A network security dynamic early warning method and system based on multi-information fusion

Abstract

The application is suitable for the field of network security technology, and provides a network security dynamic early warning method and system based on multi-information fusion.The method comprises the following steps: collecting network information data from multiple aspects; preprocessing the network information data, extracting abnormal security features from the preprocessed network information data, wherein the abnormal security features include abnormal data flow, flow increase of specific protocols and illegal access attempts; summarizing and fusing the abnormal security features extracted from different network information data, performing correlation analysis on the fused data, and constructing a security event early warning model based on the correlation analysis; through the three-level optimization mechanism of abnormal features, the protocol risk filtering, the source address confidence strengthening and the dynamic time limit control, the signal-to-noise ratio of the feature set is significantly improved, and the calculation load is reduced while ensuring the complete reservation of the core threat features.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a dynamic early warning method and system for network security based on multi-information fusion. Background Technology

[0002] With the rapid development and widespread adoption of the internet, cybersecurity threats are becoming increasingly severe. Threats such as cyberattacks, malicious code, and data breaches are constantly emerging, causing serious losses and risks to individuals, organizations, and society. To effectively address these threats, dynamic early warning of cybersecurity threats has become a crucial task.

[0003] Multi-information fusion refers to the process of integrating information from different sources using computer technology to generate information with higher value and greater accuracy. However, current multi-information fusion methods do not perform correlation analysis on data from different sources, resulting in insufficient efficiency and accuracy in security early warning.

[0004] Therefore, there is a need to provide a dynamic early warning method and system for network security based on multi-information fusion, which aims to solve the above problems. Summary of the Invention

[0005] In view of the shortcomings of the existing technology, the purpose of this invention is to provide a network security dynamic early warning method and system based on multi-information fusion, so as to solve the problems existing in the above-mentioned background technology.

[0006] This invention is implemented as follows: a dynamic early warning method for network security based on multi-information fusion, the method comprising the following steps: Collect network information data from multiple sources, including but not limited to network traffic data, system logs, and security device alarms; The network information data is preprocessed, and abnormal security features are extracted from the preprocessed network information data. The abnormal security features include abnormal data traffic, increased traffic of specific protocols, and unauthorized access attempts. The abnormal security features extracted from different network information data are summarized and fused, and the fused data is subjected to correlation analysis. Based on the correlation analysis, a security event early warning model is constructed. Real-time monitoring is conducted through a security incident early warning model. When the security incident early warning model detects an anomaly, it issues an early warning and activates the emergency response mechanism.

[0007] Another objective of this invention is to provide a dynamic early warning system for network security based on multi-information fusion, the system comprising: The multi-information acquisition module is used to collect network information data from various aspects, including but not limited to network traffic data, system logs, and security device alarms. The abnormal security feature module is used to preprocess network information data and extract abnormal security features from the preprocessed network information data. The abnormal security features include abnormal data traffic, increased traffic of specific protocols, and unauthorized access attempts. The early warning model construction module is used to summarize and fuse abnormal security features extracted from different network information data, perform correlation analysis on the fused data, and build a security event early warning model based on the correlation analysis. The network dynamic early warning module is used for real-time monitoring through the security event early warning model. When the security event early warning model detects an anomaly, it issues an early warning message and activates the emergency response mechanism.

[0008] Compared with the prior art, the beneficial effects of the present invention are: 1. This invention uses a dynamic optimization mechanism of a high-risk protocol library to feed back new high-risk protocols identified during feature extraction to a deep analysis protocol list in real time, achieving minute-level self-evolution of protocol monitoring targets and solving the problem of lagging detection of new threats in traditional solutions.

[0009] 2. This invention significantly improves the signal-to-noise ratio of the feature set by integrating protocol risk filtering, source address confidence enhancement, and dynamic timeliness control through a three-level optimization mechanism for abnormal features, thereby reducing computational load while ensuring the complete preservation of core threat features.

[0010] 3. This invention utilizes a closed-loop linkage of dual-track correlation analysis to capture short-term attack correlations using a real-time computing track, combined with historical verification data from a baseline computing track, to form an adaptive identification capability for unknown threats, and achieves real-time enhancement of the system's defense strategy through a protocol library feedback mechanism. Attached Figure Description

[0011] Figure 1 This is a flowchart of a dynamic early warning method for network security based on multi-information fusion.

[0012] Figure 2 This is a flowchart illustrating the preprocessing steps in a dynamic early warning method for cybersecurity based on multi-information fusion.

[0013] Figure 3 This is a flowchart illustrating the extraction of abnormal security features in a dynamic early warning method for network security based on multi-information fusion.

[0014] Figure 4 This is a flowchart illustrating the construction of a security event early warning model in a dynamic early warning method for network security based on multi-information fusion.

[0015] Figure 5 This is a flowchart illustrating correlation analysis in a dynamic early warning method for network security based on multi-information fusion.

[0016] Figure 6 This is a schematic diagram of the structure of a network security dynamic early warning system based on multi-information fusion. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0018] The specific implementation of the present invention will be described in detail below with reference to specific embodiments.

[0019] like Figure 1 As shown in the figure, this embodiment of the invention provides a dynamic early warning method for network security based on multi-information fusion, the method comprising the following steps: S100, collect network information data from multiple sources, including but not limited to network traffic data, system logs, and security device alarms; S200, preprocess the network information data, and extract abnormal security features from the preprocessed network information data. The abnormal security features include abnormal data traffic, increased traffic of specific protocols, and unauthorized access attempts. S300 will summarize and merge abnormal security features extracted from different network information data, perform correlation analysis on the merged data, and build a security event early warning model based on the correlation analysis. The S400 uses a security incident early warning model for real-time monitoring. When the security incident early warning model detects an anomaly, it issues an early warning and activates the emergency response mechanism.

[0020] In this embodiment of the invention, data from different information sources is integrated to provide more comprehensive, accurate and timely cybersecurity threat intelligence. Specifically, multiple aspects of network information data are collected, including but not limited to network traffic data, system logs and security device alarms. By integrating information from multiple data sources, more comprehensive cybersecurity threat intelligence can be provided.

[0021] Next, the network information data is preprocessed, and abnormal security features are extracted from the preprocessed network information data. These abnormal security features include abnormal data traffic, increased traffic of specific protocols, and unauthorized access attempts. The abnormal security features extracted from different network information data are then summarized and fused, and correlation analysis is performed on the fused data. Based on the correlation analysis, a security event early warning model is constructed. Through multi-information fusion technology, more accurate security event early warning information can be generated. Correlation analysis makes the security event early warning model more accurate and reliable, thus enabling real-time perception and identification of network security threats, and timely response and handling.

[0022] Finally, real-time monitoring can be achieved through a security incident early warning model. When the model detects an anomaly, it issues an alert and activates the emergency response mechanism. This model is adaptable to different network environments and business needs, exhibiting strong scalability and flexibility. Upon receiving an alert, once the authenticity and urgency of the anomaly are confirmed, the emergency response team, technical experts, management personnel, and other relevant personnel should be immediately notified. Based on the pre-established emergency response plan, the responsibilities and tasks of each department and personnel should be clearly defined to ensure an orderly and efficient response to the anomaly.

[0023] like Figure 2 As shown, in a preferred embodiment of the present invention, the step of preprocessing network information data specifically includes: S201 removes duplicate data based on a combination of source IP, destination IP, port, protocol, and timestamp fields, and identifies and deletes data containing invalid or unreasonable field values; S202, perform standardization settings, convert field names to a unified naming convention, and ensure that IP addresses and port numbers are in a standardized format; S203 checks the integrity of network information data based on the hash value method. For system logs and security device alarms, it checks whether all records contain critical information.

[0024] In this embodiment of the invention, when preprocessing network information data, for network traffic data, deduplication can be performed based on combinations of fields such as source IP, destination IP, port, protocol, and timestamp. For system logs and security device alarms, deduplication is typically performed based on the uniqueness of log messages (such as event ID, timestamp, and description), identifying and deleting data containing invalid or unreasonable field values. Then, field standardization settings are performed, converting field names to a unified naming convention, such as using lowercase letters and underscores, to ensure that IP addresses and port numbers are in a standardized format. Finally, data accuracy and integrity checks are also required. Specifically, the integrity of network information data is checked based on a hash value method. For system logs and security device alarms, it is checked whether all records contain key information, which needs to be set by the user in advance.

[0025] In this embodiment of the invention, checking the integrity of network information data based on the hash value method specifically includes: S2031, The network information data is standardized to obtain standardized network information data. Key fields are extracted from the standardized network information data and combined to generate a unique hash value to obtain the current data baseline fingerprint. S2032, Obtain the historical fingerprint database, compare the current data benchmark fingerprint with the historical fingerprint database one by one, and obtain the records with integrity verification anomalies; S2033, perform field change feature analysis on records with integrity verification anomalies, extract time concentration, source IP distribution pattern and protocol association features from the field change features, identify collaborative attack patterns, and generate tampering behavior diagnosis results based on the identified collaborative attack patterns. S2034, obtain the historical tampering database, use the collaborative attack pattern in the tampering behavior diagnosis results to match the historical attack signature, use the historical tampering database to count the tampering frequency, and associate the source IP and protocol to obtain a list of high-risk protocols. Based on the matching degree between the collaborative attack pattern and the new attack signature, the risk value of the protocols in the list of high-risk protocols is weighted in real time to generate a list of high-risk protocols with dynamic weights. S2035, based on the dynamic weight values ​​in the list of high-risk protocols with dynamic weights, executes a hierarchical defense strategy, while recording defense action parameters and obtaining a defense execution report; S2036, based on the dynamic weight value, the protocol monitoring priority is automatically adjusted, a defense action tracing log is generated and bound to the defense execution report, and a defense execution report containing the tracing log is obtained; S2037, perform hash binding verification on the source log in the defense execution report containing source log and the current data benchmark fingerprint to obtain the data trust authentication result, and based on the data trust authentication result, finally confirm the integrity of network information data.

[0026] In this embodiment, the present invention establishes a data baseline fingerprint by extracting key fields and generating a unique hash value; it identifies abnormal records and analyzes collaborative attack patterns based on historical fingerprint database comparison; it dynamically overlays protocol risk weights with historical tampering databases to generate a high-risk protocol list; it executes a hierarchical defense strategy and generates a source tracing log by combining dynamic weight values; and finally, it achieves data trust authentication through hash binding verification, solving the problems of traditional data integrity checks that cannot associate attack features and are difficult to respond to new collaborative tampering behaviors in a timely manner.

[0027] like Figure 3 As shown in the preferred embodiment of the present invention, the step of extracting abnormal security features from the preprocessed network information data specifically includes: S204, extract abnormal data traffic, analyze traffic size and traffic rate, compare traffic size with traffic threshold to determine abnormal traffic, and compare traffic rate with rate threshold to determine abnormal rate; S205, extract the traffic increase of specific protocols, perform statistics on protocol types in network traffic data, determine the traffic increase corresponding to each protocol type, and determine that traffic with a traffic increase value exceeding the growth threshold is abnormal traffic; perform time series analysis on the traffic of specific protocols to identify abnormal traffic growth patterns. S206, Identify unauthorized access attempts. By analyzing system logs and security device alarms, identify abnormal user behavior, establish normal user access patterns, and identify access attempts that do not conform to the normal patterns as unauthorized access attempts.

[0028] In this embodiment of the invention, in order to obtain abnormal security features, three aspects of feature extraction are required. First, abnormal data traffic is extracted, specifically by analyzing traffic size and traffic rate. The traffic size is compared with a traffic threshold to determine abnormal traffic, and the traffic rate is compared with a rate threshold to determine abnormal rate. Furthermore, the number and size of data packets in the network can be analyzed and compared with values ​​under normal conditions to identify the number and size of abnormal packets.

[0029] Next, the system extracts traffic increases for specific protocols, statistically analyzes protocol types in network traffic data, identifies traffic increases corresponding to each protocol type, and determines traffic increases exceeding growth thresholds as abnormal traffic. Simultaneously, it performs time-series analysis on traffic for specific protocols to identify abnormal traffic growth patterns. Following this, it extracts unauthorized access attempts by analyzing system logs and security device alarms to identify abnormal user behaviors, such as numerous failed logins or frequent IP address changes. It establishes normal user access patterns and identifies access attempts that do not conform to these patterns as unauthorized access attempts.

[0030] In this embodiment of the invention, time-series analysis is performed on traffic of a specific protocol to identify abnormal traffic growth patterns, specifically including: S2051, sort the high-risk protocol list by risk value to obtain a protocol list for in-depth analysis; S2052, for the list of deep analysis protocols, construct time series only for the protocols that have passed the data trust authentication results to obtain a targeted time series dataset; S2053, extract hourly growth rate features, volatility features, and trend slope features from the directional time series dataset to construct the protocol feature matrix; S2054, by combining the protocol feature matrix with in-depth analysis of the protocol list, establish differentiated baselines according to risk level to obtain the constructed hierarchical baseline model; S2055, determine and obtain real-time traffic data, use the constructed hierarchical baseline model to compare the real-time traffic data with the preset baseline threshold, classify and identify abnormal types, and obtain an abnormal growth pattern report. S2056, add abnormal protocols to the deep analysis protocol list for abnormal growth pattern reports, obtain high-risk protocol update instructions, use high-risk protocol update instructions to update the parameters of the constructed hierarchical baseline model, and obtain the updated hierarchical baseline model. S20567, using the updated hierarchical baseline model, finally obtains an updated abnormal growth pattern report, and based on the updated abnormal growth pattern report, finally identifies abnormal traffic growth patterns.

[0031] In this embodiment, the present invention generates a list of protocols for in-depth analysis by ranking high-risk protocols, constructs a targeted time series dataset based on data trust authentication, extracts multi-dimensional traffic features to establish a protocol feature matrix, constructs a differentiated baseline model according to risk level, compares traffic data in real time to identify abnormal types and dynamically updates the protocol list, and realizes abnormal traffic detection through iterative optimization of the hierarchical baseline model, thus overcoming the shortcomings of static protocol risk assessment and inability to adapt to new threats in traditional traffic analysis.

[0032] like Figure 4 As shown in the preferred embodiment of the present invention, the steps of summarizing and fusing abnormal security features extracted from different network information data, performing correlation analysis on the fused data, and constructing a security event early warning model based on the correlation analysis specifically include: S301, summarize the abnormal security features extracted from different network information data to obtain an abnormal feature set; S302, perform correlation analysis on abnormal security features, and assign weights to each abnormal security feature based on the correlation analysis results; S303, based on the results of weight allocation and correlation analysis, constructs a security incident early warning model. The security incident early warning model can integrate multiple abnormal features into a comprehensive abnormal indicator or score.

[0033] In this embodiment of the invention, to construct a security incident early warning model, it is first necessary to summarize the abnormal security features extracted from different network information data to obtain an abnormal feature set. The feature set is then organized, removing duplicate or redundant features. Correlation analysis is performed on the abnormal security features to identify which features are strongly correlated, which helps in understanding the relationships between different abnormal features. Based on the correlation analysis results, a weight is assigned to each abnormal security feature. Finally, based on the weight allocation and the results of the correlation analysis, a security incident early warning model is constructed. This model can integrate multiple abnormal features into a comprehensive abnormal indicator or score, which is then output to network security administrators or relevant systems.

[0034] In this embodiment of the invention, abnormal security features extracted from different network information data are summarized to obtain an abnormal feature set, specifically including: S3011, call the high-risk protocol list to convert it into a protocol risk level mapping table; S3012, based on extracting illegal access attempts to obtain illegal access attempt features, and performing behavioral pattern clustering processing on the illegal access attempt features, identifies three types of attack intent tags: scanning and probing, brute-force attack, and privilege escalation, and generates a high-frequency abnormal access source identifier library; S3013: For the protocol risk level mapping table, retain the features associated with high-risk protocols in the mapping table, filter the features of low-risk protocols, and associate with external threat intelligence streams to dynamically upgrade the risk level of protocols with active attacks, thereby obtaining a dynamically updated set of high-risk protocol features. S3014, add high-confidence tags to the features matched by the high-frequency abnormal access source identifier library, and generate three-level confidence tags according to the attack intent tags based on preset threat weights, thus obtaining a high-confidence feature set with hierarchical confidence tags; S3015 extracts features from the dynamically updated high-risk protocol feature set and the high-confidence feature set with graded confidence level labels, and sets a dynamic time period. If the features extracted from the dynamically updated high-risk protocol feature set or the features extracted from the high-confidence feature set with graded confidence level labels expire, they are automatically removed from the corresponding feature set. The monitoring time is dynamically adjusted according to the confidence level, and the monitoring period is extended for high-confidence features, so as to obtain high-risk protocol features and high-confidence features with optimized timeliness. S3016 feeds back the features that appear for the first time in the high-risk protocol features after timeliness optimization to the deep analysis protocol list, and associates the spatiotemporal context information of the feature appearance to generate a high-risk feature feedback package with attack scenarios. S3017 utilizes the time-optimized high-risk protocol features and high-confidence features, combined with the high-risk feature feedback packet with attack scenarios, to obtain an abnormal feature set.

[0035] In this embodiment, the present invention generates a high-risk protocol feature set by fusing protocol risk mapping with external threat intelligence, clusters illegal access behaviors to generate a high-confidence feature library, implements dynamic timeliness cycle control and confidence level monitoring, feeds back the first appearance of high-risk features to the deep analysis protocol list and associates them with attack scenarios, and finally integrates timeliness-optimized features and scenario-based high-risk feature packages to construct an abnormal feature set, thus solving the core pain points of low signal-to-noise ratio, timeliness lag and weak scenario association in multi-source feature fusion.

[0036] like Figure 5 As shown, in a preferred embodiment of the present invention, the step of performing correlation analysis on abnormal security features and assigning weights to each abnormal security feature based on the correlation analysis results specifically includes: S3021, Calculate the correlation coefficients between various abnormal safety features based on the Pearson correlation method; S3022 uses the correlation coefficient as a weight after formula transformation, normalizes the correlation coefficient to the range of 0 to 1 and uses it as a weight, and assigns weights to each abnormal security feature.

[0037] In this embodiment of the invention, Pearson's correlation coefficient is used to calculate the correlation coefficients between various abnormal security features. These coefficients reveal the degree of association between features, and their values ​​typically range from -1 to 1, where 1 represents a perfect positive correlation, -1 represents a perfect negative correlation, and 0 represents no correlation. The correlation coefficients are then transformed using a formula and used as weights. The correlation coefficients are normalized to the range of 0 to 1 and used as weights to assign weights to each abnormal security feature. The formula used for this transformation is predetermined.

[0038] In this embodiment of the invention, the correlation coefficient between various abnormal security features is calculated based on the Pearson correlation method, specifically including: S30211, based on the set of abnormal features, filter features with high confidence timeliness labels and form real-time analysis group features; S30212, Based on the updated abnormal growth pattern report, extract historical verification features to form the baseline analysis group features; S30213, calculate the Pearson correlation coefficient for the real-time analysis group features, capture short-term attack correlations, and obtain the real-time correlation coefficient; S30214, Calculate the Pearson correlation coefficient for the characteristics of the benchmark analysis group, analyze the long-term association pattern, and obtain the historical correlation coefficient; S30215, Repeatability detection is performed on the real-time analysis group features according to the baseline analysis group features to obtain the detection results. Based on the detection results, the real-time correlation coefficient and the historical correlation coefficient are mixed and calculated to finally obtain the correlation coefficient between each abnormal safety feature. The process of calculating the real-time correlation coefficient and the historical correlation coefficient based on the detection results includes: when the real-time analysis group features appear in the benchmark analysis group features, the real-time correlation coefficient is used to cover the historical correlation coefficient; when the real-time analysis group features do not appear in the benchmark analysis group features, the real-time correlation coefficient and the historical correlation coefficient are added together by a preset multiple to obtain the calculated mixed coefficient. The calculated mixed coefficient is then detected according to a preset mixed coefficient threshold, and high-risk protocols corresponding to the calculated mixed coefficients that are greater than the preset mixed coefficient threshold are extracted. At the same time, the corresponding high-risk protocols are fed back to the deep analysis protocol list.

[0039] In this embodiment, the present invention selects high-confidence timeliness features to form a real-time analysis group, constructs a benchmark analysis group based on historical verification features, calculates Pearson correlation coefficients in parallel to capture short-term attacks and long-term patterns, dynamically mixes real-time and historical correlation coefficients through a repeatability detection mechanism, extracts high-risk protocols based on the mixed coefficient threshold and feeds them back to the deep analysis protocol list, forming a closed-loop link for unknown threat identification and defense strategy enhancement, thus breaking through the technical bottleneck of the difficulty in coordinating real-time performance and historical verification in traditional correlation analysis.

[0040] like Figure 6 As shown in the figure, this embodiment of the invention also provides a network security dynamic early warning system based on multi-information fusion, the system comprising: The multi-information acquisition module 100 is used to collect various network information data, including but not limited to network traffic data, system logs, and security device alarms. The abnormal security feature module 200 is used to preprocess network information data and extract abnormal security features from the preprocessed network information data. The abnormal security features include abnormal data traffic, increased traffic of specific protocols, and unauthorized access attempts. The early warning model construction module 300 is used to summarize and fuse abnormal security features extracted from different network information data, perform correlation analysis on the fused data, and construct a security event early warning model based on the correlation analysis. The Network Dynamic Early Warning Module 400 is used for real-time monitoring through the security event early warning model. When the security event early warning model detects an anomaly, it issues an early warning message and activates the emergency response mechanism.

[0041] In a preferred embodiment of the present invention, the abnormal security feature module 200 includes: The deduplication unit is used to remove duplicate data based on a combination of source IP, destination IP, port, protocol, and timestamp fields, and to identify and delete data containing invalid or unreasonable field values. The data standardization unit is used for standardization settings, converting field names into a unified naming convention to ensure that IP addresses and port numbers are in a standardized format; The integrity verification unit is used to check the integrity of network information data based on the hash value method. For system logs and security device alarms, it checks whether all records contain critical information.

[0042] In a preferred embodiment of the present invention, the abnormal security feature module 200 further includes: The abnormal data traffic unit is used to extract abnormal data traffic, analyze the traffic size and traffic rate, compare the traffic size with the traffic threshold to identify abnormal traffic, and compare the traffic rate with the rate threshold to identify abnormal rate. The abnormal traffic increase unit is used to extract traffic increases for specific protocols, statistically analyze the protocol types in network traffic data, determine the traffic increase corresponding to each protocol type, and identify traffic with a traffic increase value exceeding the growth threshold as abnormal traffic; it also performs time series analysis on the traffic of specific protocols to identify abnormal traffic growth patterns. The illegal access determination unit is used to extract illegal access attempts. By analyzing system logs and security device alarms, it identifies abnormal user behavior, establishes normal user access patterns, and identifies access attempts that do not conform to the normal patterns as illegal access attempts.

[0043] In a preferred embodiment of the present invention, the early warning model construction module 300 includes: The abnormal feature set unit is used to summarize the abnormal security features extracted from different network information data to obtain an abnormal feature set; The correlation analysis unit is used to perform correlation analysis on abnormal security features and assign weights to each abnormal security feature based on the correlation analysis results. The early warning model building unit is used to build a security incident early warning model based on the results of weight allocation and correlation analysis. The security incident early warning model can integrate multiple abnormal features into a comprehensive abnormal indicator or score.

[0044] In a preferred embodiment of the present invention, the correlation analysis unit includes: The correlation coefficient subunit is used to calculate the correlation coefficient between various abnormal security features based on the Pearson correlation method. The weight allocation subunit is used to transform the correlation coefficients using a formula and use them as weights. The correlation coefficients are normalized to the range of 0 to 1 and used as weights to assign weights to each abnormal security feature.

[0045] The above description only details the preferred embodiments of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0046] It should be understood that although the steps in the flowcharts of the various embodiments of the present invention are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the various embodiments may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least a portion of the sub-steps or stages of other steps.

[0047] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0048] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the disclosure in the specification and embodiments. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and embodiments are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the claims.

Claims

1. A dynamic early warning method for network security based on multi-information fusion, characterized in that, The method includes the following steps: Collect network information data from multiple sources, including but not limited to network traffic data, system logs, and security device alarms; The network information data is preprocessed, and abnormal security features are extracted from the preprocessed network information data. The abnormal security features include abnormal data traffic, increased traffic of specific protocols, and unauthorized access attempts. The abnormal security features extracted from different network information data are summarized and fused, and the fused data is subjected to correlation analysis. Based on the correlation analysis, a security event early warning model is constructed. Real-time monitoring is conducted through a security incident early warning model. When the security incident early warning model detects an anomaly, it issues an early warning and activates the emergency response mechanism. The step of preprocessing network information data specifically includes: It removes duplicate data based on a combination of source IP, destination IP, port, protocol, and timestamp fields, and identifies and deletes data containing invalid or unreasonable field values. Standardize the settings by converting field names to a unified naming convention to ensure that IP addresses and port numbers are in a standardized format; The integrity of network information data is checked using the hash value method. For system logs and security device alarms, it is checked whether all records contain critical information. Specifically, the method of checking the integrity of network information data based on hash values ​​includes: The network information data is standardized to obtain standardized network information data. Key fields are extracted from the standardized network information data and combined to generate a unique hash value to obtain the current data baseline fingerprint. Obtain the historical fingerprint database, compare the current data baseline fingerprint with the historical fingerprint database one by one, and obtain the records with integrity verification anomalies; For records with integrity verification anomalies, field change feature analysis is performed, and the time concentration, source IP distribution pattern and protocol association features in the field change features are extracted to identify the collaborative attack mode. Based on the identification of the collaborative attack mode, a tampering behavior diagnosis result is generated. Obtain the historical tampering database, match the collaborative attack patterns in the tampering behavior diagnosis results with historical attack signatures, use the historical tampering database to count the tampering frequency, and associate the source IP and protocol to obtain a list of high-risk protocols. Based on the matching degree between the collaborative attack patterns and new attack signatures, the risk values ​​of the protocols in the list of high-risk protocols are weighted in real time to generate a list of high-risk protocols with dynamic weights. A tiered defense strategy is executed based on the dynamic weight values ​​of the high-risk protocol list with dynamic weights, while defense action parameters are recorded to obtain a defense execution report. The protocol monitoring priority is automatically adjusted based on the dynamic weight value, defense action tracing logs are generated and bound to the defense execution report, resulting in a defense execution report containing the tracing logs; The source logs in the defense execution report containing source logs are hash-bound and verified with the current data benchmark fingerprint to obtain the data trust authentication result. Based on the data trust authentication result, the integrity of network information data is finally confirmed. The steps of summarizing and fusing abnormal security features extracted from different network information data, performing correlation analysis on the fused data, and constructing a security event early warning model based on the correlation analysis specifically include: The abnormal security features extracted from different network information data are summarized to obtain an abnormal feature set; Perform correlation analysis on the abnormal security features, and assign weights to each abnormal security feature based on the correlation analysis results; Based on the results of weight allocation and correlation analysis, a security incident early warning model is constructed. The security incident early warning model can integrate multiple abnormal features into a comprehensive abnormal indicator or score. Specifically, the abnormal security features extracted from different network information data are summarized to obtain an abnormal feature set, which includes: Convert the list of high-risk protocols into a protocol risk level mapping table; Based on extracting illegal access attempts to obtain illegal access attempt features, and performing behavioral pattern clustering on the illegal access attempt features, we can identify three types of attack intent tags: scanning and probing, brute-force attack, and privilege escalation, and generate a high-frequency abnormal access source identifier library. For the protocol risk level mapping table, retain the features associated with high-risk protocols in the mapping table, filter the features of low-risk protocols, and associate with external threat intelligence streams to dynamically upgrade the risk level of protocols with active attacks, thereby obtaining a dynamically updated set of high-risk protocol features. High-confidence tags are added to the features matched by the high-frequency abnormal access source identifier library, and threat weights are preset according to the attack intent tags to generate three-level confidence tags, resulting in a high-confidence feature set with hierarchical confidence tags; Based on the dynamically updated high-risk protocol feature set and the high-confidence feature set with graded confidence level labels, features are extracted from the sets respectively, and a dynamic time period is set. If the features extracted from the dynamically updated high-risk protocol feature set or the features extracted from the high-confidence feature set with graded confidence level labels expire, the corresponding feature set is automatically removed, and the monitoring time is dynamically adjusted according to the confidence level. The monitoring period for high-confidence features is extended to obtain high-risk protocol features and high-confidence features with optimized timeliness. The features that appear for the first time in the high-risk protocol features after timeliness optimization are fed back to the deep analysis protocol list, and the spatiotemporal context information of the feature appearance is associated to generate a high-risk feature feedback package with attack scenarios. By utilizing the time-optimized high-risk protocol features and high-confidence features, combined with the high-risk feature feedback packets with attack scenarios, an abnormal feature set is obtained.

2. The network security dynamic early warning method based on multi-information fusion according to claim 1, characterized in that, The step of extracting abnormal security features from the preprocessed network information data specifically includes: Extract abnormal data traffic, analyze traffic size and traffic rate, compare traffic size with traffic threshold to identify abnormal traffic, and compare traffic rate with rate threshold to identify abnormal rate; Extract traffic increases for specific protocols, statistically analyze protocol types in network traffic data, determine the traffic increase corresponding to each protocol type, and identify traffic increases exceeding growth thresholds as abnormal traffic; perform time series analysis on traffic for specific protocols to identify abnormal traffic growth patterns. Illegal access attempts are extracted by analyzing system logs and security device alerts to identify abnormal user behavior, establish normal user access patterns, and identify access attempts that do not conform to the normal patterns as illegal access attempts.

3. The network security dynamic early warning method based on multi-information fusion according to claim 2, characterized in that, The aforementioned time-series analysis of traffic for a specific protocol to identify abnormal traffic growth patterns specifically includes: The list of high-risk protocols is sorted by risk value to obtain a list of protocols for in-depth analysis; For the list of deep analysis protocols, time series are constructed only for the protocols that have passed the data trust certification results, resulting in a targeted time series dataset; Hourly growth rate features, volatility features, and trend slope features are extracted from the directional time series dataset to construct the protocol feature matrix; By combining the protocol feature matrix with a deep analysis of the protocol list, differentiated baselines are established according to risk level, resulting in a constructed hierarchical baseline model. Real-time traffic data is determined and obtained. The constructed hierarchical baseline model is used to compare the real-time traffic data with the preset baseline threshold, and the abnormal types are classified and identified to obtain an abnormal growth pattern report. The abnormal growth pattern report adds abnormal protocols to the deep analysis protocol list and generates high-risk protocol update instructions; The parameters of the constructed hierarchical baseline model are updated using the high-risk protocol update command to obtain the updated hierarchical baseline model. Using the updated hierarchical baseline model, an updated abnormal growth pattern report is finally obtained, and abnormal traffic growth patterns are ultimately identified based on the updated abnormal growth pattern report.

4. The network security dynamic early warning method based on multi-information fusion according to claim 3, characterized in that, The step of performing correlation analysis on abnormal security features and assigning weights to each abnormal security feature based on the correlation analysis results specifically includes: The correlation coefficients between various abnormal safety characteristics were calculated based on the Pearson correlation method. The correlation coefficient is transformed by the formula and used as the weight. The correlation coefficient is normalized to the range of 0 to 1 and used as the weight. Weights are assigned to each abnormal security feature.

5. The network security dynamic early warning method based on multi-information fusion according to claim 4, characterized in that, The calculation of the correlation coefficients between various abnormal security features based on the Pearson correlation method specifically includes: Features with high-confidence timeliness labels are selected based on the set of abnormal features and formed into real-time analysis group features; Based on the updated abnormal growth pattern report, historical verification features were extracted to form the baseline analysis group features. Pearson correlation coefficients are calculated for real-time analysis group features to capture short-term attack correlations and obtain real-time correlation coefficients. Pearson correlation coefficients were calculated for the characteristics of the baseline analysis group to analyze long-term correlation patterns and obtain historical correlation coefficients. The real-time analysis group features are subjected to repeatability testing based on the baseline analysis group features to obtain the test results. The real-time correlation coefficient and the historical correlation coefficient are then calculated together based on the test results to finally obtain the correlation coefficient between each abnormal safety feature.

6. The network security dynamic early warning method based on multi-information fusion according to claim 5, characterized in that, The calculation of real-time correlation coefficient and historical correlation coefficient based on the detection results includes: When the real-time analysis group features appear in the benchmark analysis group features, the real-time correlation coefficient is used to cover the historical correlation coefficient. When the real-time analysis group features do not appear in the benchmark analysis group features, the real-time correlation coefficient and the historical correlation coefficient are added together by a preset multiple to obtain the calculated mixing coefficient. The calculated mixing coefficient is then detected according to the preset mixing coefficient threshold. High-risk protocols corresponding to the calculated mixing coefficients that are greater than the preset mixing coefficient threshold are extracted, and the corresponding high-risk protocols are fed back to the deep analysis protocol list.

7. A network security dynamic early warning system based on multi-information fusion, characterized in that, The system applies the network security dynamic early warning method based on multi-information fusion as described in any one of claims 1 to 6 above, and the system includes: The multi-information acquisition module is used to collect network information data from various aspects, including but not limited to network traffic data, system logs, and security device alarms. The abnormal security feature module is used to preprocess network information data and extract abnormal security features from the preprocessed network information data. The abnormal security features include abnormal data traffic, increased traffic of specific protocols, and unauthorized access attempts. The early warning model construction module is used to summarize and fuse abnormal security features extracted from different network information data, perform correlation analysis on the fused data, and build a security event early warning model based on the correlation analysis. The network dynamic early warning module is used for real-time monitoring through the security event early warning model. When the security event early warning model detects an anomaly, it issues an early warning message and activates the emergency response mechanism.

Images