Network risk identification method and device and storage medium

Abstract

The invention discloses a network risk identification method and device and a storage medium, and relates to the technical field of network security. The network risk identification method comprises the following steps: extracting historical traffic characteristics based on collected historical traffic, and constructing a normal traffic model; extracting actual network traffic characteristics based on the collected actual network traffic; obtaining the feature similarity of each network device according to the historical traffic features and the actual network traffic features; setting a feature similarity threshold of each network device, and identifying a specific risk device and a risk type according to the feature similarity of each network device; and fusing the actual network traffic characteristics, which are identified as normal, of the equipment with the normal traffic model, and iteratively identifying the network security risk. According to the method, extraction of hidden features and identification and positioning of unknown attacks can be realized, and dynamic adjustment can be carried out according to newly added normal traffic so as to adapt to dynamic changes of network services.

Description

Technical Field

[0001] This invention relates to a method, apparatus, and storage medium for identifying network risks, belonging to the field of network security technology. Background Technology

[0002] In current tasks of traffic feature extraction and abnormal traffic classification, most existing research solutions employ machine learning techniques to extract and classify traffic features through model training. These solutions primarily focus on traffic load and timing characteristics, but the lack of interpretability is a major drawback of machine learning approaches. Furthermore, load characteristics vary significantly across different business scenarios, limiting the effectiveness of directly transferring existing feature extraction solutions to power monitoring systems. Within the existing network space of power monitoring systems, massive amounts of traffic data can mask the characteristics of a small number of abnormal traffic events, and existing solutions have weak analytical capabilities for concealed traffic features. Currently, most traffic analysis solutions applied to power monitoring systems are rule-based, which has weak capabilities for identifying unknown risks, and the classification models are not dynamically updated, resulting in insufficient adaptability to changes in business operations. Therefore, researching network risk identification technologies applicable to the actual characteristics of network traffic in power monitoring systems is of significant research importance. Summary of the Invention

[0003] The purpose of this invention is to provide a network risk identification method, device, and storage medium. By extracting key information from historical traffic and actual traffic, it constructs normal traffic characteristics and actual traffic characteristics, and uses a feature similarity evaluation method to comprehensively identify network security risks from multiple dimensions, so as to adapt to the dynamic changes in network services.

[0004] To achieve the above objectives, the present invention is implemented using the following technical solution.

[0005] On the one hand, the present invention provides a method for identifying network risks, including:

[0006] Based on the collected historical traffic data, historical traffic features are extracted to construct a normal traffic model.

[0007] Extract actual network traffic characteristics based on the collected actual network traffic;

[0008] The similarity of features among various network devices is obtained based on the historical traffic characteristics and actual network traffic characteristics.

[0009] Set a similarity threshold for each network device feature, and identify specific risky devices and risk types based on the similarity of each network device feature;

[0010] The actual network traffic characteristics of devices identified as normal are fused with the normal traffic model, and network security risks are iteratively identified.

[0011] Optionally, the extraction of historical traffic features and actual network traffic features includes the following steps:

[0012] Historical traffic data packets and actual network traffic data packets are extracted based on the collected historical traffic and actual network traffic, respectively.

[0013] Based on the historical traffic data packets and the actual network traffic data packets, the first set of network devices corresponding to the historical traffic and the second set of network devices corresponding to the actual network traffic are respectively obtained.

[0014] A historical traffic statistics matrix is ​​constructed based on the historical traffic data packets, and an actual traffic statistics matrix is ​​constructed based on the actual network traffic data packets.

[0015] Feature extraction is performed on the historical traffic statistics matrix and the actual traffic statistics matrix respectively to obtain the corresponding historical traffic features and actual network traffic features.

[0016] Optionally, both the historical traffic data packets and the actual network traffic data packets include the following information: source address, destination address, and payload length, stored in the form of triples, as shown below:

[0017] ,

[0018] in It is the first Traffic information for each data packet, It is the source address IP of the data packet. It is the destination IP address of the data packet. It is the payload length of the data packet.

[0019] Optionally, both the first set of network devices and the second set of network devices are defined as follows:

[0020] ,

[0021] Among them, is A collection of network devices, where each element contains a device index and a device IP address. This is the device index, indicating the device's position in the list; its value range is... integers, Total number of equipment; It is the IP address of the specific device, taken from the source address set. and destination address set Union, set and From traffic data packets and The data was obtained from field statistics.

[0022] Optionally, both the historical traffic statistics matrix and the actual network traffic statistics matrix include a packet frequency statistics matrix. and total transmission statistics matrix , respectively OK List, Total number of devices; Matrix number Line number Column elements are devices To the equipment Traffic statistics for each direction; the specific steps for constructing the traffic statistics matrix are as follows:

[0023] Initialize the traffic statistics matrix as follows: and All elements in the array are initially assigned the value 1;

[0024] Iterate through each traffic information in the traffic data packet. Extract respectively and index value and ,Will Increment the value by one, and increase the load length. Accumulated to ;

[0025] Will and Replace all elements in the expression with their logarithmic values, that is:

[0026] ,

[0027] ,

[0028] After the above steps, the elements in the frequency matrix and traffic matrix describe the frequency and load of communication between devices in the historical traffic, and the influence of large values ​​on the features is mitigated by logarithmic transformation.

[0029] Optionally, both the historical traffic characteristics and the actual network traffic characteristics include subject characteristics and object characteristics, and feature information is extracted from the direction of the subject sending and the direction of the object receiving, respectively.

[0030] The row vectors and column vectors in the flow statistics matrix describe the subject information and object information, respectively, i.e., the first... The line describes the device Traffic statistics information in the direction of transmission, the first The column describes the equipment Statistical information on incoming traffic;

[0031] The feature extraction includes the following steps:

[0032] The main features are extracted by row normalization of the traffic statistics matrix, as expressed by the formula:

[0033] ,

[0034] in, It is the main feature fusion matrix The Line number Column elements, It is a traffic statistics matrix The The sum of the values ​​that a row can take. It is a traffic statistics matrix The Line number The column elements are used to calculate the main feature fusion matrix. The range of values ​​for each element is: ;

[0035] Fusion matrix of main features Logarithmic transformation yields the principal feature matrix. The range of values ​​for all elements is . Each element for:

[0036] ,

[0037] Column normalization is performed on the flow statistics matrix to extract object features:

[0038] ,

[0039] in, It is an object feature fusion matrix The Line number Column elements, It is the first in the flow statistics matrix The sum of the values ​​in the column. It is a traffic statistics matrix The Line number The column elements are used to calculate the feature fusion matrix. The range of values ​​for each element is: ;

[0040] Fusing the frequency features of objects Logarithmic transformation yields the object frequency feature matrix. Each element for:

[0041] ,

[0042] Logarithmic transformation is used to eliminate feature masking caused by large data volumes and to extract hidden features; row normalization and column normalization are used to separate traffic features in different directions.

[0043] Based on the feature extraction steps, the main frequency features are obtained from the historical traffic packet frequency statistics matrix through the feature extraction. and object frequency characteristics ;

[0044] The main communication volume features are obtained from the historical traffic transmission total volume statistical matrix through the feature extraction. Characteristics of object communication ;

[0045] The main frequency features are obtained from the actual network traffic packet frequency statistics matrix through the feature extraction. and object frequency characteristics ;

[0046] The main communication volume features are obtained from the statistical matrix of the actual network traffic transmission volume through the feature extraction. Characteristics of object communication .

[0047] Optionally, the feature similarity of each network device includes: obtaining the change in the main feature through the offset of the main feature row vector, and obtaining the change in the object feature through the offset of the object feature column vector;

[0048] The feature changes of the four feature dimensions—subject frequency feature, object frequency feature, subject communication volume feature, and object communication volume feature—are all defined by... 3D vector description, The total number of equipment is denoted as follows: , , , For equipment The feature similarity are respectively , , , The calculation formula is as follows:

[0049] ,

[0050] ,

[0051] ,

[0052] ,

[0053] The device obtained through calculation The range of similarity values ​​for the four-dimensional feature vectors is: A higher similarity value indicates that the device characteristics of the actual traffic and historical traffic are closer, and the network risk is lower; a lower similarity value indicates that the characteristics of the actual traffic and historical traffic deviate more, and the network security risk is higher. Low similarity indicates that the device There is a risk of attacks being launched against other devices in terms of traffic frequency; Low similarity indicates that the device There is a risk of attacks from other devices in terms of traffic frequency; Low similarity indicates that the device There is a risk of launching attacks against other devices in terms of traffic load. Low similarity indicates that the device There is a risk of attacks from other devices in terms of traffic load.

[0054] Optionally, the fusion with the normal traffic model includes: weighted summation of the device features determined to be normal in the actual traffic features and the corresponding feature values ​​in the normal traffic model;

[0055] Suppose that the indexes of all normal devices constitute a set. ,for All device index pairs The feature matrix is ​​updated as follows:

[0056] ,

[0057] ,

[0058] ,

[0059] ,

[0060] in , , , These are the updated values ​​of the specific elements of the feature matrix; It updates the weights, and the range of values ​​is... .

[0061] After the model update described above, the normal traffic model will simultaneously encompass historical traffic characteristics and actual traffic characteristics at the current stage. The new normal traffic model will serve as the detection benchmark in the next detection. With multiple rounds of detection iterations, the normal traffic model will be continuously and dynamically adjusted to absorb new traffic characteristics and adapt to the dynamic changes in actual business operations.

[0062] In a second aspect, the present invention provides a network risk identification device, comprising:

[0063] The normal traffic model construction module is used to: extract historical traffic features based on collected historical traffic and construct a normal traffic model;

[0064] The network risk identification module is used to: extract actual network traffic characteristics based on the collected actual network traffic;

[0065] The similarity of features among various network devices is obtained based on the historical traffic characteristics and actual network traffic characteristics.

[0066] Set a similarity threshold for each network device feature, and identify specific risky devices and risk types based on the similarity of each network device feature;

[0067] The normal traffic model adjustment module is used to: merge the actual network traffic characteristics of devices identified as normal with the normal traffic model, and iteratively identify network security risks.

[0068] Thirdly, the present invention provides a computer-readable storage medium having a computer program / instructions stored thereon, which, when executed by a processor, implements the steps of any of the network risk identification methods described in the first aspect.

[0069] Compared with the prior art, the beneficial effects achieved by the present invention are as follows:

[0070] This invention extracts key information from historical and actual traffic to construct normal traffic features and actual traffic features. It separates four feature types from two dimensions: device traffic direction and traffic statistics. It uses a feature similarity evaluation method to comprehensively identify network security risks from multiple dimensions. It can extract hidden features and identify and locate unknown attacks. The sensitivity of network security risk identification is adjustable. The normal traffic model can absorb newly generated traffic features to adjust the normal traffic model features, thereby realizing the adaptive capability of the normal traffic model to changes in the business of the power monitoring system. Attached Figure Description

[0071] Figure 1 This is a general framework diagram of the network risk identification method of the present invention. Detailed Implementation

[0072] The technical solution of the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the embodiments of the present invention and the specific features in the embodiments are detailed descriptions of the technical solution of the present invention, rather than limitations thereof. In the absence of conflict, the embodiments of the present invention and the technical features in the embodiments can be combined with each other.

[0073] Example 1:

[0074] This embodiment introduces a method for identifying network risks, such as... Figure 1As shown, it includes:

[0075] Based on the collected historical traffic data, historical traffic features are extracted to construct a normal traffic model.

[0076] Extract actual network traffic characteristics based on the collected actual network traffic;

[0077] The similarity of features among various network devices is obtained based on the historical traffic characteristics and actual network traffic characteristics.

[0078] Set a similarity threshold for each network device feature, and identify specific risky devices and risk types based on the similarity of each network device feature;

[0079] The actual network traffic characteristics of devices identified as normal are fused with the normal traffic model, and network security risks are iteratively identified.

[0080] I. Constructing a Normal Traffic Model

[0081] Historical traffic data is used as the basis for constructing the normal traffic model. The traffic is collected from switches, and all network traffic is collected within a specific event window, from which the required information is extracted. The source address, destination address, and payload length of data packets are extracted from the collected traffic. All extracted traffic information is stored in triplet format, as shown below:

[0082] ,

[0083] in It is the first Traffic information for each data packet; It is the source address (IP) of the data packet; It is the destination IP address of the data packet; It is the payload length of the data packet.

[0084] In a power monitoring system network, device IPs are statically assigned; therefore, the distribution of IP addresses represents the distribution pattern of network devices. From the traffic information mentioned above, the network device space can be statistically analyzed. Different devices are distinguished by their IP addresses to form the network device space, which is stored in list form. Specific devices can be located using an index. This list describes the set of all devices in the network, and the specific network device set is defined as follows:

[0085] ,

[0086] Among them, is A collection of network devices, where each element contains a device index and a device IP address. This is the device index, indicating the device's position in the list; its value range is... integers, Total number of equipment; It is the IP address of the specific device, taken from the source address set. and destination address set Union, set and Traffic information and The data was obtained from field statistics.

[0087] To statistically analyze the interaction behavior between devices, the amount of interaction between devices is calculated from the traffic information. A traffic statistics matrix is ​​constructed based on the extracted traffic information. This statistics matrix contains... OK List, This represents the total number of devices. The matrix number is... Line number Column elements are devices To the equipment Traffic statistics for each direction, including packet frequency. and total transmission volume Two statistical matrices. The specific process for constructing the statistical matrices is as follows:

[0088] Step 1: Matrix Initialization. Initialize the statistical matrix as follows: and All elements in the array are initially assigned the value 1.

[0089] Step 2: Traffic Statistics. Iterate through each traffic record. Extract respectively and index value and ,Will Increment the value by one, and increase the load length. Accumulated to .

[0090] Step 3: Logarithmic Transformation of Statistics. To mitigate the impact of large numbers in the statistics on flow characteristics, it is necessary to further logarithmize the statistics, making the statistical matrix... and Replace all elements with their logarithmic values, that is:

[0091] ,

[0092] ,

[0093] The frequency matrix obtained after the above steps and communication matrix Each element in the data describes the frequency and load of communication between devices in historical traffic, and logarithmic transformation mitigates the impact of large values ​​on features. The two statistical matrices mentioned above will be used in the subsequent traffic feature extraction process.

[0094] To extract statistical information about the characteristics of network interactions between devices, feature information is extracted from both the sending direction of the subject and the receiving direction of the object. In the two statistical matrices obtained above, the row vectors and column vectors describe the subject information and the object information, respectively. The line describes the device Traffic statistics information in the direction of transmission, the first The column describes the equipment Statistical information on the flow in the receiving direction. Therefore, by normalizing the rows of the above statistical matrix, the main features can be extracted, and by normalizing the columns of the above statistical matrix, the object features can be extracted.

[0095] Row normalization of the frequency matrix can extract the main frequency features. The calculation method is as follows:

[0096] ,

[0097] in, It is the main frequency feature fusion matrix The Line number Column elements; It is a frequency matrix The The sum of the values ​​that can be taken in the row; It is a frequency matrix The Line number Column elements. Calculated main frequency feature fusion matrix. The range of values ​​for each element is: .

[0098] The main frequency feature fusion matrix obtained after the above normalization The values ​​are decimals close to 0, and the features are not obvious. Therefore, further processing of the main frequency feature fusion matrix is ​​needed. Logarithmic transformation yields the frequency feature matrix. Each element for:

[0099] ,

[0100] After the above logarithmic transformation, the main frequency feature matrix is ​​obtained. The range of values ​​for all elements is . .

[0101] Column normalization of the frequency matrix can extract object frequency features. The calculation method is as follows:

[0102] ,

[0103] in, It is an object frequency feature fusion matrix The Line number Column elements, It is a frequency matrix The The sum of the values ​​in the column; It is a frequency matrix The Line number Column elements. The calculated object frequency feature fusion matrix. The range of values ​​for each element is: .

[0104] The object frequency feature fusion matrix obtained after the above normalization The values ​​are decimals close to 0, and the features are not obvious. Therefore, further processing of the object frequency feature fusion matrix is ​​needed. Logarithmic transformation yields the object frequency feature matrix. Each element for:

[0105] ,

[0106] By analyzing the frequency matrix After extracting the subject features and object features, the subject frequency feature matrix is ​​obtained. and object frequency feature matrix .

[0107] Similar to the steps of the frequency matrix feature extraction method described above, the communication volume matrix... After extracting the subject and object features, the subject communication volume feature matrix is ​​obtained. and object communication volume feature matrix .

[0108] The feature matrix obtained by the above method , , , Together, they constitute the historical traffic characteristic model, which includes traffic characteristics at four levels: network device subject frequency, object frequency, subject communication volume, and object communication volume. This model serves as a benchmark for network traffic characteristics and is used to assess network security status.

[0109] II. Identification of Cybersecurity Risks

[0110] To assess network security status, actual network traffic needs to be collected as the assessment object. This is done by extracting actual network traffic within a certain time window using a network switch. The aforementioned historical traffic feature extraction method is then applied to extract the characteristics of the actual network traffic, resulting in four feature matrices: subject frequency, object frequency, subject communication volume, and object communication volume. , , , .

[0111] The degree of perturbation in the network behavior features of devices can be obtained by comparing the feature vectors of specific devices in the feature matrix. For subject features, the change in subject features is obtained through row vector offset; for object features, the change in object features is obtained through column vector offset. The feature changes in the four feature dimensions are defined using... 3D vector description, The total number of equipment is denoted as follows: , , , For equipment The feature similarity are respectively , , , The calculation formula is as follows:

[0112] ,

[0113] ,

[0114] ,

[0115] ,

[0116] The equipment obtained through the above calculations The range of similarity values ​​for the four-dimensional feature vectors is: The higher the similarity value, the more similar the actual traffic and historical traffic of the devices. The closer the characteristics, the lower the network risk; the smaller the similarity, the greater the deviation between actual and historical traffic characteristics, and the higher the network security risk. Low similarity indicates that the device There is a risk of attacks being launched against other devices due to the frequency of network traffic. Low similarity indicates that the device There is a risk of attacks from other devices in terms of traffic frequency; Low similarity indicates that the device There is a risk of attacks being launched against other devices in terms of traffic load. Low similarity indicates that the device There is a risk of attacks from other devices in terms of traffic load.

[0117] For each device, preset thresholds are set for feature similarity across four dimensions to identify and locate cybersecurity risks, by maintaining a [system / mechanism]. Threshold matrix with 4 rows and 4 columns Controlling the sensitivity of feature similarity classification across different devices, among which Indicates device The The classification threshold for feature similarity.

[0118] Based on the specific risky devices and risk types identified, alarm information is output, allowing maintenance personnel to further investigate security risks.

[0119] III. Adjustment of Normal Flow Model

[0120] After the risk identification process, the traffic characteristics identified as normal will be integrated with the new normal characteristics and the normal traffic model to achieve dynamic adjustment of the normal traffic model. The dynamic adjustment method for the normal traffic model involves a weighted sum of the device characteristics identified as normal in the actual traffic characteristics and their corresponding feature values ​​in the normal traffic model, allowing the normal traffic model to adapt to changes in the power monitoring system's operations. Let the indices of all normal devices form a set. ,for All device index pairs The feature matrix is ​​updated as follows:

[0121] ,

[0122] ,

[0123] ,

[0124] ,

[0125] in , , , These are the updated values ​​of the specific elements of the feature matrix; It updates the weights, and the range of values ​​is... , The larger the value, the greater the impact of the actual traffic characteristics on the update results.

[0126] After the model update described above, the normal traffic model will simultaneously encompass historical traffic characteristics and actual traffic characteristics at the current stage. The new normal traffic model will serve as the detection benchmark in the next detection. With multiple rounds of detection iterations, the normal traffic model will be continuously and dynamically adjusted to absorb new traffic characteristics and adapt to the dynamic changes in actual business operations.

[0127] Example 2:

[0128] Based on the same inventive concept as Embodiment 1, this embodiment introduces a network risk identification device, comprising:

[0129] The normal traffic model construction module is used to: extract historical traffic features based on collected historical traffic and construct a normal traffic model;

[0130] The network risk identification module is used to: extract actual network traffic characteristics based on the collected actual network traffic;

[0131] The similarity of features among various network devices is obtained based on the historical traffic characteristics and actual network traffic characteristics.

[0132] Set a similarity threshold for each network device feature, and identify specific risky devices and risk types based on the similarity of each network device feature;

[0133] The normal traffic model adjustment module is used to: merge the actual network traffic characteristics of devices identified as normal with the normal traffic model, and iteratively identify network security risks.

[0134] The specific functions of each module described above are explained in the relevant content of the method in Embodiment 1, and will not be repeated here.

[0135] Example 3:

[0136] Based on the same inventive concept as other embodiments, this embodiment describes a computer-readable storage medium having a computer program / instructions stored thereon, which, when executed by a processor, implements the steps of the network risk identification method as described in any of the embodiments.

[0137] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0138] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0139] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0140] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0141] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims. All of these forms are within the protection scope of the present invention.

Claims

1. A method for identifying network risks, characterized in that, include: Based on the collected historical traffic data, historical traffic features are extracted to construct a normal traffic model. Extract actual network traffic characteristics based on the collected actual network traffic; The similarity of features among various network devices is obtained based on the historical traffic characteristics and actual network traffic characteristics. Set a similarity threshold for each network device feature, and identify specific risky devices and risk types based on the similarity of each network device feature; The actual network traffic characteristics of devices identified as normal are fused with the normal traffic model, and network security risks are iteratively identified.

2. The network risk identification method according to claim 1, characterized in that, The extraction of historical traffic features and actual network traffic features includes the following steps: Historical traffic data packets and actual network traffic data packets are extracted based on the collected historical traffic and actual network traffic, respectively. Based on the historical traffic data packets and the actual network traffic data packets, the first set of network devices corresponding to the historical traffic and the second set of network devices corresponding to the actual network traffic are respectively obtained. A historical traffic statistics matrix is ​​constructed based on the historical traffic data packets, and an actual traffic statistics matrix is ​​constructed based on the actual network traffic data packets. Feature extraction is performed on the historical traffic statistics matrix and the actual traffic statistics matrix respectively to obtain the corresponding historical traffic features and actual network traffic features.

3. The network risk identification method according to claim 2, characterized in that, Both the historical traffic data packets and the actual network traffic data packets include the following information: source address, destination address, and payload length, stored in the form of triples, as shown below: ， in It is the first Traffic information for each data packet, It is the source address IP of the data packet. It is the destination IP address of the data packet. It is the payload length of the data packet.

4. The network risk identification method according to claim 3, characterized in that, The first set of network devices and the second set of network devices are both defined as follows: ， Among them, is A collection of network devices, where each element contains a device index and a device IP address. This is the device index, indicating the device's position in the list; its value range is... integers, Total number of equipment; It is the IP address of the specific device, taken from the source address set. and destination address set Union, set and From traffic data packets and The data was obtained from field statistics.

5. The network risk identification method according to claim 4, characterized in that, Both the historical traffic statistics matrix and the actual network traffic statistics matrix include a packet frequency statistics matrix. and total transmission statistics matrix , respectively OK List, Total number of devices; Matrix number Line number Column elements are devices To the equipment Traffic statistics for each direction; the specific steps for constructing the traffic statistics matrix are as follows: Initialize the traffic statistics matrix as follows: and All elements in the array are initially assigned the value 1; Iterate through each traffic information in the traffic data packet. Extract respectively and index value and ,Will Increment the value by one, and increase the load length. Accumulated to ; Will and Replace all elements in the expression with their logarithmic values, that is: ， 。 6. The network risk identification method according to claim 2, characterized in that, Both the historical traffic characteristics and the actual network traffic characteristics include subject characteristics and object characteristics, and feature information is extracted from the direction of the subject sending and the direction of the object receiving, respectively. The row vectors and column vectors in the flow statistics matrix describe the subject information and object information, respectively, i.e., the first... The line describes the device Traffic statistics information in the direction of transmission, the first The column describes the equipment Statistical information on incoming traffic; The feature extraction includes the following steps: The main features are extracted by row normalization of the traffic statistics matrix, as expressed by the formula: ， in, It is the main feature fusion matrix The Line number Column elements, It is a traffic statistics matrix The The sum of the values ​​that can be taken in the row. It is a traffic statistics matrix The Line number The column elements are used to calculate the main feature fusion matrix. The range of values ​​for each element is: ; Fusion matrix of main features Logarithmic transformation yields the principal feature matrix. The range of values ​​for all elements is . Each element for: ， Column normalization is performed on the flow statistics matrix to extract object features: ， in, It is an object feature fusion matrix The Line number Column elements, It is the first in the flow statistics matrix The sum of the values ​​in the column. It is a traffic statistics matrix The Line number The column elements are used to calculate the feature fusion matrix. The range of values ​​for each element is: ; Fusing the frequency features of objects Logarithmic transformation yields the object frequency feature matrix. Each element for: ， Based on the feature extraction steps, the main frequency features are obtained from the historical traffic packet frequency statistics matrix through the feature extraction. and object frequency characteristics ; The main communication volume features are obtained from the historical traffic transmission total volume statistical matrix through the feature extraction. Characteristics of object communication ; The main frequency features are obtained from the actual network traffic packet frequency statistics matrix through the feature extraction. and object frequency characteristics ; The main communication volume features are obtained from the statistical matrix of the actual network traffic transmission volume through the feature extraction. Characteristics of object communication .

7. The network risk identification method according to claim 1, characterized in that, The feature similarity of each network device includes: obtaining the change in the main feature through the offset of the main feature row vector, and obtaining the change in the object feature through the offset of the object feature column vector; The feature changes of the four feature dimensions—subject frequency feature, object frequency feature, subject communication volume feature, and object communication volume feature—are all defined by... 3D vector description, The total number of equipment is denoted as follows: , , , For equipment The feature similarity is respectively , , , The calculation formula is as follows: ， ， ， ， The device obtained through calculation The range of similarity values ​​for the four-dimensional feature vectors is: ,in Low similarity indicates that the device There is a risk of attacks being launched against other devices in terms of traffic frequency; Low similarity indicates that the device There is a risk of attacks from other devices in terms of traffic frequency; Low similarity indicates that the device There is a risk of launching attacks against other devices in terms of traffic load. Low similarity indicates that the device There is a risk of attacks from other devices in terms of traffic load.

8. The network risk identification method according to claim 1, characterized in that, The fusion with the normal flow model includes: weighted summation of the device features identified as normal in the actual flow characteristics and the corresponding feature values ​​in the normal flow model; Suppose that the indexes of all normal devices constitute a set. ,for All device index pairs The feature matrix is ​​updated as follows: ， ， ， ， in , , , These are the updated values ​​of the specific elements of the feature matrix; It updates the weights, and the range of values ​​is... .

9. A network risk identification device, characterized in that it comprises: The normal traffic model construction module is used to: extract historical traffic features based on collected historical traffic and construct a normal traffic model; The network risk identification module is used to: extract actual network traffic characteristics based on the collected actual network traffic; The similarity of features among various network devices is obtained based on the historical traffic characteristics and actual network traffic characteristics. Set a similarity threshold for each network device feature, and identify specific risky devices and risk types based on the similarity of each network device feature; The normal traffic model adjustment module is used to: merge the actual network traffic characteristics of devices identified as normal with the normal traffic model, and iteratively identify network security risks.

10. A computer-readable storage medium having a computer program / instructions stored thereon, characterized in that, When the computer program / instruction is executed by the processor, it implements the steps of the network risk identification method according to any one of claims 1 to 8.

Images