An online information security comprehensive analysis and monitoring method and system

Abstract

The application relates to the technical field of information monitoring, and discloses a network information security comprehensive analysis and monitoring method and system, the method comprising the following steps: structurally processing network flow data, extracting time-frequency-protocol domain features of the structurally processed data, obtaining a structured feature vector, dynamically detecting the structured feature vector through a preset abnormality monitoring threshold, obtaining abnormality identification data, subsequently calculating a comprehensive risk score in combination with network topology data, dividing the comprehensive risk score into risk grades, obtaining the risk grades, performing response instruction contrast mapping on the risk grades, obtaining risk response instructions, updating the flow of the dynamic abnormality detection based on the instructions through a performance index feedback mechanism, obtaining an updated abnormality monitoring threshold, and finally generating a network information security comprehensive analysis report; the application can improve the comprehensive analysis precision of network information security.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information monitoring, and in particular to a network information security comprehensive analysis and monitoring method and system. BACKGROUND

[0002] In the current network information security analysis and monitoring method, the abnormal monitoring threshold value mostly adopts a fixed value or a general dynamic adjustment mode, lacks adaptability to protocol characteristics, and the prior art does not optimize the threshold value in combination with the protocol state conversion law, but only adjusts the detection standard according to the general statistical characteristics of the flow data, so that when the protocol behavior is complex and changeable, the false positive rate is prone to be high or the problem of missing report occurs, for example, in the face of frequent state conversion of the TCP protocol or the connectionless characteristic of the UDP protocol, the fixed threshold value cannot accurately match the security behavior baseline of different protocols, and it is difficult to effectively distinguish between normal protocol fluctuations and abnormal attack behavior, which reduces the precision and anti-interference ability of abnormal detection, and cannot meet the security monitoring needs in diversified protocol scenarios.

[0003] At the same time, when calculating the comprehensive risk, the existing risk assessment model often simply superimposes flow anomaly data or ignores the associated influence of network topology and protocol type, does not construct an effective risk propagation analysis mechanism, most methods only assess the risk based on the abnormal degree of a single node, and do not consider the propagation path of the risk between different network devices and the attenuation effect of the protocol type on the propagation intensity, so that the risk score cannot accurately reflect the overall network security situation, for example, different risk propagation attenuation coefficients are not set for different protocols such as TCP and UDP, the diffusion effect of the risk in different protocol links cannot be quantified, the risk level division deviates greatly from the actual threat degree, and then the pertinence and effectiveness of the subsequent response instructions are affected, and it is difficult to achieve accurate control of network security risks, therefore, it is an urgent problem to meet the security monitoring needs in diversified protocol scenarios and achieve accurate control of network security risks. SUMMARY

[0004] The present application provides a network information security comprehensive analysis and monitoring method and system to solve the problems raised in the background art.

[0005] To achieve the above-mentioned purpose, the present application provides a network information security comprehensive analysis and monitoring method, comprising:

[0006] S1, structurally processing network flow data to obtain structured data;

[0007] S2, extracting time-frequency-protocol domain features from the structured data to obtain a structured feature vector containing protocol-specific indicators;

[0008] S3, performing dynamic anomaly detection on the structured feature vector by a preset anomaly monitoring threshold to obtain anomaly identification data of the network traffic data;

[0009] S4, calculating a comprehensive risk score based on the anomaly identification data in combination with network topology data, dividing the comprehensive risk score into risk levels to obtain a risk level of the network traffic data;

[0010] S5, mapping the risk level to a response instruction to obtain a risk response instruction of the network traffic data;

[0011] S6, updating a process of the dynamic anomaly detection based on the risk response instruction through a performance index feedback mechanism to obtain an updated anomaly monitoring threshold;

[0012] S7, constructing a network information security comprehensive analysis report based on the risk level, the risk response instruction and the updated anomaly monitoring threshold.

[0013] In a preferred embodiment, the structured processing of the network traffic data to obtain structured data comprises:

[0014] performing denoising processing on the network traffic data to obtain initial network traffic data;

[0015] performing multi-protocol analysis on the initial network traffic data to obtain protocol analysis data of the network traffic data;

[0016] performing serialization processing on the protocol analysis data to obtain structured data of the network traffic data.

[0017] In a preferred embodiment, the time-frequency-protocol domain feature extraction of the structured data to obtain a structured feature vector containing protocol-specific indicators comprises:

[0018] performing time domain feature extraction on the structured data to obtain a time domain feature vector;

[0019] performing frequency domain feature extraction on the structured data to obtain a frequency domain feature vector;

[0020] performing protocol domain feature extraction on the structured data by calculating a protocol state transition entropy value to obtain a protocol domain feature vector, wherein a mathematical expression of a Shannon entropy formula used for calculating the protocol state transition entropy is as follows:

[0021] ;

[0022] In the formula, is a protocol state transition entropy value, is a protocol state The probability of occurrence in the state sequence For the first Each protocol status, For protocol index, This represents the total number of protocol states.

[0023] The time-domain feature vector, the frequency-domain feature vector, and the protocol-domain feature vector are fused to obtain the structured feature vector.

[0024] In a preferred embodiment, the step of dynamically detecting anomalies in the structured feature vector using a preset anomaly detection threshold to obtain anomaly identification data for the network traffic data includes:

[0025] The preset anomaly monitoring threshold is dynamically adjusted based on the protocol state transition entropy value to obtain the dynamic anomaly monitoring threshold.

[0026] The structured feature vector is used to detect anomalies using the dynamic anomaly monitoring threshold to obtain anomaly identification data for the network traffic data.

[0027] In a preferred embodiment, the calculation of the comprehensive risk score based on anomaly identification data and network topology data includes:

[0028] Obtain network topology data;

[0029] Based on the anomaly identification data and the network topology data, a directed risk propagation graph of the network traffic data is constructed;

[0030] Based on the directed risk propagation graph, a breadth-first search logic is used to calculate the node risk value, wherein the mathematical expression of the breadth-first search logic is as follows:

[0031] ;

[0032] In the formula, For nodes The risk value, This is the node identifier of the current node. Adjacent nodes The risk value, This serves as the node identifier for adjacent nodes. Protocol type The corresponding attenuation factor, Protocol type, For nodes The set of adjacent nodes;

[0033] The overall risk score of the node risk value is calculated by summing all the node risk values.

[0034] In a preferred embodiment, the risk level division of the comprehensive risk score to obtain the risk level of the network traffic data comprises:

[0035] Multi-level threshold comparison of the comprehensive risk score based on a preset risk level threshold to obtain a threshold comparison result;

[0036] Based on, through a risk level mapping rule, the threshold comparison result is assigned a corresponding risk level identifier to obtain the risk level of the network traffic data.

[0037] In a preferred embodiment, the risk level response instruction mapping to obtain the risk response instruction of the network traffic data comprises:

[0038] Response instruction mapping of the risk level to obtain the operation instruction of the network traffic data;

[0039] Protocol adaptation processing of the operation instruction to obtain the risk response instruction of the network traffic data.

[0040] In a preferred embodiment, the updating of the dynamic anomaly detection process based on the risk response instruction to obtain the updated anomaly monitoring threshold comprises:

[0041] Based on the risk response instruction, false positive events and alarm events are extracted;

[0042] Based on the false positive events and the alarm events, the total number of false positives and the total number of alarms are counted;

[0043] Based on the total number of false positives and the total number of alarms, a false positive rate is calculated;

[0044] Based on the false positive rate, the dynamic anomaly monitoring threshold is updated to obtain the updated dynamic anomaly monitoring threshold.

[0045] In a preferred embodiment, the network information security comprehensive analysis report is constructed based on the risk level, the risk response instruction, and the updated anomaly monitoring threshold, comprising:

[0046] Integrating the risk level, the risk response instruction, and the updated anomaly monitoring threshold to generate comprehensive report data;

[0047] Inputting the comprehensive report data into a preset report format template for report formatting processing to generate a network information security comprehensive analysis report.

[0048] In order to solve the above problems, the application further provides an online information security comprehensive analysis and monitoring system, which comprises a data structured processing module, a structured feature extraction module, a dynamic anomaly monitoring module, a comprehensive risk assessment module, an intelligent response decision module, a data monitoring feedback module and a comprehensive analysis report generation module, wherein:

[0049] The data structured processing module is used for structuring network flow data to obtain structured data.

[0050] The structured feature extraction module is used for extracting time-frequency-protocol domain features of the structured data to obtain a structured feature vector containing protocol-specific indicators.

[0051] The dynamic anomaly monitoring module is used for dynamically detecting the structured feature vector through a preset anomaly monitoring threshold to obtain anomaly identification data of the network flow data.

[0052] The comprehensive risk assessment module is used for calculating a comprehensive risk score based on the anomaly identification data in combination with network topology data, dividing the comprehensive risk score into risk levels to obtain a risk level of the network flow data.

[0053] The intelligent response decision module is used for mapping the risk level to a response instruction to obtain a risk response instruction of the network flow data.

[0054] The data monitoring feedback module is used for updating a flow of the dynamic anomaly detection through a performance index feedback mechanism based on the risk response instruction to obtain an updated anomaly monitoring threshold.

[0055] The comprehensive analysis report generation module is used for constructing a network information security comprehensive analysis report based on the risk level, the risk response instruction and the updated anomaly monitoring threshold.

[0056] Compared with the prior art, the application has the following beneficial effects:

[0057] 1. In the present application, the dynamic anomaly monitoring threshold adjustment mechanism based on protocol state transition entropy significantly improves the accuracy and environmental adaptability of anomaly detection. The mechanism calculates the protocol state transition entropy value through the Shannon entropy formula, binds the threshold with the randomness depth of protocol behavior, and automatically relaxes the threshold when the protocol state presents high entropy to avoid misjudgment of normal fluctuations as anomalies. When the protocol state is in low entropy, the threshold is tightened to enhance the capture of subtle abnormal behavior. Compared with traditional fixed threshold or general dynamic threshold, this mechanism can accurately match the security behavior baseline of different protocols, effectively reduce the false positive rate and false negative rate, and enhance the adaptation ability to diverse protocol scenarios in complex network environments, ensuring that anomaly detection neither misses potential threats nor interferes with normal network communication.

[0058] 2. In the present application, the protocol-aware multi-source risk propagation graph and multi-layer attenuation model, which consists of three key elements: model structure: directed risk propagation graph, core mechanism: protocol-related attenuation factor and calculation process: breadth-first search traversal, together realize the attenuated propagation calculation of risk across multiple layers of nodes in the network topology, greatly improving the comprehensiveness and accuracy of risk assessment, providing reliable basis for subsequent response decisions. The model first constructs a directed risk propagation graph combining anomaly identification data and network topology data, clearly presenting the propagation path of risk between network devices; then introduces a differentiated attenuation factor based on protocol type, and calculates the risk value of each node using breadth-first search logic, accurately quantifying the diffusion and attenuation effect of risk in different protocol links. Compared with traditional simple superposition of anomaly data or risk assessment methods that ignore the impact of protocols, this model can fully integrate network topology, protocol characteristics and multi-source information of anomaly data, making the comprehensive risk score more consistent with the overall security situation of the network, and the risk level division highly matched with the actual threat level, thereby ensuring that the subsequent risk response instructions are more targeted, and achieving fine-grained control of network security risks. BRIEF DESCRIPTION OF DRAWINGS

[0059] Figure 1 A flowchart of a network information security comprehensive analysis and monitoring method provided by an embodiment of the present application is shown;

[0060] Figure 2 A functional module diagram of a network information security comprehensive analysis and monitoring system provided by an embodiment of the present application is shown;

[0061] The implementation, functional characteristics and advantages of the present application will be further described with reference to the embodiments and the accompanying drawings. DETAILED DESCRIPTION

[0062] It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0063] The embodiment of the present application provides a kind of online information security comprehensive analysis and monitoring method.The execution subject of the kind of online information security comprehensive analysis and monitoring method includes but is not limited to server, terminal and at least one of the electronic equipment that can be configured to execute the method provided in the embodiment of the present application, etc., which is executed by software or hardware installed in terminal device or server device.In other words, the kind of online information security comprehensive analysis and monitoring method can be executed by software or hardware installed in terminal device or server device.The server includes but is not limited to: single server, server cluster, cloud server or cloud server cluster, etc.The server can be independent server, can also be cloud server that provides cloud service, cloud database, cloud computing, cloud function, cloud storage, network service, cloud communication, middleware service, domain name service, security service, content distribution network (Content Delivery Network, CDN), and basic cloud computing services such as big data and artificial intelligence platform.

[0064] Referring to Figure 1 As shown in the figure, a kind of online information security comprehensive analysis and monitoring method provided by the embodiment of the present application is flow chart diagram.In the embodiment, the kind of online information security comprehensive analysis and monitoring method includes:

[0065] S1, network traffic data is structured, and structured data is obtained;

[0066] In the embodiment of the present application, the network traffic data is structured, and the structured data is obtained, including:

[0067] The network traffic data is denoised, and initial network traffic data is obtained;

[0068] The initial network traffic data is parsed by multiple protocols, and protocol analysis data of the network traffic data is obtained;

[0069] The protocol analysis data is serialized, and the structured data of the network traffic data is obtained.

[0070] It should be noted that the essence of denoising is to balance processing delay and noise detection accuracy by setting window size to 1024 bytes, and to identify noise by comparing entropy value of window with entropy value threshold, and if entropy value is lower than threshold, it is marked as noise and filtered.

[0071] Further, the denoising is a noise filtering processing method based on sliding window, which divides data into fixed size windows by sliding window, and calculates entropy value of each window, and filters low-entropy window as noise data based on entropy value threshold, wherein the mathematical expression of Shannon entropy formula used for entropy value calculation is as follows:

[0072] ;

[0073] wherein, is the entropy value of the window, is the byte value is the probability of the byte value appearing in the window, is the byte value range, is the byte index, wherein the byte value range is 0-255.

[0074] Further, the entropy value of the window is calculated by the Shannon entropy formula, indicating the randomness degree of the data byte value in the window, and is essentially used to quantify the information entropy of the uncertainty and information content of the data. In the denoising process, the entropy value is used to identify noise windows. Low entropy value indicates that the data may contain repeated or regular patterns, and is filtered to improve data quality.

[0075] Further, the window size is set to 1024 bytes, which is determined by balancing the processing delay and noise detection accuracy to optimize the calculation efficiency in real-time network traffic analysis.

[0076] Further, the setting of the entropy value threshold is based on the statistical characteristics of historical network traffic data, which is calibrated by experiments to distinguish normal data and noise data. The entropy value threshold is specifically set according to the entropy value distribution of typical protocol traffic. Low-entropy windows are marked as noise. According to the entropy value distribution of typical protocol traffic, the entropy value distribution of different protocol sessions is analyzed by collecting historical network traffic data for 30 days, and the 25% quantile statistical characteristics are calculated to distinguish normal data and noise data. Low-entropy windows are marked as noise and filtered, thereby optimizing the accuracy and efficiency of the denoising process.

[0077] Further, the probability of the byte value appearing in the window is obtained by calculating the ratio of the number of times each byte value appears to the total number of bytes in the window.

[0078] It should be noted that multi-protocol parsing is to separate different protocol sessions by parsing the protocol fields in network traffic data, which is used to decompose mixed protocol traffic and provide protocol-specific data basis for subsequent feature extraction.

[0079] It should be noted that the protocol parsing data is the structured protocol information obtained from the multi-protocol parsing, which is the binary representation of the protocol header or payload, used to quantify the protocol behavior and provide input for time-frequency-protocol domain feature extraction.

[0080] It should be noted that the serialization process is the process of converting protocol parsing data into a standard byte sequence format, which makes data easy to store and transmit through encoding operations, standardizes data format, and ensures the consistency of structured data.

[0081] It should be noted that the structured data includes protocol analysis data composed of a protocol type and a session identifier, a serialized field composed of a timestamp and a data length, and traffic bytes after noise reduction, and the essence is a high-dimensional vector data set convenient for computer processing.

[0082] Further, the network traffic data refers to original transmission data units and derived data thereof carrying source, destination, content, timing and behavior information in a digital communication network, which includes three levels, the first level is a data packet, which is the most original communication unit, including a header and a payload;

[0083] The second level is a flow, which is a logical set composed of multiple data packets with the same key attributes, and is the most commonly used data abstraction in traffic analysis;

[0084] The third level is metadata and derived data, which is further calculated and extracted from the original data packet and flow data.

[0085] S2, time-frequency-protocol domain feature extraction is performed on the structured data to obtain a structured feature vector containing protocol-specific indicators;

[0086] In the embodiment of the application, the time-frequency-protocol domain feature extraction on the structured data to obtain a structured feature vector containing protocol-specific indicators comprises:

[0087] Time domain feature extraction is performed on the structured data to obtain a time domain feature vector;

[0088] Frequency domain feature extraction is performed on the structured data to obtain a frequency domain feature vector;

[0089] Protocol domain feature extraction is performed on the structured data by calculating protocol state transition entropy to obtain a protocol domain feature vector, wherein the mathematical expression of the Shannon entropy formula used for calculating the protocol state transition entropy is as follows:

[0090] ;

[0091] In the formula, is the protocol state transition entropy, is the protocol state The occurrence probability in the state sequence, is the th protocol state, is the protocol index, is the total number of protocol states;

[0092] The time domain feature vector, the frequency domain feature vector and the protocol domain feature vector are fused to obtain the structured feature vector.

[0093] It should be noted that temporal feature extraction is a method of obtaining features by analyzing the statistical characteristics of network traffic data in the time dimension. It is determined by calculating the average time interval of data packet arrival. It is used to capture the changing patterns of traffic over time, provide time-related behavioral features for anomaly detection, and enhance the ability to perceive dynamic changes in network traffic.

[0094] It should be noted that frequency domain feature extraction is a method of obtaining features by converting time-domain signals into frequency-domain representations. By using fast Fourier transform to calculate the frequency components of traffic data, the periodicity of traffic is represented, which provides a basis for detecting periodic anomalies and improves the accuracy of identifying hidden frequency features.

[0095] It should be noted that protocol domain feature extraction refers to the process of calculating the protocol state transition entropy value based on the protocol type field in the structured data to obtain the protocol domain feature vector, which is essentially a quantitative representation of the randomness of protocol behavior.

[0096] It should be noted that the protocol state transition entropy value represents the degree of randomness of protocol state transitions. High entropy values ​​indicate complex protocol behaviors such as frequent state transitions, while low entropy values ​​indicate stable protocol behaviors such as fixed state sequences. It is used to provide a protocol context-aware indicator for dynamic threshold adjustment and optimize the sensitivity of anomaly detection.

[0097] Furthermore, the protocol state is obtained by parsing the protocol fields in the structured data, specifically including the states in the protocol state machine, such as the TCP protocol states SYN_SENT, ESTABLISHED, FIN_WAIT, etc. These states are obtained by parsing the protocol header or state transition sequence and are used to construct a state sequence to calculate the entropy value.

[0098] Furthermore, the protocol domain feature vector is a vector composed of protocol state transition entropy values. It is a feature representation of protocol behavior and is essentially a numerical representation of the randomness of protocol states. It is used to contribute protocol-specific information in feature fusion and to provide protocol-dimensional features for structured feature vectors.

[0099] Furthermore, the total number of protocol states is predefined based on the protocol type. For example, for the TCP protocol, the total number of states is 11, which is the standard TCP state number. Different protocols have different total numbers of states, which are determined by the protocol specification. This ensures that the entropy calculation is tailored to the behavior pattern of a specific protocol, thereby improving the accuracy of feature extraction.

[0100] It should be noted that feature fusion is based on the time-domain feature vector, the frequency-domain feature vector, and the protocol-domain feature vector. The feature vectors are concatenated into a single high-dimensional vector through vector concatenation, and principal component analysis is used to reduce the dimensionality of the concatenated high-dimensional vector to obtain the structured feature vector. This process is used to reduce redundancy and improve feature representation efficiency, ensuring that the structured feature vector balances computational performance and feature integrity.

[0101] Furthermore, principal component analysis (PCA) reduces dimensionality by calculating the eigenvalues ​​of the covariance matrix of each eigenvector and retaining some principal components. This ensures that the structured eigenvectors balance computational efficiency and feature integrity. The number of principal components retained is determined by calculating the eigenvalues ​​of the covariance matrix and selecting the number of principal components with a cumulative contribution rate of 95%. This ensures that most of the information is retained after dimensionality reduction, balancing computational efficiency and feature integrity, and avoiding information loss.

[0102] It should be noted that structured feature vectors are low-dimensional vectors obtained after feature fusion and dimensionality reduction. They contain compressed features in the time domain, frequency domain, and protocol domain. Essentially, they are a comprehensive feature representation of network traffic data, used to provide input for anomaly detection and achieve efficient and accurate security analysis.

[0103] S3, dynamically detect anomalies in the structured feature vector using a preset anomaly detection threshold to obtain anomaly identification data for the network traffic data;

[0104] In this embodiment of the invention, the step of dynamically detecting anomalies in the structured feature vector using a preset anomaly monitoring threshold to obtain anomaly identification data for the network traffic data includes:

[0105] The preset anomaly monitoring threshold is dynamically adjusted based on the protocol state transition entropy value to obtain the dynamic anomaly monitoring threshold.

[0106] The structured feature vector is used to detect anomalies using the dynamic anomaly monitoring threshold to obtain anomaly identification data for the network traffic data.

[0107] It should be noted that the preset anomaly monitoring threshold is an initial threshold pre-set based on the statistical characteristics of historical network traffic data. It is used to distinguish between normal and abnormal traffic, and represents the upper limit of normal fluctuations in network traffic behavior. When the feature vector exceeds this threshold, it may indicate an anomaly. It is used to provide a benchmark reference for anomaly detection in the initial stage, ensuring that the detection process is based on evidence and improving the stability and reliability of the detection system.

[0108] Furthermore, the preset anomaly monitoring threshold is based on 30 days of historical network traffic data. Structured feature vectors are extracted, and the 95th percentile of these vectors is calculated to obtain a statistical distribution. This statistical distribution is used as the preset anomaly monitoring threshold to improve the stability and reliability of anomaly detection.

[0109] It should be noted that the dynamic threshold adjustment is based on the protocol state transition entropy value and the preset anomaly monitoring threshold. The dynamic anomaly monitoring threshold is generated by multiplication. Specifically, it is obtained by multiplying the preset anomaly monitoring threshold by 1 and the sum of the protocol state transition entropy values. This is used to adaptively adjust the detection sensitivity according to the degree of randomness of the protocol state transition.

[0110] Furthermore, when the protocol state transition entropy value is high, it indicates that the protocol behavior is complex and variable, and the threshold is automatically relaxed to reduce false alarms;

[0111] When the entropy value is low, it indicates that the protocol behavior is stable, and the threshold is tightened to improve detection accuracy;

[0112] By adjusting thresholds in real time, anomaly detection can better reflect the actual behavior of current network traffic, improving the accuracy and adaptability of detection while reducing the risk of misjudgment due to changes in the network environment.

[0113] It should be noted that the dynamic anomaly monitoring threshold is a real-time threshold that has been dynamically adjusted. It represents the critical value used for anomaly detection under the current network state and reflects the dynamic detection boundary based on the uncertainty of protocol state. It fluctuates with changes in protocol behavior and is used to provide a dynamic benchmark for anomaly detection, ensuring that the detection process can respond to real-time changes in network traffic and optimize the timeliness and effectiveness of anomaly identification.

[0114] It should be noted that anomaly detection compares structured feature vectors with dynamic anomaly monitoring thresholds to identify feature points that exceed the thresholds as anomalies. This is used to mark potential security threats and abnormal behaviors in network traffic, providing input data for subsequent risk assessments and helping to promptly detect potential network attacks or faults.

[0115] It should be noted that the anomaly identification data includes information such as the location of the anomaly point, timestamp, protocol type, feature vector value, and degree of anomaly. It represents detailed data of the detected abnormal event and is essentially a quantitative identifier of abnormal behavior in network traffic. It is used to provide basic data for the comprehensive risk assessment module, participate in the calculation of risk scores and the generation of response instructions, and support subsequent source tracing analysis and report generation.

[0116] S4. Based on the anomaly identification data and combined with the network topology data, calculate the comprehensive risk score, classify the risk level of the comprehensive risk score, and obtain the risk level of the network traffic data.

[0117] In this embodiment of the invention, the calculation of a comprehensive risk score based on anomaly identification data and network topology data includes:

[0118] Obtain network topology data;

[0119] Based on the anomaly identification data and the network topology data, a directed risk propagation graph of the network traffic data is constructed;

[0120] Based on the directed risk propagation graph, a breadth-first search logic is used to calculate the node risk value, wherein the mathematical expression of the breadth-first search logic is as follows:

[0121] ;

[0122] In the formula, For nodes The risk value, This is the node identifier of the current node. Adjacent nodes The risk value, This serves as the node identifier for adjacent nodes. Protocol type The corresponding attenuation factor, Protocol type, For nodes The set of adjacent nodes;

[0123] The overall risk score of the node risk value is calculated by summing all the node risk values.

[0124] It should be noted that obtaining network topology data is a process of actively collecting network device connection relationships through network scanning tools and network management protocols. Specific methods include using the SNMP protocol to poll network devices to obtain interface information, using the NetFlow protocol to collect traffic statistics, and combining network device configuration information to extract the physical and logical connection relationships between devices.

[0125] Furthermore, the acquired data includes network device identifiers consisting of IP addresses and MAC addresses, device type data labeling routers, switches, and firewalls, connection port information, link bandwidth capacity, and adjacency tables between devices. These data together constitute a complete description of the network topology, providing basic structural information for subsequent risk propagation analysis.

[0126] It should be noted that the construction of the directed risk propagation graph is based on the anomaly identification data and network topology data, mapping network devices and sessions as nodes, and mapping risk propagation paths as directed edges to generate the directed risk propagation graph, where nodes represent network devices or session entities, and edges represent the direction of risk propagation.

[0127] Furthermore, the essence of a directed risk propagation graph is to utilize the connectivity relationships in network topology data and the anomaly points in anomaly identification data, and store node relationships through an adjacency matrix, thus providing a graph structure foundation for risk propagation calculation.

[0128] It should be noted that the directed risk propagation graph is a graph structure model built based on network topology data and anomaly identification data. It is used to map network devices as nodes and the risk propagation path between devices as directed edges. It vividly represents the potential spread path and impact range of network security risks in the network. The node weight represents the risk level of the device, and the edge weight represents the intensity of risk propagation. This graph structure makes the originally abstract risk propagation process computable and visualized, providing a mathematical model basis for quantitative analysis of the chain reaction of risks in the network.

[0129] Furthermore, the edge weight, or the attenuation factor corresponding to the protocol type, is a predefined coefficient based on the protocol type, representing the attenuation strength of the risk propagating along the connection path.

[0130] Node weight is the node risk value. The initial value of the node risk value comes from the anomaly identification data. Specifically, when constructing a directed risk propagation graph, if a node is marked as having an anomaly by the anomaly monitoring module, then the node will be assigned an initial risk value. Nodes in the graph that are not directly marked as an anomaly but are connected to other anomaly nodes have their initial risk value set to 0.

[0131] It should be noted that the risk value of each node represents the potential risk level of network devices or sessions. It is generated by accumulating the risk values ​​of adjacent nodes and the attenuation factor, and is used to quantify the diffusion effect of risk in the topology.

[0132] It should be noted that the node risk value is a quantitative indicator calculated on the directed risk propagation graph using a graph traversal algorithm. It represents the degree of security risk of a specific network device or session in the current network environment, reflecting the likelihood of the node being threatened and its importance in the risk propagation process. It provides basic input for comprehensive risk scoring and helps identify key risk points in the network, enabling security protection resources to be prioritized for deployment on key nodes with higher risk values, thereby achieving more precise and efficient risk management.

[0133] Furthermore, since the risk values ​​of adjacent nodes have not yet been calculated, the first calculated risk value adopts an initialization method based on anomaly identification data. Specifically, the anomaly degree value of the current node is used as its initial risk value. The anomaly degree value comes from the anomaly score corresponding to the node in the anomaly identification data and is set to 0. This initialization mechanism ensures that the risk propagation calculation has a reasonable starting point, avoids logical contradictions caused by the node calculation order, and ensures that the risk value of the first calculated node can accurately reflect its actual security status.

[0134] It should be noted that the attenuation factor corresponding to the protocol type is a predefined weighting coefficient based on the protocol type, used to adjust the risk propagation intensity. It is a predefined weighting coefficient based on protocol characteristics and historical security event analysis. The predefined method is to assign values ​​by statistically analyzing the risk propagation characteristics of different protocols in historical attack events and combining expert experience.

[0135] Furthermore, the attenuation factors for specific protocol types are set as follows: TCP 0.8, UDP 0.6, ICMP 0.4, HTTP 0.7, and HTTPS 0.5. The attenuation factors for each protocol type adjust the intensity of risk propagation between different protocol sessions according to the characteristics of the protocol. For example, the risk attenuation of connection-oriented TCP is slower, while the risk attenuation of connectionless UDP is faster. This makes the risk propagation model more consistent with the security characteristics of different protocols in the actual network environment.

[0136] It should be noted that calculating the comprehensive risk score is essentially summing the risk values ​​of all nodes to generate a quantitative index of overall network risk. The higher the comprehensive risk score, the greater the overall network risk, which is used for subsequent risk level classification.

[0137] Furthermore, the neighbor node set is all nodes extracted from the directed risk propagation graph and collected through a graph traversal algorithm to ensure that risk calculation covers the entire network topology.

[0138] It should be noted that the comprehensive risk score is an aggregated value of the overall network risk. It is a scalar index obtained by summing the risk values ​​of all nodes. It is a quantitative representation of the overall risk level of the network and is used to provide input for risk level classification. The value ranges from 0 to 100. The higher the value, the greater the network risk. It is used to guide security response decisions.

[0139] In this embodiment of the invention, the step of classifying the risk level of the comprehensive risk score to obtain the risk level of the network traffic data includes:

[0140] The comprehensive risk score is compared across multiple levels based on a preset risk level threshold to obtain the threshold comparison results.

[0141] Based on this, a corresponding risk level identifier is assigned to the threshold comparison result through a risk level mapping rule to obtain the risk level of the network traffic data.

[0142] It should be noted that the essence of multi-level threshold comparison is the process of comparing the comprehensive risk score with the preset risk level threshold in real time, which is used to define the boundary of the risk level.

[0143] Furthermore, the multi-level threshold comparison has two thresholds: a low-to-medium risk threshold and a medium-to-high risk threshold. The low-to-medium risk threshold is 50, and the medium-to-high risk threshold is 80. When the comprehensive risk score is less than or equal to the low-to-medium risk threshold, the threshold comparison result is 1.

[0144] When the comprehensive risk score is less than or equal to the medium-high risk threshold, the threshold comparison result is 2;

[0145] When the overall risk score is greater than the medium-high risk threshold, the threshold comparison result is 3.

[0146] It should be noted that the threshold comparison result refers to the classification result obtained by comparing the comprehensive risk score calculated in real time with the preset multi-level thresholds. The values ​​are 1, 2 and 3, which are used to map the continuous risk score to discrete risk levels and reflect the degree of deviation of the current security status of the network from the historical benchmark.

[0147] It should be noted that the risk level identifier is assigned by mapping the value of the threshold comparison result to the risk level. When the threshold comparison result is 1, the assigned risk level identifier is low risk.

[0148] When the threshold comparison result is 2, the assigned risk level is identified as medium risk;

[0149] When the threshold comparison result is 3, the assigned risk level is identified as high risk.

[0150] It should be noted that the risk level is a network security status classification obtained through threshold comparison and label allocation. It represents a qualitative assessment of the overall risk level of the network and is a discretized mapping result of the comprehensive risk score in a preset threshold system. It reflects the gradual change of the network from safe to dangerous and is used to provide a classification decision basis for security response.

[0151] Furthermore, low-risk levels require only routine monitoring, medium-risk levels require enhanced monitoring, and high-risk levels trigger an emergency response immediately, thereby achieving refined management and optimized resource allocation for network security.

[0152] S5, perform response instruction mapping on the risk level to obtain the risk response instruction for the network traffic data;

[0153] In this embodiment of the invention, the step of mapping the risk level to a response instruction to obtain the risk response instruction for the network traffic data includes:

[0154] The risk level is mapped to a response instruction to obtain the operation instructions for the network traffic data.

[0155] The operation instructions are processed for protocol adaptation to obtain risk response instructions for the network traffic data.

[0156] It should be noted that response instruction mapping is a process of matching risk level identifiers with corresponding basic response actions. The specific mapping method is as follows: establish a correspondence between risk levels and response levels, and perform one-to-one matching and mapping based on the correspondence. This is used to transform abstract risk levels into specific executable response categories, ensuring that different risk levels can trigger security responses of appropriate strength.

[0157] Furthermore, low-risk levels are mapped to "notification" instructions, medium-risk levels to "enhanced monitoring" instructions, and high-risk levels to "emergency response" instructions.

[0158] It should be noted that the operation command is a standardized response command obtained after the response command is mapped. It is a general security response description that has not yet been adapted to the protocol and represents the direction of the response strategy initially determined by the system based on the risk level.

[0159] It should be noted that the protocol adaptation process is a process of adjusting the command parameters based on the operation command and network protocol type to obtain the risk response command. The protocol adaptation process includes parsing BGP routing policies and IP blocking rules.

[0160] Furthermore, the essence of protocol adaptation processing is to use a protocol-aware engine to convert operation instructions into executable network commands;

[0161] To adjust BGP routing commands, add AS path attributes;

[0162] To block malicious IP commands, set up IP blacklist entries and ensure that response commands are compatible with network devices.

[0163] It should be noted that the risk response instructions are a set of executable commands that are finally generated after protocol adaptation, including specific operation instructions, anomaly identification data and execution parameters;

[0164] The operational instructions include: generating security alerts and sending them to the management platform, automatically adjusting firewall policies to block TCP connections of specified IPs, issuing flow table rules to switches to limit UDP traffic, and initiating deep packet inspection for specific protocol sessions. These instructions directly drive network security devices and software to perform specific protective actions, enabling rapid containment and handling of identified risks, thereby forming a closed-loop management system from risk detection to response and handling, effectively enhancing the proactive defense capabilities of network security.

[0165] Furthermore, the execution parameters are dynamically parsed and injected from the router configuration table in the network configuration library through protocol adaptation processing, including protocol-specific fields, operation rules, and time-limit settings.

[0166] S6. Based on the risk response instruction, the dynamic anomaly detection process is updated through the performance index feedback mechanism to obtain the updated anomaly monitoring threshold.

[0167] In this embodiment of the invention, the step of updating the dynamic anomaly detection process based on the risk response instruction through a performance indicator feedback mechanism to obtain the updated anomaly monitoring threshold includes:

[0168] Based on the risk response instructions, false alarm events and alarm events are extracted;

[0169] Based on the false alarm events and the alarm events, calculate the total number of false alarms and the total number of alarms;

[0170] Calculate the false alarm rate based on the total number of false alarms and the total number of alarms;

[0171] Based on the false alarm rate, the dynamic anomaly monitoring threshold is updated to obtain the updated dynamic anomaly monitoring threshold.

[0172] It should be noted that false alarm events and alarm events are erroneous alarm records that have been verified and confirmed by rules, extracted from the alarm records after the execution of risk response instructions, as well as all alarm records within the same time period.

[0173] Furthermore, the total number of false alarms refers to the number of erroneous alarms that are verified and confirmed by the rules after the risk response command is executed, while the total number of alarms refers to the total number of alarm events within the same time period.

[0174] It should be noted that the false alarm rate is calculated by dividing the total number of false alarms by the total number of alarms. The false alarm rate represents the proportion of false alarms in the system alarms. It is used to quantify the accuracy of anomaly detection, evaluate detection performance, and provide feedback for adjusting the dynamic anomaly monitoring threshold. This optimizes detection accuracy in the network communication environment to reduce false alarms and improve security monitoring efficiency.

[0175] It should be noted that the process of updating the dynamic anomaly detection is achieved by updating the dynamic anomaly monitoring threshold. This is based on the false alarm rate and adjusts the old threshold through multiplication. Specifically, the update method is to multiply the dynamic anomaly monitoring threshold before the update by 1 and subtract the difference in the false alarm rate to obtain the updated dynamic anomaly monitoring threshold. This update method dynamically adjusts the detection sensitivity according to the false alarm rate. When the false alarm rate is high, the threshold is automatically lowered to tighten the detection and reduce false alarms.

[0176] When the false alarm rate is low, the threshold is maintained or appropriately relaxed to balance detection efficiency, thereby enabling adaptive anomaly detection in digital communication networks and improving the system's adaptability and robustness to dynamic traffic changes.

[0177] It should be noted that the updated dynamic anomaly monitoring threshold is a real-time detection threshold adjusted based on performance feedback. It represents the dynamic boundary value that distinguishes normal and abnormal traffic under network conditions. It fluctuates with changes in network protocol behavior and traffic patterns, and is used to provide an adaptive benchmark for subsequent anomaly detection. This ensures that the detection process can respond to traffic changes in real time, improve detection accuracy and efficiency, reduce false alarms and false negatives, and enhance the reliability and real-time performance of overall security monitoring.

[0178] S7. Construct a comprehensive network information security analysis report based on the risk level, the risk response instruction, and the updated anomaly monitoring threshold.

[0179] In this embodiment of the invention, the step of constructing a comprehensive network information security analysis report based on the risk level, the risk response instruction, and the updated anomaly monitoring threshold includes:

[0180] Integrate the risk level, the risk response instructions, and the updated anomaly monitoring thresholds to generate comprehensive report data;

[0181] The comprehensive report data is input into a preset report format template for report formatting to generate a comprehensive network information security analysis report.

[0182] It should be noted that the comprehensive report data is generated by integrating risk levels, risk response instructions, and updated anomaly monitoring thresholds into a structured dataset. The specific method includes extracting risk levels, parsing the operation commands and parameters in the risk response instructions, and recording the updated dynamic anomaly monitoring threshold values. These data are then aggregated to obtain the comprehensive report data.

[0183] It should be noted that the report formatting process involves inputting the comprehensive report data into a preset report format template. The template engine then populates the data and applies style rules to generate standardized report content, including adding a report title, timestamp, risk level summary, response instruction details, threshold update records, and visualization charts. This process aims to transform the raw data into an easy-to-read and distribute document format, improving the report's operability and readability, and supporting cybersecurity management decisions.

[0184] like Figure 2 The diagram shown is a functional block diagram of an online information security comprehensive analysis and monitoring system provided in an embodiment of the present invention.

[0185] The online information security comprehensive analysis and monitoring system 100 described in this invention can be installed in an electronic device. Depending on the functions implemented, the online information security comprehensive analysis and monitoring system 100 may include a data structuring processing module 101, a structured feature extraction module 102, a dynamic anomaly monitoring module 103, a comprehensive risk assessment module 104, an intelligent response decision-making module 105, a data monitoring feedback module 106, and a comprehensive analysis report generation module 107. The modules described in this invention can also be referred to as units, which are a series of computer program segments that can be executed by the processor of an electronic device and can perform a fixed function, stored in the memory of the electronic device.

[0186] In this embodiment, the functions of each module / unit are as follows:

[0187] The data structuring module is used to perform structuring processing on network traffic data to obtain structured data;

[0188] The structured feature extraction module is used to extract time-frequency-protocol domain features from the structured data to obtain a structured feature vector containing protocol-specific indicators.

[0189] The dynamic anomaly monitoring module is used to perform dynamic anomaly detection on the structured feature vector through a preset anomaly monitoring threshold to obtain anomaly identification data of the network traffic data.

[0190] The comprehensive risk assessment module is used to calculate a comprehensive risk score based on anomaly identification data and network topology data, classify the risk level of the comprehensive risk score, and obtain the risk level of the network traffic data.

[0191] The intelligent response decision module is used to perform response instruction mapping on the risk level to obtain the risk response instruction for the network traffic data;

[0192] The data monitoring and feedback module is used to update the dynamic anomaly detection process based on the risk response instruction through a performance indicator feedback mechanism, so as to obtain the updated anomaly monitoring threshold.

[0193] The comprehensive analysis report generation module is used to construct a comprehensive network information security analysis report based on the risk level, the risk response instruction, and the updated anomaly monitoring threshold.

[0194] In the several embodiments provided by this invention, it should be understood that the disclosed methods and systems can be implemented in other ways. For example, the system embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and other division methods may be used in actual implementation.

[0195] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0196] Furthermore, the functional modules in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in the form of hardware plus software functional modules.

[0197] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0198] The embodiments of this application can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence is the theory, method, technology, and application system that uses digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results.

[0199] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. A method for comprehensive analysis and monitoring of information security on the Internet, characterized in that, The method comprises: S1, structuring the network traffic data to obtain structured data; S2, extracting time-frequency-protocol domain features from the structured data to obtain a structured feature vector containing protocol-specific indicators, wherein the specific method of time-frequency-protocol domain feature extraction is as follows: extracting time domain features from the structured data to obtain a time domain feature vector; extracting frequency domain features from the structured data to obtain a frequency domain feature vector; extracting protocol domain features from the structured data by calculating protocol state transition entropy, to obtain a protocol domain feature vector, wherein the mathematical expression of the Shannon entropy formula used to calculate the protocol state transition entropy is as follows: ； wherein is a protocol state transition entropy value, is a protocol state is a probability of occurrence in a state sequence, is a protocol state, is a protocol state, is a protocol index, is a total number of protocol states; fusing the time domain feature vector, the frequency domain feature vector and the protocol domain feature vector to obtain the structured feature vector; S3, dynamically detecting the structured feature vector by a pre-set abnormality monitoring threshold to obtain abnormality identification data of the network traffic data; S4, calculating a comprehensive risk score based on the abnormality identification data in combination with network topology data, dividing the comprehensive risk score into risk levels to obtain the risk level of the network traffic data; S5, mapping the risk level to a response instruction to obtain the risk response instruction of the network traffic data; S6, updating the process of the dynamic abnormality detection based on the risk response instruction through a performance index feedback mechanism to obtain an updated abnormality monitoring threshold; S7, constructing a network information security comprehensive analysis report based on the risk level, the risk response instruction and the updated abnormality monitoring threshold.

2. The method of claim 1, wherein the method further comprises: The structuring of the network traffic data to obtain structured data comprises: denoising the network traffic data to obtain initial network traffic data; performing multi-protocol analysis on the initial network traffic data to obtain protocol analysis data of the network traffic data; serializing the protocol analysis data to obtain structured data of the network traffic data.

3. The method of claim 1, wherein the method further comprises: The dynamic abnormality detection of the structured feature vector by a pre-set abnormality monitoring threshold to obtain abnormality identification data of the network traffic data comprises: dynamically adjusting the pre-set abnormality monitoring threshold based on the protocol state transition entropy to obtain a dynamic abnormality monitoring threshold; detecting abnormal points of the structured feature vector using the dynamic abnormality monitoring threshold to obtain abnormality identification data of the network traffic data.

4. The method of claim 1, wherein the method further comprises: The calculation of a comprehensive risk score based on abnormality identification data in combination with network topology data comprises: ​ obtaining network topology data; constructing a directed risk propagation graph of the network traffic data based on the abnormality identification data and the network topology data; calculating node risk values based on the directed risk propagation graph using a breadth-first search logic, wherein the mathematical expression of the breadth-first search logic is as follows: ； wherein is a risk value of the node , is a node identifier of the current node , is a risk value of the neighboring node , is a node identifier of the neighboring node , is a protocol type , is a set of neighboring nodes of the node calculating a comprehensive risk score of the node risk values by summing all the node risk values.

5. The method of claim 1, wherein the method further comprises: The risk level division on the comprehensive risk score includes: ​ Multi-level threshold comparison on the comprehensive risk score based on a preset risk level threshold to obtain a threshold comparison result; Based on, through a risk level mapping rule, the threshold comparison result is assigned a corresponding risk level identifier to obtain the risk level of the network traffic data.

6. The method of claim 1, wherein the method further comprises: The response instruction mapping of the risk level includes: ​ Operation instruction mapping of the risk level to obtain the risk response instruction of the network traffic data; Protocol adaptation processing of the operation instruction to obtain the risk response instruction of the network traffic data.

7. The method of claim 3, wherein the method further comprises: The performance index feedback mechanism is used to update the dynamic anomaly detection process based on the risk response instruction to obtain an updated anomaly monitoring threshold, including: ​ Based on the risk response instruction, false alarm events and alarm events are extracted; Based on the false alarm events and the alarm events, the total number of false alarms and the total number of alarms are counted; Based on the false alarm rate, the dynamic anomaly monitoring threshold is updated to obtain an updated dynamic anomaly monitoring threshold. The network information security comprehensive analysis report is constructed based on the risk level, the risk response instruction, and the updated anomaly monitoring threshold, including:

8. The method of claim 1, wherein the method further comprises: Integrate the risk level, the risk response instruction, and the updated anomaly monitoring threshold to generate comprehensive report data; ​ The comprehensive report data is input into a preset report format template for report formatting processing to generate a network information security comprehensive analysis report. The system includes:

9. An integrated analysis and monitoring system for information security on the Internet, characterized by, A data structuring processing module for structuring network traffic data to obtain structured data; A structured feature extraction module for extracting time-frequency-protocol domain features from the structured data to obtain a structured feature vector containing protocol-specific indicators, wherein the specific method of time-frequency-protocol domain feature extraction is as follows: Time domain feature extraction is performed on the structured data to obtain a time domain feature vector; Frequency domain feature extraction is performed on the structured data to obtain a frequency domain feature vector; Protocol domain feature extraction is performed on the structured data by calculating protocol state transition entropy to obtain a protocol domain feature vector, wherein the mathematical expression of the Shannon entropy formula used to calculate the protocol state transition entropy is as follows: The time domain feature vector, the frequency domain feature vector, and the protocol domain feature vector are fused to obtain the structured feature vector; ； wherein is a protocol state transition entropy value, is a protocol state is a probability of occurrence in a state sequence, is a protocol state, is a protocol state, is a protocol index, is a total number of protocol states; A dynamic anomaly monitoring module for dynamically detecting anomalies in the structured feature vector based on a preset anomaly monitoring threshold to obtain anomaly identification data of the network traffic data; A comprehensive risk assessment module for calculating a comprehensive risk score based on anomaly identification data in combination with network topology data, dividing the comprehensive risk score into a risk level, and obtaining the risk level of the network traffic data; ​ The intelligent response decision module is configured to perform response instruction mapping on the risk level, and obtain a risk response instruction of the network traffic data. The data monitoring feedback module is configured to update a flow of the dynamic anomaly detection based on the risk response instruction through a performance index feedback mechanism, and obtain an updated anomaly monitoring threshold. The comprehensive analysis report generation module is configured to construct a network information security comprehensive analysis report based on the risk level, the risk response instruction, and the updated anomaly monitoring threshold.

Images