's communication address as the first address, obtain the network domain address where the request data is located corresponding to the request information as the second address, and establish a cross-domain topology structure in combination with other network domains or nodes;

[0059] S30: Establish an analysis model and train the analysis model with an event set. The analysis model analyzes dangerous events in the current log data based on the current network traffic data and access request records as risk prediction results. The current time is used as the timestamp, the second address is the source address, and the first address is the target address. The analysis model is combined to calculate the event address and the corresponding dangerous event. The risk level of the node is dynamically assessed based on the number of dangerous events existing in the network domain or node.

[0060] S40: Use the node where the second address is located as the first node for network security situation awareness; obtain the next node of the first node in the cross-domain topology; if the risk level of the next node is less than the preset maximum risk threshold, establish a transmission path between the first node and the next node, and use the next node as the first node for network security situation awareness; if the risk level of the next node is not less than the preset maximum risk threshold, use the minimum risk level of the next node as the risk level of the first node, and use the previous node of the first node as the first node for network security situation awareness.

[0061] S50: When a transmission path is established between the first address and the second address, send request data to the client; when the risk level of the next node after the second address is not less than the preset maximum risk threshold, cancel sending request data.

[0062] In one specific implementation of this solution, when extracting an event set consisting of dangerous events based on network traffic data and access request records, network traffic data (including IP, port, protocol, etc.) is collected through traffic probes, and access request records (including URL, parameters, timestamps, etc.) are extracted from server and firewall logs. The time format is unified to UTC milliseconds, unstructured logs are converted into structured tags, and IP geographic and organizational information is supplemented. Based on a static feature library (including attack signatures, anomaly rules, high-risk thresholds, etc.) and dynamic models (such as the isolated forest algorithm), deep packet inspection and regular expressions are used for dual matching of traffic and access records. A blacklist of communication addresses is set, and addresses matching the blacklist and high-frequency abnormal access addresses are filtered by source and destination addresses. For the same attack from the same source IP within a short period, only the first and last records are retained for deduplication. False alarms are eliminated through same-origin behavior, business context (such as operation and maintenance whitelists), and third-party threat intelligence verification, and the observation time for low-risk event marking is determined. Events are divided into multiple levels according to their impact, and attributes such as impact scope and attack path are supplemented. Events are associated through temporal, spatial, and causal rules, and stored in a graph database as an event set containing attack chains. The event set is updated incrementally at regular intervals, and the processing results are fed back to the feature library to optimize model parameters.

[0063] This approach solves the problem of heterogeneous multi-source data, significantly improving data consistency. Static feature matching has a wide coverage, while dynamic detection effectively identifies zero-day attack attempts, greatly improving the overall threat identification accuracy. Coarse screening and deduplication significantly reduce the amount of event set data, and cross-validation effectively reduces false positives and avoids resource waste. Through correlation analysis, the characteristics of most distributed attack organizations can be identified, overcoming the limitations of single-point analysis. Dynamic updates to the event set maintain high timeliness, and the feedback mechanism continuously improves long-term identification accuracy. Hierarchical classification and attribute completion allow defense resources to focus on high-priority events, significantly improving response efficiency and providing traceable and interconnected core data support for cross-domain security situation awareness, significantly enhancing the ability to trace complex attacks and conduct collaborative defense.

[0064] When dynamically assessing the risk level of a node, the number of neighboring nodes of the node is analyzed. Neighboring nodes in different network domains from the node are considered cross-domain nodes. The network domain of the cross-domain node is obtained as the cross-domain network type. Cross-domain nodes are classified according to the cross-domain network type. The number of cross-domain nodes corresponding to different cross-domain network types is counted. The transmission association weight of the node is analyzed based on the cross-domain network type and the proportion of the corresponding number of cross-domain nodes in the neighboring nodes. The risk level of the node is dynamically adjusted according to the transmission association weight.

[0065] Specifically, the method for dynamically assessing risk levels also includes the following steps:

[0066] S30a: Node Network Type Analysis classifies and statistically analyzes the network type to which each node belongs. These network types include, but are not limited to, financial, government, education, commercial, and anonymous network domains. By analyzing the network type of nodes, the differences in risk characteristics among nodes in different domains are identified, providing a basis for subsequent risk level adjustments.

[0067] S30b: Quantity Percentage Statistics. This section counts the percentage of different types of nodes for each node during cross-domain interactions. By analyzing the access frequency and percentage of different node types, potential abnormal access patterns can be identified. In one specific implementation of this solution, when a node suddenly experiences concentrated access from multiple low-risk nodes from different network types, quantity percentage statistics can promptly detect that this may be a precursor to a distributed attack.

[0068] S30c: Transmission association weight calculation for each node in cross-domain data sharing. This transmission association weight reflects the frequency and importance of data transmission between nodes. By analyzing the transmission association weights of nodes, core nodes and potential transmission bottlenecks are identified, providing a basis for path planning.

[0069] S30d: Risk level adjustment adjusts the risk level of a node based on its network type, number proportion, and transmission association weight.

[0070] S30e: Cross-domain threat correlation identification identifies covert cross-domain collaborative threats by analyzing the network type and quantity ratio of nodes. In one specific implementation of this solution, when a node suddenly receives concentrated access from multiple low-risk nodes from different network types, the proportion of nodes of different types can be statistically analyzed to detect in time that this may be a precursor to a distributed attack, thus providing an early warning.

[0071] More specifically, when adjusting the risk level of nodes, for network types with low attack rates (such as government domains), their risk level should be appropriately lowered to avoid misjudgments caused by a single dangerous event; for nodes that frequently interact with high-trust network types (such as research institution domains), the risk level weight should be automatically reduced to achieve a lightweight implementation of implicit cross-domain trust mechanisms; for core nodes that have high transmission association weights due to association with multiple downstream domain nodes, their risk level should be reasonably reduced to guide data diversion to these nodes and prevent other nodes from causing transmission congestion due to excessive load.

[0072] The formula for calculating the transmission association weight is shown in formula (1) below.

[0073] (1)

[0074] in, is the transmission association weight of node i, with a value range of [0,1]. The larger the value, the more critical the node is in cross-domain transmission. The number of interactions between node i and cross-domain nodes (in times per hour) reflects the activity level of the node. The total number of cross-domain interactions among all nodes in the network, used for standardization. This eliminates the impact of differences in absolute quantities. This represents the cross-domain data transfer volume of node i (in GB), reflecting the scale of data flow. The total cross-domain data transfer volume across all nodes, used for standardization. . , Weighting coefficients ( ,generally Take 0.6, Take 0.4). Focus on interaction frequency The focus is on transmission volume, as frequency better reflects the real-time correlation of nodes. Slightly large.

[0075] The reason for choosing the number of interactions and the amount of data transmitted as core parameters is that they directly determine the "bridging role" of nodes in cross-domain transmission—high-frequency interaction nodes are often key hubs for data flow, while high-volume transmission nodes may store or forward important data. Formula (1) quantifies the coreness of nodes by weighted fusion of these two dimensions, providing an objective basis for subsequent risk assessment and path planning, and avoiding bias caused by subjective judgment of node importance.

[0076] The risk level adjustment formula is shown in formula (2) below.

[0077] (2),

[0078] in, To adjust the risk level of node i, the value range is [0,10], where 0 represents no risk and 10 represents extremely high risk. An initial risk level is assigned based on the number of dangerous events (e.g., 2 points are added for each high-risk event), reflecting the basic risk of a node. The security coefficient for the network type to which node i belongs, with a value range of [0,1]. Trusted networks include government domains, research institution domains, etc. Use values ​​of 0.7-0.9 for anonymous and unknown fields, and 0.1-0.3 for unknown fields. This represents the percentage of high-risk network type nodes (such as anonymous domains) among their neighboring nodes, with a value range of [0,1]. A higher percentage indicates a greater likelihood that the node is surrounded by high-risk nodes. , , The adjustment coefficients are set to 0.3, 0.4, and 0.2 respectively (total ≤ 1, to avoid over-adjustment). The highest weight is assigned because being surrounded by high-risk nodes is a strong risk signal. The significance of parameter selection and formula lies in introducing... This is because the inherent risks of different network types differ significantly (e.g., government domains, due to strict control, have a much lower risk than anonymous domains), thus avoiding a one-size-fits-all assessment. (Included in the total...) This is to identify hidden threats where low-risk nodes are surrounded by high-risk nodes (e.g., if a normal node is accessed by multiple anonymous domain nodes, its risk level needs to be increased). Add This is because if a core node (i.e. a node with high correlation weight) is attacked, the impact will be more extensive, and its risk level weight needs to be appropriately increased.

[0079] Formula (2) dynamically adjusts the risk level based on the initial risk, combined with the credibility of network type, surrounding risk environment, and node importance, so that the assessment is more in line with the complexity of cross-domain scenarios.

[0080] This solution adjusts node risk levels by analyzing the network type, quantity ratio, and transmission association weights of cross-domain nodes, significantly improving the cross-domain adaptability of risk assessment. In cross-domain data sharing between the financial and government domains, it avoids misjudgments caused by using single-domain assessment standards. For example, it no longer simply misjudges financial nodes that frequently interact with the government domain as high-risk due to a high number of dangerous events, but appropriately lowers their risk level based on the low attack rate of the government domain. Simultaneously, this mechanism strengthens the identification of cross-domain threat correlations. By statistically analyzing the quantity ratio of different types of nodes, it can promptly detect hidden cross-domain collaborative threats, such as precursors to distributed attacks, enabling early warning. Furthermore, this mechanism optimizes the balance between security and efficiency in path planning. By reasonably adjusting the risk level of core nodes, it guides data diversion, avoids transmission congestion, indirectly achieves load balancing in cross-domain networks, and improves overall data flow efficiency. More importantly, it achieves a lightweight implementation of implicit cross-domain trust mechanisms, eliminating the need for additional complex protocol deployments, significantly reducing system resource consumption, and is applicable to various cross-domain data sharing scenarios, significantly improving the security and efficiency of cross-domain data sharing.

[0081] Specifically, step S30 also includes the following steps:

[0082] S31a: Initialize the dangerous area and the set of adjacent nodes, and calculate the diffusion risk value of the nodes based on the transmission association weight and risk level of the nodes;

[0083] S31b: When the risk of a node's spread exceeds a preset spread threshold, the node is added to the danger zone;

[0084] S31c: Perform network security situational awareness on nodes within the danger zone, identify nodes directly connected to nodes within the danger zone as neighboring nodes and add them to the neighboring node set, and remove nodes within the danger zone from the neighboring node set. If:

[0085] S31c-1: If the set of adjacent nodes is empty, then execute step S31d;

[0086] S31c-2: If the set of adjacent nodes is not empty, take one node from the set of adjacent nodes and return S31b;

[0087] S31d: Avoid dangerous areas when planning data transmission paths.

[0088] By iteratively detecting the spread risk of adjacent nodes, the potential risk spread range can be identified like ripples spreading, avoiding missed detections caused by statically dividing dangerous areas.

[0089] More specifically, the formula for calculating the diffusion risk value is shown in formula (3) below.

[0090] (3),

[0091] Let be the diffusion risk value of node i, with a value range of [0, 100]. The higher the value, the greater the possibility of risk spread and the greater the scope of impact. The transmission association weight of node i (same as formula (1)) reflects the node's own propagation capability. The risk level of node i (same as formula (2)) reflects the risk intensity of the node. Adjacent nodes The sum of transmission association weights for all adjacent nodes directly connected to node i reflects the channel width at which the risk may spread. The threshold as The preset diffusion threshold (usually set to 30) is used when At that time, node i is included in the danger zone.

[0092] In formula (3), select and This is because risk propagation depends on the strength of connections between nodes—nodes with high correlation weights interact more frequently, making risk propagation easier (e.g., between cross-domain gateways and core servers). [Introduction] This is because the premise of risk diffusion is that the node itself has risks (even if low-risk nodes are strongly associated, the diffusion threat is limited).

[0093] Formula (3) quantifies the potential destructive power of risk spreading from node i to the surrounding area, providing a quantitative basis for delineating dangerous areas and avoiding omission of low-risk but highly propagating nodes (such as a low-risk but highly associated gateway node, which may become a springboard for cross-domain attacks).

[0094] More specifically, nodes on the boundary of the dangerous area are used as boundary nodes. When dynamically assessing the risk level, the risk level and diffusion risk value of the boundary nodes are calculated first. If the risk level is less than the highest risk threshold and the diffusion risk value is less than the diffusion threshold, the boundary nodes are removed from the dangerous area to reduce the range of the dangerous area.

[0095] In another specific implementation of this scheme, when calculating the transmission association weight, different initial weights are first set for different network types, and then the proportion of the number of nodes corresponding to the cross-domain network type in the number of adjacent nodes is counted. Based on the counted proportion of the number of nodes, the weight of the corresponding network type is dynamically adjusted.

[0096] Step S20 further includes the following steps:

[0097] S20a: Introducing a real-time topology evolution algorithm in cross-domain topology structures, the real-time topology evolution algorithm can automatically identify newly added and offline nodes in the network and update the association relationship between nodes in real time;

[0098] S20b: Combining edge computing technology, lightweight sensing nodes are deployed at the edge of the network domain for real-time collection and analysis of local network data;

[0099] S20c: When the real-time topology evolution algorithm detects a new node or a node that has gone offline, it automatically updates the cross-domain topology. For nodes newly added to the network domain, it incorporates them into the cross-domain topology; it automatically detects and removes nodes that have gone offline; and then updates the connection relationships and data transmission paths between nodes in real time based on the new or offline nodes.

[0100] S20d: Combines the real-time updated topology and synchronously updates the transmission path.

[0101] Specifically, regarding the real-time topology evolution algorithm, a new node type adaptive identification module has been added. This module automatically matches the network domain based on the node's IP characteristics and port service type (e.g., identifying IPs with the "gov" suffix as belonging to the government domain). It also presets initial association weights for different node types (e.g., the initial association weight for financial domain nodes and commercial domain nodes is set to 0.6, higher than the 0.2 for anonymous domain nodes), making the association updates more accurate. In one specific implementation of this solution, in a smart campus cross-domain scenario, when a newly added laboratory research equipment node is connected, the algorithm can automatically identify it as belonging to the education domain and prioritize establishing associations with teaching system nodes within the campus. Compared to traditional indiscriminate association, this reduces the rate of invalid connections.

[0102] In addition to local data processing, the lightweight edge sensing node adds an edge-side risk feature library caching function, periodically synchronizing feature library updates with the central node. This allows for the completion of most routine risk detections (such as matching known virus features) locally, with only unknown risk samples uploaded to the center. In one specific implementation of this solution, taking vehicle-to-everything (V2X) networks as an example, roadside edge nodes can locally detect common attack behaviors of vehicle terminals (such as fake location information injection) without waiting for a response from the central node, significantly reducing risk interception latency and minimizing cross-domain data transmission.

[0103] More uniquely, the real-time topology evolution algorithm forms a distributed topology-aware network with edge nodes. Edge nodes collect micro-features such as signal strength and interaction frequency of surrounding nodes in real time, feeding them back to the central node to optimize the parameters of the topology evolution model (such as dynamically adjusting the stability weights of node connections based on signal strength), improving the adaptability of topology updates to weak network environments. Furthermore, edge nodes can act as temporary data relays. When a core node goes offline, causing a path interruption, the real-time topology evolution algorithm quickly identifies surrounding edge nodes and temporarily constructs a relay link. In one specific implementation of this solution, if a transport vehicle node suddenly goes offline, warehouse edge nodes within 3 kilometers can automatically take over the transmission, preventing the loss of logistics information. This edge relay function breaks through the limitation of traditional topologies that only focus on node existence, extending topology dynamism to the link fault tolerance level.

[0104] These refinements enable cross-domain topologies to accurately match node characteristics and achieve local rapid response and global collaboration through edge nodes. While improving real-time performance, they also enhance network resilience and resource reuse, further balancing security and efficiency in cross-domain data sharing.

[0105] Step S40 also includes the following steps:

[0106] S40a: It adopts a distributed architecture, distributing network security situation awareness functions to multiple nodes. Each node is responsible for monitoring and analyzing the lowest risk level among the nodes in its local network domain.

[0107] S40b: The central node assigns specific network security situation awareness to each node, including but not limited to data collection, event analysis, risk assessment and path planning. Each node independently executes the network security situation awareness tasks assigned by the central node according to the characteristics and needs of its local network domain, and reports the results to the central node or adjacent nodes.

[0108] S40c: The central node integrates the minimum risk level and situational awareness results reported by each distributed node. Based on the integrated information, the central node dynamically adjusts the security policy of the cross-domain network. The security policy includes the dynamic assessment method of risk level, the division of risk assessment levels, and the calculation method of diffusion risk value. Based on the decision results, the central node dynamically adjusts the network security situational awareness function and task allocation of the distributed nodes.

[0109] Specifically, relationships are established between different network domains, and when the distributed nodes perform network security situation awareness tasks, they synchronize the risk patterns identified locally to distributed nodes in the same and related domains in real time.

[0110] In terms of distributed node functionality, a local learning module for risk characteristics is added to each node. This module trains a lightweight model based on historical data at the lowest risk level, enabling it to autonomously identify risk patterns within the local network domain (e.g., low-frequency nighttime access for education domain nodes is a normal characteristic, while remote logins for the financial domain are a high-risk characteristic), thus improving the accuracy of local risk assessment. For example, in a university's cross-domain network, the local model of a research node can identify sudden drops in data transmission volume during winter and summer vacations as normal fluctuations, avoiding misjudgments as low-risk anomalies and reducing invalid warnings.

[0111] When integrating results, the central node introduces inter-domain weighting coefficients, adjusting the weights of the results based on the security priority of each network domain (e.g., medical domain > commercial domain). This prioritizes responding to the needs of higher-priority domains when making security policy decisions. For example, if a medical domain node reports a low-risk data breach, the central node can assign it a weight of 0.8 (0.3 by default for the commercial domain), prioritizing adjustments to the risk assessment method for that domain to ensure more timely security control of sensitive medical data.

[0112] In a distributed architecture, when a single node fails, the central node can quickly distribute its tasks to other nodes in the same domain (e.g., when a sub-node in the government domain goes offline, the adjacent sub-node takes over its monitoring tasks), which reduces service interruption time compared to a centralized architecture. When a node processes tasks locally, it can dynamically adjust the allocation of computing power according to the real-time load (reduce CPU utilization when under light load), which reduces the energy consumption of edge nodes in cross-domain IoT scenarios.

[0113] Furthermore, the sharing of results among distributed nodes can form a risk correlation graph. For example, if an e-commerce node detects a low-risk payment fraud event and shares this information with a logistics domain node, the logistics node can combine this information with abnormal delivery address data to jointly identify a cross-domain fraud chain. Compared to single-domain monitoring, this improves threat tracing efficiency. These refinements allow the distributed architecture to retain the efficiency of local processing while achieving inter-domain collaboration through intelligent control of the central node, further enhancing the accuracy of cross-domain security situation awareness and system resilience.

[0114] Specifically, relationships are established between different network domains, and when the distributed nodes perform network security situation awareness tasks, they synchronize the risk patterns identified locally to distributed nodes in the same and related domains in real time.

[0115] In step S30, when dynamically assessing the risk level of a node, a monitoring set is established to obtain the number of current dangerous events in a network domain or node. Based on a preset monitoring time, the number of newly added dangerous events within the monitoring time is calculated in conjunction with the current time, and the growth rate of dangerous events is calculated in conjunction with the monitoring time. Nodes or network domains with a current number of dangerous events greater than the preset monitoring number or a growth rate greater than the preset monitoring rate are added to the monitoring set.

[0116] For nodes or network domains within the monitoring set, the risk level is adjusted based on the current number and growth rate of dangerous events. The monitoring time is then adjusted as the re-listening time based on the adjusted risk level. During the re-listening time, the changes in the number and growth rate of dangerous events are monitored. When the growth rate of dangerous events exceeds the preset re-listening speed during the re-listening time, the content and transmission path of the dangerous events are obtained. The re-listening time is then adjusted again based on the content distribution and transmission path similarity of the dangerous events, or the node or network domain is added to the event set.

[0117] Specifically, when establishing a monitoring set, the preset monitoring time is configured differently according to the network domain type; the preset monitoring quantity is linked to the importance of the business carried by the node; and the preset monitoring speed is differentiated according to the attack type, setting different monitoring times for malicious code propagation and abnormal access attempts. Through multi-dimensional differentiated threshold settings, monitoring of high-risk scenarios (such as financial transactions) becomes more sensitive, while false triggers are reduced in low-risk scenarios (such as edge terminals). Compared with a uniform threshold configuration, this reduces the false positive rate and improves the threat response speed of core nodes.

[0118] When calculating the growth rate of hazardous events, a sliding window algorithm is used: using a preset sliding window time as the smallest unit, the average growth rate over the past N sliding window times is calculated in real time, eliminating the interference of single sudden peaks on the results. This processing avoids misjudgments caused by instantaneous network fluctuations, improves the accuracy of growth rate calculation, and is particularly suitable for scenarios involving intermittent abnormal data from IoT devices due to unstable signals.

[0119] When adjusting risk levels, a two-factor weighted formula is introduced: Risk Level = (Current Quantity / Preset Quantity) × Preset Quantity Weight + (Current Speed ​​ / Preset Speed) × Preset Speed ​​Weight. The result is rounded to the nearest integer (e.g., levels 1-5). When the quantity exceeds the limit but the speed is normal (e.g., 6 isolated events occur within 10 minutes on a core node), the risk level is increased by only 1 level; when the speed exceeds the limit but the quantity does not reach the threshold (e.g., 2 malicious code propagations occur within 5 minutes), the risk level is increased by 2 levels. This weighted mechanism makes the risk level more closely reflect the urgency of the threat, solving the problem of inflated levels caused by traditional single-indicator rating, and improving the accuracy of strategy matching in cross-domain collaborative defense.

[0120] When setting the relistening time, a tiered reduction rule is adopted. For example, the relistening time for risk level 1 is 1.5 times the original monitoring time. For each level increase, the relistening time is reduced by 30%, until it is fixed at 1 minute for level 5. This rule ensures that high-risk nodes are monitored frequently, while low-risk nodes reduce resource consumption, reduce cross-domain data transmission, and reduce the computing power occupation of edge nodes.

[0121] When the growth rate exceeds the preset relistening rate within the monitored relistening period, a new dangerous event category is added for processing. For malicious code events, feature codes are extracted and hashed for comparison to calculate content similarity; for abnormal access events, IP trajectories and port sequences are parsed to construct transmission path fingerprints, and path similarity is calculated using an edit distance algorithm. When both types of similarity exceed the preset similarity, it is determined to be a coordinated attack, and the relistening time is shortened to a preset proportion of the original duration; if only one type of similarity exceeds the limit, it is added to the event set and marked with a verification tag; if neither exceeds the limit, the relistening time is extended. This classification and processing mechanism can accurately identify distributed attacks and shorten the time for tracing cross-domain attacks, and is especially suitable for highly covert scenarios such as APT attacks.

[0122] The system automatically collects baseline data on dangerous events in each network domain at fixed intervals (including mean, peak, and type percentage). When the incidence rate of a certain type of event decreases by a preset percentage for several consecutive fixed periods, the corresponding preset threshold is automatically lowered; conversely, it is raised. This mechanism enables the solution to adapt to changes in the network environment and maintain a high threat identification rate over a long period as the network attack and defense situation evolves, thus solving the problem of traditional fixed thresholds becoming ineffective over time.

[0123] Once included in the event set, linked nodes will execute preventative measures. Specifically, this includes: pushing dangerous event characteristics to adjacent nodes within the same domain, triggering targeted blocking rules (such as blocking communication on specific ports); and sending risk warnings to gateway nodes in cross-domain interconnections, temporarily restricting the transmission bandwidth of suspicious traffic. This coordinated action can prevent threats from spreading across domains, limiting the impact of attacks to a smaller area within the original nodes. Especially in scenarios where industrial internet and office networks are interconnected, it can prevent production systems from being infected by viruses from the office network.

[0124] The above-mentioned detailed design not only improves the feasibility of this solution, but also achieves adaptive defense capabilities that are difficult to achieve with traditional methods through dynamic thresholds, classification and identification, and linkage protection, especially with significant threat containment effects in cross-domain scenarios.

[0125] Specifically, the system maps and associates growing hazardous events within the same network domain with node locations in the cross-domain topology, collecting distribution and growth data of hazardous events along the duration dimension; it assesses the growth trend and correlation strength between hazardous events by analyzing the spatial correlation of their quantity and distribution; it initially classifies network domains based on the growth threshold and distribution dispersion of hazardous events; it dynamically adjusts the network domain categories by combining the correlation between network domains and the continuous growth data of hazardous events; it matches preset transmission path rules based on the adjusted network domain categories; and it updates cross-domain data transmission paths in real time.

[0126] Specifically, network domains are categorized into observation domains, verification domains, and danger domains. The dynamic time window is initially set to 1 hour, decreasing to 30 minutes if the danger event increases by more than 50%, and extending to 2 hours if it increases by less than 10%. The risk impact coefficient of the associated domain is tiered according to the interaction frequency (0.3 for daily interactions <50 times, 0.5 for 50-100 times, and 0.8 for >100 times), with a threshold of 1.2. The verification domain is used to temporarily assess network domains with questionable risk levels. The observation domain, danger domain, and verification domain dynamically transform over time.

[0127] In one specific implementation of this scheme, during initialization, the time window is set to 1 hour, and all network domains are classified according to their initial risk status by default (e.g., safe domains with no dangerous events, and observation domains with a few scattered events). The growth rate of dangerous events is calculated hourly: In the observation domain, if the growth of dangerous events exceeds 50% within three consecutive windows (originally 1-hour windows) and there are more than three related events, it is converted to a dangerous domain after 24 hours; In the observation domain, if the growth of dangerous events is slow (between 10% and 30%) and the correlation does not reach the threshold, and there is no significant change after 3 days, it is transferred to the verification domain; In the verification domain, if there are no new dangerous events within 12 hours, it is converted to the observation domain; if two or more related events occur, it is immediately converted to a dangerous domain. In the dangerous domain, if the growth rate of dangerous events is less than 10% for two consecutive windows (the shortened 30-minute window), it is downgraded to the observation domain after 48 hours; If the sum of the risk impact coefficients of related domains exceeds 1.2, the related domains simultaneously enter the verification domain. Assign a risk impact coefficient to the associated domain based on the frequency of interaction. When the sum of the associated domain coefficients of the risk domain exceeds 1.2, the associated domain enters the validation domain for further evaluation.

[0128] In the time dimension analysis of the distribution and growth of dangerous events, a dynamic time window adjustment mechanism is adopted. When the growth rate of dangerous events exceeds the preset growth threshold, the time window is automatically shortened to the preset time. When the network domain category is dynamically adjusted, the risk impact coefficient of the associated domain is introduced. The risk impact coefficient of the associated domain is determined based on the historical data interaction frequency between the associated domain and the current domain. When the sum of the risk impact coefficients of the associated domains of the risk domain exceeds the preset threshold, the risk level of the associated domain is simultaneously increased.

[0129] Specifically, when the dynamic time window is shortened, the frequency of collecting dangerous events is increased to once per second; the correlation domain coefficient is included in the data sensitivity level (e.g., an additional 0.2 is added for interactions between the medical and financial domains); and the triggering conditions and time nodes for domain transformation are clearly defined.

[0130] In one specific implementation of this scheme, when the growth rate of dangerous events in the observation domain exceeds 50%, the time window is shortened to 30 minutes, the collection frequency is increased to once per second, and continuous monitoring continues for 2 hours. If more than 5 new related events are added during this period, the domain is converted from the observation domain to the dangerous domain after 6 hours. If the event growth slows down but sporadic events still occur, the domain is transferred to the verification domain, and an assessment is conducted once per hour. In the verification domain, the collection frequency remains once per minute. If no new events are added within 12 hours, the domain is transferred back to the observation domain. If a related event occurs in the dangerous domain, the domain is immediately converted to the dangerous domain. In the dangerous domain, if the event growth rate is less than 10% for three consecutive 30-minute windows, and the sum of the related domain coefficients falls below the threshold, the domain is downgraded to the observation domain after 24 hours. If the sum of the coefficients still exceeds the threshold, the related domain remains in the verification domain state. When calculating the related domain coefficients, a base value is first taken based on the interaction frequency, with an additional 0.2 for interactions between the medical and financial domains. When the sum exceeds 1.2, the related domain enters the verification domain, and the first conversion assessment is completed within 4 hours.

[0131] The above descriptions are merely embodiments of the present invention, and common knowledge regarding specific structures and characteristics is not elaborated upon here. It should be noted that those skilled in the art can make various modifications and improvements without departing from the structure of the present invention, and these should also be considered within the scope of protection of the present invention. These modifications and improvements will not affect the effectiveness of the present invention or the practicality of the patent. The scope of protection claimed in this application should be determined by the content of its claims, and the specific embodiments described in the specification can be used to interpret the content of the claims.

Claims

1. A network security situation awareness method based on cross-domain data sharing, characterized in that, Includes the following steps: S10: Collect log data including network traffic data and access request records from network devices; parse the log data, and extract an event set consisting of dangerous events based on the network traffic data and access request records, wherein the event set includes timestamps, event addresses, source addresses, and destination addresses; S20: Receive the request information sent by the client, take the client's communication address as the first address, obtain the network domain address where the request data is located corresponding to the request information as the second address, and establish a cross-domain topology structure in combination with other network domains or nodes; S30: Establish an analysis model, train the analysis model with an event set, and use the analysis model to analyze dangerous events in the current log data based on the current network traffic data and access request records as risk prediction results; Using the current time as the timestamp, the second address as the source address, and the first address as the destination address, the event address and corresponding dangerous event are calculated by combining the analysis model. The risk level of the node is dynamically assessed based on the number of dangerous events existing in the network domain or node. S40: Use the node where the second address is located as the first node for network security situation awareness; In a cross-domain topology, the next node of the first node is obtained. If the risk level of the next node is less than the preset maximum risk threshold, a transmission path is established between the first node and the next node, and the next node is used as the first node for network security situation awareness. When the risk level of the next node is not less than the preset maximum risk threshold, the minimum risk level of the next node is taken as the risk level of the first node, and the node above the first node is taken as the first node for network security situation awareness. S50: When a transmission path is established between the first address and the second address, send request data to the client; when the risk level of the next node after the second address is not less than the preset maximum risk threshold, cancel sending request data.

2. The network security situation awareness method based on cross-domain data sharing according to claim 1, characterized in that: When dynamically assessing the risk level of a node, the number of neighboring nodes of the node is analyzed. Neighboring nodes in different network domains from the node are considered cross-domain nodes. The network domain of the cross-domain node is obtained as the cross-domain network type. Cross-domain nodes are classified according to the cross-domain network type. The number of cross-domain nodes corresponding to different cross-domain network types is counted. The transmission association weight of the node is analyzed based on the cross-domain network type and the proportion of the corresponding number of cross-domain nodes in the neighboring nodes. The risk level of the node is dynamically adjusted according to the transmission association weight.

3. The network security situation awareness method based on cross-domain data sharing according to claim 2, characterized in that: When calculating the transmission association weight, different initial weights are first set for different network types. Then, the proportion of the number of nodes corresponding to the cross-domain network type in the number of adjacent nodes is counted. Based on the counted proportion of the number of nodes, the weight of the corresponding network type is dynamically adjusted.

4. The network security situation awareness method based on cross-domain data sharing according to claim 2, characterized in that: The S30 step also includes the following steps: S31a: Initialize the dangerous area and the set of adjacent nodes, and calculate the diffusion risk value of the nodes based on the transmission association weight and risk level of the nodes; S31b: When the risk of a node's spread exceeds a preset spread threshold, the node is added to the danger zone; S31c: Perform network security situational awareness on nodes within the danger zone, identify nodes directly connected to nodes within the danger zone as neighboring nodes and add them to the neighboring node set, and remove nodes within the danger zone from the neighboring node set. If: S31c-1: If the set of adjacent nodes is empty, then execute step S31d; S31c-2: If the set of adjacent nodes is not empty, take one node from the set of adjacent nodes and return S31b; S31d: Avoid dangerous areas when planning data transmission paths.

5. A network security situation awareness method based on cross-domain data sharing according to claim 4, characterized in that: When dynamically assessing the risk level, the nodes on the boundary of the dangerous area are used as boundary nodes. First, the risk level and diffusion risk value of the boundary nodes are calculated. If the risk level is less than the highest risk threshold and the diffusion risk value is less than the diffusion threshold, the boundary nodes are removed from the dangerous area to reduce the range of the dangerous area.

6. A network security situation awareness method based on cross-domain data sharing according to claim 5, characterized in that: The S20 step also includes the following steps: S20a: Introducing a real-time topology evolution algorithm in cross-domain topology structures, the real-time topology evolution algorithm can automatically identify newly added and offline nodes in the network and update the association relationship between nodes in real time; S20b: Combining edge computing technology, lightweight sensing nodes are deployed at the edge of the network domain for real-time collection and analysis of local network data; S20c: When the real-time topology evolution algorithm detects a new node or a node that has gone offline, it automatically updates the cross-domain topology. For nodes newly added to the network domain, it incorporates them into the cross-domain topology; it automatically detects and removes nodes that have gone offline; and then updates the connection relationships and data transmission paths between nodes in real time based on the new or offline nodes. S20d: Combines the real-time updated topology and synchronously updates the transmission path.

7. A network security situation awareness method based on cross-domain data sharing according to claim 6, characterized in that: The S40 step also includes the following steps: S40a: It adopts a distributed architecture, distributing network security situation awareness functions to multiple nodes. Each node is responsible for monitoring and analyzing the lowest risk level among the nodes in its local network domain. S40b: The central node assigns specific network security situation awareness to each node, including but not limited to data collection, event analysis, risk assessment and path planning. Each node independently executes the network security situation awareness tasks assigned by the central node according to the characteristics and needs of its local network domain, and reports the results to the central node or adjacent nodes. S40c: The central node integrates the minimum risk level and situational awareness results reported by each distributed node. Based on the integrated information, the central node dynamically adjusts the security policy of the cross-domain network. The security policy includes the dynamic assessment method of risk level, the division of risk assessment levels, and the calculation method of diffusion risk value. Based on the decision results, the central node dynamically adjusts the network security situational awareness function and task allocation of the distributed nodes.

8. A network security situation awareness method based on cross-domain data sharing according to claim 7, characterized in that: In step S30, when dynamically assessing the risk level of a node, a monitoring set is established to obtain the number of current dangerous events in a network domain or node. Based on the preset monitoring time, the number of newly added dangerous events within the monitoring time is calculated in conjunction with the current time, and the growth rate of dangerous events is calculated in conjunction with the monitoring time. Nodes or network domains with a current number of dangerous events greater than the preset monitoring number or a growth rate greater than the preset monitoring rate are added to the monitoring set. For nodes or network domains within the monitoring set, the risk level is adjusted based on the current number and growth rate of dangerous events. The monitoring time is then adjusted as the re-listening time based on the adjusted risk level. During the re-listening time, the changes in the number and growth rate of dangerous events are monitored. When the growth rate of dangerous events exceeds the preset re-listening speed during the re-listening time, the content and transmission path of the dangerous events are obtained. The re-listening time is then adjusted again based on the content distribution and transmission path similarity of the dangerous events, or the node or network domain is added to the event set.

9. A network security situation awareness method based on cross-domain data sharing according to claim 8, characterized in that: The distributed nodes establish associations between different network domains and, when performing network security situation awareness tasks, synchronize the locally identified risk patterns to distributed nodes in the same and related domains in real time. The system maps and associates growing hazardous events within the same network domain with node locations in the cross-domain topology, collecting distribution and growth data of hazardous events along the duration dimension. By analyzing the trends in the number of hazardous events and the spatial correlation of their distribution locations, it assesses their growth momentum and the strength of the correlation between hazardous events. Based on the growth threshold and distribution dispersion of hazardous events, the system initially classifies network domains. Combining the correlation between network domains and the continuous growth data of hazardous events, the system dynamically adjusts the network domain categories. Based on the adjusted network domain categories, it matches preset transmission path rules and updates cross-domain data transmission paths in real time.

10. A network security situation awareness method based on cross-domain data sharing according to claim 9, characterized in that: In the time dimension analysis of the distribution and growth of dangerous events, a dynamic time window adjustment mechanism is adopted. When the growth rate of dangerous events exceeds the preset growth threshold, the time window is automatically shortened to the preset time. When the network domain category is dynamically adjusted, the risk impact coefficient of the associated domain is introduced. The risk impact coefficient of the associated domain is determined based on the historical data interaction frequency between the associated domain and the current domain. When the sum of the risk impact coefficients of the associated domains of the risk domain exceeds the preset threshold, the risk level of the associated domain is simultaneously increased.

Images