Network space map surveying and mapping method and system based on multi-source data fusion

Abstract

The invention discloses a network space map surveying and mapping method and system based on multi-source data fusion, and the method comprises the steps: obtaining a multi-source data set in a unified format based on network flow data, equipment information data and geographic position data; obtaining a network asset entity and an incidence relation graph thereof through entity identification and correlation analysis based on the multi-source data set with the uniform format; obtaining a network space three-dimensional map model through three-dimensional space mapping and visual rendering based on the network asset entity and the association relationship map thereof; based on the network space three-dimensional map model, performing dynamic updating according to the accessed real-time data flow to obtain real-time network space situation data; and obtaining a network security risk assessment result through anomaly detection and threat identification based on the real-time network space situation data. According to the invention, visual display and security situation awareness of the network space are realized, and a brand new decision support tool is provided for network security management.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of cyberspace, in particular to a network space map surveying method and system based on multi-source data fusion. BACKGROUND

[0002] Network space map surveying is an important technical means of network security situation awareness and network management, which provides an intuitive support tool for network security analysis and decision-making through the visual display of network assets, connection relationships and security status.

[0003] Existing network topology discovery technologies mainly identify network structures based on a single data source, such as device information collection based on the SNMP protocol or port detection based on network scanning. Another type of technology is connection relationship identification based on network traffic analysis, which constructs a network connection graph by analyzing the source and destination addresses of data packets.

[0004] The most relevant technology at present is a network visualization method based on multi-dimensional data, which collects network device information, traffic data and configuration information, and uses graphical algorithms to display the network structure in two-dimensional or simple three-dimensional form, while identifying device status and connection quality by combining color coding and other methods.

[0005] However, the existing technology has the following key problems: first, multi-source data lacks effective fusion mechanism, resulting in serious data island phenomenon and inability to form a unified network view; second, it lacks the organic combination of geographic information and network logical structure, making it difficult to provide intuitive spatial location awareness. SUMMARY

[0006] Therefore, the embodiments of the present disclosure provide a network space map surveying method and system based on multi-source data fusion, which can solve the problems of insufficient multi-source data fusion and non-intuitive network space visualization in the prior art.

[0007] In a first aspect, the embodiments of the present disclosure provide a network space map surveying method based on multi-source data fusion, which adopts the following technical solution: The network space map surveying method based on multi-source data fusion comprises: Based on network traffic data, device information data and geographic location data, a unified format multi-source data set is obtained through data preprocessing and standardization operations; Based on the unified format multi-source data set, a network asset entity and its correlation graph are obtained through entity recognition and correlation analysis; Based on the network asset entity and its correlation graph, a network space three-dimensional map model is obtained through three-dimensional space mapping and visualization rendering; Based on the network space three-dimensional map model, real-time network space situation data is obtained by dynamically updating according to the accessed real-time data stream; Based on the real-time network space situation data, network security risk assessment results are obtained through anomaly detection and threat identification.

[0008] Optionally, based on network traffic data, device information data and geographic location data, the unified format multi-source data set is obtained through data preprocessing and standardization operation, including: For the network traffic data, redundant and erroneous packet information is removed and key quintuple information and traffic feature parameters are extracted to obtain standardized traffic data; For the device information data, the device identifier format is standardized and the standardized description mode of device attributes is established to obtain standardized device data; For the geographic location data, coordinate system conversion is performed to unify different source geographic coordinates to a standard geographic coordinate system to obtain standardized geographic data; The standardized traffic data, the standardized device data and the standardized geographic data are organized and stored according to a predefined data structure to obtain the unified format multi-source data set.

[0009] Optionally, based on the unified format multi-source data set, network asset entities and their correlation graph are obtained through entity recognition and correlation analysis, including: Based on the unified format multi-source data set, independent network asset entities are identified to obtain a network asset entity list; Based on the network asset entity list, IP address matching, MAC address association and device fingerprint identification are used to establish mapping relationships of the same entity in different data sources to obtain an entity mapping relationship table; Based on the entity mapping relationship table and network traffic data, communication relationships between network asset entities are analyzed to identify connection topologies and dependency relationships between network asset entities to obtain a correlation graph of the network asset entities.

[0010] Optionally, based on the network asset entities and their correlation graph, a network space three-dimensional map model is obtained through three-dimensional space mapping and visualization rendering, including: The physical coordinate position of the network asset entity in the three-dimensional space is determined according to the geographic location information to obtain an entity space coordinate table; Based on the entity space coordinate table, the logical distance and hierarchical relationship between network asset entities are calculated to establish a mapping association between logical structure and physical space to obtain a space mapping relationship; Based on the spatial mapping relationship, the distribution of assets in three-dimensional space is optimized, and three-dimensional graphic rendering is performed to obtain the network space three-dimensional map model.

[0011] Optionally, based on the network space three-dimensional map model, the real-time network space situation data is obtained by dynamically updating according to the accessed real-time data stream, including: Real-time network traffic, device status and security events are obtained to obtain real-time data stream; Based on the real-time data stream, the network space three-dimensional map model is updated locally to obtain an updated map model; Based on the updated map model, the state identifier, connection relationship and spatial position of assets in the three-dimensional map are updated in real time through dynamic rendering to obtain the real-time network space situation data.

[0012] Optionally, based on the real-time network space situation data, the network security risk assessment result is obtained by abnormality detection and threat identification, including: A baseline model of normal network behavior is established, and the normal characteristics of network traffic, device status and connection mode are obtained by training historical data to obtain a network behavior baseline; Based on the network behavior baseline, the real-time network space situation data is subjected to abnormality detection to identify abnormal behaviors deviating from the normal baseline; The detected abnormal behaviors are subjected to threat identification to determine whether they constitute a security threat and the threat level, and a threat identification result is obtained; Based on the threat identification result, the risk area and threat path are identified in a visual manner on the three-dimensional map to obtain the network security risk assessment result.

[0013] Optionally, based on the spatial mapping relationship, the distribution of assets in three-dimensional space is optimized, including: Based on the network asset entity and its associated relationship graph, the attraction and repulsion rules between network asset entities are set to obtain an initial force field distribution; Based on the initial force field distribution, the resultant force acting on each network asset entity is calculated; The position of the network asset entity in the three-dimensional space is adjusted according to the resultant force to obtain an optimized spatial position; When the spatial position of the network asset entity changes by less than a preset threshold, the optimization iteration is stopped.

[0014] Optionally, based on the real-time data stream, the network space three-dimensional map model is updated locally to obtain an updated map model, including: According to the real-time data stream, the data change events are captured, including new devices, connection changes and state update events; Based on the data change event, a hash comparison method is used to identify the changed cyberspace region, and local recalculation is performed on the changed cyberspace region to obtain a local update result. Based on the local update result, an updated map model is obtained.

[0015] Optionally, the network space mapping method further comprises: Collecting historical network behavior data and security event data, and establishing a time series feature library; According to the time series feature library, a deep learning prediction model is trained to learn the time pattern and trend rule of network behavior; According to the deep learning prediction model, the current network behavior is predicted, and the prediction result is integrated into the network space three-dimensional map model to show the future possible network state change in the form of prediction trajectory and probability cloud; According to the network security risk assessment result and the future possible network state change, the current network behavior is processed.

[0016] In a second aspect, the embodiments of the present disclosure also provide a network space mapping system based on multi-source data fusion, which adopts the following technical scheme: The network space mapping system based on multi-source data fusion comprises: A data fusion processing unit is configured to obtain a multi-source data set in a unified format by data preprocessing and standardization operation based on network traffic data, device information data and geographic location data; An entity association analysis unit is configured to obtain a network asset entity and its association graph based on the multi-source data set in a unified format by entity recognition and association analysis; A three-dimensional map construction unit is configured to obtain a network space three-dimensional map model by three-dimensional space mapping and visualization rendering based on the network asset entity and its association graph; A situation updating unit is configured to obtain real-time network space situation data by dynamic updating based on the network space three-dimensional map model according to the accessed real-time data stream; A security assessment unit is configured to obtain a network security risk assessment result by anomaly detection and threat identification based on the real-time network space situation data.

[0017] The present application has the advantages that: through multi-source data fusion technology, the unified management of heterogeneous data such as network traffic, device information and geographic location is realized; the three-dimensional space mapping method is introduced to organically combine network logical structure and geographic space position, and provide intuitive network space visualization display; the real-time data updating and security risk assessment functions are integrated to support dynamic network situation awareness and security early warning.

[0018] The above description is only a summary of the technical solutions of the present disclosure. In order to make the technical means of the present disclosure more clearly understood, the contents of the specification can be implemented, and in order to make the above and other purposes, characteristics and advantages of the present disclosure more obvious and easy to understand, the following preferred embodiments are described in detail below, and the accompanying drawings are described as follows. BRIEF DESCRIPTION OF DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following will briefly introduce the drawings needed to be used in the embodiments. Obviously, the drawings in the following description are only some embodiments of the present disclosure, and for those skilled in the art, other drawings can be obtained without creative labor on the basis of these drawings.

[0020] Figure 1 The flowchart of the network space mapping method provided by the embodiments of the present disclosure is shown in the figure. Figure 2 The specific flowchart of step S1 provided by the embodiments of the present disclosure is shown in the figure. Figure 3 The specific flowchart of step S2 provided by the embodiments of the present disclosure is shown in the figure. Figure 4 The specific flowchart of step S3 provided by the embodiments of the present disclosure is shown in the figure. Figure 5 The specific flowchart of step S4 provided by the embodiments of the present disclosure is shown in the figure. Figure 6 The specific flowchart of step S5 provided by the embodiments of the present disclosure is shown in the figure. Figure 7 The principle block diagram of the network space mapping system provided by the embodiments of the present disclosure is shown in the figure. DETAILED DESCRIPTION

[0021] The embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings.

[0022] It should be clear that the following describes the embodiments of the present disclosure through specific and concrete examples, and those skilled in the art can easily understand other advantages and effects of the present disclosure from the contents disclosed in the specification. Obviously, the described embodiments are only some of the embodiments of the present disclosure, not all. The present disclosure can also be implemented or applied by other different specific embodiments, and the details in the specification can be modified or changed based on different views and applications without departing from the spirit of the present disclosure. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict. Based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present disclosure.

[0023] As Figure 1As shown, the network space map mapping method based on multi-source data fusion in the embodiment of the disclosure comprises: Step S1, based on network traffic data, device information data and geographic location data, through data preprocessing and standardization operation, a unified format multi-source data set is obtained; Optionally, as Figure 2 As shown, step S1 based on network traffic data, device information data and geographic location data, through data preprocessing and standardization operation, the unified format multi-source data set comprises: Step S1.1, cleaning the network traffic data to remove redundant and error data packet information and extracting key quintuple information and traffic characteristic parameters to obtain standardized traffic data; Exemplarily, from the original traffic data collected from the enterprise core router, filter out redundant information such as heartbeat packet and broadcast packet, extract quintuple information such as source IP address xxx.xxx.x.xxx, target IP address xx.x.x.xx, source port 1024, target port 443, protocol type TCP, and traffic characteristic parameters such as packet size 1500 bytes, transmission rate 10 Mbps.

[0024] Step S1.2, standardizing the device information data to unify the device identifier format and establishing the standardized description mode of device attributes to obtain standardized device data; Exemplarily, the switch device names from different manufacturers "Cisco-SW-01", "H3C_Switch_02", "Huawei.SW.03" are uniformly standardized to "SW-VENDOR-LOCATION-ID" format, such as "SW-Cisco-BJ-01", and the device attributes are uniformly standardized to standard fields: DeviceType, MgmtIP, PortCount, FirmwareVersion, etc.

[0025] Step S1.3, coordinate system conversion is performed on the geographic location data to unify different sources of geographic coordinates to a standard geographic coordinate system to obtain standardized geographic data; Exemplarily, the WGS84 coordinate system data of Beijing machine room and the Beijing 54 coordinate system data of Shanghai machine room are converted into unified WGS84 coordinate system, ensuring that all geographic location data adopt the same coordinate reference and accuracy standard.

[0026] Step S1.4, the standardized traffic data, the standardized device data and the standardized geographic data are organized and stored according to a predefined data structure to obtain the unified format multi-source data set.

[0027] Specifically, a unified data schema and storage format are established to organize and store the processed multi-source data according to a predefined data structure, specifically including: (1) defining a general data field mapping rule to map data attributes of different sources to a unified field name and data type; (2) establishing a hierarchical data organization structure to store classifiedly according to a device layer, a network layer and an application layer; (3) designing a data association index mechanism to establish a fast retrieval path for subsequent entity recognition and association analysis; (4) implementing data integrity checking to ensure that the stored data meets predefined constraint conditions and business rules; (5) establishing a data version management mechanism to support historical tracing and incremental updating of data.

[0028] Exemplarily, (1) a general data field mapping rule is defined, for example, "hostname" of Cisco devices, "sysname" of Huawei devices and "device-name" of H3C devices are uniformly mapped to a standard field "DeviceName", and port status descriptions "up / down", "active / inactive", "online / offline" of different manufacturers are uniformly mapped to a Boolean type "PortStatus" field; (2) a hierarchical data organization structure is established, physical device information such as switches, routers and firewalls is stored according to the device layer, logical network information such as VLAN configuration, routing table and ACL rule is stored according to the network layer, and application system information such as Web service, database service and mail service is stored according to the application layer; (3) a data association index mechanism is designed, a multi-index structure based on IP address, MAC address and device ID is established, for example, an "IP_to_Device" index table is created to quickly find the device entity corresponding to the IP address xxx.xxx.x.xxx, and a "MAC_to_Port" index table is established to quickly locate the switch port connected by the MAC address 00:0C:29:A4:BC:DE; (4) data integrity checking is implemented, IP address format verification rules are set to ensure that all IP fields meet the IPv4 or IPv6 standard, device type enumeration constraints are established to limit the DeviceType field to only pre-defined values such as "Router", "Switch" and "Firewall", and timestamp range checks are set to ensure that data collection time is within a reasonable range; (5) a data version management mechanism is established, a version number and a timestamp field are added to each record, for example, historical versions "Config_v1.0_20240115" and "Config_v1.1_20240116" are retained when device configuration is changed, network historical state can be queried according to time points, and incremental data synchronization and rollback operations based on timestamps are implemented.

[0029] Step S2, based on the multi-source data set in the unified format, obtaining a network asset entity and its correlation graph through entity recognition and correlation analysis; Optionally, as shown in Figure 3 Step S2, based on the multi-source data set in the unified format, obtaining a network asset entity and its correlation graph through entity recognition and correlation analysis, comprising: Step S2.1, based on the multi-source data set in the unified format, identifying independent network asset entities to obtain a network asset entity list; For example, a core router with model "Cisco ASR 1000" is identified from the SNMP data, a web server virtual machine running Ubuntu 20.04 is found from the virtualization platform API, and a MySQL database service running on TCP 3306 port is identified from the port scanning result.

[0030] Step S2.2, based on the network asset entity list, establishing a mapping relationship of the same entity in different data sources through IP address matching, MAC address association and device fingerprint identification to obtain an entity mapping relationship table; For example, the IP address xxx.xxx.x.xxx in the traffic monitoring, the record with MAC address 00:50:56:C0:00:08 in the asset management system, and the device with hostname "WEB-SERVER-01" in the SNMP query are identified as the same web server entity.

[0031] Step S2.3, based on the entity mapping relationship table and network traffic data, analyzing the communication relationship between network asset entities to identify the connection topology and dependency relationship between network asset entities, and obtaining the correlation graph of the network asset entities.

[0032] For example, by analyzing the traffic log, it is found that the web server xxx.xxx.x.xxx sends an average of 50 SQL query requests per second to the database server xxx.xxx.x.xxx, establishing an application dependency relationship between them; through the LLDP protocol, it is found that the switch port Gi0 / 1 / 1 is directly connected to the router's Gi0 / 0 / 1 port, determining the physical connection topology.

[0033] A correlation graph of network asset entities is constructed, and a comprehensive network model containing entity attributes and correlation is formed. For example, a comprehensive network model containing a Web server (attributes: IP = xxx.xxx.x.xxx, OS = Ubuntu 20.04, CPU = 4 cores), a database server (attributes: IP = xxx.xxx.x.xxx, service = MySQL 8.0, storage = 2 TB), and an application dependency relationship (relationship type: database connection, frequency: 50 times / sec, port: 3306) between them is constructed.

[0034] Step S3, based on the network asset entities and the correlation graph thereof, a network space three-dimensional map model is obtained through three-dimensional space mapping and visual rendering; Optionally, as shown in Figure 4 Step S3, based on the network asset entities and the correlation graph thereof, a network space three-dimensional map model is obtained through three-dimensional space mapping and visual rendering, including: Step S3.1, determining the physical coordinate position of the network asset entity in the three-dimensional space according to the geographic location information, and obtaining an entity space coordinate table; Step S3.2, based on the entity space coordinate table, calculating the logical distance and hierarchical relationship between the network asset entities, establishing a mapping association of logical structure and physical space, and obtaining a space mapping relationship; Step S3.3, based on the space mapping relationship, optimizing the distribution of assets in the three-dimensional space, and performing three-dimensional graphic rendering, to obtain the network space three-dimensional map model.

[0035] Exemplarily, first, the Beijing headquarters core router is positioned at a coordinate, the Shanghai branch switch is positioned at a coordinate, and the Shenzhen R&D center firewall is positioned at a coordinate. Then, the core layer device (such as a backbone router) is placed at a height of Z=100, the aggregation layer device (such as an aggregation switch) is placed at a height of Z=50, and the access layer device (such as an access switch) is placed at a height of Z=0, forming a clear network hierarchy. Next, the finance server xxx.xxx.x.xxx and the finance database xxx.xxx.x.xxx generate an attractive force due to frequent communication (50 SQL queries per second), and after optimization, the distance between the two in the three-dimensional space is shortened from the initial 200 meters to 50 meters; and the video monitoring system unrelated to the finance system is pushed to a remote location due to a repulsive force. Finally, a three-dimensional network map model containing network assets, connection lines, and spatial relationships is generated using three-dimensional graphics rendering technology, different colors and shapes of 3D icons are used to represent different types of devices (blue cubes represent routers, green cylinders represent switches, and red spheres represent servers), dynamic light lines are used to represent data flow (light line thickness represents flow size, and color represents flow type), and finally a hierarchical and clear network spatial three-dimensional map model is formed.

[0036] Optionally, based on the spatial mapping relationship, the distribution of assets in the three-dimensional space is optimized, including: based on the network asset entity and its associated relationship graph, setting the attractive and repulsive force rules between the network asset entities (attractive force between assets with frequent communication, and repulsive force between unrelated assets), obtaining an initial force field distribution; based on the initial force field distribution, calculating the resultant force received by each network asset entity; adjusting the position of the network asset entity in the three-dimensional space according to the resultant force to obtain an optimized spatial position; when the spatial position of the network asset entity changes by less than a preset threshold, the optimization iteration is stopped, and finally a three-dimensional layout structure that meets both logical association and geographical distribution is formed. In the optimization process, geographical position constraints can be added to ensure that assets with clear geographical coordinates do not deviate from their actual physical positions; through multiple rounds of iterative optimization.

[0037] Exemplarily, the financial server xxx.xxx.x.xxx and the financial database xxx.xxx.x.xxx have strong attraction (with an attraction coefficient of 0.8) due to 50 SQL queries per second, while the financial system and the video monitoring system have repulsion (with a repulsion coefficient of 0.3) due to no business association; the direction and size of the resultant force acting on each asset are calculated, such as the financial server receiving an attraction vector F1(50, 30, 0) from the database direction and a repulsion vector F2(-20, -15, 0) from the monitoring system, and the resultant force is F(30, 15, 0), according to which the server is moved 15 meters in the northeast direction; the convergence condition is set, and when the position changes of all assets in the last 10 iterations are less than 2 meters, the algorithm iteration is stopped; the geographical position constraint is maintained to ensure that the Beijing headquarters core router is always located within a range of 50 meters around its coordinates, and the Shanghai branch equipment is kept in its coordinate area; through multiple iterations of optimization, the financial server and the database are finally optimized from an initial spatial distance of 200 meters to 50 meters, and the irrelevant monitoring equipment is pushed to 150 meters away to form a three-dimensional layout structure that meets the logical association and takes into account the geographical distribution.

[0038] Step S4, based on the network space three-dimensional map model, dynamically updating according to the accessed real-time data stream to obtain real-time network space situation data; Optionally, as Figure 5 shown, step S4 is based on the network space three-dimensional map model, dynamically updating according to the accessed real-time data stream to obtain real-time network space situation data, including: Step S4.1, real-time acquisition of network traffic, device state and security events to obtain real-time data stream; For example, through the Kafka message queue, NetFlow data (containing real-time traffic information from source IP xxx.xxx.x.xxx to target IP xx.x.x.xx) from the enterprise headquarters core router is received every second, the port state change (such as Gi0 / 1 / 1 port from UP to DOWN) of the switch SW-BJ-01 is obtained through the SNMP protocol, and the security alarm event (such as detection of port scanning behavior from external IP xxx.xx.xx.xx) is pushed by the SIEM system.

[0039] Step S4.2, based on the real-time data stream, updating the network space three-dimensional map model locally to obtain an updated map model; For example, when detecting that the financial server xxx.xxx.x.xxx newly establishes a connection with the cloud server xx.xx.xx.xxx, only the local area involving the two nodes is updated, and their spatial position relationship is recalculated, without affecting the rendering of the other thousands of device nodes in the network.

[0040] Optionally, based on the real-time data stream, a local update is performed on the network space three-dimensional map model to obtain an updated map model, including: (1) capturing new devices, connection changes and state update events according to the real-time data stream to obtain data change events; (2) identifying a changed network space region by using a hash comparison method based on the data change events, and performing a local recalculation on the changed network space region to obtain a local update result; and (3) obtaining the updated map model based on the local update result.

[0041] Exemplarily, the SNMP Trap message is listened to in real time through the WebSocket connection, and an event notification is triggered immediately when the Gi0 / 1 / 5 port state of the switch SW-SH-02 of the Shanghai branch changes from UP to DOWN; the hash comparison method is used to quickly identify the changed network region, and it is calculated that the device state hash value of the Beijing headquarters network segment xxx.xxx.x.x / 24 changes from “A5B2C3D4” to “A5B2C3E8”, and it is located that the change occurs in the network segment rather than the entire enterprise network; the local recalculation is performed on the changed region, and when the financial server xxx.xxx.x.xxx is newly connected with the cloud service xx.xx.xx.xxx, only the position relationship of the two nodes and their adjacent devices in the three-dimensional space is recalculated, and the device layout of the Shenzhen R&D center is not affected; multiple concurrent update requests are processed according to priorities, for example, the core router failure event is set to P1 priority for immediate processing, and the ordinary terminal device online event is set to P3 priority for queuing and waiting; and (5) the state update frequency of the same device is limited to no more than 5 times per second, and when the CPU usage rate of the Web server frequently fluctuates between 85%-95%, the icon color is prevented from rapidly flashing between yellow and red, and a 3-second average value is used for state judgment to ensure the stability of the visual display.

[0042] Step S4.3, based on the updated map model, the state identifier, connection relationship and spatial position of the asset in the three-dimensional map are updated in real time through dynamic rendering to obtain the real-time network space situation data.

[0043] Optionally, the state identifier, connection relationship and spatial position of the asset in the three-dimensional map are updated in real time through dynamic rendering, specifically including: adjusting the color and icon of the asset according to the real-time data change, and using different colors to represent the running state of the device (green for normal, yellow for alarm, and red for failure); real-time drawing and deleting connection lines, adding connection lines when a new communication connection is detected, and removing the corresponding connection lines when the communication is interrupted; dynamically adjusting the spatial coordinates of the asset, recalculating the asset position and smoothly moving to the new position when the network topology changes; using the frame buffer technology to ensure the smoothness of the rendering and avoid picture flickering caused by frequent updates; and setting the rendering priority to preferentially update the visual content of the current focus area of the user.

[0044] For example, when the CPU utilization of the Beijing headquarters web server xxx.xxx.x.xxx rises from 60% to 95%, its 3D icon color changes from green (normal) to red (fault) in real time, and the icon shape changes from a static cube to a flashing warning indicator; when a connection is detected between the financial server xxx.xxx.x.xxx and the newly deployed cloud backup service xx.xx.xx.xxx, a blue data flow connection line is immediately drawn; when a fault in the SW-SH-02 port of the Shanghai branch switch causes a connection interruption with the database server xx.xx.x.xxx, the corresponding connection line is automatically removed; when the Shenzhen R&D center adds... When firewall devices change the network topology, they recalculate the 3D coordinates of the affected devices and perform smooth movement animations. For example, a switch originally located at one coordinate is smoothly moved to a new coordinate to reflect the hierarchical structure change. When processing multiple device status updates simultaneously (such as 5 servers reporting alarms at the same time), all rendering calculations are completed in the background buffer before the display is refreshed all at once to avoid the flickering effect caused by the device icons changing color one by one. When a user is viewing the network status of the Beijing headquarters area, the visualization updates of devices in that area are processed first, while update tasks in the Shanghai and Shenzhen areas are queued with lower priority to ensure the real-time response performance of the areas the user is concerned about.

[0045] Step S5: Based on the real-time cyberspace situational data, obtain the cybersecurity risk assessment results through anomaly detection and threat identification.

[0046] Optionally, such as Figure 6 As shown, step S5, based on the real-time cyberspace situational data, obtains a cybersecurity risk assessment result through anomaly detection and threat identification, including: Step S5.1: Establish a baseline model of normal network behavior. Train the model using historical data to obtain normal characteristics of network traffic, device status, and connection mode, and obtain the network behavior baseline. Optionally, a baseline model of normal network behavior is established. This model is trained using historical data to obtain normal characteristics of network traffic, device status, and connection patterns, thus creating a network behavior baseline. Specifically, this includes: collecting at least 30 days of historical data as training samples; statistically analyzing key indicators such as peak traffic, device CPU and memory usage, and port connection count for each time period; calculating the mean and standard deviation of each indicator to establish a normal value range; identifying periodic patterns, such as traffic differences between weekdays and weekends, and changes in connection patterns between day and night; establishing a normal device status profile, recording typical operating parameters and performance indicators for various devices; creating a connection relationship whitelist, recording normal communication paths and frequency patterns between devices; and periodically updating the baseline model to adjust normal behavior standards according to changes in the network environment.

[0047] Step S5.2, based on the network behavior baseline, performing anomaly detection on the real-time cyberspace situation data to identify abnormal behaviors deviating from the normal baseline; Optionally, based on the network behavior baseline, performing anomaly detection on the real-time cyberspace situation data to identify abnormal behaviors deviating from the normal baseline, specifically including: monitoring network traffic indicators in real time, triggering an abnormal alarm when the traffic exceeds the normal interval range; monitoring changes in device state parameters, identifying abnormal fluctuations in CPU usage, memory occupancy, and other key indicators; detecting abnormal connection behaviors, finding a large number of connection requests or unauthorized device communications in non-normal time periods; analyzing traffic pattern changes, identifying data transmission behaviors that are significantly different from historical normal patterns; setting multi-level alarm thresholds, classifying anomalies into three levels of slight, moderate, and severe according to the degree of deviation; establishing an abnormal event record mechanism to save detailed information such as the time, location, type, and impact range of the abnormal occurrence.

[0048] Step S5.3, performing threat identification on the detected abnormal behaviors to determine whether they constitute a security threat and the threat level, obtaining a threat identification result; Optionally, performing threat identification on the detected abnormal behaviors to determine whether they constitute a security threat and the threat level, obtaining a threat identification result, specifically including: establishing a threat feature library to include known attack patterns and malicious behavior characteristics; matching the detected anomalies with the threat feature library to identify whether they belong to known threat types; analyzing the impact range and duration of the anomalies to assess their potential harm to network security; dividing the threat level into three levels of low, medium, and high according to the source of the anomaly, the importance of the target asset, and the impact range; manually reviewing anomalies that cannot be matched with known threats to update the threat feature library in a timely manner; generating a threat identification report to record the threat type, level, impacted assets, and recommended disposal measures.

[0049] Step S5.4, based on the threat identification result, identifying risk areas and threat paths in a visual manner on a three-dimensional map to obtain the network security risk assessment result.

[0050] Exemplarily, by analyzing the historical data of the headquarters of the enterprise in the past 90 days, the normal behavior pattern of the financial server xxx.xxx.x.xxx is determined: an average of 150MB of SQL query traffic is sent to the database server xxx.xxx.x.xx every hour during working hours from 9:00 to 18:00, the CPU usage is maintained in the interval of 30%-60%, and there is no direct communication with the external network. Then, the real-time data is analyzed for anomaly detection, and when it is monitored that the financial server suddenly sends 500MB of data to the external IP xxx.xx.xx.xx at 2:30 in the morning and the CPU usage soars to 95%, it is immediately identified as an abnormal behavior deviating from the normal baseline. Then, the detected anomaly is identified for threat, and it is found through the threat intelligence library matching that the target IP belongs to a known C&C server, and the data transmission characteristics conform to the data stealing mode in the APT attack, and it is judged as a high-level security threat. Finally, a risk assessment report is generated, the financial server is marked as a red high-risk node on the three-dimensional map, the suspicious transmission path to the outside is displayed with flashing red data flow lines, and the orange risk spread range is displayed in the Beijing headquarters area, providing visual decision support information for the security team, including attack timeline, affected asset list and emergency disposal suggestions.

[0051] Optionally, the network space mapping method further comprises: Step S6.1, collect historical network behavior data and security event data, and establish a time series feature library; Optionally, historical network behavior data and security event data are collected to establish a time series feature library, specifically including: extracting at least 90 days of historical traffic data, device state change records, and security alarm events from the network monitoring system, for example, collecting NetFlow data from January 1 to March 31, 2024 from the enterprise core router, recording the hourly traffic changes of the financial server xxx.xxx.x.xxx (peak of 800 Mbps on weekdays, only 100 Mbps on weekends), and the Web server state change records (CPU usage fluctuation from 30% to 85%) and firewall security alarm events (detected port scanning, malicious IP access, etc.); grouping the data according to the time dimension, and calculating the traffic peak, connection number change, and abnormal event frequency in units of hours, such as calculating the average traffic of Beijing headquarters during the period of 9:00-10:00 as 600 Mbps, the concurrent connection number as 1500, and the security alarm event as 3 times; extracting key time features, including the behavior difference between weekdays and non-weekdays (database query frequency of 200 times per hour on weekdays, and 50 times on weekends), traffic distribution pattern at different times (double peak of traffic at 9-11 am and 2-4 pm), and time aggregation of security events (malicious scanning mostly occurs at night from 22:00-6:00); establishing a multi-level time series structure to record network behavior patterns in short-term (hour level, such as hourly SQL query times of the financial system), medium-term (day level, such as daily total traffic and security event number), and long-term (week level, such as traffic decline pattern during system maintenance period of each week); constructing a feature label system to associate network behavior with corresponding security status, for example, marking "late-night large traffic out + CPU anomaly + multiple login failures" as "suspected APT attack", and marking "normal business traffic during working hours + stable device state" as "security status", forming a standardized time series feature library for model training.

[0052] Step S6.2. According to the time series feature library, a deep learning prediction model is trained to learn the time pattern and trend rule of network behavior. Optionally, according to the time series feature library, the deep learning prediction model is trained to learn the time pattern and trend rule of network behavior, specifically including: selecting an LSTM neural network as the prediction model architecture to capture the time dependence of network behavior using its memory capability; dividing the time series feature library into a training set and a validation set according to an 8:2 ratio to ensure the effectiveness of model training; setting a sliding time window to predict the state change of the future 4 hours using the network behavior data of the past 24 hours; optimizing the model parameters through a back propagation algorithm, and stopping training when the validation set error does not decrease for 10 consecutive rounds; establishing a model performance evaluation mechanism to evaluate the model effect using mean square error and prediction accuracy; periodically using new network behavior data to incrementally train the model to maintain the timeliness of the prediction ability.

[0053] Step S6.3, predicting the current network behavior according to the deep learning prediction model, integrating the prediction results into the network space three-dimensional map model, and displaying the possible future network state changes in the form of prediction trajectory and probability cloud; Optionally, first, the network space three-dimensional map model at the current time is taken as the base map; then the prediction results of the deep learning prediction model for the future 4 hours of the current network behavior, including the traffic mean and peak values of each network asset entity at 5 min granularity, the probability distribution of the three running states, and the possible new or removed connections, are projected onto the base map. Specifically, for each predicted logical connection, a Bézier curve is generated as a "prediction trajectory line" according to the physical coordinates of the two network asset entities, the color of the line is determined by the probability (dark gray low, light blue high), and the thickness of the line changes linearly with the predicted traffic; for each asset, a semi-transparent sphere "probability cloud" is drawn with the icon center as the origin, the radius is proportional to the failure probability, the color smoothly transitions between green-yellow-red, and an animation track of 4 hours is formed by scrolling forward along the time axis. During the whole process, all predicted geometric bodies are constrained by "geographic coordinates + logical layer height", ensuring that the network asset entities do not deviate from their real geographic fence by 50 m. In the rendering stage, a double buffering strategy of back-end one-time calculation and front-end overall refresh is adopted, and the update is performed in the order of user's current view frustum priority P1 and the rest of the area degradation P3, which not only guarantees the smoothness, but also continues the priority rules of the previous real-time situation display.

[0054] Step S6.4, processing the current network behavior according to the network security risk assessment results and the possible future network state changes.

[0055] Optionally, when the predicted trajectory is superimposed on the network space three-dimensional map model, the network security risk assessment result is fused with the future possible network state change, for example, if a network asset entity has been assessed as "high" in real time, the corresponding probability cloud is highlighted in red, and an additional red dashed line "emergency predicted trajectory" is drawn, directly showing the possible diffusion path of the threat. If the predicted trajectory overlaps with the real-time threat path and the probability exceeds the set threshold, a "isolation shield" 3D marker is automatically generated above the network asset entity icon, and the predicted trajectory line is changed to a "X" shaped cut-off symbol, prompting that ACL automatic blocking has been triggered; if the anomaly cannot match the known feature library, the network asset entity icon becomes a yellow question mark and a "manual review panel" pops up, and the review conclusion is written back to the training set in real time, providing samples for the next round of model incremental training.

[0056] Optionally, all disposal actions generate event version stamps in the "Action_v serial number_YYYYMMDD_HHMMSS" format and are written into a unified data version library; users can trace back to any event version through the "time playback slider" in the sidebar of the three-dimensional map to reproduce the network situation and prediction results at that time, meeting the post-audit needs. After 30 minutes of disposal execution, real-time data streams are collected again, the prediction error is compared, and the results are automatically included in the time series feature library, realizing the rolling closed loop of "prediction→disposal→verification→retraining".

[0057] As shown in Figure 7 The embodiment of the disclosure also provides a network space map surveying and mapping system based on multi-source data fusion, comprising: A data fusion processing unit 10 is configured to obtain a multi-source data set in a unified format by data preprocessing and standardization operation based on network traffic data, device information data and geographic location data; An entity correlation analysis unit 20 is configured to obtain a network asset entity and its correlation graph based on the multi-source data set in a unified format by entity recognition and correlation analysis; A three-dimensional map construction unit 30 is configured to obtain a network space three-dimensional map model by three-dimensional space mapping and visual rendering based on the network asset entity and its correlation graph; A situation updating unit 40 is configured to obtain real-time network space situation data by dynamic updating based on the network space three-dimensional map model according to the accessed real-time data stream; A security assessment unit 50 is configured to obtain a network security risk assessment result by anomaly detection and threat identification based on the real-time network space situation data.

[0058] Taking a corporate headquarters network environment as an example, the specific implementation process of each step is described in detail.

[0059] Assume that the enterprise has deployed network infrastructure in Beijing headquarters, Shanghai branch, and Shenzhen R&D center, and needs to build a unified network spatial map.

[0060] First, collect network traffic data. For example, traffic data captured from the core switch in Beijing headquarters shows that the source IP xxx.xxx.x.xxx (financial server) sent a large number of TCP 1433 port packets to the target IP xxx.xxx.x.xx (database server), with a traffic size of 500MB and a duration of 2 hours. Clean these raw data, remove duplicate and incorrect packets, and extract key information: IP addresses of both parties, port numbers, protocol types, traffic sizes, and timestamps. At the same time, obtain device information data from the network management system, such as the SNMP query result of switch SW-BJ-01 showing its model as Cisco Catalyst 9300, management IP as xxx.xxx.x.xxx, and port configuration containing 48 gigabit Ethernet ports. Geographical location data is obtained through GPS positioning and machine room records, and these different formats of data are uniformly converted into standard JSON format for storage.

[0061] Use multiple algorithms to identify network entities. For example, by analyzing device information and traffic data, identify that the financial server xxx.xxx.x.xxx is a physical server running Windows Server 2019, with MAC address 00:0C:29:A4:BC:DE, located in B2 cabinet of Beijing headquarters machine room. At the same time, find that there is a device with IP address xx.xx.x.xxx in the Shanghai branch, although the IP is different, but through deep packet detection, it is found that it has the same device fingerprint characteristics, and it is judged as the same server in different network segments. Through correlation analysis, build the dependency relationship between the financial server and the database server, find that the financial system synchronizes data to the database every day, forming a stable communication mode. These correlation relationships eventually form the asset correlation graph of the enterprise network.

[0062] Convert abstract network relationships into a three-dimensional map. First, according to the geographical location information, determine the positions of each site in the X-Y plane of the three-dimensional space: Beijing headquarters is located at a coordinate, Shanghai branch is located at a coordinate, and Shenzhen R&D center is located at a coordinate. Then, according to the network hierarchy distribution of devices, place them in the Z-axis (vertical direction), for example, core layer devices are placed at Z=100, aggregation layer devices are placed at Z=50, and access layer devices are placed at Z=0. The financial server, as a key business server, is placed at Z=80. Use force-directed algorithms to optimize device distribution, so that frequently communicating financial servers and database servers are relatively close in three-dimensional space, and finally generate a three-dimensional network map with clear hierarchy and clear relationships.

[0063] The timeliness of the map is maintained through continuous data updates. For example, when a new web server is added in the Shanghai branch, the real-time data collection interface immediately detects the new network activity: a new IP address xx.xx.x.xxx starts providing HTTP services externally. The incremental update algorithm analyzes this change, determines that a new node needs to be added in the three-dimensional map, and determines its position in space based on its communication relationship with existing devices. The dynamic rendering mechanism updates the map display accordingly, and the new web server appears in the Shanghai branch area with a green icon, showing the connection line between it and the load balancer. Users can see this change in real time, including detailed information about the new device and real-time traffic status.

[0064] The security risk assessment function provides proactive security protection. The established normal behavior baseline shows that the finance server usually communicates with the database server during working hours (9:00-18:00) with an average traffic of 100MB per hour. When the finance server is detected to send a large amount of data to an external IP address xxx.xx.xxx.xx at 2:00 in the morning, the anomaly detection algorithm immediately marks this behavior as abnormal. The threat identification model further analyzes and finds that the target IP belongs to a known malicious IP library, and the data transmission mode matches the characteristics of data leakage. This event is evaluated as a high-risk threat, and the finance server is marked with a red warning on the three-dimensional map, and the suspicious data flow path is displayed. At the same time, a security report is generated, detailing the time of abnormal behavior, involved devices, data flow direction, and threat level, providing a basis for rapid response for the security team.

[0065] As can be seen from this complete example, how the technical solution integrates scattered network data into a unified three-dimensional visual map, not only provides an intuitive network structure display, but also has the ability of real-time monitoring and security protection. Enterprise network administrators can quickly understand the topology of the entire network, device distribution and security status through this three-dimensional map, greatly improving the efficiency of network management and security operation.

[0066] The basic principles of the present disclosure are described above in conjunction with specific embodiments, but it should be noted that the advantages, advantages, effects, etc. mentioned in the present disclosure are only examples and not limitations, and these advantages, advantages, effects, etc. cannot be considered as the must-have of each embodiment of the present disclosure. In addition, the above specific details of the disclosure are only for the purpose of example and understanding, and are not limited to the above specific details. The above details do not limit the present disclosure to the above specific details.

[0067] In this disclosure, relational terms such as first and second and the like can be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. The block diagram of the devices, apparatus, equipment, systems referred to in this disclosure is merely illustrative and not intended to imply the necessity or arrangement of the connections, arrangement, configuration as shown in the block diagram. As will be appreciated by those skilled in the art, the devices, apparatus, equipment, systems can be connected, arranged, configured in any way. The words "comprising," "containing," "including," "having," and the like, are to be construed open-ended, meaning "including but not limited to," and are to be taken in their broadest context. The words "or" and "and" as used herein, mean "and / or," and are to be taken in their broadest context, unless the context clearly indicates otherwise. The word "comprising" as used herein, means "comprising but not limited to," and is to be taken in its broadest context.

[0068] Also, as used in this disclosure, "or" as used in the context of items A and B as "at least one of A or B" indicates a disjunction, such that, for example, a disjunction of "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "example" is not meant to convey that a described example is preferred or better than other examples.

[0069] It is also important to note that the systems and methods of the disclosure can be embodied in a variety of forms including, but not limited to, a data processor, a computer program product, a computer, one or more tangible computer readable storage devices, one or more computer-implemented methods, information, or a propagated signal. It is also intended that the systems and methods can be embodied in software-implemented instructions, which can be programmed into a computer and executed to perform the methods.

[0070] Various changes, modifications and improvements in the technologies described herein can be made without departing from the teachings of the teachings defined by the appended claims. Moreover, the scope of the claims of this disclosure is not limited to the specific aspects described above. The processes, machines, manufactures, compositions of matter, means, methods, or steps, described herein can be substituted with other processes, machines, manufactures, compositions of matter, means, methods, or steps that achieve the same result in substantially the same way. Accordingly, the appended claims include within their scope such processes, machines, manufactures, compositions of matter, means, methods, or steps.

[0071] The above description of the disclosed aspects is meant to be illustrative only and not limiting as to the scope of the disclosure. Many variations of these aspects, as well as alternate aspects, can be made without departing from the scope of the present disclosure. Other aspects of the disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the aspects disclosed herein. Therefore, it is intended that the disclosure not be limited to the aspects disclosed herein, but include all aspects falling within the scope of the appended claims and their equivalents.

[0072] The foregoing description has been presented for the purposes of illustration and description. Furthermore, the description is not intended to limit the embodiments of the disclosure to the forms disclosed herein. Although the various example aspects and embodiments have been described herein with regard to particular aspects and embodiments, those skilled in the art will recognize that certain modifications, changes, substitutions, additions and sub-combinations can be made without departing from the spirit of the disclosure.

Claims

1. A network space mapping method based on multi-source data fusion, characterized in that, Comprise: Based on network traffic data, device information data and geographic location data, through data preprocessing and standardization operation, obtain the uniform format of multi-source data set; Based on the uniform format of multi-source data set, through entity recognition and correlation analysis, obtain the network asset entity and its correlation graph; Based on the network asset entity and its correlation graph, through three-dimensional space mapping and visualization rendering, obtain the network space three-dimensional map model; Based on the network space three-dimensional map model, according to the access of real-time data stream, dynamic update, obtain real-time network space situation data; Based on the real-time network space situation data, through abnormal detection and threat identification, obtain network security risk assessment result.

2. The cyber map mapping method of claim 1, wherein, Based on network traffic data, device information data and geographic location data, through data preprocessing and standardization operation, obtain the uniform format of multi-source data set, including: For the network traffic data, remove redundant and error data packet information and extract key five tuple information and traffic characteristic parameter, get the standardized traffic data; For the device information data, standardization processing unifies the device identifier format and establishes the standardized description mode of device attribute, gets the standardized device data; For the geographic location data, coordinate system conversion is carried out to unify different sources of geographic coordinates to standard geographic coordinate system, and the standardized geographic data is obtained; The standardized traffic data, the standardized device data and the standardized geographic data are organized and stored according to the pre-defined data structure, and the uniform format of multi-source data set is obtained.

3. The cyber map mapping method of claim 1, wherein, Based on the uniform format of multi-source data set, through entity recognition and correlation analysis, obtain the network asset entity and its correlation graph, including: Based on the uniform format of multi-source data set, identify independent network asset entity, get network asset entity list; Based on the network asset entity list, through IP address matching, MAC address association and device fingerprint identification, the mapping relationship of the same entity in different data sources is established, and the entity mapping relationship table is obtained; Based on the entity mapping relationship table, network traffic data, analyze the communication relationship between network asset entities, identify the connection topology and dependency relationship between network asset entities, and obtain the correlation graph of the network asset entity.

4. The cyber map mapping method of claim 1, wherein, Based on the network asset entity and its correlation graph, through three-dimensional space mapping and visualization rendering, obtain the network space three-dimensional map model, including: According to the geographic location information, determine the physical coordinate position of the network asset entity in the three-dimensional space, get the entity space coordinate table; Based on the entity space coordinate table, calculate the logical distance and hierarchical relationship between network asset entities, establish the mapping association of logical structure and physical space, get the space mapping relationship; Based on the space mapping relationship, optimize the distribution of assets in three-dimensional space, and carry out three-dimensional graphic rendering, get the network space three-dimensional map model.

5. The cyber map mapping method of claim 1, wherein, Based on the network space three-dimensional map model, according to the access of real-time data stream, dynamic update, obtain real-time network space situation data, including: Real-time network traffic, device status and security events are obtained to obtain real-time data streams; Based on the real-time data streams, the network space three-dimensional map model is locally updated to obtain an updated map model; Based on the updated map model, the state identifier, connection relationship and spatial position of assets in the three-dimensional map are dynamically rendered and updated in real time to obtain the real-time network space situation data.

6. The cyber map mapping method of claim 1, wherein, Based on the real-time network space situation data, abnormal detection and threat identification are performed to obtain network security risk assessment results, including: A baseline model of normal network behavior is established, and normal features of network traffic, device status and connection mode are obtained by training historical data to obtain a network behavior baseline; Based on the network behavior baseline, the real-time network space situation data is subjected to abnormal detection to identify abnormal behaviors deviating from the normal baseline; The detected abnormal behaviors are subjected to threat identification to determine whether they constitute a security threat and the threat level, and a threat identification result is obtained; Based on the threat identification result, the risk area and threat path are identified in a visual manner on the three-dimensional map to obtain the network security risk assessment result.

7. The cyber map mapping method of claim 4, wherein, Based on the spatial mapping relationship, the distribution of assets in three-dimensional space is optimized, including: Based on the network asset entity and its associated relationship graph, the attraction and repulsion rules between network asset entities are set to obtain an initial force field distribution; Based on the initial force field distribution, the resultant force acting on each network asset entity is calculated; The position of the network asset entity in the three-dimensional space is adjusted according to the resultant force to obtain an optimized spatial position; When the spatial position of the network asset entity changes by less than a preset threshold, the optimization iteration is stopped.

8. The cyber map mapping method of claim 5, wherein, Based on the real-time data streams, the network space three-dimensional map model is locally updated to obtain an updated map model, including: According to the real-time data streams, new devices, connection changes and state update events are captured to obtain data change events; Based on the data change events, a hash comparison method is used to identify the network space area where changes have occurred, and local recalculation is performed for the network space area where changes have occurred to obtain a local update result; Based on the local update result, an updated map model is obtained.

9. The cyber map mapping method of claim 1, wherein, Further comprising: Collecting historical network behavior data and security event data to establish a time series feature library; According to the time series feature library, a deep learning prediction model is trained to learn the time pattern and trend of network behavior; According to the deep learning prediction model, the current network behavior is predicted, and the prediction result is integrated into the network space three-dimensional map model to display the possible future network state changes in the form of prediction trajectory and probability cloud; According to the network security risk assessment result and the possible future network state changes, the current network behavior is processed. 10.A network space map surveying system based on multi-source data fusion, characterized in that, It includes: A data fusion processing unit is used to obtain a unified format multi-source data set based on network traffic data, device information data and geographic location data through data preprocessing and standardization operations; An entity association analysis unit is used to obtain a network asset entity and its associated relationship graph based on the unified format multi-source data set through entity recognition and association analysis; A three-dimensional map construction unit is configured to obtain a cyber space three-dimensional map model by three-dimensional space mapping and visual rendering based on the network asset entity and its correlation graph; A situation updating unit is configured to obtain real-time cyber space situation data by dynamic updating according to the accessed real-time data stream based on the cyber space three-dimensional map model; A security evaluation unit is configured to obtain a network security risk evaluation result by anomaly detection and threat identification based on the real-time cyber space situation data.

Images