Network security situation assessment method based on data mining

Abstract

The invention belongs to the technical field of security situation assessment, and particularly relates to a network security situation assessment method based on data mining, which comprises the following steps of: constructing a multi-source network security knowledge base, analyzing an unstructured security document through a natural language processing technology, and determining the security situation based on equipment identification information input by a user. The method comprises the following steps: associating a knowledge base to match check items of target equipment, mining and analyzing historical check records based on a time sequence, generating a network security situation trend graph, dynamically evaluating the security state of the equipment, outputting a quantitative score report containing compliance items, risk items and improvement suggestions, automatically analyzing security documents through an NLP technology, reducing the manual maintenance cost, and improving the security of the equipment. The device type and the baseline rule are intelligently matched in combination with a large model, the checking time is shortened by more than 90%, meanwhile, a high-frequency violation configuration combination is discovered by adopting an association rule, the risk identification precision is improved, and a potential attack path is predicted by utilizing LSTM to realize active defense.

Description

Technical Field

[0001] This invention relates to the field of security situation assessment technology, specifically a network security situation assessment method based on data mining. Background Technology

[0002] Currently, network security operations and maintenance face the following challenges:

[0003] Equipment configuration verification is inefficient: Traditional manual verification methods rely on the experience of operation and maintenance personnel. When facing switches and firewalls from different manufacturers and models, it is necessary to manually compare the security baseline requirements, which is time-consuming and prone to errors.

[0004] Security posture assessment lacks intelligence: existing tools are mostly based on static rule matching, which cannot dynamically analyze the associated risks between device configurations and make it difficult to predict potential security threats;

[0005] Knowledge management is fragmented: security baseline rules, vulnerability databases, and threat intelligence are scattered across different systems, lacking a unified knowledge base to support intelligent decision-making;

[0006] Insufficient historical data analysis: Most systems only record the verification results and do not use data mining techniques to analyze long-term trends, making it difficult to provide proactive defense suggestions;

[0007] Although some automated verification tools have been implemented, the following issues still exist:

[0008] The verification rules are outdated and cannot adapt to new devices or vulnerabilities.

[0009] Lacking natural language processing capabilities, it struggles to parse unstructured secure documents;

[0010] The assessment results were presented in a single way, without combining quantitative scoring and visual analysis. Summary of the Invention

[0011] The purpose of this section is to outline some aspects of the embodiments of the present invention and to briefly describe some preferred embodiments. Simplifications or omissions may be made in this section, as well as in the abstract and title of this application, to avoid obscuring the purpose of these documents; however, such simplifications or omissions should not be construed as limiting the scope of the invention.

[0012] Therefore, the purpose of this invention is to provide a network security situation assessment method based on data mining. It automatically parses security documents using NLP technology, reducing manual maintenance costs. It combines large-scale models to intelligently match device types with baseline rules, shortening the verification time by more than 90%. At the same time, it uses association rules to discover high-frequency illegal configuration combinations, improving the accuracy of risk identification, and uses LSTM to predict potential attack paths, achieving proactive defense.

[0013] To address the aforementioned technical problems, according to one aspect of the present invention, the present invention provides the following technical solution:

[0014] A network security posture assessment method based on data mining includes the following steps:

[0015] S1. Construct a multi-source network security knowledge base, integrating the device baseline rule base, historical vulnerability base, and real-time threat intelligence base. The device baseline rule base shall at least include the security baseline requirements of the management information system and the vendor-specific configuration templates for switches and firewalls.

[0016] S2. Parse unstructured security documents using natural language processing technology, automatically extract the mapping relationship between device type, manufacturer, model and baseline rules, and generate an executable verification instruction set;

[0017] S3. Based on the device identification information input by the user, match the verification items of the target device with the knowledge base, log in to the device through the automated protocol and send the verification command;

[0018] S4. Use data mining algorithms to extract features from the configuration data returned by the device, including:

[0019] Based on association rules, analyze the dependencies between configuration items;

[0020] Clustering algorithms are used to identify abnormal configuration patterns;

[0021] S5. Dynamically assess the safety status of equipment and output a quantitative scoring report that includes compliance items, risk items, and improvement suggestions;

[0022] S6. Based on time series mining and analysis of historical verification records, generate a network security situation trend map.

[0023] As a preferred embodiment of the network security situation assessment method based on data mining described in this invention, the device identification information includes IP address, device name, or hierarchical location information in the device tree, and the system realizes topology visualization retrieval through a pre-set device management module.

[0024] As a preferred embodiment of the network security situation assessment method based on data mining described in this invention, the automated protocol login includes network device login via SSH / Telnet protocol and secure device access via API calls, and the login credentials are transmitted through an encrypted channel.

[0025] As a preferred embodiment of the network security situation assessment method based on data mining described in this invention, the method includes: using the Apriori algorithm to discover high-frequency illegal configuration combinations, using DBSCAN clustering to detect configuration clusters that deviate from the normal baseline, and applying LSTM neural networks to predict potential attack paths caused by configuration defects.

[0026] As a preferred embodiment of the network security situation assessment method based on data mining described in this invention, the quantitative scoring report generation process includes: constructing a baseline item weight system based on the analytic hierarchy process, performing weighted calculations on risk items in conjunction with CVSS vulnerability scores, and outputting an interactive matrix report with color coding.

[0027] As a preferred embodiment of the network security situation assessment method based on data mining described in this invention, the situation trend map includes:

[0028] Baseline compliance rate change curves predicted by the Prophet algorithm;

[0029] Cross-device associated risk propagation paths identified through social network analysis;

[0030] A visual attack surface heatmap that incorporates threat intelligence.

[0031] As a preferred embodiment of the network security situation assessment method based on data mining described in this invention, step S6 includes a prompt word optimization module. The prompt word optimization module analyzes user operation logs to mine high-frequency verification scenarios, automatically generates preset verification instruction templates and associates them with device type tags, and supports the conversion of voice input into standardized verification instructions.

[0032] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0033] 1. Automation and intelligence improve efficiency: Automatically parse security documents using NLP technology to reduce manual maintenance costs;

[0034] By combining large-scale models with intelligent matching of device types and baseline rules, the verification time can be reduced by more than 90%.

[0035] 2. Enhanced analytical capabilities through multi-dimensional data mining: Utilizing association rules to discover frequently violated configuration combinations, thereby improving the accuracy of risk identification;

[0036] Based on clustering to identify abnormal configuration patterns, the false alarm rate is reduced;

[0037] LSTM is used to predict potential attack paths, enabling proactive defense.

[0038] 3. Dynamic quantitative assessment and visualization: Combines AHP (Analytic Hierarchy Process) to generate equipment safety scores, providing objective decision-making basis;

[0039] The changes in the security situation are intuitively displayed through interactive heatmaps and trend curves;

[0040] 4. Historical data-driven predictive capabilities: Employing the Prophet algorithm to predict future compliance rate changes, assisting in operation and maintenance planning;

[0041] Identify cross-device risk propagation based on social network analysis and optimize security strategies. Attached Figure Description

[0042] To more clearly illustrate the technical solutions of the embodiments of the present invention, the present invention will be described in detail below with reference to the accompanying drawings and detailed embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein:

[0043] Figure 1 This is a flowchart illustrating the steps of the security situation assessment method of the present invention. Detailed Implementation

[0044] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0045] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0046] Secondly, the present invention is described in detail with reference to the schematic diagrams. When detailing the embodiments of the present invention, for ease of explanation, the cross-sectional views illustrating the device structure may be partially enlarged, not according to the usual scale. Furthermore, the schematic diagrams are merely examples and should not limit the scope of protection of the present invention. In addition, actual fabrication should include three-dimensional spatial dimensions of length, width, and depth.

[0047] To make the objectives, technical solutions, and advantages of the present invention clearer, the embodiments of the present invention will be described in further detail below with reference to the accompanying drawings.

[0048] This invention provides a network security situation assessment method based on data mining. It automatically parses security documents using NLP technology, reducing manual maintenance costs. Combined with a large-scale model for intelligent matching of device types and baseline rules, it shortens verification time by over 90%. Furthermore, it employs association rules to discover high-frequency illegal configuration combinations, improving risk identification accuracy, and utilizes LSTM to predict potential attack paths, achieving proactive defense. Please refer to [link to relevant documentation]. Figure 1 This includes the following steps:

[0049] S1. Construct a multi-source network security knowledge base, integrating the device baseline rule base, historical vulnerability base, and real-time threat intelligence base. The device baseline rule base shall at least include the security baseline requirements of the management information system and the vendor-specific configuration templates for switches and firewalls.

[0050] S2. Parse unstructured security documents using natural language processing technology, automatically extract the mapping relationship between device type, manufacturer, model and baseline rules, and generate an executable verification instruction set;

[0051] S3. Based on the device identification information input by the user, match the verification items of the target device with the knowledge base, log in to the device through the automated protocol and send the verification command;

[0052] S4. Use data mining algorithms to extract features from the configuration data returned by the device, including:

[0053] Based on association rules, analyze the dependencies between configuration items;

[0054] Clustering algorithms are used to identify abnormal configuration patterns;

[0055] S5. Dynamically assess the safety status of equipment and output a quantitative scoring report that includes compliance items, risk items, and improvement suggestions;

[0056] S6. Based on time series mining and analysis of historical verification records, generate a network security situation trend map;

[0057] Device identification information includes IP address, device name, or hierarchical location information in the device tree. The system enables topology visualization retrieval through a pre-built device management module.

[0058] Automated protocol login includes network device login via SSH / Telnet protocol and secure device access via API call, with login credentials transmitted through an encrypted channel;

[0059] The data mining algorithms specifically include: using the Apriori algorithm to discover high-frequency non-compliant configuration combinations, using DBSCAN clustering to detect configuration clusters that deviate from the normal baseline, and applying LSTM neural networks to predict potential attack paths caused by configuration defects;

[0060] The quantitative scoring report generation process includes: constructing a baseline item weight system based on the analytic hierarchy process, combining CVSS vulnerability scores to perform weighted calculations on risk items, and outputting an interactive matrix report with color coding;

[0061] The situation trend map includes:

[0062] Baseline compliance rate change curves predicted by the Prophet algorithm;

[0063] Cross-device associated risk propagation paths identified through social network analysis;

[0064] A visualized attack surface heatmap incorporating threat intelligence;

[0065] Step S6 includes a prompt word optimization module. This module analyzes user operation logs to identify high-frequency verification scenarios, automatically generates preset verification instruction templates and associates them with device type tags, and supports the conversion of voice input into standardized verification instructions.

[0066] Example 1: Automated security baseline verification based on data mining:

[0067] System Architecture: The network security situation assessment system in this embodiment includes the following core modules:

[0068] Knowledge base construction module: stores security baseline rules, device configuration templates, vulnerability databases, and threat intelligence;

[0069] NLP parsing engine: Automatically parses documents such as "Security Baseline Requirements for Management Information Systems" and extracts key verification items;

[0070] Intelligent verification engine: Based on the DeepSeek large model, it matches device types and verification rules to generate executable instructions;

[0071] Data mining and analysis module: Uses algorithms such as Apriori and DBSCAN to analyze configuration data;

[0072] Situation assessment dashboard: Visually displays compliance rate, risk trends, and improvement suggestions.

[0073] 2. Implementation steps:

[0074] Device login and data acquisition:

[0075] Users enter the target switch IP address in the "Device Management" interface and select the SSH protocol to log in;

[0076] The system automatically matches the device manufacturer and loads the corresponding baseline rules from the knowledge base (such as "password complexity must include uppercase and lowercase letters").

[0077] Automated verification execution:

[0078] Send verification commands to the device via SSH and retrieve configuration return data;

[0079] Data mining analysis:

[0080] Association rule mining: We found that "weak passwords" often appear together with "ACL not enabled" (support >70%).

[0081] Anomaly detection: DBSCAN clustering identified 3 devices whose configurations deviated from the normal mode (e.g., Telnet was not disabled);

[0082] Dynamic scoring and report generation:

[0083] The weights are calculated based on the AHP algorithm (e.g., password security accounts for 30%), and the overall score (85 / 100) is output.

[0084] Working principle: When in use, this invention automatically parses security documents through NLP technology, reducing manual maintenance costs. It combines large models to intelligently match device types with baseline rules, shortening the verification time by more than 90%. At the same time, it uses association rules to discover high-frequency illegal configuration combinations, improving the accuracy of risk identification, and uses LSTM to predict potential attack paths, achieving proactive defense.

[0085] The Prophet algorithm is used to predict future compliance rate changes, assisting in operation and maintenance planning, and social network analysis is used to identify cross-device risk propagation and optimize security strategies.

[0086] Although the present invention has been described above with reference to embodiments, various modifications can be made and components can be replaced with equivalents without departing from the scope of the invention. In particular, as long as there is no structural conflict, the features in the disclosed embodiments can be combined with each other in any manner. The lack of an exhaustive description of these combinations in this specification is merely for the sake of brevity and resource conservation. Therefore, the present invention is not limited to the specific embodiments disclosed herein, but includes all technical solutions falling within the scope of the claims.

Claims

1. A network security situation assessment method based on data mining, characterized in that, Includes the following steps: S1. Construct a multi-source network security knowledge base, integrating the device baseline rule base, historical vulnerability base, and real-time threat intelligence base. The device baseline rule base shall at least include the security baseline requirements of the management information system and the vendor-specific configuration templates for switches and firewalls. S2. Parse unstructured security documents using natural language processing technology, automatically extract the mapping relationship between device type, manufacturer, model and baseline rules, and generate an executable verification instruction set; S3. Based on the device identification information input by the user, match the verification items of the target device with the knowledge base, log in to the device through the automated protocol and send the verification command; S4. Use data mining algorithms to extract features from the configuration data returned by the device, including: Based on association rules, analyze the dependencies between configuration items; Clustering algorithms are used to identify abnormal configuration patterns; S5. Dynamically assess the safety status of equipment and output a quantitative scoring report that includes compliance items, risk items, and improvement suggestions; S6. Based on time series mining and analysis of historical verification records, generate a network security situation trend map.

2. The network security situation assessment method based on data mining according to claim 1, characterized in that, The device identification information includes IP address, device name, or hierarchical location information in the device tree. The system realizes topology visualization retrieval through a pre-set device management module.

3. The network security situation assessment method based on data mining according to claim 1, characterized in that, The automated protocol login includes network device login via SSH / Telnet protocol and secure device access via API call, with login credentials transmitted through an encrypted channel.

4. The network security situation assessment method based on data mining according to claim 1, characterized in that, The data mining algorithms specifically include: using the Apriori algorithm to discover high-frequency illegal configuration combinations, using DBSCAN clustering to detect configuration clusters that deviate from the normal baseline, and applying LSTM neural networks to predict potential attack paths caused by configuration defects.

5. The network security situation assessment method based on data mining according to claim 1, characterized in that, The quantitative scoring report generation process includes: constructing a baseline item weight system based on the analytic hierarchy process, performing weighted calculations on risk items in conjunction with CVSS vulnerability scores, and outputting an interactive matrix report with color coding.

6. The network security situation assessment method based on data mining according to claim 1, characterized in that, The situation trend map includes: Baseline compliance rate change curves predicted by the Prophet algorithm; Cross-device associated risk propagation paths identified through social network analysis; A visual attack surface heatmap that incorporates threat intelligence.

7. The network security situation assessment method based on data mining according to claim 1, characterized in that, Step S6 includes a prompt word optimization module. This module analyzes user operation logs to identify high-frequency verification scenarios, automatically generates preset verification instruction templates and associates them with device type tags, and supports the conversion of voice input into standardized verification instructions.

Images