Host vulnerability scanning security protection system under flexible gray measurement

Abstract

The invention discloses a host vulnerability scanning security protection system under flexible gray measurement and calculation, and relates to the technical field of vulnerability detection. Obtaining the log data packet and importing the log data packet into a preset anomaly detection model to obtain an anomaly detection score; different data sets are obtained through division according to the anomaly detection threshold value; the data set comprises an abnormal data set, a fuzzy data set and a normal data set; performing a preliminary exception division module and a target exception division module on the fuzzy set to obtain a target exception data packet set; merging the target abnormal data packet set into an abnormal data set to extract a data log packet of an abnormal level, querying a preset script library to obtain a corresponding test script, and executing the test script to generate a corresponding test case; and executing the test case to detect vulnerabilities of the target host, and performing corresponding security protection measures on the vulnerabilities. According to the method, the fuzzy level logs are re-divided through the log data packet length, the vulnerability detection speed and efficiency are improved, the security vulnerabilities can be found in time, and corresponding security protection measures can be taken.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of vulnerability detection, and in particular to a host vulnerability scanning security protection system based on flexible gray scale measurement. BACKGROUND

[0002] With the rapid development of information technology, a host system as a core asset bears increasingly complex business and application, and the security thereof is directly related to the confidentiality, integrity and availability of data; a traditional host vulnerability scanning technology mainly performs deep detection on a target system through an automatic tool, identifies known vulnerabilities, configuration defects and security policy violations and the like, and thus a host vulnerability scanning security protection system based on the concept aims to realize flexibility and precision of security protection, guarantee high availability of business and improve active defense capability.

[0003] The prior art (publication number: CN118761068B) discloses a vulnerability management method and system based on a self-adaptive architecture of a host security platform. The method comprises the following steps: performing multi-dimensional data acquisition on a host through a host security platform, obtaining a multi-dimensional host data set, establishing a host security feature model for security domain division, obtaining a host security management strategy, obtaining a local vulnerability data set and a cloud vulnerability data set, and constructing a cloud collaborative vulnerability knowledge base, scanning to obtain host baseline data according to the host security management strategy, and constructing a corresponding attack graph, performing attack path risk calculation and vulnerability analysis on the attack graph, obtaining a host vulnerability analysis result, and performing vulnerability verification and repair to generate an initial vulnerability management strategy, tracking the vulnerability state, obtaining a vulnerability security metric, and performing iterative optimization on the vulnerability management strategy to obtain a target vulnerability management strategy, and the application improves the vulnerability management efficiency and the overall host security protection level.

[0004] However, in actual application, log data packets of a detection host are often missed, so that host vulnerabilities cannot be comprehensively detected, and thus the efficiency of detecting vulnerabilities is reduced. SUMMARY

[0005] The application aims to solve the above problems and provides a host vulnerability scanning security protection system based on flexible gray scale measurement.

[0006] The application can be realized by the following technical scheme.

[0007] Firstly, a host vulnerability scanning security protection system based on flexible gray scale measurement is provided, and the system comprises:

[0008] An abnormal score module: obtains log data packets corresponding to a target host, imports the log data packets into a preset abnormality detection model to obtain abnormality detection scores corresponding to the log data packets;

[0009] The data packet division module divides all log data packets according to the abnormality detection threshold and the abnormality detection score to obtain a data packet set, wherein the data set includes an abnormal data set, a fuzzy data set and a normal data set;

[0010] The preliminary abnormality division module obtains each log data packet corresponding to the fuzzy data set in a preset time period, analyzes the length of the log data packet, and divides the fuzzy data set into a preliminary abnormal data packet set and a preliminary normal data packet set according to the length of the log data packet and a preset data packet length threshold.

[0011] The target abnormality division module dynamically adjusts and analyzes the fuzzy data set, calculates a corresponding abnormality monitoring index, and re-divides the preliminary abnormal data packet set according to the abnormality monitoring index to obtain a target abnormal data packet set and a target normal data packet set.

[0012] The test case execution module integrates the target abnormal data packet set of the fuzzy data set into the abnormal data set, extracts all data log packets of the abnormal data set, queries a preset script library according to the data log packets of the abnormal data set, extracts a corresponding test script, executes the test script, and generates a corresponding test case.

[0013] The security protection module detects a target host for vulnerabilities by executing the test case, and performs corresponding security protection measures on the vulnerabilities.

[0014] Optionally, the data packet division module includes a first comparison module, a first normal judgment module, a first fuzzy judgment module and a first abnormality judgment module.

[0015] The first comparison module is configured to compare the abnormality detection score of each log data packet with a preliminary threshold and a second threshold of the abnormality detection threshold.

[0016] The first normal judgment module is configured to determine that the log data packet is in a normal state if the abnormality detection score is less than the preliminary threshold.

[0017] The first fuzzy judgment module is configured to determine that the log data packet is in a fuzzy state if the preliminary threshold is less than or equal to the abnormality detection score and the abnormality detection score is less than or equal to the second threshold.

[0018] The first abnormality judgment module is configured to determine that the log data packet is in an abnormal state if the abnormality detection score is greater than the second threshold.

[0019] Optionally, the preliminary abnormality division module includes an extraction module and a data packet length module.

[0020] The extraction module is configured to extract each format of each log data packet and select a corresponding calculation method according to different formats.

[0021] The data packet length module is configured to decompose components of the log data packet according to a corresponding calculation method, the components including a header length, a body length, and a tail length, and to calculate a total length of the log data packet, denoted as a log data packet length.

[0022] Optionally, the operation process of the preliminary anomaly division module includes:

[0023] S1: if the current log data packet length > the preset data packet length threshold, the current log data packet is divided into a preliminary anomaly;

[0024] S2: if the current log data packet length ≤ the preset data packet length threshold, the current log data packet is divided into a preliminary normal;

[0025] S3: execute step S1 and step S2 on the fuzzy data set, and when the traversal of the fuzzy data set is terminated, finally obtain a preliminary anomaly data packet set and a preliminary normal data packet set.

[0026] Optionally, the target anomaly division module includes a second anomaly judgment module and a second normal judgment module.

[0027] The second anomaly judgment module is configured to divide all log data packets in the preliminary anomaly data packet set into a target anomaly data packet set if the anomaly monitoring index > the anomaly detection threshold.

[0028] The second normal judgment module is configured to divide all log data packets in the preliminary anomaly data packet set into a target normal data packet set if the anomaly monitoring index ≤ the anomaly detection threshold.

[0029] Optionally, the anomaly monitoring index calculation process includes:

[0030] According to analysis of the respective log data packets in a preset time period, a behavior chain breakage entropy coefficient and a critical heuristic density coefficient are obtained, the behavior chain breakage entropy coefficient and the critical heuristic density coefficient are weighted and summed to obtain a first anomaly index, and the first anomaly index is normalized to obtain an anomaly monitoring index.

[0031] Optionally, the calculation process of the behavior chain breakage entropy coefficient includes:

[0032] A log data packet sequence corresponding to a fuzzy level in a preset period is obtained.

[0033] The log data packet sequence is substituted into a Transformer model to obtain a corresponding behavior transition probability distribution sequence.

[0034] A sequence behavior coefficient of the log data packet sequence is calculated, and the calculation formula is:

[0035]

[0036] wherein BC represents a sequence behavior coefficient, denotes adjacent behavior transition probability; q t denotes the behavior transition probability at the tth moment; q t-1 denotes the behavior transition probability at the (t-1) th moment; t=1, 2, …, n, n represents the number of total moments;

[0037] The behavior chain breaking entropy coefficient is calculated, and the calculation formula is: , wherein θ represents the behavior chain breaking entropy coefficient.

[0038] Optionally, the calculation process of the critical exploratory density coefficient comprises:

[0039] The feature vector of the log data packet in the preset period is obtained;

[0040] The density clustering algorithm is used to cluster and analyze the feature vector to obtain an exploratory operation cluster;

[0041] The density index of each cluster is calculated, and the density index comprises a spatial point density and a time distribution density;

[0042] The spatial point density and the time distribution density are weighted and fused to obtain the critical exploratory density coefficient.

[0043] Optionally, the calculation formula of the critical exploratory density coefficient comprises:

[0044] The calculation formula of the critical exploratory density coefficient is:

[0045]

[0046] wherein ω represents the critical exploratory density coefficient, Y i denotes the spatial point density of the ith log data packet, K t denotes the time distribution density at the tth moment; i=1, 2, …, m, m represents the total number of log data packets, J is the total number of feature dimensions, x ik is the kth feature value of the ith data packet, c k is the kth feature value of the cluster center, N t denotes the number of log data packets of the current cluster at the tth moment, σ represents the time interval standard deviation of the log data packets in the time window, t=1, 2, …, n, n represents the number of total moments.

[0047] Optionally, the training process of the preset anomaly detection model comprises:

[0048] The various log data packets and anomaly detection scores are obtained from the database, and the log data packets and the anomaly detection scores corresponding thereto are integrated into a plurality of training data and verification data;

[0049] The several training data are imported into the artificial intelligence model for training, and the test data are used to test the trained artificial intelligence model; finally, a preset anomaly detection model with input of log data packets and corresponding anomaly detection scores and output of anomaly detection scores is obtained.

[0050] The present application has the following advantages:

[0051] The present application provides a flexible gray scale calculation-based host vulnerability scanning security protection system, which obtains log data packets corresponding to a target host, imports the log data packets into a preset anomaly detection model to obtain anomaly detection scores corresponding to the log data, divides all log data packets according to an anomaly detection threshold and the anomaly detection scores to obtain a data packet set, the data set including an anomaly data set, a fuzzy data set and a normal data set, obtains each log data packet corresponding to the fuzzy data set within a preset time period, analyzes the log data packet length according to each log data packet, divides the fuzzy data set into a preliminary anomaly data packet set and a preliminary normal data packet set according to the log data packet length and a preset data packet length threshold, dynamically adjusts and analyzes the fuzzy data set, calculates a corresponding anomaly monitoring index, re-divides the preliminary anomaly data packet set according to the anomaly monitoring index to obtain a target anomaly data packet set and a target normal data packet set, integrates the anomaly data packets of the fuzzy data set into the anomaly data set, extracts all data log packets of the anomaly data set, queries a preset script library according to the data log packets of the anomaly data set, extracts corresponding test scripts, executes the test scripts to generate corresponding test cases, executes the test cases to detect vulnerabilities of the target host, and takes corresponding security protection measures for the vulnerabilities. The present application improves the comprehensiveness of log data packet detection and the efficiency of anomaly detection, automatically converts and executes from anomaly data to test cases, greatly improves the vulnerability detection speed and efficiency, can timely discover security vulnerabilities, takes security protection measures for the detected vulnerabilities, and effectively enhances the security protection capability of the target host. BRIEF DESCRIPTION OF DRAWINGS

[0052] Figure 1 A flexible gray scale calculation-based host vulnerability scanning security protection system framework provided by the present application is shown in the figure. DETAILED DESCRIPTION

[0053] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0054] The embodiment of the present application provides a flexible gray scale calculation host vulnerability scanning security protection system. Figure 1 , Figure 1 The embodiment of the present application provides a flexible gray scale calculation host vulnerability scanning security protection system. The system comprises the following modules:

[0055] Anomaly scoring module: obtain the log data packet corresponding to the target host, and import the log data packet into a preset anomaly detection model to obtain an anomaly detection score corresponding to the log data;

[0056] Packet division module: divide all log data packets according to the anomaly detection threshold and the anomaly detection score to obtain a data set, wherein the data set comprises an anomaly data set, a fuzzy data set and a normal data set;

[0057] Preliminary anomaly division module: obtain each log data packet corresponding to the fuzzy data set within a preset time period, analyze the log data packet length according to each log data packet; and divide the fuzzy data set into a preliminary anomaly data packet set and a preliminary normal data packet set according to the log data packet length and a preset data packet length threshold;

[0058] Target anomaly division module: dynamically adjust and analyze the fuzzy data set, calculate a corresponding anomaly monitoring index, and redivide the preliminary anomaly data packet set according to the anomaly monitoring index to obtain a target anomaly data packet set and a target normal data packet set;

[0059] Test case execution module: incorporate the target anomaly data packet set of the fuzzy data set into the anomaly data set, extract all data log packets of the anomaly data set, query a preset script library according to the data log packets of the anomaly data set, extract a corresponding test script, and execute the test script to generate a corresponding test case;

[0060] Security protection module: execute the test case to detect a vulnerability of the target host, and perform a corresponding security protection measure on the vulnerability.

[0061] Based on the flexible gray scale calculation host vulnerability scanning security protection system provided by the embodiment of the present application, the log data is divided into an anomaly data set, a fuzzy data set and a normal data set, and then the fuzzy data set is subjected to preliminary anomaly division and target anomaly division operation, so that the comprehensiveness of log data packet detection and the efficiency of anomaly detection are improved, automatic conversion and execution from anomaly data to test case are realized, the vulnerability detection speed and efficiency are greatly improved, security vulnerabilities can be discovered in time, security protection measures are taken according to the detected vulnerabilities, and the security protection capability of the target host is effectively enhanced.

[0062] In an implementation manner, the packet division module comprises a first comparison module, a first normal judgment module, a first fuzzy judgment module and a first anomaly judgment module:

[0063] The first comparison module is configured to compare the anomaly detection score of each log data packet with a preliminary threshold and a second threshold of the anomaly detection threshold;

[0064] The first normal judgment module is configured to determine that the log data packet is normal if the anomaly detection score is less than the preliminary threshold.

[0065] The first fuzzy judgment module is configured to determine that the log data packet is fuzzy if the preliminary threshold is less than or equal to the anomaly detection score and the anomaly detection score is less than or equal to the second threshold.

[0066] The first anomaly judgment module is configured to determine that the log data packet is abnormal if the anomaly detection score is greater than the second threshold.

[0067] In an implementation manner, the preliminary anomaly division module includes an extraction module and a data packet length module.

[0068] The extraction module is configured to extract each format of each log data packet, and select a corresponding calculation method according to different formats.

[0069] The data packet length module is configured to decompose components of the log data packet according to the corresponding calculation method, the components include a header length, a body length and a tail length, and calculate a total length of the log data packet, which is recorded as a log data packet length.

[0070] Specifically, the formats include pure text, JSON, Syslog and binary.

[0071] In an implementation manner, the calculation method of the pure text format: for the log in the pure text format, the file content can be directly read, and then the total length is calculated by using a string length function. This method is simple and direct, and is suitable for text files without special coding or delimiters; the calculation method of the JSON format: for the log in the JSON format, the JSON structure needs to be parsed first, and then the parsed object is traversed to calculate the string representation length of each key-value pair. This may involve recursively traversing nested objects and arrays. In Python, the JSON module can be used to parse JSON, and then the length is calculated. The calculation method of the Syslog format: the Syslog format usually has a fixed structure, including a timestamp, a hostname, a process name and the like. Regular expressions can be used to parse these fields, and then the length of each field is calculated. In addition, a special Syslog parsing library can also be used to simplify this process. The calculation method of the binary format: for the log in the binary format, the specific structure needs to be parsed according to its specific structure. This may involve bit operations to extract specific fields; in Python, the struct module can be used to process binary data, parse data according to a predefined format string, and calculate the length.

[0072] In an implementation, the operation process of the preliminary anomaly division module includes:

[0073] S1: if the length of the current log data packet is greater than the preset data packet length threshold, the current log data packet is divided into a preliminary anomaly;

[0074] S2: if the length of the current log data packet is less than or equal to the preset data packet length threshold, the current log data packet is divided into a preliminary normal;

[0075] S3: execute steps S1 and S2 on the fuzzy data set, and when the traversal of the fuzzy data set is terminated, finally obtain a preliminary anomaly data packet set and a preliminary normal data packet set.

[0076] In an implementation, the fuzzy level log data packets are accurately divided by setting the preset data packet length threshold and the anomaly detection threshold. The obviously abnormal log data packets are quickly screened out based on the data packet length, reducing the complexity of subsequent analysis. For log data packets with lengths within the threshold range, the anomaly monitoring index is dynamically adjusted for analysis and calculation, further accurately distinguishing normal and abnormal data packets. This hierarchical processing method improves the efficiency and accuracy of log data packet analysis, quickly locates abnormal conditions, reduces false positives, and improves the reliability of system monitoring.

[0077] In an implementation, the target anomaly division module includes a second anomaly judgment module and a second normal judgment module:

[0078] The second anomaly judgment module is configured to divide all log data packets in the preliminary anomaly data packet set into a target anomaly data packet set if the anomaly monitoring index is greater than the anomaly detection threshold.

[0079] The second normal judgment module is configured to divide all log data packets in the preliminary anomaly data packet set into a target normal data packet set if the anomaly monitoring index is less than or equal to the anomaly detection threshold.

[0080] In an implementation, the calculation process of the anomaly monitoring index includes:

[0081] The behavior chain breakage entropy coefficient and the critical heuristic density coefficient are obtained by analyzing the respective log data packets in a preset time period, the behavior chain breakage entropy coefficient and the critical heuristic density coefficient are weighted and summed to obtain a first anomaly index, and the first anomaly index is normalized to obtain the anomaly monitoring index.

[0082] In an implementation, the calculation process of the behavior chain breakage entropy coefficient includes:

[0083] Obtain the log data packet sequence corresponding to the fuzzy level in a preset period;

[0084] substitute the log data packet sequence into the Transformer model to obtain a corresponding sequence of behavior transition probability distributions;

[0085] a sequence behavior coefficient of the log data packet sequence is calculated, and a calculation formula is:

[0086]

[0087] where BC represents the sequence behavior coefficient, represents adjacent behavior transition probability; q t represents the behavior transition probability at the tth moment; q t-1 represents the behavior transition probability at the (t-1) th moment; t = 1, 2, …, n, n represents the number of total moments;

[0088] a behavior chain breakage entropy coefficient is calculated, and a calculation formula is: , and θ represents the behavior chain breakage entropy coefficient.

[0089] In an implementation, the data acquisition manner involved in the calculation process of the chain breakage entropy coefficient is as follows: a preset period (one hour or one day, etc.) is set, where t corresponds to a unit of seconds, and the log data packet sequence includes system security log packets, process call logs, network connection logs, etc. The sequence behavior coefficient is an index for analyzing whether the log data packet sequence of a user / process deviates from a normal mode; specifically, when the sequence behavior coefficient value is larger, the behavior chain breakage entropy coefficient value is larger, indicating that the breakage degree of the behavior chain corresponding to the log data packet is higher, and it is indicated that the abnormal degree of the current log data packet is larger.

[0090] In an implementation, the behavior chain breakage entropy coefficient (θ) is a dynamic index for quantifying the abnormal degree of the operation log data packet sequence, and the core idea is: by analyzing the logical correlation between continuous operations of a user or a process, it is determined whether the current log data packet deviates from a normal mode.

[0091] In an implementation, the calculation process of the critical tentative density coefficient includes:

[0092] a feature vector of the log data packet of the fuzzy level in the preset period is acquired;

[0093] a density clustering algorithm is used to perform clustering analysis on the feature vector to obtain a tentative operation cluster;

[0094] a density index of each cluster is calculated, and the density index includes a spatial point density and a time distribution density;

[0095] the spatial point density and the time distribution density are weighted and fused to obtain the critical tentative density coefficient.

[0096] In an implementation, the critical exploratory density coefficient is used to evaluate an index of the distribution density of data points in space and time.

[0097] In an implementation, the feature vector is a spatial feature vector and a temporal feature vector in the log data packet, corresponding to the spatial and temporal distribution patterns for quantitative analysis of behaviors; the calculation method of the critical exploratory density coefficient can effectively identify and analyze abnormal behaviors in the log data packet. By obtaining the feature vector of the log data packet of the fuzzy level in the preset period, feature extraction of the data can be performed, providing a basis for subsequent analysis. Secondly, the density clustering algorithm (such as DBSCAN) is used to cluster and analyze the feature vector, which can automatically find the high-density area in the data, that is, the exploratory operation cluster, which helps to identify potential abnormal behavior patterns. The spatial point density and the temporal distribution density of each cluster are calculated and weighted and fused to obtain the critical exploratory density coefficient. The critical exploratory density coefficient reflects the distribution characteristics of exploratory operations in space and time, providing a more comprehensive basis for anomaly detection. Through this method, abnormal behaviors can be more accurately identified, improving the security and stability of the system; in summary, the calculation method of the critical exploratory density coefficient provides an effective anomaly detection means for log data analysis, which helps to improve the security protection capability of the system.

[0098] In an implementation, the calculation formula of the critical exploratory density coefficient includes:

[0099] The calculation formula of the critical exploratory density coefficient is:

[0100]

[0101] wherein ω represents the critical exploratory density coefficient, Y i represents the spatial point density of the i th log data packet, K t represents the temporal distribution density at the t th moment; i = 1, 2, …, m, m represents the total number of log data packets, J is the total number of feature dimensions, x ik is the k th feature value of the i th data packet, c k is the k th feature value of the cluster center, N t represents the number of log data packets of the current cluster at the t th moment, σ represents the time interval standard deviation of the log data packet within the time window, t = 1, 2, …, n, n represents the number of total moments.

[0102] Specifically, the feature dimensions (such as access IP, port, operation type, etc.);

[0103] In an implementation, the greater the critical exploratory density coefficient, the closer the current log data packet to the high-density area, the higher the identification of potential abnormal behaviors, and the greater the degree of log data packet abnormality.

[0104] In an implemented manner, the training process of the preset anomaly detection model comprises:

[0105] Obtaining each log data packet and anomaly detection score from the database, and integrating the log data packet and the anomaly detection score corresponding thereto into a plurality of training data and verification data;

[0106] Importing the plurality of training data into an artificial intelligence model for training, and verifying the trained artificial intelligence model with the verification data; and finally obtaining a preset anomaly detection model with input of the log data packet and the anomaly detection score corresponding thereto, and output of the anomaly detection score.

[0107] Specifically, the artificial intelligence model comprises a LogBERT model and the like.

[0108] In an implemented manner, the querying of the preset script library according to the data log packet of the anomaly level, and the extraction of the corresponding test script comprise:

[0109] According to the data log packet of the anomaly level, adding a corresponding log label to the data log packet, and querying the test script in the preset script library according to the log label.

[0110] It should be noted that in this document, terms such as “comprise”, “include” or any other variant thereof are intended to cover non-exclusive inclusion, so that processes, methods, articles or devices that include a series of elements not only include those elements, but also include other elements not explicitly listed, or inherent elements of such processes, methods, articles or devices.

[0111] Although the embodiments of the present application have been shown and described, it can be understood by those of ordinary skill in the art that various changes, modifications, replacements and variations can be made to the embodiments without departing from the principles and spirits of the present application.

Claims

1. A flexible gray-box vulnerability scanning security protection system, characterized in that, The system comprises: An anomaly scoring module: obtains log data packets corresponding to a target host, and imports the log data packets into a preset anomaly detection model to obtain anomaly detection scores corresponding to the log data packets; A data packet division module: divides all log data packets according to an anomaly detection threshold and the anomaly detection scores to obtain a data set, wherein the data set comprises an anomaly data set, a fuzzy data set, and a normal data set; A preliminary anomaly division module: obtains each log data packet corresponding to the fuzzy data set within a preset time period, analyzes the log data packet to obtain a log data packet length, and divides the fuzzy data set into a preliminary anomaly data packet set and a preliminary normal data packet set according to the log data packet length and a preset data packet length threshold; A target anomaly division module: dynamically adjusts and analyzes the fuzzy data set, calculates a corresponding anomaly monitoring index, and re-divides the preliminary anomaly data packet set according to the anomaly monitoring index to obtain a target anomaly data packet set and a target normal data packet set; An execution test case module: integrates the target anomaly data packet set of the fuzzy data set into the anomaly data set, extracts all data log packets of the anomaly data set, queries a preset script library according to the data log packets of the anomaly data set, extracts corresponding test scripts, and executes the test scripts to generate corresponding test cases; A security protection module: detects vulnerabilities of the target host by executing the test cases, and performs corresponding security protection measures on the vulnerabilities.

2. The flexible gray-scale vulnerability scanning security system of claim 1, wherein, The data packet division module comprises a first comparison module, a first normal judgment module, a first fuzzy judgment module, and a first anomaly judgment module: The first comparison module is configured to compare the anomaly detection scores of each log data packet with a preliminary threshold and a second threshold of the anomaly detection threshold; The first normal judgment module is configured to determine that the log data packet is in a normal state if the anomaly detection score is less than the preliminary threshold; The first fuzzy judgment module is configured to determine that the log data packet is in a fuzzy state if the preliminary threshold is less than or equal to the anomaly detection score and the anomaly detection score is less than or equal to the second threshold; The first anomaly judgment module is configured to determine that the log data packet is in an anomaly state if the anomaly detection score is greater than the second threshold.

3. The flexible gray-scale vulnerability scanning security system of claim 1, wherein, The preliminary anomaly division module comprises an extraction module and a data packet length module: The extraction module is configured to extract each format of each log data packet, and select a corresponding calculation method according to the different formats; The data packet length module is configured to decompose components of the log data packet according to the corresponding calculation method, the components comprise a header length, a body length, and a tail length, calculate a total length of the log data packet, and record the total length as a log data packet length.

4. The flexible gray-scale vulnerability scanning security system of claim 1, wherein, The operation process of the preliminary anomaly division module comprises: S1: if the current log data packet length is greater than the preset data packet length threshold, the current log data packet is divided into a preliminary anomaly; S2: if the current log data packet length is less than or equal to the preset data packet length threshold, the current log data packet is divided into a preliminary normal; S3: execute steps S1 and S2 on the fuzzy data set, and when the fuzzy data set is traversed to the end, finally obtain the preliminary anomaly data packet set and the preliminary normal data packet set.

5. The flexible gray-scale vulnerability scanning security system of claim 1, wherein, The target anomaly division module comprises a second anomaly judgment module and a second normal judgment module: The second anomaly judgment module is configured to divide all log data packets in the preliminary anomaly data packet set into a target anomaly data packet set if the anomaly monitoring index is greater than the anomaly detection threshold. The second normal judgment module is configured to divide all log data packets in the preliminary anomaly data packet set into a target normal data packet set if the anomaly monitoring index is less than or equal to the anomaly detection threshold.

6. The flexible gray-scale vulnerability scanning security system of claim 5, wherein, The anomaly monitoring index calculation process includes: Behavior chain break entropy coefficients and critical heuristic density coefficients are obtained by analyzing the respective log data packets in a preset time period, the behavior chain break entropy coefficients and the critical heuristic density coefficients are weighted and summed to obtain a first anomaly index, and the first anomaly index is normalized to obtain an anomaly monitoring index.

7. The flexible gray-scale vulnerability scanning security system of claim 5, wherein, The behavior chain break entropy coefficient calculation process includes: A log data packet sequence corresponding to a fuzzy level in a preset period is obtained; The log data packet sequence is substituted into a Transformer model to obtain a corresponding behavior transition probability distribution sequence; A sequence behavior coefficient of the log data packet sequence is calculated, and the calculation formula is: where BC represents a sequence behavior coefficient, denotes a neighboring behavior transition probability; q t denotes a behavior transition probability at the tth time; q t-1 denotes a behavior transition probability at the t-1th time; t = 1, 2, …, n, n denotes the number of total time; The calculation formula of the behavior chain breakage entropy coefficient is as follows: , wherein θ represents the behavior chain breakage entropy coefficient.

8. The flexible gray-scale vulnerability scanning security system of claim 5, wherein, The critical heuristic density coefficient calculation process includes: A feature vector of a log data packet of a fuzzy level in a preset period is obtained; A density clustering algorithm is used to cluster and analyze the feature vector to obtain a heuristic operation cluster; A density index of each cluster is calculated, and the density index includes a spatial point density and a time distribution density; The spatial point density and the time distribution density are weighted and fused to obtain a critical heuristic density coefficient.

9. The flexible gray-scale vulnerability scanning security system of claim 5, wherein, The critical heuristic density coefficient calculation formula includes: The critical heuristic density coefficient calculation formula is: where ω represents the critical exploratory density coefficient, Y i represents the spatial point density of the i-th log data packet, K t represents the time distribution density at the t-th moment; i = 1, 2, …, m, m represents the total number of log data packets, J is the total number of feature dimensions, x ik is the k-dimensional feature value of the i-th data packet, c k is the k-dimensional feature value of the cluster center, N t represents the number of log data packets of the current cluster at the t-th moment, σ represents the time interval standard deviation of the log data packets within the time window, t = 1, 2, …, n, n represents the number of total moments.

10. The flexible gray-scale vulnerability scanning security system of claim 1, wherein, The preset anomaly detection model training process includes: Respective log data packets and anomaly detection scores are obtained from a database, and the log data packets and the anomaly detection scores corresponding thereto are integrated into a plurality of training data and test data; The plurality of training data are imported into an artificial intelligence model for training, and the test data are used to test the trained artificial intelligence model; finally, a preset anomaly detection model with input of log data packets and the anomaly detection scores corresponding thereto and output of anomaly detection scores is obtained.

Images