A cyber security situation awareness method and application

Abstract

The application discloses a network security situation awareness method, comprising: acquiring multi-source data representing network security situation, extracting core security entities from the multi-source data, and constructing a network security situation awareness knowledge graph based on the correlation between each security entity; based on the knowledge graph, using a document ranking algorithm to calculate node security influence, dynamically evaluating key threat nodes and high-risk assets; constructing a security protection energy efficiency evaluation model, and quantitatively obtaining protection efficiency scores and asset risk levels according to the security protection energy efficiency evaluation model; cross-verification is performed according to the dynamically evaluated key threat nodes and high-risk assets and the quantitatively obtained protection efficiency scores and asset risk levels, a comprehensive situation awareness report is generated, and a protection strategy is optimized. It can improve the accurate identification capability of network security risks, threat propagation paths, key assets and attack situation.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a network security situation awareness method and device, an electronic device and a computer readable storage medium. BACKGROUND

[0002] With the continuous upgrading of network attack means, network security situation awareness has become an important link to ensure network security. Traditional network security situation awareness methods mainly rely on rule detection and abnormal behavior analysis, but in the face of complex network environment and multi-source heterogeneous data, these methods often have problems such as low detection accuracy and slow response speed. Therefore, there is an urgent need for a method that can accurately identify and effectively respond to network security risks. SUMMARY

[0003] In order to overcome the defects of the prior art, the embodiments of the present application provide a network security situation awareness method and application, which improves the accurate identification ability of network security risks, threat propagation paths, key assets and attack situation through semantic association and structured modeling.

[0004] In one aspect, the embodiments of the present application provide a network security situation awareness method, comprising: S01: acquiring multi-source data representing network security situation, extracting core security entities from the multi-source data, and constructing a network security situation awareness knowledge graph based on the association relationship between each security entity; S02: based on the knowledge graph, calculating node security influence using a document ranking algorithm, dynamically evaluating key threat nodes and high-risk assets; S03: constructing a security protection energy efficiency evaluation model, and quantifying the protection efficiency score and asset risk level according to the security protection energy efficiency evaluation model; S04: cross-verification according to the dynamically evaluated key threat nodes and high-risk assets and the quantified protection efficiency score and asset risk level, generating a comprehensive situation awareness report and optimizing the protection strategy.

[0005] In one embodiment of the present application, the construction of the knowledge graph in step S01 specifically includes: the acquired multi-source data covers network monitoring data, alarm data, threat intelligence data, vulnerability intelligence data and asset data; the core security entities are extracted from the multi-source data using natural language processing, entity recognition and regular matching, including attacker entities, attack method entities, vulnerability entities, defense measure entities and network asset entities; the association relationship is constructed using rule matching, graph neural network reasoning and causal reasoning to form attack relationship, vulnerability association, defense mapping and threat propagation path.

[0006] In an embodiment of the present application, the construction of the knowledge graph in step S01 further comprises knowledge fusion and optimization: data fusion based on confidence calculation; missing relationship between data is completed by using a completion algorithm; the knowledge graph is dynamically updated according to real-time threat intelligence flow.

[0007] In an embodiment of the present application, the document ranking algorithm of step S02 iteratively calculates node importance according to the following formula: ; wherein, is the value of node v, d is a damping factor, is the out-degree of the node, is the in-degree of the node.

[0008] In an embodiment of the present application, in step S03, the security protection energy efficiency evaluation model calculates the protection efficiency score by formula ; wherein, represents the protection energy efficiency score, represents the threat risk, represents the vulnerability risk, represents the protection capability.

[0009] In an embodiment of the present application, in step S03, the security protection energy efficiency evaluation model calculates the asset risk level by formula ; wherein, represents the asset risk level, represents the threat risk, represents the vulnerability risk, represents the asset importance.

[0010] In an embodiment of the present application, the cross-validation step of step S04 comprises: comparing the node importance ranking obtained by the document ranking algorithm with the asset risk score output by the security protection energy efficiency evaluation model; according to the comparison result, marking abnormal nodes whose difference exceeds a preset threshold, and performing abnormal troubleshooting by adjusting algorithm parameters or data sources; and generating a security situation report for nodes whose difference is less than the preset threshold.

[0011] In another aspect, the embodiment of the present application also provides a network security situation awareness device, comprising: a knowledge graph construction module, configured to acquire multi-source data representing a network security situation, extract core security entities from the multi-source data, and construct a network security situation awareness knowledge graph based on the association relationship between the security entities; a node and asset evaluation module, configured to calculate node security influence based on the knowledge graph by using a document ranking algorithm, and dynamically evaluate key threat nodes and high-risk assets; an energy efficiency and risk quantification module, configured to construct a security protection energy efficiency evaluation model, and quantitatively obtain a protection efficiency score and an asset risk level according to the security protection energy efficiency evaluation model; and a cross-validation module, configured to cross-validate according to the dynamically evaluated key threat nodes and high-risk assets and the quantitatively obtained protection efficiency score and asset risk level, generate a comprehensive situation awareness report, and optimize a protection strategy.

[0012] In another aspect, the embodiment of the present application also provides an electronic device, comprising: a memory and one or more processors connected to the memory, wherein the memory stores a computer program, and the processor is configured to execute the computer program to implement the network security situation awareness method according to any one of the above embodiments.

[0013] In another aspect, the embodiment of the present application also provides a computer readable storage medium, wherein the computer readable storage medium stores computer executable instructions, and the computer executable instructions are used to execute the network security situation awareness method according to any one of the above embodiments.

[0014] From the above, the above embodiments of the present application can have at least one or more of the following beneficial effects compared with the prior art:

[0015] The present application provides a network security situation awareness method, which can comprehensively and accurately identify and evaluate security risks and threats in the network by constructing a security situation awareness framework based on a knowledge graph, combining the integration and reasoning of multi-source data, introducing a document ranking algorithm to efficiently identify key assets and core threat nodes, quantifying attack paths and threat propagation, improving the accuracy and response speed of situation awareness, and constructing a protection energy efficiency evaluation model to provide scientific analysis of asset risk and protection efficiency from the comprehensive evaluation of threats, vulnerabilities and protection capabilities, and optimizing protection resource allocation. The method not only improves the intelligent level of network security protection, but also provides a quantitative and standardized decision basis for security management, and has a wide application prospect. BRIEF DESCRIPTION OF DRAWINGS

[0016] The accompanying drawings, which are included to provide a further understanding of the application and constitute a part of this application, illustrate certain illustrative embodiments of the application and together with the description serve to explain the application. In the drawings:

[0017] Figure 1 A flow chart of a network security situation awareness method provided for an embodiment of the present application is shown in FIG. 1.

[0018] Figure 2 A flow chart of knowledge graph construction provided for an embodiment of the present application is shown in FIG. 2.

[0019] Figure 3 A specific execution logic diagram of a network security situation awareness method provided for an embodiment of the present application is shown in FIG. 3.

[0020] Figure 4 A structure diagram of a network security situation awareness device provided for an embodiment of the present application is shown in FIG. 4.

[0021] Figure 5 A structure diagram of an electronic device provided for an embodiment of the present application is shown in FIG. 5.

[0022] Figure 6 A structure diagram of a computer readable storage medium provided for an embodiment of the present application is shown in FIG. 6. DETAILED DESCRIPTION

[0023] It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict. The present application will be described below with reference to the accompanying drawings and in combination with the embodiments.

[0024] In order to make those skilled in the art better understand the technical solutions of the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, and should belong to the protection scope of the present application.

[0025] It should be noted that the terms "first", "second" and the like in the specification and claims of the present application and the above-mentioned drawings are applicable to distinguish similar objects, and do not have to be used to describe a specific order or sequence. It should be understood that the terms thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0026] It should also be noted that the division of the plurality of embodiments in the present application is only for the convenience of description, and should not constitute a special limitation. The features in various embodiments can be combined with each other and mutually quoted without contradiction.

[0027] As Figure 1 shown, the first embodiment of the present application proposes a network security situation awareness method, for example, comprising: step S01, acquiring multi-source data representing network security situation, extracting core security entities from the multi-source data, and constructing a network security situation awareness knowledge graph based on the association relationship between each security entity; step S02, based on the knowledge graph, using a document ranking algorithm to calculate node security influence, dynamically evaluating key threat nodes and high-risk assets; step S03, constructing a security protection energy efficiency evaluation model, and quantifying the protection effectiveness score and asset risk level according to the security protection energy efficiency evaluation model; step S04, cross-verification according to the dynamically evaluated key threat nodes and high-risk assets and the quantified protection effectiveness score and asset risk level, generating a comprehensive situation awareness report and optimizing the protection strategy.

[0028] Specifically, in combination with Figure 2 shown, step S01 constructs an efficient and accurate network security situation awareness knowledge graph based on multi-source heterogeneous security data. First, by integrating multiple data sources, including but not limited to network monitoring data (such as traffic logs, intrusion detection logs), alarm data (such as firewall, IDS / IPS, SOC alarm logs), threat intelligence data (such as malicious IP, attacker information), vulnerability intelligence data (such as CVE, CWE, CPE) and asset data (such as servers, terminals, business systems), comprehensive data collection and preprocessing is performed. Data standardization, cleaning, and deduplication techniques are used to ensure the consistency and high quality of the collected data.

[0029] In the entity extraction and normalization process, for example, through natural language processing (NLP) technology and entity recognition (NER) algorithm, core entities such as attackers (APT organizations, malicious IPs), attack methods (such as SQL injection, XSS attacks), vulnerabilities (such as CVE numbers), defense measures (such as firewall policies, zero-trust architecture) and network assets (such as servers, terminals, web applications) are accurately extracted from massive unstructured texts, and standardized normalization processing is performed using domain knowledge base. This step ensures the consistency and standardization of entities, improving the accuracy of subsequent data association.

[0030] Next, by using graph neural networks (GNN) and causal reasoning techniques, a correlation graph is constructed between entities. For example, an attacker affects a vulnerability through a certain attack method, and then affects an asset, forming a complete attack path. The construction of the graph not only considers direct correlations, but also reveals potential attack propagation paths and threat chains through causal reasoning. By combining real-time threat intelligence streams, the graph data can be dynamically updated to supplement newly emerging threats, vulnerabilities, or attack methods, thereby improving the real-time and accuracy of situational awareness.

[0031] The knowledge graph is stored in a distributed graph database such as Neo4, and the query capabilities and graph analysis functions of the graph database are used to provide core functions such as security event tracing, situational visualization, and risk assessment. Based on security events and threat chains, the security team can quickly identify attack sources, propagation paths, and target assets, and improve response speed and protection effectiveness.

[0032] In step S02, the Figure 3 As shown in the figure, the ArticleRank algorithm is based on the importance of entity nodes in the graph to accurately assess network security risks. First, in the constructed knowledge graph, attackers, attack methods, vulnerabilities, and victim assets are represented by directed and weighted graphs, where the weight of each node reflects the influence of the entity in the network. For example, a high in-degree weight of an attacker node means that the attacker has launched multiple attacks, making the attack path more threatening; a high out-degree weight of a victim asset node means that the asset is targeted in multiple attack events.

[0033] Specifically, in the ArticleRank algorithm, each node is first assigned an initial security score. To ensure the accuracy of the score, key nodes such as core assets and APT attackers are given higher initial weights. Then, through iterative calculation, the score of each node is updated based on the following ArticleRank formula:

[0034] ;

[0035] wherein, is the value of node v, d is the damping factor, is the out-degree of the node, is the in-degree of the node. Through continuous iteration, the algorithm gradually converges, and finally obtains the security score of each node. A higher score indicates that the node is a high-risk node and may become the core target of an attack.

[0036] For example, in one embodiment, suppose an APT group (attacker node) attacks different critical assets (such as Apache servers) through multiple vulnerabilities (such as CVE-2024-XXXX). Using the ArticleRank algorithm, the system can identify the threat propagation path between the attacker and the target assets and quantify its security impact. Ultimately, by analyzing node scores, the system can determine the attacker's threat level and high-risk assets in the network, providing targeted protection recommendations for the security team.

[0037] The ArticleRank algorithm can also be dynamically adjusted based on the time dimension, predicting attack trends and situational evolution through the accumulation of historical attack data. For example, it can predict the activity areas of future attackers based on historical attack patterns, helping security teams to deploy defensive measures in advance. Through this algorithm, network security situational awareness systems can accurately identify key security risk points in complex network environments, improve the intelligence level of situational awareness, and provide a reliable basis for protection decisions.

[0038] In step S03, for example, an application server is taken as a core asset and it is subjected to a high-intensity DDoS attack. The specific data is as follows:

[0039] Threat Risk (R): High attack frequency, threat intensity assessment is 80.

[0040] Vulnerability Score (V): The server has an unpatched medium-risk vulnerability, with a score of 60.

[0041] Protection capability (C): The protective equipment is fully deployed, but the response is slow, with a score of 70.

[0042] Asset Importance (A): This server runs core business operations and has an asset importance score of 90.

[0043] The formula for calculating protective energy efficiency is: ;in, Indicates the protective energy efficiency score. Indicates threat or risk. Indicates vulnerability risk. It indicates protective capabilities.

[0044] Substituting the data, we calculate:

[0045] Protection effectiveness score (E): 0.0144, close to the lowest effectiveness.

[0046] Analysis: The protective equipment is ineffective against high-intensity attacks, and there is an urgent need to optimize the response mechanism.

[0047] The formula for calculating asset risk level is: ;in, Indicates the asset risk level. Indicates threat or risk. Indicates vulnerability risk. Indicates the importance of assets.

[0048] Substituting the data, we calculate:

[0049] Asset risk rating (AR): 43.2, which is considered medium risk.

[0050] Analysis: The server is of high importance, but its risk level has increased due to unresolved vulnerabilities and threats.

[0051] In step S04, a secondary verification method is used to verify the results of steps S02 and S03. First, the node importance ranking obtained through the ArticleRank algorithm (step S02) is compared with the asset risk score output by the security protection efficiency assessment model (step S03) to ensure that the two reflect the same security situation. The specific steps are as follows:

[0052] Consistency verification of results: The node importance in the ArticleRank algorithm is compared with the risk score in the security protection efficiency assessment. If a node is rated as high risk in both, it indicates that the results are consistent and meet expectations. This ensures the consistency of results from different algorithms.

[0053] Anomaly identification: If there is a discrepancy between the two assessment results (e.g., the ArticleRank algorithm determines a node to be high-risk, while the security protection efficiency assessment model rates it as low-risk), the node will be marked as an anomaly, an alarm will be triggered, and manual intervention will be initiated. Experts will investigate the discrepancy and adjust the data source, algorithm, or check for potential vulnerabilities.

[0054] Comprehensive Situational Awareness Assessment: If the results of the two are consistent, the comprehensive results will generate a final security situation report, which accurately reflects the current network risks, predicts potential threats, provides the risk level of critical assets, the influence of core threat nodes and high-risk propagation paths, and provides security managers with profound security insights.

[0055] Dynamic feedback and optimization: After verification, the security protection strategy is optimized based on the results. If deviations occur, the system adjusts the model through self-learning and periodically re-verifies to cope with changing security situations.

[0056] Through a secondary verification mechanism, the system can improve the accuracy and reliability of network security situational awareness, ensure consistency of results, and provide accurate basis for security decisions. This not only enhances sensitivity to abnormal situations but also optimizes automated risk management processes, improves overall network protection effectiveness, and provides security experts with a clear analysis path, reducing the complexity of manual intervention.

[0057] In summary, the first embodiment of this invention proposes a network security situation awareness method. By constructing a security situation awareness framework based on a knowledge graph and combining the integration and reasoning of multi-source data, it can comprehensively and accurately identify and assess security risks and threats in the network. The introduction of a document ranking algorithm can efficiently identify key assets and core threat nodes, quantify attack paths and threat propagation, and improve the accuracy and response speed of situation awareness. At the same time, a protection efficiency assessment model is constructed to provide scientific analysis of asset risk and protection effectiveness from the comprehensive assessment perspective of threats, vulnerabilities, and protection capabilities, and optimize the allocation of protection resources. This method not only improves the intelligence level of network security protection, but also provides quantitative and standardized decision-making basis for security management, and has broad application prospects.

[0058] In addition, such as Figure 4 As shown, the second embodiment of the present invention also proposes a network security situation awareness device, which includes, for example: a knowledge graph construction module 201, a node and asset assessment module 202, an energy efficiency and risk quantification module 203, and a cross-validation module 204.

[0059] The knowledge graph construction module 201 is used to acquire multi-source data representing the network security situation, extract core security entities from the multi-source data, and construct a network security situation awareness knowledge graph based on the relationships between the security entities; the node and asset assessment module 202 is used to calculate the security influence of nodes based on the knowledge graph using a document ranking algorithm, and dynamically assess key threat nodes and high-risk assets; the energy efficiency and risk quantification module 203 is used to construct a security protection energy efficiency assessment model, and quantify the protection effectiveness score and asset risk level according to the security protection energy efficiency assessment model; the cross-validation module 204 is used to perform cross-validation based on the dynamically assessed key threat nodes and high-risk assets, as well as the quantified protection effectiveness score and asset risk level, to generate a comprehensive situation awareness report and optimize the protection strategy.

[0060] The network security situation awareness method implemented by the network security situation awareness device disclosed in the second embodiment of the present invention is as described in the first embodiment above, and therefore will not be described in detail here. Optionally, each module and the other operations or functions mentioned above are for implementing the method described in the first embodiment, and the beneficial effects of the network security situation awareness device provided in this embodiment are the same as the beneficial effects of the network security situation awareness method provided in the first embodiment above. For the sake of brevity, they will not be repeated here.

[0061] like Figure 5As shown, the third embodiment of the present invention also proposes an electronic device, for example including: at least one processing unit and at least one storage unit, wherein the storage unit stores a computer program, and when the computer program is executed by the processing unit, the processing unit performs the method described in the first embodiment, and the beneficial effects of the electronic device provided in this embodiment are the same as the beneficial effects of the network security situation awareness method provided in the first embodiment.

[0062] like Figure 6 As shown, the fourth embodiment of the present invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the above-described method. The beneficial effects of the computer-readable storage medium provided in this embodiment are the same as those of the network security situation awareness method provided in the first embodiment.

[0063] The computer-readable storage medium may include, but is not limited to, any type of disk, including floppy disks, optical disks, DVDs, CD-ROMs, microdrives, as well as magneto-optical disks, ROMs, RAMs, EPROMs, EEPROMs, DRAMs, VRAMs, flash memory devices, magnetic cards or optical cards, nanosystems (including molecular memory ICs), or any type of medium or device suitable for storing instructions and / or data.

[0064] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0065] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0066] In the several embodiments provided in this application, it should be understood that the disclosed apparatus can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some service interface; the indirect coupling or communication connection between devices or units may be electrical or other forms.

[0067] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0068] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0069] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage device (CMD). Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned memory includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0070] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, which may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.

[0071] The foregoing description is merely an exemplary embodiment of this disclosure and should not be construed as limiting the scope of this disclosure. Any equivalent changes and modifications made in accordance with the teachings of this disclosure shall still fall within the scope of this disclosure. Those skilled in the art will readily conceive of embodiments of this disclosure upon considering the specification and practicing the disclosure herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not described herein. The specification and embodiments are to be considered exemplary only, and the scope and spirit of this disclosure are defined by the claims.

[0072] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0073] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A network security situation awareness method, characterized in that, include: S01: Obtain multi-source data representing the network security situation, extract core security entities from the multi-source data, and construct a network security situation awareness knowledge graph based on the relationship between the security entities. S02: Based on the knowledge graph, a document ranking algorithm is used to calculate the security influence of nodes and dynamically assess key threat nodes and high-risk assets; S03: Construct a security protection efficiency assessment model, and quantify the protection efficiency score and asset risk level based on the security protection efficiency assessment model; S04: Based on the dynamic assessment of key threat nodes and high-risk assets, as well as the quantified protection effectiveness score and asset risk level, cross-validate the data to generate a comprehensive situational awareness report and optimize the protection strategy.

2. The network security situation awareness method according to claim 1, characterized in that, The construction of the knowledge graph in step S01 specifically includes: The acquired multi-source data includes network monitoring data, alarm data, threat intelligence data, vulnerability intelligence data, and asset data; The core security entity extraction utilizes natural language processing, entity recognition, and regular expression matching to extract attacker entities, attack method entities, vulnerability entities, defense measure entities, and network asset entities from the multi-source data. The association construction employs rule matching, graph neural network reasoning, and causal reasoning to form attack relationships, vulnerability associations, defense mappings, and threat propagation paths.

3. The network security situation awareness method according to claim 1, characterized in that, The construction of the knowledge graph in step S01 also includes knowledge fusion and optimization: Data fusion based on confidence level calculation; Use completion algorithms to fill in missing relationships between data; The knowledge graph is dynamically updated based on real-time threat intelligence streams.

4. The network security situation awareness method according to claim 1, characterized in that, The document ranking algorithm in step S02 iteratively calculates node importance using the following formula: ； in, For node v Value, where d is the damping factor. It is the out-degree of the node. It is the in-degree of the node.

5. The network security situation awareness method according to claim 1, characterized in that, In step S03, the safety protection energy efficiency evaluation model is determined by the formula... Calculate the protective effectiveness score; among which, Indicates the protective energy efficiency score. Indicates threat or risk. Indicates vulnerability risk. It indicates protective capabilities.

6. The network security situation awareness method according to claim 1, characterized in that, In step S03, the safety protection energy efficiency evaluation model is determined by the formula... Calculate the asset risk level; among which, Indicates the asset risk level. Indicates threat or risk. Indicates vulnerability risk. Indicates the importance of assets.

7. The network security situation awareness method according to claim 1, characterized in that, The cross-validation steps in step S04 include: Compare the node importance ranking obtained by the document ranking algorithm with the asset risk score output by the security protection efficiency assessment model; Based on the comparison results, abnormal nodes with differences exceeding a preset threshold are marked, and anomalies are investigated by adjusting algorithm parameters or data sources. A security status report is generated for nodes whose differences are less than the preset threshold.

8. A network security situation awareness device, characterized in that, include: The knowledge graph construction module is used to acquire multi-source data representing the network security situation, extract core security entities from the multi-source data, and construct a network security situation awareness knowledge graph based on the relationship between the security entities. The node and asset assessment module is used to calculate the security influence of nodes based on the knowledge graph and using a document ranking algorithm to dynamically assess key threat nodes and high-risk assets. The energy efficiency and risk quantification module is used to construct a safety protection energy efficiency assessment model, and to quantify the protection effectiveness score and asset risk level based on the safety protection energy efficiency assessment model. The cross-validation module is used to perform cross-validation based on the dynamically assessed key threat nodes and high-risk assets, as well as the quantified protection effectiveness score and asset risk level, to generate a comprehensive situational awareness report and optimize protection strategies.

9. An electronic device, characterized in that, include: A memory and one or more processors connected to the memory, the memory storing a computer program, the processors executing the computer program to implement the network security situational awareness method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable commands for performing the network security situation awareness method as described in any one of claims 1-7.

Images