Dynamic security protection system and method for smart city special communication network

Abstract

This application discloses a dynamic security protection system and method for a dedicated communication network in a smart city. The system includes: a perception layer, used to collect and preprocess various network data related to the dedicated communication network in a smart city through a pre-trained anomaly detection model to obtain multi-source dedicated network data; a decision layer, used to input the multi-source dedicated network data into a pre-trained security risk identification model and output the decision results corresponding to the multi-source dedicated network data; an execution layer, used to execute the policy template of the decision results when the decision results indicate that there are known threats or potential unknown threats in the dedicated communication network in the smart city, and obtain the execution results; and an evolution layer, used to feed back the execution results to the perception layer and the decision layer to dynamically update the pre-trained anomaly detection model and the pre-trained security risk identification model, respectively. Therefore, by adopting the embodiments of this application, unknown threats can be detected, and threats can be effectively dealt with when facing new attack methods.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a dynamic security protection system and method for a dedicated communication network for smart cities. Background Technology

[0002] In the construction of smart cities, urban network infrastructure typically adopts a networking model that combines public networks and private networks. Public networks mainly refer to public communication networks built by telecommunications operators, such as 4G and 5G, which provide communication services to a wide range of users; private networks are dedicated communication networks built by government departments to ensure the security and confidentiality of information, serving key areas such as government, public safety, and public utilities.

[0003] In related technologies, private networks typically employ independent physical or logical communication channels to enhance network security. Regarding information security, smart city dedicated communication networks utilize traditional security measures such as firewalls, intrusion detection systems (IDS), and antivirus software.

[0004] On the one hand, existing technologies mainly focus on defending against known threats, lacking the ability to proactively detect unknown threats. On the other hand, most existing security measures are based on static rules, which cannot be dynamically adjusted according to changes in the network environment and the evolution of the threat landscape. As a result, when faced with new attack methods, the system needs to manually update the rules, resulting in slow response speed and an inability to respond to threats in a timely and effective manner. Summary of the Invention

[0005] This application provides a dynamic security protection system and method for a dedicated communication network for smart cities. To provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. This summary is not intended as a general description, nor is it intended to identify key / important components or describe the scope of protection of these embodiments. Its sole purpose is to present some concepts in a simple form as a prelude to the detailed description that follows.

[0006] In a first aspect, embodiments of this application provide a dynamic security protection system for a smart city dedicated communication network, the system comprising: a perception layer, a decision-making layer, an execution layer, and an evolution layer;

[0007] The perception layer is used to collect and preprocess various network data related to the smart city's dedicated communication network through a pre-trained anomaly detection model to obtain multi-source private network data.

[0008] The decision layer is used to input multi-source private network data into a pre-trained security risk identification model and output the decision results corresponding to the multi-source private network data; the pre-trained security risk identification model is trained based on historical multi-source data and known attack patterns.

[0009] The execution layer is used to execute the policy template of the decision when the decision results indicate that there are known threats or potential unknown threats in the smart city dedicated communication network, and obtain the execution results;

[0010] The evolution layer is used to feed the execution results back to the perception layer and the decision layer, so as to dynamically update the pre-trained anomaly capture model and the pre-trained security risk identification model, respectively.

[0011] Optionally, various network data related to the smart city's dedicated communication network are collected and preprocessed to obtain multi-source private network data, including:

[0012] The goal is to establish a dedicated communication network for smart cities;

[0013] Collect and standardize at least target-related network traffic, network attack events, and host controlled events from the information security protection equipment and security awareness management platform according to a preset cycle as the first network data;

[0014] Collect and standardize at least fault data, alarm data, logs, and terminal detection data from host, network device, and application categories in the target network infrastructure according to a preset cycle as second network data;

[0015] Collect and standardize actual business scenario data from the terminal devices and external platforms connected to the target according to a preset cycle, and use it as third-party network data.

[0016] Acquire and standardize global threat intelligence information from external threat intelligence platforms as fourth-party network data;

[0017] Data correlation analysis is performed on the first network data, the second network data, the third network data, and the fourth network data to obtain situational data;

[0018] The situational data is input into a pre-trained anomaly detection model to capture anomalous data and patterns in the situational data, and outputs multi-source private network data corresponding to the situational data.

[0019] Optionally, data correlation analysis is performed on the first network data, second network data, third network data, and fourth network data to obtain situational data, including:

[0020] Based on timestamps and event types, network attack events in the first network data are correlated with alarm data in the second network data to identify existing attack paths;

[0021] The network traffic data in the first network data is correlated with the actual business scenario data in the third network data to analyze the relationship between traffic anomalies and business activities.

[0022] The fault data in the second network data is correlated with the threat intelligence information in the fourth network data to identify known threats;

[0023] By analyzing the host-controlled events in the first network data and the log data in the second network data, detailed information on the host-controlled events is obtained to determine the behavior patterns of the controlled hosts.

[0024] The terminal detection data in the third network data is correlated with the threat intelligence information in the fourth network data to identify the threat information faced by the terminal device.

[0025] The network traffic data in the first network data is correlated with the global threat intelligence information in the fourth network data to analyze whether there are characteristics of known threats in the traffic;

[0026] By integrating all the results obtained from the above correlations, a unified situation dataset is obtained.

[0027] Optionally, the pre-trained anomaly capture model includes a feature extraction layer, an anomaly pattern analysis layer, a severity quantification layer, a context information acquisition layer, and a data output layer;

[0028] The situational data is input into a pre-trained anomaly detection model, which outputs multi-source private network data corresponding to the situational data, including:

[0029] The feature extraction layer extracts network traffic features, network attack event features, host controlled event features, terminal detection data features, and threat intelligence information features from the situational data to obtain a multi-source feature set;

[0030] The anomaly pattern analysis layer uses multi-source feature sets to perform anomaly pattern analysis in order to identify anomaly patterns in the smart city dedicated communication network; the anomaly patterns include at least the abnormal behavior in network attack events, the abnormal behavior in host controlled events, the abnormal behavior in terminal devices, and the abnormal information in threat intelligence.

[0031] The severity quantification layer quantifies the severity of each anomalous pattern;

[0032] The context information acquisition layer obtains the network devices, terminal devices, and business systems involved in each abnormal mode to obtain context information;

[0033] The data output layer outputs each anomaly pattern, the severity of each anomaly pattern, and contextual information as multi-source private network data corresponding to the situational data.

[0034] Optionally, a pre-trained anomaly capture model is generated by following these steps:

[0035] Collect historical multi-source data from dedicated smart city communication networks;

[0036] Perform data cleaning and data normalization on historical multi-source data;

[0037] Data correlation analysis was performed on the normalized historical multi-source data to obtain historical situation data;

[0038] Identify known historical normal behaviors and their related datasets, as well as historical abnormal patterns and their related datasets, corresponding to historical multi-source data.

[0039] For historical situational data, known historical normal behaviors and their related datasets, as well as historical abnormal patterns and their related datasets, are labeled to obtain the first model training samples; the related datasets of historical abnormal patterns include historical severity and historical context information;

[0040] An anomaly detection model is created using neural networks;

[0041] The training samples of the first model are input into the anomaly capture model, and the loss value of the first model is output. When the loss value of the first model reaches its minimum, the pre-trained anomaly capture model is generated.

[0042] Optionally, the multi-source private network data includes each anomaly pattern, the severity of each anomaly pattern, and contextual information; the pre-trained security risk identification model includes a feature extraction layer, a parameter quantization layer, a weighted summation layer, an anomaly pattern labeling layer, a strategy template acquisition layer, and a decision output layer;

[0043] The multi-source private network data is input into a pre-trained security risk identification model, which outputs the decision results corresponding to the multi-source private network data, including:

[0044] The feature extraction layer maps each anomaly pattern to a discrete code, normalizes the severity of each anomaly pattern to the 0-1 range, and performs embedding vector transformation on the context information of each anomaly pattern to obtain a unified target feature vector.

[0045] The parameter quantification layer quantifies the asset importance score, the probability of current threat occurrence, and the potential harm level based on the target feature vector;

[0046] The weighted summation layer sums the asset importance score, the probability of the current threat, and the potential harm to obtain a comprehensive risk score for each anomaly pattern.

[0047] When the overall risk score is greater than the upper limit of the preset risk threshold range, the anomaly pattern marking layer marks each anomaly pattern as a high-risk known threat; or when the overall risk score is within the preset risk threshold range, it marks each anomaly pattern as a medium-risk known threat; or when the overall risk score is less than the lower limit of the preset risk threshold range and the similarity between each anomaly pattern and a known attack pattern is greater than the preset difference threshold, it marks each anomaly pattern as a potential unknown threat.

[0048] The strategy template acquisition layer obtains the target strategy templates corresponding to high-risk known threats, medium-risk known threats, or potential unknown threats from the pre-established mapping relationship between threat categories and strategy templates, and uses them as the decision-making results corresponding to multi-source private network data;

[0049] The decision output layer outputs decision results corresponding to multi-source private network data.

[0050] Optionally, the target strategy template for high-risk known threats consists of an immediate blocking strategy, an isolation strategy, and an evidence collection strategy; the target strategy template for medium-risk known threats consists of a rate limiting strategy, an alerting strategy, and a patch push strategy; and the target strategy template for unknown threats consists of a sandbox deep analysis strategy and a behavior monitoring strategy.

[0051] Asset Importance Score The calculation formula is:

[0052]

[0053] in, and These are weighting coefficients used to adjust the impact of contextual information and severity on the asset importance score. It is the embedding vector of contextual information in the target feature vector. It is a standardized result of the severity of abnormal patterns in the target feature vector;

[0054] Current probability of threat occurrence The calculation formula is:

[0055]

[0056] in, and These are weighting coefficients used to adjust the impact of anomaly patterns and severity on the probability of a threat occurring. It is the discrete encoding of abnormal patterns in the target feature vector. It is a standardized result of the severity of abnormal patterns in the target feature vector. It is the Sigmoid function, used to map the calculation result to the 0-1 interval;

[0057] Potential hazard level It can be calculated using the following formula:

[0058]

[0059] in, and These are weighting coefficients used to adjust for the impact of contextual information and severity on the potential hazard level. It is the embedding vector of contextual information in the target feature vector. It is a standardized result of the severity of abnormal patterns in the target feature vector.

[0060] Optionally, a pre-trained security risk identification model is generated by following these steps:

[0061] Collect historical multi-source data from dedicated smart city communication networks;

[0062] Perform data cleaning and data normalization on historical multi-source data;

[0063] Data correlation analysis was performed on the normalized historical multi-source data to obtain historical situation data;

[0064] Historical situation data is input into a pre-trained anomaly detection model, which outputs historical multi-source private network data corresponding to the historical situation data.

[0065] For historical multi-source private network data, each historical anomaly pattern is labeled with a known attack pattern, and the historical threat category and historical strategy template for each historical anomaly pattern are labeled to obtain the training samples for the second model.

[0066] A security risk identification model is created using neural networks;

[0067] Input the training samples of the second model into the security risk identification model and output the loss value of the second model; when the loss value of the second model reaches its minimum, generate the pre-trained security risk identification model.

[0068] Optionally, the execution results include execution time, executed policy template, execution outcome, post-execution network status, and security results;

[0069] Dynamically update the pre-trained anomaly detection model and the pre-trained security risk identification model, including:

[0070] The execution time, execution strategy template, execution result, post-execution network status, and security result are used as data tags and associated with multi-source private network data to obtain an incremental dataset;

[0071] An incremental dataset is used to fine-tune the pre-trained anomaly detection model and the pre-trained security risk identification model, so as to dynamically update the pre-trained anomaly detection model and the pre-trained security risk identification model.

[0072] Secondly, embodiments of this application provide a dynamic security protection method for a dedicated communication network for smart cities, the method comprising:

[0073] By using a pre-trained anomaly detection model, various network data related to smart city dedicated communication networks are collected and pre-processed to obtain multi-source dedicated network data.

[0074] Multi-source private network data is input into a pre-trained security risk identification model, which outputs the decision results corresponding to the multi-source private network data. The pre-trained security risk identification model is trained based on historical multi-source data and known attack patterns.

[0075] When the decision results indicate that there are known or potential unknown threats in the smart city dedicated communication network, the strategy template of the decision results is executed to obtain the execution result;

[0076] Based on the execution results, the pre-trained anomaly detection model and the pre-trained security risk identification model are dynamically updated respectively.

[0077] The technical solutions provided in this application embodiment may include the following beneficial effects:

[0078] In this embodiment, on one hand, the perception layer uses a pre-trained anomaly detection model to fit multi-source private network data. This multi-source private network data contains parameter information related to unknown threats. The decision layer can input this multi-source private network data into a security risk identification model. This model is trained based on historical data and known attack patterns, and can effectively identify abnormal data and patterns, enabling the smart city's dedicated communication network to defend against potential security threats, thereby reducing the risk of unknown attacks. On the other hand, the evolution layer feeds back the execution results to the perception and decision layers, dynamically updating the anomaly detection model and the security risk identification model. This feedback mechanism allows the system to continuously learn and evolve based on the latest execution results to adapt to the constantly changing network environment.

[0079] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0080] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0081] Figure 1This is a schematic diagram of the system architecture of a dynamic security protection system for a smart city dedicated communication network provided in an embodiment of this application;

[0082] Figure 2 This is a schematic diagram of multi-source private network data fitting provided in an embodiment of this application;

[0083] Figure 3 This application provides a schematic diagram of the model structure of a pre-trained anomaly capture model.

[0084] Figure 4 This is a schematic diagram of the model structure of a pre-trained security risk identification model provided in an embodiment of this application;

[0085] Figure 5 This is a flowchart illustrating a dynamic security protection method for a dedicated communication network for smart cities, provided in an embodiment of this application.

[0086] Figure 6 This is a schematic block diagram illustrating the dynamic security protection process of a dedicated communication network for smart cities, as provided in an embodiment of this application.

[0087] Figure 7 This is a flowchart illustrating a model training method for an anomaly detection model provided in an embodiment of this application.

[0088] Figure 8 This is a flowchart illustrating a model training method for a security risk identification model provided in an embodiment of this application. Detailed Implementation

[0089] The following description and accompanying drawings fully illustrate specific embodiments of this application to enable those skilled in the art to practice them.

[0090] It should be understood that the described embodiments are merely some, not all, of the embodiments in this application. All other embodiments obtained by those skilled in the art based on the embodiments in this application without inventive effort are within the scope of protection of this application.

[0091] In the following description, when referring to the accompanying drawings, the same numbers in different drawings denote the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of systems and methods consistent with some aspects of this application as detailed in the appended claims.

[0092] In the description of this application, it should be understood that the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances. Furthermore, in the description of this application, unless otherwise stated, "multiple" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship.

[0093] Currently, private networks typically employ independent physical or logical communication channels to enhance network security. In terms of information security, smart city dedicated communication networks utilize traditional security measures such as firewalls, intrusion detection systems (IDS), and antivirus software.

[0094] The inventors of this application have noted that, on the one hand, existing technologies mainly focus on defending against known threats and lack the ability to proactively detect unknown threats. On the other hand, most existing security measures are based on static rules and cannot be dynamically adjusted according to changes in the network environment and the evolution of the threat landscape. As a result, when facing new attack methods, the system needs to manually update the rules, resulting in slow response speed and an inability to respond to threats in a timely and effective manner.

[0095] To address the problems in existing technologies, this application provides a dynamic security protection system and method for smart city dedicated communication networks, resolving the aforementioned technical issues. In this application's embodiments, on one hand, the perception layer utilizes a pre-trained anomaly detection model to fit multi-source dedicated network data. This multi-source dedicated network data contains relevant parameter information regarding unknown threats. The decision layer can input this multi-source dedicated network data into a security risk identification model. This model, trained based on historical data and known attack patterns, can effectively identify abnormal data and patterns, enabling the smart city dedicated communication network to defend against potential security threats and thus reducing the risk of unknown attacks. On the other hand, the evolution layer feeds back the execution results to the perception and decision layers, dynamically updating the anomaly detection model and the security risk identification model. This feedback mechanism allows the system to continuously learn and evolve based on the latest execution results to adapt to the constantly changing network environment. Exemplary embodiments are described in detail below.

[0096] Please see Figure 1 This illustration shows a schematic diagram of the dynamic security protection system for a smart city dedicated communication network provided in an exemplary embodiment of this application. The dynamic security protection system for the smart city dedicated communication network includes: a perception layer, a decision layer, an execution layer, and an evolution layer; and communication connections between the perception layer, decision layer, execution layer, and evolution layer.

[0097] The perception layer is used to collect and preprocess various network data related to the smart city's dedicated communication network through a pre-trained anomaly detection model to obtain multi-source private network data.

[0098] In some embodiments of this application, the specific process of collecting and preprocessing various network data related to the smart city dedicated communication network to obtain multi-source private network data includes: targeting the smart city dedicated communication network; collecting and standardizing, according to a preset period, network traffic, network attack events, and host controlled events related to the target as first network data from the security compliance equipment and security awareness management platform; collecting and standardizing, according to a preset period, fault data, alarm data, logs, and terminal detection data from the host, network device, and application classes in the target's network infrastructure as second network data; collecting and standardizing actual business scenario data from the terminal devices and external platforms connected to the target as third network data according to a preset period; obtaining and standardizing global threat intelligence information from an external threat intelligence platform as fourth network data; performing data correlation analysis on the first, second, third, and fourth network data to obtain situational data; inputting the situational data into a pre-trained anomaly capture model to capture abnormal data and abnormal patterns in the situational data, and outputting the multi-source private network data corresponding to the situational data.

[0099] Among them, classified protection equipment is used to protect the security of networks and information systems. A security awareness management platform is a platform for centrally managing security devices and monitoring network security status. Network traffic is the amount of data transmitted over a network, including the size and number of data packets transmitted. Network attack events are malicious attacks against network systems, such as DDoS attacks and port scanning. Host-controlled events refer to events where a host is controlled by malware or accessed without authorization. Fault data is data generated when network devices or hosts malfunction. Alarm data is alarm information generated when a security system detects potential threats or abnormal behavior. Logs are recorded information generated during the operation of systems, applications, or network devices. Endpoint detection data is data collected during security testing of terminal devices. Actual business scenario data is data directly related to smart city operations, such as traffic flow and public safety monitoring data. An external threat intelligence platform is a platform that provides global cybersecurity threat information. Global threat intelligence information is information about cybersecurity threats obtained from external platforms.

[0100] For example, in the case of a dedicated communication network serving a smart city's traffic management system, network traffic could be video streams captured by traffic cameras. A cyberattack could be an attempt to illegally access the traffic management system. A host-controlled event could be a traffic control server being infected with malware. Fault data could be traffic light malfunction reports. Alarm data could include alarms detected by abnormal traffic flow. Logs could be operational logs of the traffic management system. Terminal detection data could involve security checks on traffic monitoring equipment. Real-world business scenario data could include real-time traffic flow information. Global threat intelligence could be intelligence on new cyberattacks targeting the traffic management system.

[0101] For example Figure 2 As shown, Figure 2 This application provides a schematic diagram of multi-source private network data fitting. Based on information security compliance equipment, security awareness management platform, host, network equipment and application, terminal equipment and external platform, and external threat intelligence platform, it collects first network data, second network data, third network data and fourth network data in four directions. Finally, it can perform correlation analysis on the first network data, second network data, third network data and fourth network data, and obtain multi-source private network data by combining it with a pre-trained anomaly detection model.

[0102] In some embodiments of this application, the specific process of performing data correlation analysis on first network data, second network data, third network data, and fourth network data to obtain situational data includes: correlating network attack events in the first network data with alarm data in the second network data based on timestamps and event types to identify existing attack paths; correlating network traffic data in the first network data with actual business scenario data in the third network data to analyze the relationship between traffic anomalies and business activities; correlating fault data in the second network data with threat intelligence information in the fourth network data to identify known threats; analyzing detailed information of host-controlled events through host-controlled events in the first network data and log data in the second network data to determine the behavior patterns of controlled hosts; correlating terminal detection data in the third network data with threat intelligence information in the fourth network data to identify threat information faced by terminal devices; correlating network traffic data in the first network data with global threat intelligence information in the fourth network data to analyze whether there are characteristics of known threats in the traffic; and integrating all the results obtained from the above correlations to obtain a unified situational dataset.

[0103] In one possible implementation, based on timestamps and event types, network attack events in the first network data are correlated with alarm data in the second network data to identify attack paths. Network traffic data in the first network data is correlated with actual business scenario data in the third network data to analyze the relationship between traffic anomalies and business activities. Fault data in the second network data is correlated with threat intelligence information in the fourth network data to identify known threats. Host control events in the first network data and log data in the second network data are analyzed to determine the behavioral patterns of controlled hosts. Terminal detection data in the third network data is correlated with threat intelligence information in the fourth network data to identify threats faced by terminal devices. Network traffic data in the first network data is correlated with global threat intelligence information in the fourth network data to analyze whether the traffic contains characteristics of known threats.

[0104] For example, a smart city's traffic management system suffered a cyberattack. The first network data section records the attack event, showing the attacker's attempt to illegally access the traffic management system. The second network data section shows alarm data indicating abnormal login attempts detected by the system. Through data correlation, the attack path can be identified, showing entry through a known vulnerability. The first network data section shows abnormal traffic peaks. The third network data section shows the normal traffic patterns of the traffic management system. Through data correlation, it can be found that the abnormal traffic is unrelated to a specific business activity (such as peak-hour traffic flow monitoring), thus confirming the traffic anomaly. The second network data section shows fault data indicating abnormal system behavior during the attack. The fourth network data section provides threat intelligence information with detailed information about the vulnerability. Through data correlation, this can be identified as a known threat.

[0105] For example Figure 3 As shown, the pre-trained anomaly capture model includes a feature extraction layer, an anomaly pattern analysis layer, a severity quantification layer, a context information acquisition layer, and a data output layer.

[0106] In some embodiments of this application, the specific process of inputting situational data into a pre-trained anomaly detection model and outputting multi-source private network data corresponding to the situational data includes: a feature extraction layer extracting network traffic features, network attack event features, host-controlled event features, terminal detection data features, and threat intelligence information features from the situational data to obtain a multi-source feature set; an anomaly pattern analysis layer using the multi-source feature set to perform anomaly pattern analysis to identify anomaly patterns in the smart city dedicated communication network; anomaly patterns at least include abnormal behaviors in network attack events, abnormal behaviors in host-controlled events, abnormal behaviors in terminal devices, and abnormal information in threat intelligence; a severity quantification layer quantifying the severity of each anomaly pattern; a context information acquisition layer acquiring the network devices, terminal devices, and business systems involved in each anomaly pattern to obtain context information; and a data output layer outputting each anomaly pattern, the severity of each anomaly pattern, and the context information as multi-source private network data corresponding to the situational data.

[0107] In some embodiments of this application, the specific process of generating a pre-trained anomaly capture model includes: collecting historical multi-source data from a smart city dedicated communication network; cleaning and normalizing the historical multi-source data; performing data association analysis on the normalized historical multi-source data to obtain historical situation data; determining the known historical normal behaviors and their related datasets, and the historical anomaly patterns and their related datasets corresponding to the historical multi-source data; marking the known historical normal behaviors and their related datasets, and the historical anomaly patterns and their related datasets on the historical situation data to obtain a first model training sample; the related datasets of the historical anomaly patterns include historical severity and historical context information; creating an anomaly capture model using a neural network; inputting the first model training sample into the anomaly capture model and outputting the first model loss value; and generating a pre-trained anomaly capture model when the first model loss value reaches its minimum.

[0108] The decision layer is used to input multi-source private network data into a pre-trained security risk identification model and output the decision results corresponding to the multi-source private network data. The pre-trained security risk identification model is trained based on historical multi-source data and known attack patterns.

[0109] The multi-source private network data includes each anomaly pattern, the severity of each anomaly pattern, and contextual information.

[0110] For example Figure 4 As shown, the pre-trained security risk identification model includes a feature extraction layer, a parameter quantization layer, a weighted summation layer, an anomaly pattern labeling layer, a strategy template acquisition layer, and a decision output layer.

[0111] In some embodiments of this application, the specific process of inputting multi-source private network data into a pre-trained security risk identification model and outputting the decision results corresponding to the multi-source private network data includes: the feature extraction layer maps each anomaly pattern to a discrete code and standardizes the severity of each anomaly pattern to 0-1. The system first defines the target feature vector by embedding the context information of each anomaly pattern into a unified target feature vector. The parameter quantification layer quantifies the asset importance score, the probability of current threat occurrence, and the potential harm level based on the target feature vector. The weighted summation layer weights and sums the asset importance score, the probability of current threat occurrence, and the potential harm level to obtain a comprehensive risk score for each anomaly pattern. The anomaly pattern marking layer marks each anomaly pattern as a high-risk known threat when the comprehensive risk score is greater than the upper limit of the preset risk threshold range; or as a medium-risk known threat when the comprehensive risk score is within the preset risk threshold range; or as a potential unknown threat when the comprehensive risk score is less than the lower limit of the preset risk threshold range and the similarity between each anomaly pattern and a known attack pattern is greater than a preset difference threshold. The strategy template acquisition layer obtains the target strategy templates corresponding to high-risk known threats, medium-risk known threats, or potential unknown threats from the pre-established mapping relationship between threat categories and strategy templates, serving as the decision-making results corresponding to the multi-source private network data. The decision-making result output layer outputs the decision-making results corresponding to the multi-source private network data.

[0112] Among them, the target strategy template for high-risk known threats consists of an immediate blocking strategy, an isolation strategy, and an evidence collection strategy; the target strategy template for medium-risk known threats consists of a rate limiting strategy, an alarm strategy, and a patch push strategy; and the target strategy template for unknown threats consists of a sandbox deep analysis strategy and a behavior monitoring strategy.

[0113] Among them, the asset importance score The calculation formula is:

[0114]

[0115] in, and These are weighting coefficients used to adjust the impact of contextual information and severity on the asset importance score. It is the embedding vector of contextual information in the target feature vector. It is a standardized result of the severity of abnormal patterns in the target feature vector;

[0116] Current probability of threat occurrence The calculation formula is:

[0117]

[0118] in, and These are weighting coefficients used to adjust the impact of anomaly patterns and severity on the probability of a threat occurring. It is the discrete encoding of abnormal patterns in the target feature vector. It is a standardized result of the severity of abnormal patterns in the target feature vector. It is the Sigmoid function, used to map the calculation result to the 0-1 interval;

[0119] Potential hazard level It can be calculated using the following formula:

[0120]

[0121] in, and These are weighting coefficients used to adjust for the impact of contextual information and severity on the potential hazard level. It is the embedding vector of contextual information in the target feature vector. It is a standardized result of the severity of abnormal patterns in the target feature vector.

[0122] In some embodiments of this application, the specific process of generating a pre-trained security risk identification model includes: collecting historical multi-source data from a smart city dedicated communication network; cleaning and normalizing the historical multi-source data; performing data correlation analysis on the normalized historical multi-source data to obtain historical situation data; inputting the historical situation data into a pre-trained anomaly detection model to output historical multi-source dedicated network data corresponding to the historical situation data; labeling each historical anomaly pattern and its historical threat category and historical strategy template using known attack patterns on the historical multi-source dedicated network data to obtain a second model training sample; creating a security risk identification model using a neural network; inputting the second model training sample into the security risk identification model to output the second model loss value; and generating a pre-trained security risk identification model when the second model loss value reaches its minimum.

[0123] The execution layer is used to execute the strategy template of the decision when the decision results indicate that there are known threats or potential unknown threats in the smart city dedicated communication network, and obtain the execution result.

[0124] The decision-making outcome refers to the conclusions drawn by the decision-making level regarding the network security status after analyzing multi-source private network data, including threat identification and assessment. The policy template is a predefined security response measure used to address specific types or levels of identified threats. Known threats are network attacks or security vulnerabilities that have been identified and have corresponding defenses. Potential unknown threats are novel network attacks or security vulnerabilities that have not yet been widely identified or for which there are no known defenses. The execution result is the outcome after the execution level implements the policy template, including whether the threat was successfully blocked and whether the system returned to normal.

[0125] In one possible implementation, the execution layer receives analysis results from the decision layer, including identified known threats and potential unknown threats. Based on the threat type and severity in the decision results, the execution layer selects an appropriate policy template from the policy library. The execution layer implements specific security measures according to the selected policy template, such as blocking malicious IPs, isolating infected hosts, and distributing security patches. The execution layer monitors the effectiveness of the policy implementation to ensure that the measures are executed correctly. After execution, the execution results are recorded, including successfully blocked threats and issues requiring further processing. The execution results are then fed back to the evolution layer for further model optimization and policy template updates.

[0126] The evolution layer is used to feed back the execution results to the perception layer and the decision layer, so as to dynamically update the pre-trained anomaly capture model and the pre-trained security risk identification model, respectively.

[0127] The execution results include execution time, the executed policy template, the execution outcome, the post-execution network status, and the security outcome. Execution time is the specific point in time when the security policy is executed. The policy template is a predefined security response measure used to address specific types of threats. The execution outcome is the result of implementing the policy template, such as success, failure, or partial success. The post-execution network status is the current state of the network after the policy is executed, which may include traffic, connection status, etc. The security outcome is an assessment of the network security situation after the policy is executed, such as whether the threat has been eliminated. The incremental dataset is a collection of data containing newly collected data and execution results, used for model updates.

[0128] In some embodiments of this application, the specific process of dynamically updating the pre-trained anomaly detection model and the pre-trained security risk identification model includes: associating the execution time, execution policy template, execution result, post-execution network status and security result as data labels with multi-source private network data to obtain an incremental dataset; using the incremental dataset, fine-tuning the pre-trained anomaly detection model and the pre-trained security risk identification model to dynamically update the pre-trained anomaly detection model and the pre-trained security risk identification model.

[0129] In one possible implementation, the execution layer records the execution time (16:25:54), the executed policy template (traffic scrubbing), the execution result (partial success), the post-execution network status (traffic reduced by 20%), and the security outcome (attack not completely prevented). This execution data is correlated with multi-source private network data (such as network traffic data, alarm data, etc.) to form an incremental dataset. The incremental dataset is used to fine-tune a pre-trained anomaly detection model and security risk identification model to identify the characteristics of this new type of DDoS attack. The model parameters are then updated to more accurately identify and evaluate this new type of attack.

[0130] In this embodiment, on one hand, the perception layer uses a pre-trained anomaly detection model to fit multi-source private network data. This multi-source private network data contains parameter information related to unknown threats. The decision layer can input this multi-source private network data into a security risk identification model. This model is trained based on historical data and known attack patterns, and can effectively identify abnormal data and patterns, enabling the smart city's dedicated communication network to defend against potential security threats, thereby reducing the risk of unknown attacks. On the other hand, the evolution layer feeds back the execution results to the perception and decision layers, dynamically updating the anomaly detection model and the security risk identification model. This feedback mechanism allows the system to continuously learn and evolve based on the latest execution results to adapt to the constantly changing network environment.

[0131] Please see Figure 5 This figure illustrates a flowchart of a dynamic security protection method for a dedicated communication network for smart cities, as provided in this application embodiment. As shown, the method of this application embodiment may include the following steps:

[0132] S101 uses a pre-trained anomaly detection model to collect and preprocess various network data related to the smart city's dedicated communication network to obtain multi-source private network data.

[0133] In some embodiments of this application, a dedicated communication network for smart cities is targeted. First network data is collected and standardized from security compliance equipment and security awareness management platforms at a preset cycle, including at least network traffic, network attack events, and host-controlled events related to the target. Second network data is collected and standardized from host-type, network device-type, and application-type data within the target's network infrastructure at a preset cycle, including at least fault data, alarm data, logs, and terminal detection data. Third network data is collected and standardized from terminal devices and external platforms connected to the target at a preset cycle. Fourth network data is obtained and standardized from an external threat intelligence platform, including global threat intelligence information. Data correlation analysis is performed on the first, second, third, and fourth network data to obtain situational data. The situational data is input into a pre-trained anomaly detection model to capture abnormal data and abnormal patterns in the situational data, and outputs multi-source dedicated network data corresponding to the situational data.

[0134] S102, input multi-source private network data into a pre-trained security risk identification model, and output the decision results corresponding to the multi-source private network data; the pre-trained security risk identification model is obtained by training based on historical multi-source data and known attack patterns;

[0135] S103, when the decision results indicate that there are known threats or potential unknown threats in the smart city dedicated communication network, execute the policy template of the decision results to obtain the execution result;

[0136] S104. Based on the execution results, dynamically update the pre-trained anomaly detection model and the pre-trained security risk identification model respectively.

[0137] The execution results include the execution time, the executed strategy template, the execution outcome, the network status after execution, and the security results.

[0138] In some embodiments of this application, the specific process of dynamically updating the pre-trained anomaly detection model and the pre-trained security risk identification model based on the execution results includes: associating the execution time, execution policy template, execution result, post-execution network status, and security result as data labels with multi-source private network data to obtain an incremental dataset; using the incremental dataset, fine-tuning the pre-trained anomaly detection model and the pre-trained security risk identification model to dynamically update the pre-trained anomaly detection model and the pre-trained security risk identification model.

[0139] For example Figure 6 As shown, Figure 6This application provides a schematic block diagram of a dynamic security protection process for a dedicated communication network for smart cities. The process involves: targeting the dedicated communication network for smart cities; collecting and standardizing, according to a preset cycle, network traffic, network attack events, and host control events related to the target from security compliance equipment and security awareness management platforms as first network data; collecting and standardizing, according to a preset cycle, fault data, alarm data, logs, and terminal detection data from host, network device, and application classes within the target's network infrastructure as second network data; collecting and standardizing, according to a preset cycle, actual business scenario data from terminal devices and external platforms connected to the target as third network data; obtaining and standardizing global threat intelligence information from an external threat intelligence platform as fourth network data; performing data correlation analysis on the first, second, third, and fourth network data to obtain situational data; inputting the situational data into a pre-trained anomaly detection model to capture abnormal data and patterns in the situational data, and outputting multi-source dedicated network data corresponding to the situational data. Multi-source private network data is input into a pre-trained security risk identification model, which outputs the decision results corresponding to the multi-source private network data. The pre-trained security risk identification model is trained based on historical multi-source data and known attack patterns. When the decision results indicate that there are known threats or potential unknown threats in the smart city private communication network, the policy template of the decision results is executed to obtain the execution results. Based on the execution results, the pre-trained anomaly detection model and the pre-trained security risk identification model are dynamically updated respectively.

[0140] In this embodiment, on the one hand, a pre-trained anomaly detection model can fit multi-source private network data. This multi-source private network data contains relevant parameter information indicating unknown threats. This data can be input into a security risk identification model, which is trained based on historical data and known attack patterns. This model can effectively identify abnormal data and patterns, enabling the smart city's dedicated communication network to defend against potential security threats and reduce the risk of unknown attacks. On the other hand, the execution results can dynamically update the anomaly detection model and the security risk identification model. This feedback mechanism allows the system to continuously learn and evolve based on the latest execution results, adapting to the ever-changing network environment.

[0141] Please see Figure 7 The figure shows a flowchart illustrating a method for training an anomaly detection model, as provided in this embodiment of the application. As shown, the method in this embodiment may include the following steps:

[0142] S201 collects historical multi-source data from the dedicated communication network for smart cities;

[0143] S202, performs data cleaning and data normalization on historical multi-source data;

[0144] S203, perform data correlation analysis on the normalized historical multi-source data to obtain historical situation data;

[0145] S204, Determine the known historical normal behaviors and their related datasets, and the historical abnormal patterns and their related datasets corresponding to historical multi-source data;

[0146] S205. For historical situational data, mark known historical normal behaviors and their related datasets, and historical abnormal patterns and their related datasets to obtain the first model training samples; the related datasets of historical abnormal patterns include historical severity and historical context information.

[0147] S206, an anomaly detection model is created using a neural network;

[0148] S207, Input the training samples of the first model into the anomaly capture model and output the loss value of the first model; when the loss value of the first model reaches the minimum, generate the pre-trained anomaly capture model.

[0149] In some embodiments, if the first model loss value has not reached its minimum, the step of inputting the first model training samples into the anomaly capture model continues until the first model loss value reaches its minimum.

[0150] In this embodiment, on the one hand, a pre-trained anomaly detection model can fit multi-source private network data. This multi-source private network data contains relevant parameter information indicating unknown threats. This data can be input into a security risk identification model, which is trained based on historical data and known attack patterns. This model can effectively identify abnormal data and patterns, enabling the smart city's dedicated communication network to defend against potential security threats and reduce the risk of unknown attacks. On the other hand, the execution results can dynamically update the anomaly detection model and the security risk identification model. This feedback mechanism allows the system to continuously learn and evolve based on the latest execution results, adapting to the ever-changing network environment.

[0151] Please see Figure 8 This figure illustrates a method flowchart for training a security risk identification model, as provided in this application embodiment. As shown, the method of this application embodiment may include the following steps:

[0152] S301 collects historical multi-source data from the dedicated communication network for smart cities;

[0153] S302, perform data cleaning and data normalization on historical multi-source data;

[0154] S303, perform data correlation analysis on normalized historical multi-source data to obtain historical situation data;

[0155] S304: Input historical situation data into a pre-trained anomaly capture model and output historical multi-source private network data corresponding to the historical situation data.

[0156] S305: For historical multi-source private network data, each historical anomaly pattern is labeled with a known attack pattern, and the historical threat category and historical strategy template for each historical anomaly pattern are labeled to obtain the training samples for the second model.

[0157] S306 uses a neural network to create a security risk identification model;

[0158] S307, Input the training samples of the second model into the security risk identification model and output the loss value of the second model; When the loss value of the second model reaches the minimum, generate the pre-trained security risk identification model.

[0159] In some embodiments, if the second model loss value has not reached its minimum, the step of inputting the second model training samples into the security risk identification model continues until the second model loss value reaches its minimum.

[0160] In this embodiment, on the one hand, a pre-trained anomaly detection model can fit multi-source private network data. This multi-source private network data contains relevant parameter information indicating unknown threats. This data can be input into a security risk identification model, which is trained based on historical data and known attack patterns. This model can effectively identify abnormal data and patterns, enabling the smart city's dedicated communication network to defend against potential security threats and reduce the risk of unknown attacks. On the other hand, the execution results can dynamically update the anomaly detection model and the security risk identification model. This feedback mechanism allows the system to continuously learn and evolve based on the latest execution results, adapting to the ever-changing network environment.

[0161] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program for dynamic security protection of the smart city dedicated communication network can be stored in a computer-readable storage medium. When executed, the program can include the processes of the embodiments of the above methods. The storage medium for the program for dynamic security protection of the smart city dedicated communication network can be a magnetic disk, optical disk, read-only memory, or random access memory, etc.

[0162] The above-disclosed embodiments are merely preferred embodiments of this application and should not be construed as limiting the scope of this application. Therefore, any equivalent variations made in accordance with the claims of this application shall still fall within the scope of this application.

Claims

1. A dynamic security protection system for a smart city dedicated communication network, characterized in that, The system comprises a perception layer, a decision layer, an execution layer, and an evolution layer. The perception layer is configured to collect and pre-process various network data related to the smart city special communication network by using a pre-trained anomaly capture model to obtain multi-source special network data. The decision layer is configured to input the multi-source special network data into a pre-trained security risk identification model to output a decision result corresponding to the multi-source special network data. The pre-trained security risk identification model is trained based on historical multi-source data and known attack patterns. The feature extraction layer maps each abnormal pattern to a discrete code, normalizes the severity of each abnormal pattern to the 0-1 interval, and converts the context information of each abnormal pattern into an embedding vector to obtain a unified target feature vector; the parameter quantization layer quantizes the asset importance score, the current threat occurrence probability, and the potential harm degree based on the target feature vector; the weighted summation layer performs weighted summation on the asset importance score, the current threat occurrence probability, and the potential harm degree to obtain a comprehensive risk score of each abnormal pattern; the abnormal pattern marking layer marks each abnormal pattern as a high-risk known threat when the comprehensive risk score is greater than the upper limit value of a preset risk threshold interval; or marks each abnormal pattern as a medium-risk known threat when the comprehensive risk score is within the preset risk threshold interval; or marks each abnormal pattern as a potential unknown threat when the comprehensive risk score is less than the lower limit value of the preset risk threshold interval and the similarity between each abnormal pattern and a known attack pattern is greater than a preset difference threshold; the strategy template acquisition layer obtains a target strategy template corresponding to the high-risk known threat or the medium-risk known threat or the potential unknown threat from a mapping relationship between pre-established threat categories and strategy templates, as a decision result corresponding to the multi-source private network data; the decision result output layer outputs the decision result corresponding to the multi-source private network data; the target strategy template corresponding to the high-risk known threat is composed of an immediate blocking strategy, an isolation strategy, and a forensics strategy, the target strategy template corresponding to the medium-risk known threat is composed of a flow limiting strategy, an alarm strategy, and a patch pushing strategy, and the target strategy template corresponding to the unknown threat is composed of a sandbox deep analysis strategy and a behavior monitoring strategy; wherein the calculation formula of the asset importance score is: ​ wherein, and are weight coefficients for adjusting the influence of the context information and the severity on the asset importance score, is an embedding vector of the context information in the target feature vector, is a standardization result of the severity of the abnormal pattern in the target feature vector; The current threat occurrence probability The calculation formula is: wherein, and are weight coefficients for adjusting the influence of abnormal patterns and severity on the probability of threat occurrence, is a discrete encoding of abnormal patterns in the target feature vector, is a standardization result of the severity of abnormal patterns in the target feature vector, is a Sigmoid function for mapping the calculation result to the 0-1 interval; the potential hazard level may be calculated by the following equation: wherein, and are weight coefficients for adjusting the influence of the context information and the severity on the potential harm degree, is an embedding vector of the context information in the target feature vector, is a standardized result of the severity of the abnormal pattern in the target feature vector; The multi-source special network data includes each abnormal mode, the severity of each abnormal mode, and context information. The pre-trained security risk identification model includes a feature extraction layer, a parameter quantization layer, a weighted summation layer, an abnormal mode marking layer, a strategy template acquisition layer, and a decision result output layer.

2. The system of claim 1, wherein, The execution layer is configured to execute a strategy template of the decision result when the decision result indicates that there is a known threat or a potential unknown threat in the smart city special communication network to obtain an execution result. The evolution layer is configured to feed back the execution result to the perception layer and the decision layer to dynamically update the pre-trained anomaly capture model and the pre-trained security risk identification model, respectively. The collection and pre-processing of various network data related to the smart city special communication network to obtain multi-source special network data comprises: targeting the smart city special communication network; collecting and standardizing at least network traffic, network attack events, and host controlled events related to the target as first network data from an information security protection device and a security perception management platform according to a preset period; collecting and standardizing at least fault data, alarm data, logs, and terminal detection data from host classes, network device classes, and application program classes in the network infrastructure of the target as second network data according to a preset period; collecting and standardizing actual business scenario data from terminal devices and external platforms connected to the target as third network data according to a preset period; obtaining and standardizing global threat intelligence information from an external threat intelligence platform as fourth network data; 3. The system of claim 2, wherein, performing data correlation analysis on the first network data, the second network data, the third network data, and the fourth network data to obtain situation data; inputting the situation data into the pre-trained anomaly capture model to capture abnormal data and abnormal patterns in the situation data and output multi-source special network data corresponding to the situation data. The data correlation analysis on the first network data, the second network data, the third network data, and the fourth network data to obtain situation data comprises: based on timestamps and event types, correlating network attack events in the first network data with alarm data in the second network data to identify existing attack paths. Correlate network traffic data in the first network data with actual business scenario data in the third network data to analyze the relationship between traffic anomalies and business activities; Correlate fault data in the second network data with threat intelligence information in the fourth network data to identify known threats; Analyze detailed information of the host controlled event in the first network data and log data in the second network data to determine the behavior pattern of the controlled host; Correlate terminal detection data in the third network data with threat intelligence information in the fourth network data to identify threat information faced by terminal equipment; Correlate network traffic data in the first network data with global threat intelligence information in the fourth network data to analyze whether there is a known threat feature in the traffic; Integrate all results obtained by the above correlation to obtain a unified situation data set.

4. The system of claim 2, wherein, The pre-trained anomaly capture model includes a feature extraction layer, an anomaly pattern analysis layer, a severity quantification layer, a context information acquisition layer, and a data output layer; Input the situation data into the pre-trained anomaly capture model to output multi-source special network data corresponding to the situation data, including: The feature extraction layer extracts network traffic features, network attack event features, host controlled event features, terminal detection data features, and threat intelligence information features existing in the situation data to obtain a multi-source feature set; The anomaly pattern analysis layer performs anomaly pattern analysis using the multi-source feature set to identify anomaly patterns of the smart city special communication network; the anomaly patterns at least include abnormal behaviors in network attack events, abnormal behaviors in host controlled events, abnormal behaviors in terminal equipment, and abnormal information in threat intelligence; The severity quantification layer quantifies the severity of each anomaly pattern; The context information acquisition layer acquires network devices, terminal equipment, and business systems involved in each anomaly pattern to obtain context information; The data output layer outputs each anomaly pattern, the severity of each anomaly pattern, and context information as multi-source special network data corresponding to the situation data.

5. The system of claim 1, wherein, The pre-trained anomaly capture model is generated according to the following steps, including: Collect historical multi-source data from the smart city special communication network; Perform data cleaning and data normalization on the historical multi-source data; Perform data correlation analysis on the normalized historical multi-source data to obtain historical situation data; Determine known historical normal behaviors and their related data sets, historical anomaly patterns and their related data sets corresponding to the historical multi-source data; Label known historical normal behaviors and their related data sets, historical anomaly patterns and their related data sets in the historical situation data to obtain a first model training sample; the related data set of the historical anomaly pattern includes historical severity and historical context information; Create an anomaly capture model using a neural network; The first model training sample is input into the anomaly capturing model, and a first model loss value is output; and in the case that the first model loss value reaches a minimum, a pre-trained anomaly capturing model is generated.

6. The system of claim 1, wherein, The pre-trained security risk identification model is generated according to the following steps, including: Collecting historical multi-source data from a smart city special communication network; Performing data cleaning and data normalization on the historical multi-source data; Performing data correlation analysis on the normalized historical multi-source data to obtain historical situation data; Inputting the historical situation data into the pre-trained anomaly capturing model to output historical multi-source special network data corresponding to the historical situation data; Marking each historical anomaly mode and the historical threat category and historical strategy template of each historical anomaly mode of the historical multi-source special network data using a known attack mode to obtain a second model training sample; Creating a security risk identification model using a neural network; Inputting the second model training sample into the security risk identification model to output a second model loss value; and in the case that the second model loss value reaches a minimum, a pre-trained security risk identification model is generated.

7. The system of claim 1, wherein, The execution result includes execution time, executed strategy template, execution result, network state after execution, and security result; The dynamic updating of the pre-trained anomaly capturing model and the pre-trained security risk identification model includes: Associating the execution time, executed strategy template, execution result, network state after execution, and security result as data labels with the multi-source special network data to obtain an incremental data set; Fine-tuning the pre-trained anomaly capturing model and the pre-trained security risk identification model using the incremental data set to dynamically update the pre-trained anomaly capturing model and the pre-trained security risk identification model.

8. A method for dynamic security protection of a smart city dedicated communication network implemented by the system according to any one of claims 1-7, characterized in that, The method includes: Collecting and preprocessing various network data related to a smart city special communication network using a pre-trained anomaly capturing model to obtain multi-source special network data; Inputting the multi-source special network data into a pre-trained security risk identification model to output decision results corresponding to the multi-source special network data; the pre-trained security risk identification model is trained based on historical multi-source data and known attack modes; When the decision results indicate that there is a known threat or potential unknown threat in the smart city special communication network, executing a strategy template of the decision results to obtain an execution result; According to the execution result, dynamically updating the pre-trained anomaly capturing model and the pre-trained security risk identification model respectively.

Images