Security analysis method based on network flow data

Abstract

The invention discloses a security analysis method based on network traffic data, which comprises the following steps of: S1, constructing a digital twin model for a target network entity; s2, in the digital twinborn model, simulating a network attack according to a given network attack program; s3, collecting network flow data of the digital twin model, monitoring network abnormal information, performing network security analysis to obtain a network risk level, and constructing a data sample by using the network flow data and the network risk level to form a sample data set; s4, constructing a network risk level prediction model through a BP neural network, and training the network risk level prediction model by using the sample data set to obtain a trained network risk level prediction model; and S5, in the operation process of the target network entity, collecting network flow data of the target network entity, and predicting a network risk level. According to the method, the security risk caused by the network attack can be actually measured on the basis of a digital twinning mode, and the operation of a real network entity is not influenced.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, and in particular to a security analysis method based on network flow data. BACKGROUND

[0002] The development of Internet technology has brought great convenience to people's life, but the network security problem has become increasingly prominent; at present, various network entities in the running process may be subject to network attacks, causing privacy leakage, node delay rising, node permission being changed, and even node paralysis, making the whole network entity difficult to run, etc.; therefore, timely monitoring of network attacks is particularly important. However, the current network security monitoring or prevention scheme can only deal with known network attack types, and once a new network attack method appears, since network attack testing cannot be performed in the actual running network entity, the security risk level it can bring cannot be known, making it difficult to flexibly adopt different processing measures. SUMMARY

[0003] The present application aims to overcome the shortcomings of the prior art and provide a security analysis method based on network flow data, which can measure the security risks brought by network attacks in a digital twinning manner and will not affect the operation of the real network entity.

[0004] The purpose of the present application is achieved by the following technical scheme: a security analysis method based on network flow data, comprising the following steps: S1. For a target network entity, a digital twin model is constructed; S2. Given a plurality of types of network attack programs, simulate network attacks according to the given network attack programs in the digital twin model; S3. Under no network attack and each given network attack program, network flow data of the digital twin model is collected, network anomaly information is monitored, network security analysis is performed according to the network anomaly information, network risk level is obtained, data samples are constructed using network flow data and network risk level, and sample data set is formed; S4. A network risk level prediction model is constructed by BP neural network, and the network risk level prediction model is trained using the sample data set to obtain a trained network risk level prediction model; S5. In the running process of the target network entity, network flow data of the target network entity is collected and input into the trained network risk level prediction model to predict the network risk level, thereby realizing security analysis based on network flow data.

[0005] The method has the beneficial effects that: the method can measure the security risks caused by network attacks in a digital twinning manner, and does not affect the operation of the real network entity; and the method combines artificial analysis and a neural network, obtains a network risk level according to network abnormal information by using artificial analysis, combines the network risk level with network traffic data, trains a network risk level prediction model, and after the training is completed, the network risk level prediction model can be used to predict the real network entity, so that network abnormal information that is inconvenient to detect is converted into network traffic data for security analysis, and the efficiency of network security analysis is improved. BRIEF DESCRIPTION OF DRAWINGS

[0006] Figure 1 The method flowchart of the application. DETAILED DESCRIPTION

[0007] The technical solutions of the application will be described in further detail below with reference to the accompanying drawings, but the protection scope of the application is not limited to the following description.

[0008] As shown in Figure 1 a security analysis method based on network traffic data, characterized in that: comprising the following steps: S1. For a target network entity, a digital twinning model is constructed; The step S1 comprises: According to the network topology of the target network entity, the internal architecture, programs, protocols, permissions of each node of the target entity network, and the connection relationship and protocol between each node in the target network entity, a digital twinning model of the target entity network is constructed in a 1:1 ratio, so that the constructed digital twinning model is completely consistent with the target entity network, and the digital twinning model and the target entity network are assigned the same task.

[0009] S2. Given a plurality of types of network attack programs, in the digital twinning model, network attacks are simulated according to the given network attack programs; S3. Under no network attack and each given network attack program, network traffic data of the digital twinning model is collected, and network abnormal information is monitored, network security analysis is performed according to the network abnormal information, a network risk level is obtained, and data samples are constructed by using the network traffic data and the network risk level, forming a sample data set; The step S3 comprises: S301. When there is no network attack, network traffic data of the digital twinning model is collected, and network abnormal information is monitored, and the collection time is t; under each given network attack program, network traffic data of the digital twinning model is collected, and corresponding network abnormal information is monitored, and the collection time is t; S302. According to the network anomaly information, manually classify the network risk level, including: no risk, low risk, medium risk and high risk; S303. For any one piece of collected network traffic data, according to the network risk level obtained by classifying the corresponding network anomaly information, add a label to the network traffic data, when there is no risk, the label is 0; when there is low risk, the label is 1; when there is medium risk, the label is 2; when there is high risk, the label is 3; S304. Repeat step S303 for all collected network traffic data to obtain a sample data set.

[0010] The network anomaly information includes: The number of privacy data leaks, that is, the number of privacy data stolen by the network attack program from the digital twin model; Node permission anomaly, characterized by the number of modified node permissions in the digital twin model; Node paralysis, characterized by the number of node paralyses in the digital twin model; Node running speed anomaly, the delay of node running in the digital twin model is obtained by statistics; Data packet signature anomaly, characterized by the number of data packet signature errors in the digital twin model.

[0011] The network traffic data includes: the throughput of each node and the traffic composition of the transmission path between nodes to form a network traffic topology graph.

[0012] S4. Construct a network risk level prediction model through a BP neural network, and train the network risk level prediction model using the sample data set to obtain a trained network risk level prediction model; The step S4 includes: Construct a network risk level prediction model through a BP neural network; For each piece of network traffic data in the sample data set, take it as the input of the network risk level prediction model, and take the corresponding label as the expected output, and train the network risk level prediction model; After all the network traffic data is trained, a trained network risk level prediction model is obtained.

[0013] S5. In the running process of the target network entity, collect the network traffic data of the target network entity, input the trained network risk level prediction model, predict the network risk level, and realize security analysis based on network traffic data.

[0014] The application considers that network attack experiments in real network entities will cause damage to the network entities, based on the digital twinning mode, the security risks brought by network attacks are measured, and the operation of the real network entity is not affected, which is convenient for testing new network attacks; and considering that it is difficult to directly extract network anomaly data, for example, node permission anomaly, node paralysis, node running speed anomaly, data packet signature anomaly statistics are difficult, and privacy data leakage is more accurate from the perspective of the attacker, the network traffic data and the network anomaly data are correspondingly and ingeniously obtained, and the abnormal data of different angles can be obtained from the digital twinning model and the attacker at the same time in the training process for level judgment, and the risk level is associated with the network traffic data; the network risk level prediction model is trained, when the real network entity is analyzed, only the network traffic data needs to be extracted to analyze the risk level, so that different measures can be taken in time according to the risk level, and since some network attacks may be defended by the network entity itself, when the risk level is low, measures are not needed, therefore, the application does not need to know the network attack type, and only the risk level needs to be obtained.

[0015] The above description shows and describes one preferred embodiment of the application, but as previously discussed, it is to be understood that the application is not limited to the form disclosed herein, but is to be accorded the full scope that the principles and novel features thereof warrant, and that metes and bounds are to be expressed by the limitations of the narrowest patent claims that can be drafted as follows:

Claims

1. A security analysis method based on network traffic data, characterized in that: Includes the following steps: S1. For the target network entity, construct a digital twin model; S2. Given multiple types of network attack programs, simulate network attacks in a digital twin model according to the given network attack programs; S3. In the absence of network attacks and under each given network attack program, collect network traffic data of the digital twin model, monitor network anomaly information, conduct network security analysis based on network anomaly information, obtain network risk level, and construct data samples using network traffic data and network risk level to form a sample dataset. S4. Construct a network risk level prediction model using a BP neural network, and train the network risk level prediction model using a sample dataset to obtain a trained network risk level prediction model. S5. During the operation of the target network entity, collect network traffic data of the target network entity, input it into the trained network risk level prediction model, predict the network risk level, and realize security analysis based on network traffic data.

2. The security analysis method based on network traffic data according to claim 1, characterized in that: Step S1 includes: Based on the network topology of the target network entity, the internal architecture, programs, protocols, permissions of each node in the target network entity, as well as the connection relationships and protocols between the nodes in the target network entity, a digital twin model of the target network entity is constructed at a 1:1 scale, so that the constructed digital twin model is completely consistent with the target network entity, and the same tasks are assigned to the digital twin model and the target network entity.

3. The security analysis method based on network traffic data according to claim 1, characterized in that: Step S3 includes: S301. In the absence of network attacks, collect network traffic data of the digital twin model and monitor network anomaly information for a collection time of t; under each given network attack program, collect network traffic data of the digital twin model and monitor the corresponding network anomaly information for a collection time of t. S302. Based on network anomaly information, manually classify the network risk level, including: no risk, low risk, medium risk and high risk; S303. For any piece of collected network traffic data, add a label to the network traffic data according to the network risk level obtained by classifying the corresponding network anomaly information. When there is no risk, the label is 0; when there is low risk, the label is 1; when there is medium risk, the label is 2; and when there is high risk, the label is 3. S304. Repeat step S303 for all collected network traffic data to obtain a sample dataset.

4. The security analysis method based on network traffic data according to claim 3, characterized in that: The network anomaly information includes: The number of privacy data breaches refers to the number of privacy data items stolen from a digital twin model by a cyberattack program. Abnormal node permissions are characterized by the number of modified node permissions in the digital twin model. Node paralysis is characterized by the number of paralyzed nodes in a statistical digital twin model; The node's running speed is abnormal, which can be obtained by statistically analyzing the latency of the node's operation in the digital twin model; Packet signature anomalies are characterized by the number of packet signature errors in a statistical digital twin model.

5. A security analysis method based on network traffic data according to claim 3, characterized in that: The network traffic data includes: the throughput of each node and the traffic of the transmission paths between nodes, forming a network traffic topology.

6. The security analysis method based on network traffic data according to claim 1, characterized in that: Step S4 includes: A network risk level prediction model was constructed using a BP neural network. For each piece of network traffic data in the sample dataset, it is used as the input to the network risk level prediction model, and the corresponding label is used as the expected output to train the network risk level prediction model. Once all network traffic data has been trained, a well-trained network risk level prediction model is obtained.

Images