Network security spatial data vulnerability monitoring method based on neural network algorithm

Abstract

The invention provides a network security spatial data vulnerability monitoring method based on a neural network algorithm, and relates to the technical field of network security. Inputting the to-be-tested vulnerability data into a constructed final vulnerability prediction model to obtain a vulnerability classification result and a vulnerability prediction result; and according to the vulnerability classification result and the vulnerability prediction result, monitoring the life vulnerability of the data asset life cycle in the network space. According to the invention, the problem of easy missing detection or false detection of network security monitoring in the prior art is solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a network security space data vulnerability monitoring method based on a neural network algorithm. BACKGROUND

[0002] With the rapid development of information technology, network attacks and security problems are increasingly serious, and network security has become a very important part of government and daily life. In the network space, the importance of data assets is increasing day by day. Traditional network security monitoring methods are often limited to a single way, such as rule engine, black and white list, etc. These methods can detect and prevent network attacks from attackers to a certain extent, but due to the variability of attack means, the complexity of attack methods, and the concealment of attackers, the traditional methods are easy to miss or misjudge, so that network security problems are difficult to be discovered in time. SUMMARY

[0003] In order to overcome the shortcomings of the prior art, the purpose of the present application is to provide a network security space data vulnerability monitoring method based on a neural network algorithm, which solves the problem of easy missed or misjudged network security monitoring in the prior art.

[0004] To achieve the above purpose, the present application provides the following scheme:

[0005] A network security space data vulnerability monitoring method based on a neural network algorithm comprises:

[0006] obtaining to-be-tested vulnerability data;

[0007] inputting the to-be-tested vulnerability data into a constructed final vulnerability prediction model to obtain vulnerability classification results and vulnerability prediction results;

[0008] monitoring the life vulnerability of the data asset life cycle in the network space according to the vulnerability classification results and the vulnerability prediction results;

[0009] The construction method of the final vulnerability prediction model is:

[0010] obtaining vulnerability data and performing data cleaning to obtain cleaned vulnerability data;

[0011] performing first preprocessing on the cleaned vulnerability data to obtain preprocessed vulnerability data;

[0012] performing feature extraction on the preprocessed vulnerability data to obtain a feature set;

[0013] performing feature selection on the feature set by using an embedding method to obtain optimal features;

[0014] performing second preprocessing on the optimal features to obtain preprocessed optimal features;

[0015] based on a supervised learning method, constructing an initial model according to the preprocessed optimal features;

[0016] training the initial model using the training set to obtain a final vulnerability prediction model.

[0017] Preferably, it further comprises:

[0018] setting a time threshold;

[0019] continuously optimizing the final vulnerability prediction model according to the time threshold and the vulnerability prediction result;

[0020] generating an optimized vulnerability classification result and an optimized vulnerability prediction result using the optimized model.

[0021] Preferably, the vulnerability data is obtained and data cleaning is performed to obtain cleaned vulnerability data, which comprises:

[0022] performing data deduplication on the vulnerability data to obtain deduplicated data;

[0023] performing out-of-range data processing on the deduplicated data to obtain corrected data;

[0024] performing null value processing on the corrected data to obtain complete data;

[0025] performing noise reduction processing on the complete data to obtain denoised data;

[0026] performing data conversion processing on the denoised data to obtain converted data;

[0027] performing data integration on the converted data to obtain integrated data;

[0028] performing data verification on the data integration data to obtain the cleaned vulnerability data.

[0029] Preferably, the cleaned vulnerability data is preprocessed to obtain preprocessed vulnerability data, which comprises:

[0030] performing natural language processing on the cleaned vulnerability data to obtain first data;

[0031] performing abnormality detection algorithm processing on the first data to obtain second data;

[0032] performing data conversion and normalization on the second data to obtain third data;

[0033] cleaning the third data using an interactive data cleaning tool to obtain the preprocessed vulnerability data.

[0034] Preferably, the second preprocessing process comprises:

[0035] The normalization processing, the standardization processing, the discretization processing, the default value processing, the outlier processing and the feature coding dimension reduction processing are sequentially performed.

[0036] The following technical effects are disclosed in the present application:

[0037] The application provides a network security space data vulnerability monitoring method based on a neural network algorithm, and the method comprises the following steps: obtaining to-be-tested vulnerability data; inputting the to-be-tested vulnerability data into a finally constructed vulnerability prediction model to obtain vulnerability classification results and vulnerability prediction results; and monitoring life vulnerabilities of a data asset life cycle in a network space according to the vulnerability classification results and the vulnerability prediction results; and the construction method of the finally constructed vulnerability prediction model comprises the following steps: obtaining vulnerability data and performing data cleaning to obtain cleaned vulnerability data; performing first preprocessing on the cleaned vulnerability data to obtain preprocessed vulnerability data; performing feature extraction on the preprocessed vulnerability data to obtain a feature set; performing feature selection on the feature set by using an embedding method to obtain optimal features; performing second preprocessing on the optimal features to obtain preprocessed optimal features; constructing an initial model based on a supervised learning method according to the preprocessed optimal features; and training the initial model by using a training set to obtain a finally constructed vulnerability prediction model. The application can effectively monitor data asset vulnerabilities in a network space, and timely respond to and solve network security problems, thereby improving security and ensuring safe storage of data assets. BRIEF DESCRIPTION OF DRAWINGS

[0038] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed in the embodiments. Obviously, the drawings described below are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0039] Figure 1 A network security space data vulnerability monitoring method based on a neural network algorithm is provided for the embodiments of the present application. DETAILED DESCRIPTION

[0040] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0041] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0042] like Figure 1 As shown, this invention provides a method for monitoring cybersecurity spatial data vulnerabilities based on a neural network algorithm, comprising:

[0043] Step 100: Obtain the vulnerability data to be tested;

[0044] Step 200: Input the vulnerability data to be tested into the constructed final vulnerability prediction model to obtain vulnerability classification results and vulnerability prediction results;

[0045] Step 300: Based on the vulnerability classification results and vulnerability prediction results, monitor the lifecycle vulnerabilities of data assets in cyberspace.

[0046] The method for constructing the final vulnerability prediction model is as follows:

[0047] Step 201: Obtain vulnerability data and perform data cleaning to obtain cleaned vulnerability data;

[0048] Step 202: Perform a first preprocessing on the cleaned vulnerability data to obtain preprocessed vulnerability data;

[0049] Step 203: Extract features from the preprocessed vulnerability data to obtain a feature set;

[0050] Step 204: Use the embedding method to select features from the feature set to obtain the optimal features;

[0051] Step 205: Perform a second preprocessing on the optimal features to obtain the preprocessed optimal features;

[0052] Step 206: Construct an initial model based on the preprocessed optimal features using a supervised learning method;

[0053] Step 207: Train the initial model using the training set to obtain the final vulnerability prediction model.

[0054] Furthermore, it also includes:

[0055] Set a time threshold;

[0056] The final vulnerability prediction model is continuously optimized based on the vulnerability prediction results according to the time threshold.

[0057] The optimized model is used to generate optimized vulnerability classification results and optimized vulnerability prediction results.

[0058] Further, the vulnerability data is obtained and data cleaning is performed to obtain cleaned vulnerability data, including:

[0059] The vulnerability data is de-duplicated to obtain de-duplicated data;

[0060] The de-duplicated data is processed to correct out-of-range data to obtain corrected data;

[0061] The corrected data is processed to remove null values to obtain complete data;

[0062] The complete data is processed to remove noise to obtain de-noised data;

[0063] The de-noised data is processed to convert data to obtain converted data;

[0064] The converted data is integrated to obtain integrated data;

[0065] The integrated data is verified to obtain cleaned vulnerability data.

[0066] Specifically, data asset vulnerability data in the network is collected and classified, including but not limited to system vulnerabilities, network vulnerabilities, application vulnerabilities, etc. In the implementation of the network security space data asset life cycle vulnerability monitoring method based on neural network algorithm, data collection is a very important step. The purpose is to collect data asset vulnerability data in the network space and classify it to prepare for model establishment. The following is the detailed implementation process of data collection.

[0067] Specifically, the source of network security data collection needs to be determined first. The collected data can be automatically classified by using machine learning classification methods, or a classified vulnerability data set can be selected. According to the data source, select the appropriate collector for the network security data set. Different data forms have different requirements for the selection of data collectors. The data collector collects information on the network, including system vulnerabilities, network vulnerabilities, application vulnerabilities, etc., and then classifies and processes them to form a data set that can be trained by a neural network algorithm. The original data inevitably has some interference, noise, etc. Therefore, after data collection, the data needs to be cleaned. The specific processing methods include: de-duplication, out-of-range data, null value removal, and outlier removal. The implementation process is as follows:

[0068] Data cleaning is a key step in the data preprocessing process, which involves removing errors, incomplete or irrelevant information from the original data to improve data quality and provide accurate data for subsequent analysis and model training. The following is the detailed implementation process of data cleaning:

[0069] De-duplication: Identify and remove duplicate records in the dataset. Duplicate data can cause model overfitting, affecting its generalization ability. Data cleaning tools or custom scripts can be used to compare data records and remove duplicate entries.

[0070] Outlier removal: Identify and handle outliers or data points that significantly deviate from the normal range due to entry errors, measurement errors, or other reasons. Statistical methods (such as IQR, Z-score) or visualization tools (such as box plots) can be used to identify outliers and decide whether to delete or replace them.

[0071] Missing value handling: Handle missing data, which may include deleting records containing missing values, filling with global constants (such as 0 or specific values), filling with column averages, medians, or modes, or using more complex methods (such as KNN interpolation, model-based interpolation). The choice of processing method depends on the characteristics of the data and the number of missing values.

[0072] Noise reduction: Identify and reduce random variation or noise in the data, which may affect model performance. Smoothing techniques (such as moving average, exponential smoothing) or more advanced methods (such as wavelet transform, empirical mode decomposition) can be used to reduce noise.

[0073] Data conversion: Convert non-numeric data (such as text, images) into numeric data for mathematical operations and statistical analysis. Encoding techniques (such as one-hot encoding, label encoding) or text processing techniques (such as bag-of-words, TF-IDF) can be used for conversion.

[0074] Data integration: Merge data from different sources into a unified dataset, which may involve solving data inconsistency, data redundancy, and data conflict problems. ETL (Extract, Transform, Load) tools or custom scripts can be used to integrate data.

[0075] Data validation: After the cleaning process is complete, validate the data to ensure that the data cleaning effect meets expectations. Data quality indicators (such as completeness, uniqueness, accuracy) and statistical analysis of data distribution can be used for validation.

[0076] Through the above steps, the data cleaning process can effectively improve the quality and usability of the data, laying a solid foundation for subsequent data analysis and model training. A clean and tidy dataset will help improve the accuracy and reliability of the model, thus playing a key role in network security space data asset lifecycle vulnerability monitoring.

[0077] Further, the cleaned vulnerability data is preprocessed to obtain preprocessed vulnerability data, including:

[0078] performing natural language processing on the cleaned vulnerability data to obtain first data;

[0079] performing abnormality detection algorithm processing on the first data to obtain second data;

[0080] performing data conversion and normalization on the second data to obtain third data;

[0081] performing cleaning on the third data by using an interactive data cleaning tool to obtain preprocessed vulnerability data.

[0082] Specifically, the cleaned data may have various abnormalities and noises, and needs to be preprocessed. Common data preprocessing includes standardization, normalization, discretization, etc. to facilitate neural network algorithm modeling. To enhance the value of the data, the present application uses the following methods for enhanced data preprocessing:

[0083] Natural language processing: applying NLP technology to process noise and outliers in text data. For example, using sentiment analysis to identify malicious software reviews, or using entity recognition to extract key information from log files.

[0084] Abnormality detection algorithm: developing or integrating an abnormality detection algorithm, such as Isolation Forest or Autoencoder, to automatically identify and exclude abnormal data points.

[0085] Data conversion and normalization: performing necessary conversion on the collected data, such as date and time format unification, unit conversion, etc. At the same time, normalization processing is performed to ensure that the data is on the same scale, facilitating subsequent analysis and model training.

[0086] Interactive data cleaning tool: providing an interactive data cleaning tool that allows analysts to visually inspect data and manually correct errors or exclude outliers.

[0087] The collected cleaned and preprocessed data set is divided into a training set and a test set. The training set is used for model training, while the test set is used for model evaluation and performance testing.

[0088] After completing the above steps, we can use machine learning algorithms such as neural network algorithms for inductive learning, supervised learning, etc. to process the prepared network security data set and establish a suitable monitoring model to monitor data asset vulnerabilities in cyberspace.

[0089] More specifically, select appropriate vulnerability features and preprocess them. Feature selection is an important step in the network security space data asset vulnerability monitoring method based on neural network algorithm. The purpose is to select specific features from raw data that best reflect data asset vulnerabilities for better data processing and modeling. The detailed implementation process of feature selection is as follows:

[0090] Define feature set: According to experience and business needs, define a feature set that can be used to distinguish different types of data. Common features include system vulnerabilities, network vulnerabilities, and application vulnerabilities, and other types of vulnerabilities.

[0091] Feature extraction: Extract representative features from a large amount of raw data. Common feature extraction techniques include PCA principal component analysis, LDA linear discriminant analysis, information gain, etc.

[0092] Feature selection: Based on the extracted feature set, select the best and most representative feature set through automatic or manual methods. Common feature selection methods include filtering, wrapping, and embedding. In practical applications, feature selection usually needs to combine domain knowledge and data characteristics to determine which method to use. Filtering method is simple to calculate, but may ignore the interaction between features; wrapping method can find the optimal feature set, but the calculation cost is higher; embedding method naturally performs feature selection during training, and usually finds a good compromise. The invention uses embedding method for feature selection, and the implementation process is as follows:

[0093] Model initialization: Select a suitable machine learning model for the problem, such as support vector machine (SVM), L1 regularization logistic regression, or neural network, etc. Initialize model parameters, including feature weights and model hyperparameters.

[0094] Regularization parameter setting: Set the regularization parameters (such as L1 regularization coefficient or SVM C parameter) for the model, which will affect the feature selection process. Higher values of regularization parameters will cause the model to tend to select fewer features, while lower values will allow the model to use more features.

[0095] Model training: Train the model using the training data set. During training, the model not only learns the weights of the features, but also adjusts the importance of the features through the regularization term. The regularization term will penalize large feature weights, prompting the model to concentrate weights on the most important features.

[0096] Feature importance evaluation: During training, the model will automatically evaluate the importance of each feature and adjust the weights based on these evaluations. The importance of a feature can be determined by observing the size of the weight or by sorting the feature importance.

[0097] Weight Update: In each iteration, the model updates the feature weights based on the current loss function and regularization term. The weight update rule varies depending on the type of model (e.g., gradient descent, stochastic gradient descent, Adam, etc.).

[0098] Feature Selection: As training progresses, unimportant features gradually obtain weights close to zero, while important features maintain higher weights. A threshold can be set to determine which features are important. For example, all features with weights less than a certain threshold can be considered unimportant and removed from the model.

[0099] Model Evaluation and Selection: During training, the validation set is used periodically to evaluate the model's performance. Based on the model's performance on the validation set, the regularization parameter and learning rate are adjusted to optimize the feature selection process.

[0100] Convergence Judgment: When the model's performance no longer improves or reaches a predetermined number of iterations, the training process stops. Ultimately, the model retains the features that contribute most to the prediction results, while unimportant features are excluded.

[0101] Through the embedding method, the feature selection process is closely linked to model training, enabling the model to automatically learn the most useful features for the target task. This method not only improves the model's performance but also simplifies the feature selection process, as it does not require a separate preprocessing step. In addition, the embedding method can better handle feature interactions, as it considers both individual feature importance and collective contribution during training.

[0102] Further, the second preprocessing process includes:

[0103] Sequentially performing normalization processing, standardization processing, discretization processing, default value processing, outlier processing, and feature encoding dimension reduction processing.

[0104] Specifically, appropriate preprocessing is performed according to the different types of features, and common preprocessing methods include normalization, standardization, discretization, default value processing, outlier processing, etc., to improve the mapping effect between features and the model. The implementation process is as follows:

[0105] Normalization: Scale the feature values to the [0, 1] interval, so that all features are on the same scale, which helps the model better learn the relationships between features. The formula is as follows:

[0106]

[0107] where: x is the value of the original data point; min(x) is the minimum value of all data points in the entire dataset; max(x) is the maximum value of all data points in the entire dataset; xnorm is the normalized value.

[0108] The formula works by first calculating the range of the original data (i.e., the difference between the maximum and minimum values), then subtracting the minimum value from each data point, and finally dividing the result by the range. This way, the original minimum value is mapped to 0, the maximum value is mapped to 1, and all other values are mapped to a proportional position between 0 and 1.

[0109] Normalization: Converting features to a distribution with a mean of 0 and a standard deviation of 1 helps the model better understand the relative importance of features. Its formula is as follows:

[0110]

[0111] where μ is the mean of the feature and σ is the standard deviation.

[0112] Discretization: Converting continuous features to discrete features helps simplify the complexity of the model, especially when dealing with text or categorical data. This can be achieved by dividing the data interval or using methods such as decision trees.

[0113] Handling missing values: For missing data, you can fill them in (e.g., using the mean, median, or mode), delete records containing missing values, or use models (such as KNN interpolation) to predict and fill in missing values.

[0114] Handling outliers: Identify and handle outliers using methods such as IQR (Interquartile Range), Z-score (standard score), or clustering algorithms like DBSCAN to detect and remove outliers to avoid their impact on model training.

[0115] Feature encoding: Encode categorical features, such as using One-Hot Encoding or Label Encoding, so that neural networks can better handle non-numeric data.

[0116] Dimensionality reduction: If the feature dimension is too high, you can use methods such as PCA (Principal Component Analysis), t-SNE (t-distributed Stochastic Neighbor Embedding) for dimensionality reduction to reduce computational complexity and avoid overfitting.

[0117] After selecting the features, we can use them as inputs for the neural network algorithm and train the neural network with other pre-processed data. Through continuous iteration and optimization, the neural network algorithm can finally accurately classify and predict vulnerabilities and monitor the life vulnerability of data asset lifecycle in cyberspace in real time.

[0118] More specifically, a supervised learning method is used to establish an artificial neural network, and the data asset vulnerability data set is brought into the neural network for training. Multilayer Perceptron (MLP) is a kind of feedforward artificial neural network, which is suitable for various supervised learning tasks, including classification and regression problems. Therefore, MLP can be used as a starting point in this invention. After selecting MLP as a starting point, we can start designing and optimizing the network to better adapt to the task of monitoring the life vulnerability of data asset lifecycle in cyberspace. The following is the detailed design and optimization process:

[0119] Design a network structure containing an input layer, one or more hidden layers, and an output layer. Determine the number of nodes in each layer. Generally, the number of nodes in the input layer is equal to the number of features, and the number of nodes in the output layer is equal to the number of target variables (for classification problems, equal to the number of categories; for regression problems, usually 1).

[0120] For the hidden layer, choose a nonlinear activation function, as follows:

[0121] ReLU (Rectified Linear Unit) activation function:

[0122] f(x) = max(0, x)

[0123] The function of ReLU is to set all negative values to 0, while keeping non-negative values unchanged. This means that if the input x is negative, the output is 0; if the input x is non-negative, the output is equal to the input x itself.

[0124] The graph of the ReLU function is a broken line with a slope of 1, starting at x = 0, with a turning point at x = 0.

[0125] The advantage of ReLU is that it is simple to calculate and computationally efficient, and it can alleviate the problem of gradient vanishing because its gradient in the positive interval is constant.

[0126] Tanh (Hyperbolic Tangent) activation function:

[0127]

[0128] The Tanh function is a hyperbolic tangent function that maps input values x to the range -1 and 1. Its output value range is -1 ≤ f(x) ≤ 1.

[0129] The graph of the Tanh function is a sigmoid curve that is symmetric about x = 0, and as x tends to positive or negative infinity, the function value tends to 1 or -1, but never quite reaches these extreme values.

[0130] The advantage of the Tanh function is that its output value range is known, which helps in initializing and normalizing the parameters in the network. Additionally, it also provides a smooth nonlinear transformation.

[0131] Both activation functions are nonlinear, but the linear nature of ReLU in the positive interval makes it constant in gradient, which helps the network converge faster during training. The Tanh function, on the other hand, provides a more compact output range, which helps the network learn more concentrated feature representations. In practical applications, the choice of activation function depends on the specific problem and the characteristics of the data. Sometimes, both activation functions are used in combination, or other types of activation functions are explored to achieve the best network performance.

[0132] For classification problems, the cross-entropy loss function L = -∑ i y i log(p i ) is used, where y i is the one-hot encoding of the true labels, and p i is the predicted probability.

[0133] For regression problems, the mean squared error loss function is used, where y i is the true value, is the predicted value.

[0134] Choose an optimization algorithm to minimize the loss function, such as stochastic gradient descent (SGD), Adam, or RMSprop.

[0135] Optimize the MLP network: Introduce L1 or L2 regularization terms to the loss function to reduce the risk of overfitting.

[0136] L1 regularization L L1 = λ∑ j |w j | can produce sparse weight matrices, while L2 regularization The size of the weights can be limited; batch normalization is applied before the activation of each layer to speed up the training process and improve the stability of the model; methods such as grid search, random search or Bayesian optimization are used to find the best combination of hyperparameters, including learning rate, number of nodes in hidden layers, type of activation function, etc.; monitor the performance of the validation set during training. If the performance of the validation set no longer improves after a certain number of iterations, stop training to avoid overfitting; randomly drop a portion of nodes during training (i.e., set their output to zero) to reduce the model's dependence on specific nodes and enhance the model's generalization ability; use cross-validation or a reserved test set to evaluate the performance of the model to ensure its accuracy and robustness on unknown data. Through the above design and optimization steps, we can build an MLP network suitable for network security space data asset lifecycle vulnerability monitoring. This network will be able to learn from data and identify potential security vulnerabilities, providing effective early warning and protection for network security.

[0137] Model application: Apply the trained feedforward neural network to actual data asset vulnerability monitoring tasks to make predictions and classifications on new data.

[0138] More specifically, we can use a two-layer feedforward neural network for fingerprint identification in a binary classification task, consisting of an input layer, a hidden layer, and an output layer, with N nodes in the input layer, M nodes in the hidden layer, and 1 node in the output layer. The input data x undergoes a series of nonlinear transformations and weight matrix operations through the neural network, and finally obtains the prediction result.

[0139] Define network structure and parameters:

[0140] Input layer: x = [x1, x2,... x N ] T

[0141] Hidden layer activation function: f(z) = sigmoid(z);

[0142] Output layer activation function: f(z) = θ(z);

[0143] Output layer weights: w = [w1, w2,... w M ] T ;

[0144] Output layer bias: b;

[0145] Output result: y;

[0146] Loss function:

[0147] where z = w tx+b, h(x) is a sigmoid function.

[0148] The model is trained by continuously adjusting the weights and biases to reduce the loss function, as follows:

[0149] Forward propagation algorithm:

[0150] z = w t x+b

[0151]

[0152] Backpropagation algorithm (gradient descent method for updating):

[0153]

[0154]

[0155] w = w - aDw

[0156] b = b - aDb

[0157] where a is the learning rate.

[0158] By continuously updating the weights and biases, continuously performing forward propagation and backpropagation, a trained feedforward neural network is finally obtained, which can be used for fingerprint recognition and other vulnerability monitoring tasks in actual use.

[0159] In summary, in the data prediction phase, we mainly use the trained artificial neural network model to predict and classify new data, and evaluate the performance and accuracy of the model through model validation. It should be noted that in actual application, the prediction results often affect the training of the model, so we can choose to periodically use newly collected data to retrain, so as to continuously optimize the precision and accuracy of the model.

[0160] Evaluate and analyze the prediction results, and classify and correct the results.

[0161] Each embodiment in the specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between each embodiment can be referred to each other.

[0162] The principles and implementation methods of the present application are described in this paper by using specific examples. The above description of the embodiments is only to help understand the method and its core idea; at the same time, for those skilled in the art, according to the idea of the present application, the specific implementation method and application range will be changed. In summary, the content of the specification should not be understood as a limitation of the present application.

Claims

1. A method for monitoring cybersecurity spatial data vulnerabilities based on a neural network algorithm, characterized in that, include: Obtain data on the vulnerabilities to be tested; The vulnerability data to be tested is input into the constructed final vulnerability prediction model to obtain vulnerability classification results and vulnerability prediction results; Based on the vulnerability classification results and vulnerability prediction results, the system can monitor life-cycle vulnerabilities of data assets in cyberspace. The method for constructing the final vulnerability prediction model is as follows: Acquire vulnerability data and perform data cleaning to obtain cleaned vulnerability data; The cleaned vulnerability data is subjected to a first preprocessing step to obtain preprocessed vulnerability data. Feature extraction is performed on the preprocessed vulnerability data to obtain a feature set; The optimal features are obtained by using the embedding method to select features from the feature set. The optimal features are subjected to a second preprocessing to obtain the preprocessed optimal features; Based on supervised learning methods, an initial model is constructed using the preprocessed optimal features. The initial model is trained using the training set to obtain the final vulnerability prediction model.

2. The method for monitoring network security spatial data vulnerabilities based on a neural network algorithm according to claim 1, characterized in that, Also includes: Set a time threshold; The final vulnerability prediction model is continuously optimized based on the vulnerability prediction results according to the time threshold. The optimized model is used to generate optimized vulnerability classification results and optimized vulnerability prediction results.

3. The method for monitoring cybersecurity spatial data vulnerabilities based on a neural network algorithm according to claim 1, characterized in that, The process of acquiring vulnerability data and cleaning the data to obtain cleaned vulnerability data includes: The vulnerability data is deduplicated to obtain deduplicated data; The deduplicated data is processed to remove data outside the range, resulting in corrected data; The corrected data is then processed to remove null values, resulting in complete data. The complete data is then subjected to noise reduction processing to obtain denoised data; The denoised data is then subjected to data conversion processing to obtain converted data; The transformed data is then integrated to obtain integrated data; The data is integrated and verified to obtain cleaned vulnerability data.

4. The network security spatial data vulnerability monitoring method based on neural network algorithm according to claim 1, characterized in that, The cleaned vulnerability data undergoes a first preprocessing step to obtain preprocessed vulnerability data, including: Natural language processing is performed on the cleaned vulnerability data to obtain the first data; The first data is processed by an anomaly detection algorithm to obtain the second data; The second data is transformed and normalized to obtain the third data; The third data is cleaned using an interactive data cleaning tool to obtain preprocessed vulnerability data.

5. The method for monitoring cybersecurity spatial data vulnerabilities based on a neural network algorithm according to claim 1, characterized in that, The second preprocessing process includes: The normalization, standardization, discretization, default value handling, outlier handling, and feature encoding dimensionality reduction processes are performed sequentially.

Images