A network operation and maintenance environment evaluation system based on a quasimode security technology

Abstract

The application belongs to the technical field of network operation and maintenance supervision, and discloses a network operation and maintenance environment evaluation system based on quasi-state security technology, which comprises a quasi-state data acquisition layer, a quasi-state selection layer, a dynamic analysis layer, a weight calculation layer and an optimization layer; the quasi-state data acquisition layer is used for collecting power data, equipment configuration data, network traffic data and hardware state data in the network operation and maintenance environment, and performing data preprocessing; the quasi-state selection layer is used for monitoring various types of data in real time, and automatically matching corresponding quasi-state instruction sets according to real-time security requirements of various types of data, while FPGA performs real-time variation on the instructions according to a preset strategy. Through the comprehensive use of the quasi-state data acquisition layer and the dynamic analysis layer, the system can comprehensively cover network traffic, power data and configuration information data in the network operation and maintenance environment, while FPGA performs real-time variation on the instructions according to the preset strategy, thereby increasing the difficulty for attackers to predict the system behavior.

Description

Technical Field

[0001] This application belongs to the field of network operation and maintenance supervision technology, specifically involving a network operation and maintenance environment assessment system based on mimicry security technology. Background Technology

[0002] With the rapid development of information technology, network scale is constantly expanding and complexity is increasing, posing unprecedented challenges to network security. The massive number of connected devices, the integration of diverse services, and frequent data interactions have led to an exponential increase in the network attack surface. Security threats such as malware, data breaches, and DDoS attacks are emerging in an increasingly sophisticated and covert manner. Against this backdrop, the security and stability of the network operation and maintenance environment are crucial to ensuring the normal operation of business. It not only concerns the security of core enterprise data assets, ensuring that customer information is not leaked and business transactions are not disrupted, but also directly affects the enterprise's reputation and market competitiveness. A network security incident can lead to business interruption, customer loss, and huge economic losses and irreparable negative impacts on the enterprise.

[0003] For example, a network operation and maintenance environment assessment system based on mimicry security technology, authorized by China (CN117834305B), discloses a network operation and maintenance environment assessment system that can effectively apply mimicry security technology to network operation and maintenance environment assessment, and can perform full-process monitoring and accurately judge the assessment operation status during network operation and maintenance environment assessment, which is conducive to improving network security.

[0004] However, most current network operation and maintenance environment assessment systems are limited to single-data mimicry assessments, such as performing only power analysis while ignoring other critical factors like configuration vulnerabilities. This results in blind spots in the assessment, failing to comprehensively and accurately reflect the true security status of the network. Furthermore, their fixed assessment logic makes them vulnerable to reverse engineering and exploitation by attackers to launch escape attacks, significantly reducing system security. Summary of the Invention

[0005] This application provides a network operation and maintenance environment assessment system based on mimicry security technology, which aims to solve the problems of existing technologies that are limited to single data mimicry assessment, resulting in blind spots in the assessment. At the same time, the assessment logic is fixed and unchanging, making it easy for attackers to reverse analyze and use it to launch escape attacks, thereby greatly reducing the security of the system.

[0006] A network operation and maintenance environment assessment system based on mimicry security technology includes a mimicry data acquisition layer, a mimicry selection layer, a dynamic analysis layer, a weight calculation layer, and an optimization layer;

[0007] The mimicry data acquisition layer is used to collect power data, equipment configuration data, network traffic data, and hardware status data in the network operation and maintenance environment, and to perform data preprocessing; the mimicry data acquisition layer includes a hardware probe unit, a heterogeneous acquisition unit, and a preprocessing unit;

[0008] The mimicry selection layer is used to monitor various types of data in real time and automatically match the corresponding mimicry instruction set according to the real-time security requirements of various types of data. At the same time, the FPGA performs real-time mutation of the instructions according to the preset strategy.

[0009] The dynamic analysis layer can analyze and perceive various types of data through the analysis model, and determine the corresponding target indices for power, equipment configuration, network data and hardware status.

[0010] The weight calculation layer is used to calculate the credibility of multiple target indices respectively, and to perform quantitative comparison based on the credibility calculation results. If the difference in credibility values ​​between two sets of target indices exceeds a threshold, the layer will take corrective action. If so, it is marked as a potential conflict pair;

[0011] The optimization layer can construct an evaluation mechanism through correction function units, dynamic adjustment units, and update units to achieve adaptive optimization of the system in a dynamic environment.

[0012] Furthermore, the hardware probe unit is built based on a Physically Unclonable Function (PUF) chip and is used to generate keys;

[0013] The heterogeneous acquisition unit can combine with the hardware probe unit to collect power data, equipment configuration data and network traffic data in the network operation and maintenance environment respectively;

[0014] The preprocessing unit is used to clean and verify the various types of data collected by the heterogeneous acquisition unit.

[0015] Furthermore, the verification process uses the HMAC_SHA3 algorithm to perform spatiotemporal signature verification on various types of data after data cleaning. First, the collected data types are combined with the timestamps generated when the data is acquired to closely associate the data content with time information.

[0016] Furthermore, the mimicry selection layer includes a data monitoring unit and an FPGA unit;

[0017] The data monitoring unit is built on a decision matrix and a threat intelligence sandbox, and can automatically match and activate corresponding instructions using a priority algorithm;

[0018] The FPGA unit disrupts the fixed execution order of instructions through dynamic reconfiguration. At the same time, the FPGA is designed with multiple instruction execution units, and the data path is randomly selected through a dynamic interconnection network, so that the order in which instructions flow through different units changes dynamically.

[0019] Furthermore, the dynamic analysis layer can output target indices in the range of 0-1 corresponding to power data, network traffic data, and equipment configuration data through the analysis model.

[0020] Furthermore, the weight calculation layer is used to calculate the credibility of multiple target indices respectively, and to perform quantitative comparison based on the credibility calculation results. If the difference in credibility values ​​between two sets of target indices exceeds a threshold... If they are, they are marked as potential conflict pairs, and the calculation formula is as follows:

[0021]

[0022] in, This is the confidence level value. This is the base credibility value for the current period. These are weighting coefficients. and For any two of the target indices output by the analysis model, This is an indicator function.

[0023] Furthermore, the correction function unit is used to determine the merits of the strategy for evaluating the target index, triggering strategy retention or adjustment to achieve a dynamic trade-off between risk and efficiency. The correction function is shown below:

[0024]

[0025] Where s is the correction coefficient;

[0026] The dynamic adjustment unit achieves synergistic optimization of multiple objective indices through dynamic adjustment based on historical performance and iterative updates of weights.

[0027] In the update unit, the policy network parameters θ are updated along the gradient direction, where the policy gradient reflects the sensitivity of the action probability distribution to parameter changes and is used to eliminate scale differences between different states.

[0028] Furthermore, the weight iteration update formula is as follows:

[0029]

[0030] in, Let T be the weight of the current target index, and T be the average confidence value of all target indices. The learning rate parameter, This represents the historical reliability value.

[0031] Compared with the prior art, this application has at least the following beneficial effects:

[0032] Based on further analysis and research into existing technical problems, this application, through the comprehensive application of a mimicry data acquisition layer and a dynamic analysis layer, enables the system to comprehensively cover network traffic, power data, and configuration information data in the network operation and maintenance environment. Compared with traditional single-data source evaluation methods, this significantly reduces evaluation blind spots and improves the accuracy and reliability of evaluation results.

[0033] This application also utilizes a dynamic matching mechanism in the mimicry selection layer to automatically match corresponding mimicry instruction sets based on the real-time security requirements of various data. Simultaneously, the FPGA performs real-time mutation of the instructions according to a preset strategy, increasing the difficulty for attackers to predict system behavior and making it difficult for them to launch effective attacks, thereby improving the system's security performance. Attached Figure Description

[0034] Figure 1 This is a block diagram of a network operation and maintenance environment assessment system based on mimicry security technology, provided as an embodiment of this application. Detailed Implementation

[0035] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments.

[0036] like Figure 1 As shown, a network operation and maintenance environment assessment system based on mimicry security technology is provided, including a mimicry data acquisition layer, a mimicry selection layer, a dynamic analysis layer, a weight calculation layer, and an optimization layer.

[0037] The mimicry data acquisition layer is used to collect power data, device configuration data, network traffic data, and hardware status data in the network operation and maintenance environment, and performs data preprocessing to ensure that the data entering the mimicry selection layer comes from legitimate devices and is reliable data that has not been tampered with, providing an accurate basis for subsequent analysis.

[0038] The mimicry data acquisition layer comprises a hardware probe unit, a heterogeneous acquisition unit, and a preprocessing unit. The hardware probe unit, based on a Physically Unclonable Function (PUF) chip, serves as the foundation for device-level trusted authentication. Each PUF hardware probe possesses unique physical characteristics, and the keys generated based on these physical characteristics are highly unique and uncopyable.

[0039] Based on the distribution and type of power equipment (such as power supplies and distribution cabinets), PUF hardware probes are installed on power nodes. When power equipment connects to the network, the PUF hardware probes use their own characteristics to authenticate the equipment, ensuring that only legitimate equipment can participate in the subsequent data interaction process, which greatly improves the accuracy and reliability of equipment authentication.

[0040] The heterogeneous acquisition unit can combine with the hardware probe unit to collect power data, equipment configuration data and network traffic data in the network operation and maintenance environment.

[0041] Electricity data is acquired in real time via PUF hardware probes deployed in smart meters, which acquire voltage, current, and power parameters, leveraging their physically unclonable nature to ensure the legitimate identity authentication of the metering equipment. Through built-in sensors and signal processing circuits, analog signals are converted into digital signals, and preliminary data processing and verification are performed to ensure the accuracy and integrity of the data.

[0042] The heterogeneous acquisition unit can send GET requests via the SNMP protocol to obtain configuration data such as device system information, interface configuration, and routing tables. During the acquisition process, the heterogeneous acquisition module processes the response data returned by the device. For the data returned by the SNMP protocol, it parses it according to the definition of the MIB (Management Information Base) to extract key configuration information.

[0043] The heterogeneous acquisition unit also includes optical splitters, which are deployed at key network nodes (such as core switches and router egress points). Optical splitters can capture network data packets passing through that node in real time. For distributed network environments, multiple optical splitters can be deployed in multiple subnets to achieve comprehensive monitoring of network traffic. Simultaneously, it ensures that the performance and bandwidth of the traffic acquisition equipment can meet the network traffic capture requirements, avoiding packet loss.

[0044] The preprocessing unit is used to clean and validate various types of data collected by the heterogeneous acquisition units. Data cleaning can handle outliers and missing values ​​according to different data characteristics.

[0045] For example: Power data is processed by removing outliers exceeding reasonable thresholds and supplementing them with interpolation; equipment configuration data is processed by removing duplicate records; network traffic data is processed by analyzing and troubleshooting abnormal packets; and hardware status data is used to correct errors caused by sensor malfunctions. Next comes data standardization and format unification: power data is standardized using Z-score to eliminate the influence of dimensions; equipment configuration data is unified into structured tables from different formats and converted into specific semantic information; network traffic data is parsed and aggregated according to business categories, while sensitive information is anonymized; and hardware status data is used to calibrate sensor errors and convert status codes into readable descriptions.

[0046] The verification process employs the HMAC_SHA3 algorithm to perform spatiotemporal signature verification on various types of cleaned data. First, the collected data is concatenated with the timestamps generated during data acquisition to tightly link the data content with time information. Then, the SHA3 algorithm is used to perform a hash operation on the concatenated data, generating a fixed-length hash value. Finally, a key generated using a Physically Unclonable Function (PUF) is used to cryptographically sign the hash value. The PUF key is unique and cannot be copied, greatly enhancing the security of the signature. This ensures that the data has not been tampered with during transmission or storage (because the hash value reflects data integrity), prevents malicious replay of data through timestamps, and further guarantees the reliability and security of the verification process through PUF key signing, effectively verifying the authenticity and timeliness of the data.

[0047] The mimicry selection layer is used to monitor various types of data in real time and automatically match the corresponding mimicry instruction set according to the real-time security requirements of each type of data. Simultaneously, the FPGA performs real-time mutation of the instructions according to a preset strategy. The mimicry selection layer includes a data monitoring unit and an FPGA unit. Details are as follows:

[0048] 1) Data monitoring unit

[0049] The data monitoring unit is built upon a decision matrix and a threat intelligence sandbox. It can automatically match and activate corresponding commands using priority algorithms (such as triggering MIMIC_SCHED for computing power reallocation after a timeout), achieving precise resource scheduling and adaptive switching of protection strategies. Simultaneously, the data monitoring unit's built-in threat intelligence sandbox performs cross-validation of multi-source data. For example, when composite attack characteristics are detected, the MIMIC_VOTE mechanism is simultaneously activated to aggregate the weighted opinions of each target index. After confirming high risk, the MIMIC_ISOL command is instantly issued to implement physical isolation, blocking potential attack chains.

[0050] 2) FPGA unit

[0051] FPGAs disrupt the fixed execution order of instructions through dynamic reconfiguration. Furthermore, the FPGA incorporates multiple instruction execution units, which randomly select data paths via a dynamic interconnect network, causing the order in which instructions flow through different units to change dynamically. This prevents attackers from predicting the instruction execution flow through static analysis or pattern matching, effectively defending against side-channel attacks.

[0052] Simultaneously, by leveraging the programmable logic resources of the FPGA, redundant instruction templates are dynamically generated and inserted into the instruction stream at runtime via a reconfiguration interface. This allows the FPGA to integrate redundant instructions, inserting redundant operations (such as pseudo-operations) with no practical function before or after critical instructions. This increases the difficulty for attackers to extract key instruction features while maintaining the functional integrity of the original algorithm, thereby obfuscating the attacker's observation of the real instructions.

[0053] For example, the original continuous ADD→MUL→SUB instruction sequence can be randomly adjusted to variants such as MUL→SUB→ADD or SUB→ADD→MUL each time it is executed.

[0054] The dynamic analysis layer, through its analytical model, can analyze and perceive various types of data, determining corresponding target indices for power, equipment configuration, network data, and hardware status, thus eliminating blind spots inherent in traditional single-data-based mimicry assessments. Details are as follows:

[0055] 1) The analysis model can dynamically construct a directed topology graph with network devices as nodes and communication traffic as edge weights using power data. Then, iteratively calculating the betweenness centrality of nodes through the message passing mechanism of a graph neural network, it identifies key hub nodes (such as abnormal cross-domain connection points). When a sudden increase in node betweenness centrality is detected (exceeding three standard deviations of the historical mean) and the associated connection entropy value is abnormal, the node is identified as a potential attack springboard and marked. The final output is a target index in the range of 0-1 and a list of high-risk nodes.

[0056] 2) The analysis model performs wavelet packet decomposition on the temporal characteristics (data packet quantity / size distribution) of network traffic data to extract the energy entropy values ​​of 8 sub-bands; it uses a Hidden Markov Model (HMM) to establish a 5-state transition matrix for normal traffic and calculates the likelihood probability of the real-time traffic sequence; when the abrupt change in sub-band energy entropy exceeds a preset value and the HMM likelihood probability is lower than 0.01, it is determined to be a DDoS or port attack. The final output is a target index in the range of 0-1.

[0057] 3) The analysis model generates a differential privacy-protected version by injecting Laplace noise (privacy budget ε=0.1) into the device configuration data; it performs fuzzy matching with the CIS security baseline library, and calculates configuration compliance using the formula: deviation = (number of violations / total number of detected items) × risk weight; the identified key deviations are then quantified and ranked according to risk. The final output is a target index in the range of 0-1.

[0058] The weight calculation layer can be based on a preset threshold. The corresponding target indices derived from the dynamic analysis layer are calculated separately to determine whether each target index exceeds the threshold. If the difference between the result of a certain target index and other corresponding target indices exceeds a threshold... If this is detected, it is considered an anomaly, which helps to identify deviations in the evaluation process in a timely manner.

[0059] The weight calculation layer is used to calculate the credibility of multiple target indices separately, and to perform quantitative comparison based on the credibility calculation results. If the difference in credibility values ​​between two sets of target indices exceeds a threshold, the layer will take further action. If the data is not found in the previous N pairs, it is marked as a potential conflict pair. This process uses a sliding window mechanism to dynamically update the most recent N historical comparison records, avoiding misjudgments caused by instantaneous fluctuations. The calculation formula is as follows:

[0060]

[0061] in, This is the confidence level value. This is the base credibility value for the current period. These are weighting coefficients. and For any two of the target indices output by the analysis model, The indicator function takes the value 1 when the difference between the results of two target indices is less than the threshold δ, and 0 otherwise. Here, it determines whether the results of the two target indices are within the allowable error range, where N is the total number of target indices participating in the comparison. The credibility calculation can dynamically adjust the confidence level of each target index, making the system more flexible in responding to various situations.

[0062] The optimization layer constructs an evaluation mechanism through correction function units, dynamic adjustment units, and update units, enabling the system to adaptively optimize in dynamic environments. This balances risk and evaluation efficiency in the network operation and maintenance environment while ensuring security, allowing the system to dynamically adjust its strategies based on real-time feedback and ultimately converge to the optimal decision-making mode.

[0063] The correction function unit is used to determine the merits of the strategy used to evaluate the target index, triggering strategy retention or adjustment to achieve a dynamic trade-off between risk and efficiency. The correction function is shown below:

[0064]

[0065] Where s is the correction coefficient.

[0066] The dynamic adjustment unit dynamically adjusts and iteratively updates weights based on historical performance to achieve coordinated optimization of multiple objective indices. This provides a quantitative basis for the coordinated operation of multiple objective indices and avoids system crashes caused by the failure of a single objective index. The weight iterative update formula is as follows:

[0067]

[0068] in, Let T be the weight of the current target index, and T be the average confidence value of all target indices. The learning rate parameter, This represents the historical reliability value.

[0069] If the confidence value of a target index is higher than the average confidence value, its weight is increased; conversely, its dependence is reduced. For example, a traffic target index that has been stable for a long time will receive a higher weight than a newly deployed traffic target index.

[0070] In the update unit, the policy network parameters θ are updated along the gradient direction, where the policy gradient reflects the sensitivity of the action probability distribution to parameter changes. Specifically, baseline subtraction is used to control the dominance function, eliminating scale differences between different states. The policy network update algorithm is as follows:

[0071]

[0072] in, The policy gradient direction indicates how to modify parameters to increase the probability of a specific action. This is another learning rate parameter. The algorithm iteratively updates the policy network parameters, enabling the system to gradually learn the optimal policy combination over a long period of interaction, thereby continuously improving its performance and adaptability.

[0073] In the aforementioned network operation and maintenance environment assessment system based on mimicry security technology, the comprehensive application of a mimicry data acquisition layer and a dynamic analysis layer enables the system to fully cover network traffic, power data, and configuration information data within the network operation and maintenance environment. Compared with traditional single-data source assessment methods, this significantly reduces assessment blind spots and improves the accuracy and reliability of assessment results.

[0074] The dynamic matching mechanism of the mimicry selection layer can automatically match the corresponding mimicry instruction set according to the real-time security requirements of various data. At the same time, the FPGA mutates the instructions in real time according to the preset strategy, which increases the difficulty for attackers to predict the system behavior, making it difficult for them to launch effective attacks and improving the security performance of the system.

[0075] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

Claims

1. A network operation and maintenance environment evaluation system based on a quasistate security technology, characterized in that, The application relates to a network operation and maintenance system based on a mimic data acquisition layer, a mimic selection layer, a dynamic analysis layer, a weight calculation layer and an optimization layer. The mimic data acquisition layer is used for collecting power data, device configuration data, network flow data and hardware state data in a network operation and maintenance environment and performing data preprocessing; the mimic data acquisition layer comprises a hardware probe unit, a heterogeneous acquisition unit and a preprocessing unit. The mimic selection layer is used for monitoring various types of data in real time, automatically matching corresponding mimic instruction sets according to real-time security requirements of various types of data, and simultaneously performing real-time variation of the instructions by an FPGA according to a preset strategy. The mimic selection layer comprises a data monitoring unit and an FPGA unit. The data monitoring unit is constructed based on a decision matrix and a threat intelligence sandbox and can automatically match and activate corresponding instructions by using a priority algorithm. The FPGA unit can disturb the fixed execution sequence of the instructions by dynamic reconfiguration, and a plurality of instruction execution units are designed in the FPGA, the dynamic interconnection network is used to randomly select a data path, and the sequence of the instruction flowing through different units is dynamically changed. The dynamic analysis layer can analyze and perceive various types of data respectively by an analysis model, and determine corresponding target indexes of power, device configuration, network data and hardware state. The calculation formula is as follows. The weight calculation layer is used for respectively performing credibility calculation on the plurality of target indexes, and performing quantitative comparison according to the credibility calculation results, if the difference amplitude of the credibility values of the two groups of target indexes exceeds a threshold value , the pair is marked as a potential conflict pair; The optimization layer can construct an evaluation mechanism by a correction function unit, a dynamic adjustment unit and an updating unit, and realize self-adaptive optimization of the system in a dynamic environment. ， wherein, is a trustworthiness value, is a base trustworthiness value for the current period, is a weighting coefficient, and are any two of the target indices output by the analysis model, is an indicator function; The hardware probe unit is constructed based on a physically unclonable function chip and is used for generating a key.

2. The network operation and maintenance environment evaluation system based on the security technology of quasi-state according to claim 1, characterized in that, The heterogeneous acquisition unit can acquire power data, device configuration data and network flow data in the network operation and maintenance environment in combination with the hardware probe unit. The preprocessing unit is used for performing data cleaning and verification processing on various types of data collected by the heterogeneous acquisition unit. The verification processing adopts an HMAC_SHA3 algorithm to perform time-space signature verification on various types of data after data cleaning, combines various types of collected data with a time stamp generated when the data is acquired, and is used for closely associating the data content with time information.

3. The network operation and maintenance environment evaluation system based on the security technology of quasi-state according to claim 2, characterized in that, The dynamic analysis layer can output target indexes in the 0-1 range corresponding to power data, network flow data and device configuration data respectively by an analysis model.

4. The network operation and maintenance environment evaluation system based on the security technology of quasi-state according to claim 1, characterized in that, The correction function unit is used for judging the pros and cons of a target index evaluation strategy, triggering strategy reservation or adjustment, realizing dynamic trade-off between risks and efficiencies, and the correction function is as follows:

5. The network operation and maintenance environment assessment system based on the security technology of quasi-state according to claim 1, characterized in that, Wherein, s is a correction coefficient. ， The dynamic adjustment unit realizes collaborative optimization of multiple target indexes by dynamically adjusting and iteratively updating weights based on historical performances. Strategy network parameters theta in the updating unit are updated along a gradient direction, wherein a strategy gradient reflects the sensitivity of an action probability distribution to parameter changes and is used for eliminating scale differences between different states. The weight iterative updating formula is as follows:

6. The network operation and maintenance environment assessment system based on the security technology of quasi-state according to claim 5, characterized in that, ​ ， wherein, is the weight of the current target index, T is the average reliability value of all target indices, is the learning rate parameter, is the historical reliability value.

Images