A network security intelligent protection method and system based on endogenous security

Abstract

The application discloses a network security intelligent protection method and system based on endogenous security, relates to the technical field of intelligent protection, and mainly has the following scheme: network operation state data, user operation behavior data, network traffic data, application program access data and network connection data of an endogenous security system of an internet device are collected, network security risk values, user operation behavior risk values, network traffic security risk values, application program access risk values and network connection performance risk values are calculated according to the above data, network security comprehensive values are further calculated, a protection level is obtained by comparing preset threshold values, and adaptive intelligent protection is implemented accordingly.

Description

Technical Field

[0001] This invention relates to the field of intelligent protection technology, specifically to a network security intelligent protection method and system based on intrinsic security. Background Technology

[0002] In today's digital age, the internet has permeated every aspect of social life, making inherent network security particularly important. Intelligent network security protection methods and systems based on inherent security are advanced approaches that tap into the security potential of network systems by examining their internal architecture, operational mechanisms, and data processing flows. They construct a network security concept with proactive defense capabilities, effectively identifying and resisting security threats to achieve self-protection.

[0003] Traditional cybersecurity protection methods are mainly based on perimeter defense, but they are weak in preventing complex internal threats, slow to respond to emerging threats, have incomplete data collection, and rely on simple rules for risk assessment. They are difficult to accurately quantify risks and cannot provide early warnings, thus having certain limitations. Summary of the Invention

[0004] (a) Technical problems to be solved

[0005] To address the shortcomings of existing technologies, this invention provides a network security intelligent protection method and system based on intrinsic security. By collecting network operation status data, user operation behavior data, network traffic data, application access data, and network connection data from the intrinsic security system of internet devices, it can reflect the real situation inside the network system, which is an important foundation for realizing intrinsic security intelligent network security protection and makes up for the one-sidedness of traditional single data source protection. Based on the above data, network security risk values, user operation behavior risk values, network traffic security risk values, application access risk values, and network connection performance risk values ​​are calculated accordingly, and a comprehensive network security value is further calculated. The protection level is determined by comparing preset thresholds, and adaptive intelligent protection is implemented accordingly. This enables dynamic adjustment of protection strategies based on real-time network risks, solving the problems of single risk assessment, judgment based on simple rules, difficulty in accurately quantifying risks, and inability to provide early warnings. It effectively responds to complex network attacks and ensures the stable operation of network security.

[0006] (II) Technical Solution

[0007] To achieve the above objectives, the present invention provides the following technical solution: a network security intelligent protection method based on intrinsic security, comprising the following steps:

[0008] Step 1: Collect network operation status data, user operation behavior data, network traffic data, application access data, and network connection data from the Internet device's built-in security system;

[0009] Step 2: Calculate the Network Device Health Index (NDH), Network Congestion Index (NCI), and Network Service Quality Index (NSQ) based on network operation status data; calculate the Network Security Risk Value (NSR) based on the Network Device Health Index (NDH), Network Congestion Index (NCI), and Network Service Quality Index (NSQ).

[0010] Calculate the user behavior risk value (URB) based on user behavior data;

[0011] Calculate the Network Traffic Security Risk Value (NSS) based on network traffic data;

[0012] Calculate the application access risk value (AIR) based on application access data;

[0013] Calculate the network connectivity performance risk value (CPR) based on network connectivity data;

[0014] The comprehensive network security value (JFM) is calculated based on the network security risk value (NSR), user behavior risk value (URB), network traffic security risk value (NSS), application access risk value (AIR), and network connectivity performance risk value (CPR).

[0015] Step 3: Preset a set of network security thresholds, compare the network security comprehensive value JFM with the set of network security thresholds, determine the network security intelligent protection level based on the comparison results, and take corresponding intelligent protection measures.

[0016] In the preferred embodiment of the above-mentioned intelligent network security protection method based on intrinsic security, the method for calculating the network device health index (NDH), network congestion index (NCI), and network service quality index (NSQ) is as follows:

[0017] Network operating status data includes the device's current temperature TNB, the device's minimum allowable temperature TAS, the device's maximum allowable temperature TMJ, the current power supply voltage fluctuation value VNB, the device's maximum allowable voltage fluctuation value VML, the device's current error rate ENJ, and the device's maximum allowable error rate EMI.

[0018] The network device health index NDH is calculated based on the device's current temperature TNB, minimum allowable temperature TAS, maximum allowable temperature TMJ, current power supply voltage fluctuation VNB, maximum allowable voltage fluctuation VML, current error rate ENJ, and maximum allowable error rate EMI. The formula used is as follows:

[0019]

[0020] Wherein, α1 is the weighting coefficient of the temperature factor, with a value of 0.1 to 0.3; α2 is the weighting coefficient of the voltage factor, with a value of 0.3 to 0.4; α3 is the weighting coefficient of the error rate factor, with a value of 0.4 to 0.5; and α1 + α2 + α3 = 1;

[0021] Network operation status data also includes current bandwidth utilization (BCU), maximum bandwidth utilization (BCM), current network connections (NCD), and maximum network connections (NCM).

[0022] The Network Congestion Index (NCI) is calculated based on the current bandwidth utilization (BCU), maximum bandwidth utilization (BCM), current number of network connections (NCD), and maximum number of network connections (NCM). The formula used is as follows:

[0023]

[0024] Network operational status data also includes the current service response time (SRN), the maximum acceptable response time (SRM), the ideal service response time (SRA), and the service availability time (SAV).

[0025] The Network Service Quality Index (NSQ) is calculated based on the current service response time (SRN), the maximum acceptable response time (SRM), the ideal service response time (SRA), and the service availability time (SAV). The formula used is as follows:

[0026]

[0027] Wherein, β1 is the weighting coefficient of service response time, with a value of 0.2 to 0.4; β2 is the weighting coefficient of service availability time, with a value of 0.6 to 0.8; and β1 + β2 = 1.

[0028] In the preferred embodiment of the above-mentioned intelligent network security protection method based on intrinsic security, the method for calculating the network security risk value (NSR) is as follows:

[0029] The network security risk value (NSR) is calculated based on the Network Device Health Index (NDH), Network Congestion Index (NCI), and Network Service Quality Index (NSQ), using the following formula:

[0030]

[0031] Wherein, γ1 is the weighting coefficient of the Network Device Health Index (NDH), with a value of 0.1 to 0.3; γ2 is the weighting coefficient of the Network Congestion Index (NCI), with a value of 0.3 to 0.4; γ3 is the weighting coefficient of the Network Service Quality Index (NSQ), with a value of 0.4 to 0.5; and γ1 + γ2 + γ3 = 1.

[0032] In the preferred embodiment of the above-mentioned intelligent network security protection method based on intrinsic security, the method for calculating the user operation behavior risk value (URB) is as follows:

[0033] User behavior data includes login time (TIU). i Historical login time average (TRE), login location (LJI) j Common login location center value (LPI), number of operation violations (VGT), and total number of operations (JDI);

[0034] The User Behavior Risk Value (URB) is calculated based on user behavior data using the following formula:

[0035]

[0036] Among them, TIU i Let δ1 be the login time for the i-th login attempt, where i is the sequence number corresponding to different login attempts, ranging from [1, n]; n is the total number of login attempts, a positive integer; δ1 is the weighting coefficient for login time, ranging from 0.1 to 0.3; LJI j Let j be the j-th login location, where j is the sequence number of the different login locations, with a value of [1, m]; m is the number of login locations, with a value of a positive integer; δ2 is the weight coefficient of the login location, with a value of 0.3 to 0.4; δ3 is the weight coefficient of the compliance of the user's operation, with a value of 0.4 to 0.5; and δ1 + δ2 + δ3 = 1.

[0037] In the preferred embodiment of the above-mentioned intelligent network security protection method based on intrinsic security, the method for calculating the Network Traffic Security Risk Value (NSS) is as follows:

[0038] Network traffic data includes the current traffic transmission rate (DFG), the average normal traffic transmission rate (EFQ), and the maximum normal traffic transmission rate (DWP).

[0039] The Network Traffic Security Risk Value (NSS) is calculated based on the current traffic transmission rate (DFG), the average normal traffic transmission rate (EFQ), and the maximum normal traffic transmission rate (DWP). The formula used is as follows:

[0040]

[0041] In the preferred embodiment of the above-mentioned intelligent network security protection method based on intrinsic security: the method for calculating the application access risk value AIR is as follows:

[0042] Application access data includes the frequency of use of functional modules (UIH) f and historical usage frequency DGU f ;

[0043] The Application Access Risk Value (AIR) is calculated based on application access data using the following formula:

[0044]

[0045] Among them, UIH f The usage frequency of the f-th functional module, historical usage frequency DGU f Let f be the historical usage frequency of the f-th functional module, where f is the sequence number of the different functional modules, and its value is [1, t]; t is the number of functional modules, and its value is a positive integer.

[0046] In the preferred embodiment of the above-mentioned intelligent network security protection method based on intrinsic security, the method for calculating the network connectivity performance risk value (CPR) is as follows:

[0047] Network connection data includes the actual bandwidth usage (CBG) of the network connection, the lower limit of bandwidth usage (NBW) under normal conditions, the upper limit of bandwidth usage (PBW), the actual traffic (CTZ) of the network connection, the lower limit of normal connection traffic (NCT) and the upper limit of traffic (PCT);

[0048] The network connection performance risk value (CPR) is calculated based on the actual bandwidth usage (CBG), the lower limit of bandwidth usage (NBW) under normal conditions, the upper limit of bandwidth usage (PBW), the actual traffic volume (CTZ) of the network connection, the lower limit of traffic volume (NCT) and the upper limit of traffic volume (PCT) under normal connection conditions. The formula used is as follows:

[0049]

[0050] In the preferred embodiment of the above-mentioned intelligent network security protection method based on intrinsic security, the method for calculating the comprehensive network security value (JFM) is as follows:

[0051] The Comprehensive Network Security Value (JFM) is calculated based on the following formula: Network Security Risk Rating (NSR), User Behavior Risk Rating (URB), Network Traffic Security Risk Rating (NSS), Application Access Risk Rating (AIR), and Network Connectivity Performance Risk Rating (CPR).

[0052] JFM = NSR + URB + NSs + AIR + CPR.

[0053] In the preferred embodiment of the above-mentioned intelligent network security protection method based on intrinsic security: the method for determining the level of intelligent network security protection is as follows:

[0054] The set of cybersecurity thresholds includes a low-risk threshold GY and a high-risk threshold GH; where GY > GH.

[0055] The Comprehensive Network Security Value (JFM) is compared with a set of network security thresholds, and the network security intelligent protection level is determined based on the comparison result, according to the following standards:

[0056]

[0057] Among them, corresponding intelligent protection measures are taken according to the level of security risk.

[0058] This invention also discloses a network security intelligent protection system based on intrinsic security, comprising:

[0059] The data acquisition module is used to collect network operation status data, user operation behavior data, network traffic data, application access data, and network connection data of the Internet device's built-in security system.

[0060] The value calculation module is used to calculate the Network Device Health Index (NDH), Network Congestion Index (NCI), and Network Service Quality Index (NSQ) based on network operation status data; and to calculate the Network Security Risk Value (NSR) based on the Network Device Health Index (NDH), Network Congestion Index (NCI), and Network Service Quality Index (NSQ).

[0061] Calculate the user behavior risk value (URB) based on user behavior data;

[0062] Calculate the Network Traffic Security Risk Value (NSS) based on network traffic data;

[0063] Calculate the application access risk value (AIR) based on application access data;

[0064] Calculate the network connectivity performance risk value (CPR) based on network connectivity data;

[0065] The comprehensive network security value (JFM) is calculated based on the network security risk value (NSR), user behavior risk value (URB), network traffic security risk value (NSS), application access risk value (AIR), and network connectivity performance risk value (CPR).

[0066] The judgment module is used to preset a set of network security thresholds, compare the network security comprehensive value JFM with the set of network security thresholds, determine the network security intelligent protection level based on the comparison result, and take corresponding intelligent protection measures.

[0067] (III) Beneficial Effects

[0068] This invention provides a network security intelligent protection method and system based on intrinsic security, which has the following beneficial effects:

[0069] (1) By collecting network operation status data, user operation behavior data, network traffic data, application access data and network connection data of the Internet device's intrinsic security system, it provides a basis for intrinsic security protection from multiple key levels. It is an important foundation for realizing intelligent network security protection of intrinsic security, and builds a comprehensive and dynamic intelligent protection system. It makes up for the one-sidedness of traditional single data source protection and ensures the comprehensiveness and dynamic adaptability of network security protection.

[0070] (2) By calculating the corresponding network security risk value, user operation behavior risk value, network traffic security risk value, application access risk value and network connection performance risk value through multi-level data, and further calculating the network security comprehensive value, multi-dimensional comprehensive analysis to accurately quantify risks, reduce security risks caused by human factors, effectively identify potential internal threats, fully grasp the network status in all aspects, greatly improve the network's ability to cope with unknown attacks, build a comprehensive and solid security defense line, and thus help the network security protection of intrinsic security to be more targeted and efficient.

[0071] (3) By comparing preset thresholds, the protection level is obtained and the appropriate intelligent protection is implemented accordingly. This can clearly divide the network security level, so that the managers can have an intuitive and quantitative understanding of the network security situation and take corresponding intelligent protection measures according to different levels. This achieves accurate allocation and efficient use of protection resources, avoids over-protection or under-protection, effectively resists potential threats, enhances the overall security and stability of the network, and improves the network's ability to cope with risks. Attached Figure Description

[0072] Figure 1 This is a schematic diagram illustrating the working steps of a network security intelligent protection method based on intrinsic security according to the present invention. Detailed Implementation

[0073] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0074] Please see Figure 1 This invention provides a network security intelligent protection method based on intrinsic security, comprising the following steps:

[0075] Step 1: Collect network operation status data, user operation behavior data, network traffic data, application access data, and network connection data from the Internet device's built-in security system.

[0076] When using it, refer to the content of step 1:

[0077] By collecting network operation status data, user operation behavior data, network traffic data, application access data, and network connection data of the inherent security system of Internet devices, this provides a basis for inherent security protection from multiple key levels. It is an important foundation for realizing intelligent network security protection of inherent security, and builds a comprehensive and dynamic intelligent protection system. This makes up for the one-sidedness of traditional single data source protection and ensures the comprehensiveness and dynamic adaptability of network security protection.

[0078] Step 2: Calculate the Network Device Health Index (NDH), Network Congestion Index (NCI), and Network Service Quality Index (NSQ) based on the network operation status data; calculate the Network Security Risk Value (NSR) based on the Network Device Health Index (NDH), Network Congestion Index (NCI), and Network Service Quality Index (NSQ).

[0079] The User Behavior Risk Value (URB) is calculated based on user behavior data.

[0080] Calculate the Network Traffic Security Risk Value (NSS) based on network traffic data.

[0081] Calculate the application access risk value (AIR) based on application access data.

[0082] Calculate the network connectivity performance risk value (CPR) based on network connectivity data.

[0083] The comprehensive network security value (JFM) is calculated based on the network security risk value (NSR), user behavior risk value (URB), network traffic security risk value (NSS), application access risk value (AIR), and network connectivity performance risk value (CPR).

[0084] Step 201: The method for calculating the Network Device Health Index (NDH), Network Congestion Index (NCI), and Network Service Quality Index (NSQ) is as follows:

[0085] Network operating status data includes the device's current temperature (TNB), the device's minimum allowable temperature (TAS), the device's maximum allowable temperature (TMJ), the current power supply voltage fluctuation (VNB), the device's maximum allowable voltage fluctuation (VML), the device's current error rate (ENJ), and the device's maximum allowable error rate (EMI).

[0086] It should be noted that: TNB (True Temperature) represents the current operating temperature of the device, obtained through a temperature sensor; TAS (Minimum Allowable Temperature) represents the minimum temperature at which the device can operate normally. If the ambient temperature is below this value, the device may malfunction or even be damaged. This information is obtained from the technical specifications. TMJ (Maximum Allowable Temperature) represents the maximum operating temperature of the device. If the ambient temperature exceeds this value, the device may overheat, leading to performance degradation, malfunction, or even damage. This information is also obtained from the technical specifications. VNB (Volume Fluctuation Value) represents the fluctuation value of the current power supply voltage, obtained by real-time measurement of the power supply voltage fluctuation using a voltage monitor. VML (Maximum Allowable Voltage Fluctuation Value) represents the maximum voltage fluctuation range that the device can operate normally. This information is obtained from the technical specifications. ENJ (Current Error Rate) represents the frequency of errors such as packet loss, port failure, and system crashes during the device's current operation. This information is obtained through the device's internal error detection mechanism. EMI (Maximum Allowable Error Rate) represents the maximum frequency of errors that the device can tolerate during normal operation. This information is obtained from the quality standard documents.

[0087] The network device health index NDH is calculated based on the device's current temperature TNB, minimum allowable temperature TAS, maximum allowable temperature TMJ, current power supply voltage fluctuation VNB, maximum allowable voltage fluctuation VML, current error rate ENJ, and maximum allowable error rate EMI. The formula used is as follows:

[0088]

[0089] Wherein, α1 is the weighting coefficient of the temperature factor, which is determined according to the degree of influence of the temperature factor on the Network Equipment Health Index (NDH), and takes a value of 0.1 to 0.3; α2 is the weighting coefficient of the voltage factor, which is determined according to the degree of influence of the voltage factor on the Network Equipment Health Index (NDH), and takes a value of 0.3 to 0.4; α3 is the weighting coefficient of the error rate factor, which is determined according to the degree of influence of the error rate factor on the Network Equipment Health Index (NDH), and takes a value of 0.4 to 0.5; and α1 + α2 + α3 = 1.

[0090] It should be noted that in this formula: This value reflects the current temperature of the equipment relative to its permissible temperature range. A higher value indicates that the current temperature is closer to the maximum permissible temperature, which is more detrimental to the equipment's health. This reflects the current voltage fluctuation of the equipment relative to its maximum permissible voltage fluctuation value. The larger the value, the closer the current voltage fluctuation is to the maximum permissible voltage fluctuation value, which is more detrimental to the equipment's health. The error rate reflects the current error rate of the device relative to the maximum allowable error rate. The larger the value, the closer the current error rate is to the maximum allowable error rate, which is more detrimental to the health of the device. The Network Device Health Index (NDH) is calculated by comprehensively considering the impact of three factors on the health of the device: temperature, voltage fluctuation, and error rate, and calculating them according to their respective weighting coefficients. The larger the NDH value, the worse the health of the device and the closer it is to a fault state.

[0091] Network operation status data also includes current bandwidth utilization (BCU), maximum bandwidth utilization (BCM), current number of network connections (NCD), and maximum number of network connections (NCM).

[0092] It should be noted that the current bandwidth utilization (BCU) represents the proportion of bandwidth actually used in the current network relative to the total bandwidth. This is obtained through the network device's monitoring function to obtain the current network bandwidth usage and then calculate the current bandwidth utilization. The maximum bandwidth utilization (BCM) represents the maximum bandwidth usage that the network can handle, which is obtained from the network device's technical specifications. The current number of network connections (NCD) represents the number of connections being established and maintained in the current network, which is obtained through the connection statistics function of network monitoring software. The maximum number of network connections (NCM) represents the maximum number of connections that the network can support, which is obtained from the network device's technical manual.

[0093] The Network Congestion Index (NCI) is calculated based on the current bandwidth utilization (BCU), maximum bandwidth utilization (BCM), current number of network connections (NCD), and maximum number of network connections (NCM). The formula used is as follows:

[0094]

[0095] It should be noted that in this formula: This represents the ratio of current bandwidth utilization to maximum bandwidth utilization. The closer the ratio is to 1, the closer the network is to its bandwidth limit, and the greater the possibility of network congestion. The NCI (Network Congestion Index) represents the ratio of the current number of network connections to the maximum number of network connections. The closer the ratio is to 1, the closer the current network connections are to saturation, and the higher the risk of network congestion. The NCI is used to assess the degree of network congestion by comprehensively considering two key factors: bandwidth utilization and the number of network connections. The larger the NCI value, the more congested the network is; the smaller the NCI value, the smoother the network is.

[0096] Network operational status data also includes the current service response time (SRN), the maximum acceptable response time (SRM), the ideal service response time (SRA), and the service availability time (SAV).

[0097] It should be noted that the current service response time (SRN) represents the time it takes for the current network service to respond to a request, which is obtained by measuring the time interval from sending a service request to receiving a response using network monitoring tools; the maximum acceptable response time (SRM) represents the maximum acceptable response time for the network service as specified by the network operator, obtained through the service level agreement (SLA); the ideal service response time (SRA) represents the fastest response time of the network service, determined through network architecture and service design; and the service availability time (SAV) represents the proportion of time that the network service can provide normal service, calculated by the network service's downtime and uptime. For example, in a 24-hour day, if the network service downtime is 1 hour, then the service availability time is (24-1) / 24.

[0098] The Network Service Quality Index (NSQ) is calculated based on the current service response time (SRN), the maximum acceptable response time (SRM), the ideal service response time (SRA), and the service availability time (SAV). The formula used is as follows:

[0099]

[0100] Wherein, β1 is the weighting coefficient of service response time, which is determined according to the degree of influence of service response time on the network service quality index NSQ, and takes a value of 0.2 to 0.4; β2 is the weighting coefficient of service availability time, which is determined according to the degree of influence of service availability time on the network service quality index NSQ, and takes a value of 0.6 to 0.8; and β1+β2=1.

[0101] It should be noted that in this formula: This reflects the current service response time relative to the ideal and maximum acceptable values. The larger the ratio, the closer the current service response time is to the ideal value, and the better the network service quality in terms of response time. The Network Service Quality Index (NSQ) is calculated by comprehensively considering the impact of both service response time and service availability on network service quality and according to their respective weighting coefficients. The larger the value, the higher the network service quality.

[0102] Step 202: The method for calculating the Network Security Risk Value (NSR) is as follows:

[0103] The network security risk value (NSR) is calculated based on the Network Device Health Index (NDH), Network Congestion Index (NCI), and Network Service Quality Index (NSQ), using the following formula:

[0104]

[0105] Wherein, γ1 is the weighting coefficient of the Network Device Health Index (NDH), determined according to the degree of influence of the NDH on the Network Security Risk Rating (NSR), and its value ranges from 0.1 to 0.3; γ2 is the weighting coefficient of the Network Congestion Index (NCI), determined according to the degree of influence of the NCI on the NSR, and its value ranges from 0.3 to 0.4; γ3 is the weighting coefficient of the Network Service Quality Index (NSQ), determined according to the degree of influence of the NSQ on the NSR, and its value ranges from 0.4 to 0.5; and γ1 + γ2 + γ3 = 1.

[0106] It should be noted that in this formula, network security risks are assessed by comprehensively considering network device health index, network congestion index, and network service quality index. 1 represents the ideal state of network security. Subtracting the value composed of the network device health, network congestion, and network service quality related components from 1 yields the network security risk value NSR. The smaller the NSR value, the higher the network security risk.

[0107] Step 203: The method for calculating the User Action Behavior Risk Value (URB) is as follows:

[0108] User behavior data includes login time (TIU). i Historical login time average (TRE), login location (LJI) j The central value of frequently used login locations (LPI), the number of operation violations (VGT), and the total number of operations (JDI).

[0109] It should be noted that the login time is TIU i The specific time of the user's i-th login is obtained from the system's login log; the historical login time mean (TRE) represents the average of the user's historical login times, obtained by summing all the user's past login times and dividing by the total number of logins (n); the login location (LJI) is also mentioned. jThis represents the location of the user's j-th login to the system. The user's actual login location is obtained through IP address location, and the unit of quantification is usually geographic coordinates. For example, a login location might be represented as (120.12345°E, 30.12345°N), where 120.12345°E is longitude and 30.12345°N is latitude. The Center Value of Frequently Used Login Locations (LPI) represents the center position of the user's frequently used login locations. It is obtained by calculating the average geographic coordinates of frequently used login locations, and the unit of quantification is geographic coordinates. For example, if the user has logged in from locations A, B, and C respectively, corresponding to coordinates (x1, y1), (x2, y2), and (x3, y3), the LPI will calculate a center coordinate (X, Y) by averaging these coordinates. It is also measured in longitude and latitude; Operation Violation Count (VGT) represents the number of times a user violates regulations during operation. The system records user actions, checks the compliance of each operation, and counts the number of violations. For example, in a business system, if a user performs an operation that does not comply with business rules, such as unauthorized operation or incorrect data input, the system will record these violations and count the Operation Violation Count (VGT); Total Operation Count (JDI) represents the total number of operations performed by the user, including compliant and compliant operations. It is obtained by recording all user operation events in the system log and counting the total number of operation events. For example, in a software application, every click and input by the user is recorded, and the total number of operations is obtained by counting the number of these operation records.

[0110] The User Behavior Risk Value (URB) is calculated based on user behavior data using the following formula:

[0111]

[0112] Among them, TIU i Let δ1 be the login time for the i-th login instance, where i is the sequence number corresponding to different login attempts, ranging from [1, n]; n is the total number of login attempts, a positive integer; δ1 is the weighting coefficient of login time, determined based on the degree of influence of login time on the user's operational behavior risk value URB, ranging from 0.1 to 0.3; LJI j Let δ1 be the j-th login location, where j is the sequence number of each login location, ranging from [1, m]; m is the number of login locations, taking a positive integer value; δ2 is the weighting coefficient of the login location, determined based on the degree of influence of the login location on the user's operational behavior risk value URB, ranging from 0.3 to 0.4; δ3 is the weighting coefficient of the user's operational compliance level, determined based on the degree of influence of the user's operational compliance level on the user's operational behavior risk value URB, ranging from 0.4 to 0.5; and δ1 + δ2 + δ3 = 1.

[0113] It should be noted that in this formula: This represents the sum of the absolute values ​​of the differences between each login time and the historical average login time. This represents the sum of the absolute values ​​of the differences between each login location and the center value of frequently used login locations; The URB value represents the percentage of violations out of the total number of operations, reflecting the compliance level of user actions. It comprehensively considers fluctuations in user login time, login location, and operational compliance to assess the risk of user behavior. A higher URB value indicates a higher risk during the user's login and operation process; a lower URB value indicates that the user's login and operation behavior is relatively safe.

[0114] Step 204: The method for calculating the Network Traffic Security Risk Value (NSS) is as follows:

[0115] Network traffic data includes the current traffic transmission rate (DFG), the average normal traffic transmission rate (EFQ), and the maximum normal traffic transmission rate (DWP).

[0116] It should be noted that the current traffic transmission rate (DFG) represents the actual observed traffic transmission rate in the current network, obtained by measuring the data transmission rate in the network in real time using a network analyzer; the average normal traffic transmission rate (EFQ) represents the average level of traffic transmission rate under normal network operation conditions, obtained by collecting network traffic data from the past week and calculating the average of these data; and the maximum normal traffic transmission rate (DWP) represents the maximum traffic transmission rate ever reached under normal network operation conditions, obtained by finding the maximum traffic transmission rate value from historical traffic data from the past week.

[0117] The Network Traffic Security Risk Value (NSS) is calculated based on the current traffic transmission rate (DFG), the average normal traffic transmission rate (EFQ), and the maximum normal traffic transmission rate (DWP). The formula used is as follows:

[0118]

[0119] It should be noted that in this formula: the numerator represents the difference between the current traffic transmission rate and the average normal traffic transmission rate, and the denominator represents the difference between the maximum normal traffic transmission rate and the average normal traffic transmission rate. Dividing the numerator and denominator yields the Network Traffic Security Risk (NSS) value. The larger the NSS value, the further the current traffic deviates from the normal traffic range, and the higher the network traffic security risk; the smaller the NSS value, the closer the current traffic is to the normal traffic range, and the lower the network traffic security risk.

[0120] Step 205: The method for calculating the Application Access Risk Value (AIR) is as follows:

[0121] Application access data includes the frequency of use of functional modules (UIH) f and historical usage frequency DGU f .

[0122] It should be noted that the usage frequency of the functional modules is UIH f This indicates the usage frequency of the f-th functional module in actual use, obtained from the application's usage logs; historical usage frequency (DGU) f This represents the usage frequency of the f-th functional module over a period of time. The historical usage frequency is calculated by analyzing the number of times each functional module was called in the past quarter from the application usage logs.

[0123] The Application Access Risk Value (AIR) is calculated based on application access data using the following formula:

[0124]

[0125] Among them, UIH f The usage frequency of the f-th functional module, historical usage frequency DGU f Let f be the historical usage frequency of the f-th functional module, where f is the sequence number of the different functional modules, and its value is [1, t]; t is the number of functional modules, and its value is a positive integer.

[0126] It should be noted that in this formula: The application's functional deviation coefficient is calculated by summing the squares of the differences between the usage frequency and historical usage frequency of each functional module, and then dividing by the square of the historical usage frequency of each functional module. The larger the application's functional deviation coefficient, the greater the difference between the actual usage of the application's functional modules and the expected usage, and the more likely there may be abnormal functional usage. The risk of application access is assessed by taking the negative square root of the square of the deviation coefficient of application function divided by 2, and then using it as the exponent for the power operation of e. The risk of application access is assessed by comprehensively considering the difference between the current usage frequency and the historical usage frequency of each functional module. The smaller the final AIR value, the higher the risk of application access; the larger the AIR value, the lower the risk of application access.

[0127] Step 206: The method for calculating the Network Connectivity Performance Risk Value (CPR) is as follows:

[0128] Network connection data includes the actual bandwidth usage (CBG) of the network connection, the lower limit of bandwidth usage (NBW) under normal conditions, the upper limit of bandwidth usage (PBW), the actual traffic (CTZ) of the network connection, the lower limit of normal connection traffic (NCT), and the upper limit of traffic (PCT).

[0129] It should be noted that: Actual Bandwidth Usage (CBG) represents the actual bandwidth used by the current network connection, obtained by measuring the bandwidth used by the current network connection using bandwidth management software; Lower Bandwidth Usage (NBW) represents the minimum expected bandwidth usage of the network connection under normal network operation, obtained from the network design document; Upper Bandwidth Usage (PBW) represents the maximum allowed bandwidth usage of the network connection, obtained from the network equipment's technical specifications; Actual Traffic (CTZ) represents the actual data traffic volume of the current network connection, obtained by measuring the data traffic volume of the current network connection using network traffic monitoring software; Lower Normal Connection Traffic (NCT) represents the minimum expected traffic volume of the network connection under normal network operation, obtained from the network design document; and Upper Traffic Volume (PCT) represents the maximum allowed traffic volume of the network connection, obtained from the network equipment's technical specifications.

[0130] The network connection performance risk value (CPR) is calculated based on the actual bandwidth usage (CBG), the lower limit of bandwidth usage (NBW) under normal conditions, the upper limit of bandwidth usage (PBW), the actual traffic volume (CTZ) of the network connection, the lower limit of traffic volume (NCT) and the upper limit of traffic volume (PCT) under normal connection conditions. The formula used is as follows:

[0131]

[0132] It should be noted that in this formula: It reflects the ratio of the difference between the actual bandwidth usage of the network connection and the lower limit of bandwidth usage under normal circumstances to the difference between the upper and lower limits of bandwidth usage. The larger the value, the closer the current network connection's bandwidth usage is to the upper limit, and the higher the risk of network connection performance. It reflects the ratio of the difference between the actual network connection traffic and the lower limit of normal connection traffic to the difference between the upper and lower limits of traffic. The larger the value, the closer the current network connection traffic is to the upper limit, and the higher the network connection performance risk. The performance risk of the network connection is evaluated by comprehensively considering the bandwidth usage and traffic situation of the network connection. The larger the CPR value, the higher the network connection performance risk; the smaller the CPR value, the lower the network connection performance risk.

[0133] Step 207: The method for calculating the Comprehensive Network Security Value (JFM) is as follows:

[0134] The Comprehensive Network Security Value (JFM) is calculated based on the following formula: Network Security Risk Rating (NSR), User Behavior Risk Rating (URB), Network Traffic Security Risk Rating (NSS), Application Access Risk Rating (AIR), and Network Connectivity Performance Risk Rating (CPR).

[0135] JFM = NSR + URB + NSS + AIR + CPR.

[0136] It should be noted that this formula comprehensively considers the impact of multiple factors on network security, such as the network's own security status, user behavior, network traffic, application access, and network connection performance. The larger the JFM value, the higher the overall security risk of the network; the smaller the JFM value, the better the overall security status of the network.

[0137] When using this method, refer to steps 201 to 207:

[0138] By calculating corresponding network security risk values, user operation behavior risk values, network traffic security risk values, application access risk values, and network connection performance risk values ​​from multi-layered data, and further calculating a comprehensive network security value, this multi-dimensional comprehensive analysis accurately quantifies risks, reduces security risks caused by human factors, effectively identifies potential internal threats, comprehensively grasps all aspects of network conditions, significantly improves the network's ability to cope with unknown attacks, and builds a comprehensive and robust security defense, thereby making intrinsic security network security protection more targeted and efficient.

[0139] Step 3: Preset a set of network security thresholds, compare the network security comprehensive value JFM with the set of network security thresholds, determine the network security intelligent protection level based on the comparison results, and take corresponding intelligent protection measures.

[0140] Step 301: Preset a set of network security thresholds, with the following standards:

[0141] The cybersecurity threshold set is calculated by collecting historical cybersecurity data over a period of time, calculating the overall cybersecurity value JFM over that period, selecting the top 50% of the overall cybersecurity values ​​JFM, and calculating their mean and standard deviation. The mean plus twice the standard deviation is used as the low-risk threshold GY; the mean minus twice the standard deviation is used as the high-risk threshold GH; where GY > GH.

[0142] Step 302: The method for determining the network security intelligent protection level is as follows:

[0143] The set of cybersecurity thresholds includes a low-risk threshold GY and a high-risk threshold GH; where GY > GH.

[0144] The Comprehensive Network Security Value (JFM) is compared with a set of network security thresholds, and the network security intelligent protection level is determined based on the comparison result, according to the following standards:

[0145]

[0146] Among them, corresponding intelligent protection measures are taken according to the level of security risk.

[0147] It should be noted that, at low risk levels, the corresponding intelligent protection measures are as follows: maintain a low frequency of data collection, such as collecting key data once every 4 hours, only performing simple organization and archiving, and monitoring the basic trends of network operation; in terms of equipment maintenance, conduct routine equipment inspections once a week, checking basic conditions such as hardware temperature and fan operation, and automatically updating routine security software patches; maintain the status quo for access control, allowing normal daily business traffic to pass through, and logging but not blocking occasional access from unknown IPs; update applications according to the normal rhythm of application management, without additional intervention, to ensure a normal user experience.

[0148] At the medium-risk level, the corresponding intelligent protection measures are as follows: the data collection frequency is increased to once every hour, and data analysis algorithms are used to initially screen abnormal data and mark suspicious traffic sources; equipment maintenance is changed to daily key inspections, checking the resource usage of critical equipment, and attempting automatic optimization for abnormal usage, such as restarting related services; access control is adjusted to adjust firewall rules, restricting the access time of suspected abnormal IP ranges, and reminding users with abnormal operations to perform secondary authentication; application management suspends some new feature updates with potential risks, investigates the reasons for recent abnormal access to applications, and promptly fixes minor vulnerabilities.

[0149] At high-risk levels, the corresponding intelligent protection measures are as follows: real-time uninterrupted data collection, in-depth analysis using deep learning models, and precise location of attack types and paths; emergency shutdown of non-critical services for equipment maintenance, strengthening device login security, such as using dynamic passwords and recording detailed device operation logs; comprehensive access control to block high-risk traffic entry points, intrusion prevention to block suspicious connections in real time, and locking suspicious user accounts; application management to force the rollback of problematic applications to stable versions, organize expert teams to repair core application vulnerabilities, and restrict external interface calls.

[0150] When using this method, refer to the content of steps 301 to 302:

[0151] By comparing preset thresholds to determine the protection level, and implementing appropriate intelligent protection accordingly, network security levels can be clearly defined. This allows administrators to have an intuitive and quantitative understanding of the network security situation and take corresponding intelligent protection measures based on different levels. This enables precise allocation and efficient utilization of protection resources, avoids over-protection or under-protection, effectively resists potential threats, enhances the overall security and stability of the network, and improves the network's ability to cope with risks.

[0152] On the other hand, the present invention also discloses a network security intelligent protection system based on intrinsic security, comprising:

[0153] The data acquisition module is used to collect network operation status data, user operation behavior data, network traffic data, application access data, and network connection data of the Internet device's built-in security system.

[0154] The value calculation module is used to calculate the Network Device Health Index (NDH), Network Congestion Index (NCI), and Network Service Quality Index (NSQ) based on network operation status data; and to calculate the Network Security Risk Value (NSR) based on the Network Device Health Index (NDH), Network Congestion Index (NCI), and Network Service Quality Index (NSQ).

[0155] The User Behavior Risk Value (URB) is calculated based on user behavior data.

[0156] Calculate the Network Traffic Security Risk Value (NSS) based on network traffic data.

[0157] Calculate the application access risk value (AIR) based on application access data.

[0158] Calculate the network connectivity performance risk value (CPR) based on network connectivity data.

[0159] The comprehensive network security value (JFM) is calculated based on the network security risk value (NSR), user behavior risk value (URB), network traffic security risk value (NSS), application access risk value (AIR), and network connectivity performance risk value (CPR).

[0160] The judgment module is used to preset a set of network security thresholds, compare the network security comprehensive value JFM with the set of network security thresholds, determine the network security intelligent protection level based on the comparison result, and take corresponding intelligent protection measures.

[0161] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented in software, the above embodiments can be implemented, in whole or in part, as a computer program product. Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution.

[0162] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0163] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A network security intelligent protection method based on intrinsic security, characterized in that: Includes the following steps: Step 1: Collect network operation status data, user operation behavior data, network traffic data, application access data, and network connection data from the Internet device's built-in security system; Step 2: Calculate the Network Device Health Index (NDH), Network Congestion Index (NCI), and Network Service Quality Index (NSQ) based on network operation status data; The network security risk value NSR is calculated based on the Network Device Health Index (NDH), the Network Congestion Index (NCI), and the Network Service Quality Index (NSQ). Calculate the user behavior risk value (URB) based on user behavior data; Calculate the Network Traffic Security Risk Value (NSS) based on network traffic data; Calculate the application access risk value (AIR) based on application access data; Calculate the network connectivity performance risk value (CPR) based on network connectivity data; The comprehensive network security value (JFM) is calculated based on the network security risk value (NSR), user behavior risk value (URB), network traffic security risk value (NSS), application access risk value (AIR), and network connectivity performance risk value (CPR). Step 3: Preset a set of network security thresholds, compare the network security comprehensive value JFM with the set of network security thresholds, determine the network security intelligent protection level based on the comparison results, and take corresponding intelligent protection measures. The methods for calculating the Network Device Health Index (NDH), Network Congestion Index (NCI), and Network Service Quality Index (NSQ) are as follows: Network operating status data includes the device's current temperature TNB, the device's minimum allowable temperature TAS, the device's maximum allowable temperature TMJ, the current power supply voltage fluctuation value VNB, the device's maximum allowable voltage fluctuation value VML, the device's current error rate ENJ, and the device's maximum allowable error rate EMI. The network device health index NDH is calculated based on the device's current temperature TNB, minimum allowable temperature TAS, maximum allowable temperature TMJ, current power supply voltage fluctuation VNB, maximum allowable voltage fluctuation VML, current error rate ENJ, and maximum allowable error rate EMI. The formula used is as follows: ； in, The weighting coefficient for the temperature factor ranges from 0.1 to 0.

3. The weighting coefficient for the voltage factor is 0.3 to 0.

4. The weighting coefficient for the error rate factor is 0.4 to 0.5; and ; Network operation status data also includes current bandwidth utilization (BCU), maximum bandwidth utilization (BCM), current network connections (NCD), and maximum network connections (NCM). The Network Congestion Index (NCI) is calculated based on the current bandwidth utilization (BCU), maximum bandwidth utilization (BCM), current number of network connections (NCD), and maximum number of network connections (NCM). The formula used is as follows: ； Network operational status data also includes the current service response time (SRN), the maximum acceptable response time (SRM), the ideal service response time (SRA), and the service availability time (SAV). The Network Service Quality Index (NSQ) is calculated based on the current service response time (SRN), the maximum acceptable response time (SRM), the ideal service response time (SRA), and the service availability time (SAV). The formula used is as follows: ； The method for calculating the Cybersecurity Risk Rating (NSR) is as follows: The network security risk value (NSR) is calculated based on the Network Device Health Index (NDH), Network Congestion Index (NCI), and Network Service Quality Index (NSQ), using the following formula: ； in, The weighting coefficient for the Network Device Health Index (NDH) ranges from 0.1 to 0.

3. This is the weighting coefficient for the Network Congestion Index (NCI), with a value ranging from 0.3 to 0.

4. The weighting coefficient for the Network Service Quality Index (NSQ) is 0.4 to 0.5; and ; The method for calculating the User Action Behavior Risk Value (URB) is as follows: User behavior data includes login time (TIU). i Historical login time average (TRE), login location (LJI) j Common login location center value (LPI), number of operation violations (VGT), and total number of operations (JDI); The User Behavior Risk Value (URB) is calculated based on user behavior data using the following formula: ； in, Let i be the login time for the i-th login, where i is the sequence number corresponding to different login times, and its value is [1, n]; n is the total number of logins, and its value is a positive integer. The weighting factor for login time ranges from 0.1 to 0.

3. Let j be the j-th login location, where j is the index of each login location, and its value is [1, m]; m is the number of login locations, and its value is a positive integer. The weighting coefficient for the login location, with a value ranging from 0.3 to 0.4; The weighting coefficient for the compliance level of user operations ranges from 0.4 to 0.5; and ; The method for calculating the Network Traffic Security Risk Value (NSS) is as follows: Network traffic data includes the current traffic transmission rate (DFG), the average normal traffic transmission rate (EFQ), and the maximum normal traffic transmission rate (DWP). The Network Traffic Security Risk Value (NSS) is calculated based on the current traffic transmission rate (DFG), the average normal traffic transmission rate (EFQ), and the maximum normal traffic transmission rate (DWP). The formula used is as follows: ； The method for calculating the Application Access Risk Value (AIR) is as follows: Application access data includes the frequency of use of functional modules. and historical usage frequency ; The Application Access Risk Value (AIR) is calculated based on application access data using the following formula: ； in, The usage frequency of the f-th functional module, and its historical usage frequency. Let f be the historical usage frequency of the f-th functional module, where f is the sequence number of the different functional modules, taking the value [1, t]; and t is the number of functional modules, taking the value of a positive integer. The method for calculating the Network Connectivity Performance Risk Value (CPR) is as follows: Network connection data includes the actual bandwidth usage (CBG) of the network connection, the lower limit of bandwidth usage (NBW) under normal conditions, the upper limit of bandwidth usage (PBW), the actual traffic (CTZ) of the network connection, the lower limit of normal connection traffic (NCT) and the upper limit of traffic (PCT); The network connection performance risk value (CPR) is calculated based on the actual bandwidth usage (CBG), the lower limit of bandwidth usage (NBW) under normal conditions, the upper limit of bandwidth usage (PBW), the actual traffic volume (CTZ) of the network connection, the lower limit of traffic volume (NCT) and the upper limit of traffic volume (PCT) under normal connection conditions. The formula used is as follows: ； The method for calculating the Comprehensive Network Security Value (JFM) is as follows: The Comprehensive Network Security Value (JFM) is calculated based on the following formula: Network Security Risk Rating (NSR), User Behavior Risk Rating (URB), Network Traffic Security Risk Rating (NSS), Application Access Risk Rating (AIR), and Network Connectivity Performance Risk Rating (CPR). 。 2. The network security intelligent protection method based on intrinsic security according to claim 1, characterized in that: The method for determining the network security intelligent protection level is as follows: The set of cybersecurity thresholds includes a low-risk threshold GY and a high-risk threshold GH; where GY > GH. The Comprehensive Network Security Value (JFM) is compared with a set of network security thresholds, and the network security intelligent protection level is determined based on the comparison result, according to the following standards: ； Among them, corresponding intelligent protection measures are taken according to the level of security risk.

3. A network security intelligent protection system based on intrinsic security, characterized in that: The network security intelligent protection method according to claim 1 or 2 includes: The data acquisition module is used to collect network operation status data, user operation behavior data, network traffic data, application access data, and network connection data of the Internet device's built-in security system. The value calculation module is used to calculate the Network Device Health Index (NDH), Network Congestion Index (NCI), and Network Service Quality Index (NSQ) based on network operation status data; and to calculate the Network Security Risk Value (NSR) based on the Network Device Health Index (NDH), Network Congestion Index (NCI), and Network Service Quality Index (NSQ). Calculate the user behavior risk value (URB) based on user behavior data; Calculate the Network Traffic Security Risk Value (NSS) based on network traffic data; Calculate the application access risk value (AIR) based on application access data; Calculate the network connectivity performance risk value (CPR) based on network connectivity data; The comprehensive network security value (JFM) is calculated based on the network security risk value (NSR), user behavior risk value (URB), network traffic security risk value (NSS), application access risk value (AIR), and network connectivity performance risk value (CPR). The judgment module is used to preset a set of network security thresholds, compare the network security comprehensive value JFM with the set of network security thresholds, determine the network security intelligent protection level based on the comparison result, and take corresponding intelligent protection measures.

Images