Dynamic network risk assessment and security management method based on situation awareness

Abstract

The invention discloses a dynamic network risk assessment and security management method based on situation awareness, and particularly relates to the technical field of network security. Parameters such as communication frequency, access path depth, operation instruction type and resource consumption rate in a node interaction record are utilized to calculate a node risk association coefficient; and generating an attack intention boundary difference degree value, dynamically adjusting risk distribution by comparing a risk triggering frequency, a topological connection parameter and a delay detection parameter, generating a local risk trust average value, and monitoring and responding to potential threats in the network in real time. According to the method, through a dynamic risk assessment and adjustment mechanism, the identification and response capability to potential attacks in a complex network environment is improved, network behavior data can be acquired in real time, the change rate can be calculated, node risk distribution can be adjusted according to an assessment result, a high-risk area can be delimited, the real-time performance and flexibility of network protection are greatly improved, and the network protection efficiency is improved. The response time of potential threats is reduced, and the network security protection capability is enhanced.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a dynamic network risk assessment and security management method based on situational awareness. Background Technology

[0002] The field of cybersecurity technology encompasses methods for protecting and defending information and system resources during transmission, storage, and processing within computer networks. Core components of this technology include network risk identification, vulnerability detection, access control, intrusion prevention, and data security management. Cybersecurity technology constructs a multi-layered protection system by monitoring network structure, communication protocols, information flow, and system behavior to prevent and respond to network attacks, malicious activities, and abnormal events. This field also involves security policy formulation, encryption mechanism design, authentication, access control, and threat intelligence analysis, forming a systematic technical framework from risk perception to security protection.

[0003] Among them, the situational awareness-based dynamic network risk assessment and security management method refers to the quantitative analysis and risk prediction of system security status by collecting real-time status data in the network operating environment, and then combining this with security policies to achieve dynamic risk assessment and security control. This method mainly covers network security situational awareness, threat feature extraction, risk assessment model construction, and security management decisions based on the assessment results. Its implementation typically relies on steps such as network traffic data parsing, threat feature matching, risk indicator calculation, and risk level classification, thereby achieving dynamic monitoring and management of the security status during network operation.

[0004] Existing technologies rely on traditional static risk assessment models, typically focusing on protection based on known threats and defined rules. This approach has significant limitations when dealing with novel attacks, dynamically changing threats, and complex network environments. Network risk assessments often lack real-time performance and flexibility, relying heavily on manually configured rules and historical data during threat identification. This data is often outdated and difficult to adapt to rapidly changing network environments. For example, when facing diverse attack methods and complex communication patterns, existing assessment methods may fail to capture subtle changes in threats in a timely manner, leading to delayed risk assessments and incorrect judgments, increasing the likelihood of network attacks. Traditional methods often present risks in a broad manner and cannot be dynamically adjusted according to real-time network conditions. This makes it difficult for the system to respond quickly to large-scale, covert attacks, creating potential security vulnerabilities. For instance, when certain nodes in the network exhibit abnormal behavior, traditional static assessment methods may miss these important risk signals, preventing timely identification and implementation of necessary protective measures, thus increasing the risk of network attacks. Summary of the Invention

[0005] The main objective of this invention is to provide a dynamic network risk assessment and security management method based on situational awareness. By using dynamic risk fusion adjustment values ​​to perform real-time assessment and risk level classification of network nodes, this invention solves the problem of insufficient identification and priority management of high-risk nodes in network security monitoring.

[0006] To achieve the above objectives, the technical solution adopted by the present invention is as follows: A dynamic network risk assessment and security management method based on situational awareness, comprising: Obtain communication frequency, access path depth, operation command type and resource consumption rate parameters from node interaction records, establish a node correspondence table based on node interaction records, group communication frequency and access path depth, compare operation command type and resource consumption rate, calculate deviation and generate node risk relationship value. Based on the node risk relationship value, the session duration, communication direction and operation command parameters are called to calculate the rate of change and generate the attack intent boundary difference value. Based on the attack intent boundary difference value, the trust level and resource utilization parameters are detected, the ratio difference is calculated, the levels are divided, and the local risk trust average value is generated. Based on the local risk trust average value, the risk triggering frequency, topology connection parameters and delay detection parameters are selected. The difference between the risk triggering frequency and the node topology connection parameters is calculated. The difference is then compared synchronously with the network delay detection parameters to generate the risk situation spatial distribution coefficient. Monitor the temporal changes of the spatial distribution coefficient of the risk situation, calculate the difference, and use the attack intent boundary difference value to adjust the interval, generating a dynamic risk fusion adjustment value.

[0007] Preferably, the node risk correlation value is specifically the ratio calculation result of communication frequency parameter, access path depth parameter, operation command type parameter, and resource consumption rate parameter; the attack intent boundary difference value includes the change rate of session duration parameter, communication direction parameter, operation command parameter, difference offset, and the identified attack stage boundary; the local risk trust average value specifically refers to the ratio comparison result of trust parameter and resource utilization parameter, and the node hierarchy division result calculated based on the ratio; the risk situation spatial distribution coefficient includes the difference calculation result of risk trigger frequency parameter, topology connection parameter, and network latency detection parameter, and the spatial relationship mapping result; the dynamic risk fusion adjustment value is specifically the adjustment result of the node distribution interval based on the risk trigger frequency parameter and the time series change difference calculation result, combined with the attack intent boundary difference value.

[0008] Preferably, the comparison between the execution operation instruction type and the resource consumption rate, the calculation of the deviation, and the generation of node risk correlation values ​​include: Based on the comparison of the fluctuation ratios of the operation instruction type and resource consumption rate parameters, the ratio deviation is calculated to obtain the ratio deviation result. Based on the ratio deviation result, the ratios of the communication frequency parameter and the access path depth parameter and the operation instruction type parameter and the resource consumption rate parameter are normalized. The degree of change is calculated by using the ratio comparison to generate the ratio calculation result. Based on the ratio calculation results, the deviation value is compared with the benchmark value set by the system, the difference is calculated, and the node risk relationship value is obtained by combining the data fluctuation situation.

[0009] Preferably, the session duration, communication direction, and operation command parameters are derived from intrusion detection logs, communication traffic monitoring records, and behavior instruction audit tables; The specific process for calculating the rate of change and generating the attack intent boundary difference value is as follows: Based on the node risk relationship value, obtain the session duration, communication direction and operation command parameters, calculate the change rate of the session duration and communication direction parameters respectively, and generate the session change rate result; Based on the session change rate results, the session duration and the change rate of the communication direction parameters are mapped to the corresponding positions in the matrix, and the parameter values ​​in the matrix are compared to obtain the behavior parameter matrix. Based on the behavior parameter matrix, a coupling difference comparison is performed to analyze the differences in coupling between different parameter groups and generate attack intent boundary difference values.

[0010] Preferably, each row of the behavior parameter matrix represents a network session, and each column represents a parameter type, including the rate of change of the session duration and the rate of change of the communication direction.

[0011] Preferably, the step of detecting trust level and resource utilization parameters based on the attack intent boundary difference value, calculating the ratio difference, dividing the hierarchy, and generating a local risk trust average value includes: Obtain the attack intent boundary difference value; for the trust and resource utilization parameters of network nodes, calculate the ratio of trust and resource utilization of each node based on the node set data, and generate the node trust and resource ratio calculation results. Based on the calculation results of node trust and resource ratio, the ratio is compared with the trust utilization balance benchmark value set by the system. The ratio difference comparison is performed to determine whether the ratio deviates from the preset balance range and generate the ratio difference judgment result. Based on the results of the proportional difference judgment, the nodes with the offset proportion are divided into levels, and the average value of the trust degree parameter of each level node is calculated to generate the local risk trust average value.

[0012] Preferably, the step of synchronously comparing the difference with network latency detection parameters to generate a risk situation spatial distribution coefficient specifically involves: Based on the difference between the risk triggering frequency and the node topology connection parameters, the difference is compared with the network latency detection parameters. A synchronization offset comparison is performed to calculate the offset range and obtain the offset comparison result. Based on the offset comparison results, a spatial correlation matrix is ​​constructed, and the coupling relationship between nodes is extracted to generate the spatial distribution coefficient of the risk situation.

[0013] Preferably, the monitoring of the temporal change of the spatial distribution coefficient of the risk situation, the calculation of the difference, and the use of the attack intent boundary difference value for interval adjustment to generate a dynamic risk fusion adjustment value include: Monitor the time series changes of the risk trigger frequency parameter, calculate its change over a continuous time period, and obtain the trigger frequency change difference result; Based on the differential result of the trigger frequency change, it is compared with the preset risk status stability threshold, and an interval judgment is performed to determine whether the differential result exceeds the stability threshold, and a stability threshold judgment result is generated. If the threshold is exceeded based on the stability threshold judgment result, the node distribution range is repositioned by calling the attack intent boundary difference value, and a dynamic risk fusion adjustment value is generated.

[0014] Preferably, the dynamic network risk assessment and security management method based on situational awareness disclosed in this invention further includes: after generating the dynamic risk fusion adjustment value, reassessing the risk distribution of network nodes based on the value, redefining the risk level and risk area of ​​nodes according to the adjustment value, marking nodes with higher risks as high-priority monitoring objects, triggering a security early warning mechanism, generating real-time warnings for potentially high-risk areas, and issuing alerts to administrators.

[0015] Compared with the prior art, the present invention has the following beneficial effects: This invention utilizes multi-dimensional analysis of node interaction records, including parameters such as communication frequency, access path depth, operation command type, and resource consumption rate. Based on the deviation calculation and correlation of these data, it can generate a risk correlation coefficient for each node. Furthermore, by analyzing the rate of change of parameters such as session duration, communication direction, and operation commands, it delves into the dynamic characteristics of network behavior. This assessment, based on the rate of change of dynamic change and the difference in attack intent, can accurately identify potential attack activities and abnormal behaviors in the network. By calculating the proportional difference and generating local risk trust averages based on hierarchical division, it can effectively distinguish risk areas at different levels, thereby accurately delineating the security level of network nodes. When processing the difference between risk triggering frequency and topology connection parameters, the system combines network latency detection parameters for synchronous comparison, providing comprehensive dynamic data for generating the spatial distribution coefficient of the risk situation. This process continuously monitors changes in the spatial distribution of the risk situation, dynamically adjusts the risk distribution of each node in the network, and generates adjustment values ​​in real time to adapt to the current network state, greatly improving the flexibility and real-time performance of risk protection. Ultimately, the system can quickly identify high-risk areas and nodes and automatically trigger early warning mechanisms, ensuring the timeliness and accuracy of network security responses. This comprehensive and dynamic monitoring and adjustment mechanism significantly improves the ability to identify and respond to risks in complex network environments, and reduces response time to potential threats. Attached Figure Description

[0016] Figure 1 This is an exemplary flowchart of a dynamic network risk assessment and security management method based on situational awareness, as described in some embodiments of the present invention. Figure 2 This is a schematic diagram illustrating the process of generating node risk correlation coefficients in some embodiments of the present invention; Figure 3 This is a schematic diagram illustrating the process of generating attack intent boundary difference values ​​in some embodiments of the present invention; Figure 4 This is a schematic diagram illustrating the process of generating local risk trust average values ​​in some embodiments of the present invention; Figure 5 This is a schematic diagram illustrating the process of generating the spatial distribution coefficient of risk situation in some embodiments of the present invention; Figure 6 This is a schematic diagram illustrating the process of obtaining dynamic risk fusion adjustment values ​​and subsequent steps in some embodiments of the present invention. Detailed Implementation

[0017] To more clearly illustrate the technical solutions of the embodiments in this specification, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are merely some examples or embodiments of this specification. For those skilled in the art, these drawings can be applied to other similar scenarios without creative effort. Unless obvious from the linguistic context or otherwise specified, the same reference numerals in the drawings represent the same structures or operations.

[0018] It should be understood that the terms "system," "device," "unit," and / or "module" as used in this specification are a method of distinguishing different components, elements, parts, sections, or assemblies at different levels. However, if other terms can achieve the same purpose, they may be replaced by other expressions.

[0019] As indicated in this specification and claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" are not specifically singular and may include the plural. Generally speaking, the terms "comprising" and "including" only indicate the inclusion of explicitly identified steps and elements, which do not constitute an exclusive list, and the method or apparatus may also include other steps or elements.

[0020] Flowcharts are used in this specification to illustrate the operations performed by the system according to embodiments of this specification. It should be understood that the preceding or following operations are not necessarily performed in exact order. Instead, the steps can be processed in reverse order or simultaneously. Furthermore, other operations can be added to these processes, or one or more steps can be removed from them.

[0021] The following describes in detail, with reference to the accompanying drawings, the dynamic network risk assessment and security management method based on situational awareness provided in the embodiments of this specification.

[0022] Figure 1 This is an exemplary flowchart illustrating a situation-aware-based dynamic network risk assessment and security management method according to some embodiments of this specification. In some embodiments, the situation-aware-based dynamic network risk assessment and security management method can be executed by processing logic, which may include hardware (e.g., circuits, dedicated logic, programmable logic, microcode, etc.), software (instructions running on a processing device to execute hardware simulations), and any combination thereof. In some embodiments, Figure 1One or more operations in the flowchart of the situational awareness-based dynamic network risk assessment and security management method shown can be implemented by processing devices and / or terminal devices. For example, the situational awareness-based dynamic network risk assessment and security management method can be stored in a storage device in the form of computer programs and / or instructions, and invoked and / or executed by processing devices and / or terminal devices.

[0023] like Figure 1 As shown, in some embodiments of the present invention, the dynamic network risk assessment and security management method based on situational awareness includes the following steps: Step 001: Obtain the communication frequency, access path depth, operation command type, and resource consumption rate parameters from the node interaction records. Establish a node correspondence table based on the node interaction records, group the communication frequency and access path depth, compare the operation command type and resource consumption rate, calculate the deviation, and generate the node risk relationship value. Specifically, the node risk relationship value is the result of the ratio calculation of the communication frequency parameter, access path depth parameter, operation command type parameter, and resource consumption rate parameter. Step 002: Based on the node risk relationship value, call the session duration, communication direction and operation command parameters, calculate the rate of change, and generate the attack intent boundary difference value; the attack intent boundary difference value includes the rate of change of the session duration parameter, communication direction parameter, operation command parameter, difference offset, and the identified attack stage boundary; Step 003: Based on the attack intent boundary difference value, detect the trust level and resource utilization parameters, calculate the ratio difference, divide the hierarchy and generate the local risk trust average value; the local risk trust average value specifically refers to the ratio comparison result of the trust level parameter and the resource utilization parameter, as well as the node hierarchy division result calculated based on the ratio. Step 004: Based on the local risk trust average value, select the risk trigger frequency, topology connection parameters, and delay detection parameters. Calculate the difference between the risk trigger frequency and the node topology connection parameters. Simultaneously compare the difference with the network delay detection parameters to generate the risk situation spatial distribution coefficient. The risk situation spatial distribution coefficient includes the calculation results of the difference between the risk trigger frequency parameter, topology connection parameters, and network delay detection parameters, as well as the spatial relationship mapping results. Step 005: Monitor the temporal changes of the spatial distribution coefficient of the risk situation, calculate the difference and call the attack intent boundary difference value for interval adjustment to generate a dynamic risk fusion adjustment value; the dynamic risk fusion adjustment value is specifically the result of the difference calculation between the risk trigger frequency parameter and the time series change, combined with the adjustment result of the node distribution interval based on the attack intent boundary difference value.

[0024] Please see Figure 2In some embodiments of the present invention, step 001 specifically includes steps 0011-0013: Step 0011: Obtain the communication frequency parameters, access path depth parameters, operation command type parameters, and resource consumption rate parameters of the network nodes. Based on the source address and target port fields in the node interaction record, establish a node correspondence table and perform time period grouping operations on the communication frequency and access path depth parameters. First, based on the interaction records of network nodes, four parameters are extracted: communication frequency, access path depth, operation command type, and resource consumption rate. Communication frequency typically refers to the number of communications between nodes within a certain time period. Access path depth refers to the number of nodes traversed along the path from the source node to the target node. Operation command type refers to the type of operation performed by the node (e.g., reading data, writing data, executing a specific program, etc.). Resource consumption rate refers to the rate at which a node consumes computing, memory, or bandwidth resources when performing a certain operation. To establish a node mapping table, the source address and target port fields in the interaction logs can be used to map each pair of communicating nodes (source node and target node) to a table that maps each node's communication frequency, access path depth, operation command type, and resource consumption rate to the corresponding source address and target port. Then, grouping operations are performed based on time periods to statistically analyze the node communication frequency and access path depth within each time period. For example, a time window (e.g., every hour) can be set, and the communication frequency and access path depth of each node within that time window can be statistically analyzed to obtain the activity status of each node in different time periods. Suppose that during a certain time period, the communication frequency between node A and node B is 10 times, the access path depth is 3, the operation command type is "read", and the resource consumption rate is 5MB / s. Then, based on the source address and target port in the interaction record, this information can be recorded in the node correspondence table.

[0025] Step 0012: Based on the comparison of the fluctuation ratio of the operation instruction type and resource consumption rate parameter, calculate the ratio deviation and obtain the ratio deviation result. Based on the ratio deviation result, normalize the ratio of the communication frequency parameter to the access path depth parameter and the ratio of the operation instruction type parameter to the resource consumption rate parameter, and use the ratio comparison to calculate the degree of change to generate the ratio calculation result. In this stage, the first step is to detect fluctuations in the operation command type and resource consumption rate parameters. These fluctuations can be measured by comparing the changes in resource consumption rates of different nodes over a given time period. Specifically, the average resource consumption rate is calculated over different time periods, and its standard deviation is also calculated. The degree of fluctuation is determined by comparing the ratio of the consumption rate in each time period to its average. For example, if a node's resource consumption rate is 10 MB / s in one period and 5 MB / s in another, the ratio deviation can be calculated by dividing these two values ​​by 10 / 5 = 2. Next, based on this ratio deviation, the ratio of the communication frequency parameter to the access path depth parameter is also calculated. During this calculation, the average and standard deviation of the communication frequency and access path depth parameters are calculated separately. Then, these two parameters are normalized using the ratio to eliminate the influence of different parameter units, resulting in a standardized ratio. For example, assuming a communication frequency of 10 times / hour, an access path depth of 3, an operation command type of "read", and a resource consumption rate of 5MB / s, the obtained ratio deviation is 2. After normalization, the final ratio calculation result may be "1.5", indicating that there is a certain degree of proportional change between the two parameters. Step 0013: Based on the ratio calculation results, compare the deviation value with the benchmark value set by the system, perform difference calculation, and combine the data fluctuation situation to obtain the node risk relationship value.

[0026] In this stage, firstly, based on the ratio calculation result obtained in step 0012, it needs to be compared with the benchmark value set by the system. The benchmark value can be obtained through statistical analysis of historical data. Assuming the benchmark value set by the system is 1.2, and the ratio calculation result obtained in step 0012 is 1.5, then the difference calculation result is 1.5 - 1.2 = 0.3. Next, considering the data fluctuation, the data fluctuation can be determined by calculating the standard deviation of each node's communication frequency, access path depth, and resource consumption rate in different time periods. For example, the standard deviation of node A's resource consumption rate in different time periods is 0.5, the standard deviation of its communication frequency is 1, and the standard deviation of its access path depth is 0.2. Based on these standard deviations and the calculated difference, the node risk correlation value is finally obtained. This value can be used to assess whether a node has abnormal behavior or risk; the larger the value, the higher the risk of the node.

[0027] For example, assuming the difference is 0.3 and the standard deviation of the data fluctuation is 0.2, the node risk correlation value can be calculated as follows: Risk correlation value = difference / standard deviation = 0.3 / 0.2 = 1.5, indicating that the node has a high risk level.

[0028] like Figure 3 As shown, in some embodiments of the present invention, step 002 specifically includes steps 0021-0023: Step 0021: Based on the node risk relationship value, obtain the session duration, communication direction and operation command parameters from the intrusion detection log, communication traffic monitoring record and behavior instruction audit table, calculate the change rate of the session duration and communication direction parameters respectively, and generate the session change rate result; In this step, the system first obtains relevant monitoring data based on the risk relationship values ​​of the nodes, including intrusion detection logs, communication traffic monitoring records, and data from the behavior instruction audit table. The intrusion detection logs record detailed information about each network intrusion or abnormal behavior, the communication traffic monitoring records the traffic between nodes in the network, and the behavior instruction audit table records the specific operational instructions executed by the nodes. This data will serve as the basis for subsequent analysis.

[0029] After obtaining this data, the next step is to calculate the session duration and the rate of change of communication direction. Session duration refers to the length of a communication session between nodes, which can be obtained by calculating the time difference between the first and last communication between two nodes. Communication direction refers to the direction of data flow; it can be unidirectional or bidirectional, which can be determined by recording network traffic. The rate of change is determined by comparing the changes in these parameters over different time periods. For example, if the session duration between node A and node B changes from 10 seconds to 20 seconds, the rate of change of session duration during that time period can be calculated.

[0030] Suppose that during monitoring, the session duration between node A and node B increases from 10 seconds to 20 seconds. When calculating the rate of change, the following formula can be used: Session change rate = End time − Start time / Time period; For example, assuming a time period of 5 seconds, and the session increases from 10 seconds to 20 seconds, then the rate of change is: (20-10) / 5 = 2 seconds / second, meaning the rate of change for this session is 2 seconds per second. Similarly, the rate of change in the communication direction can be calculated in the same way.

[0031] Step 0022: Based on the session change rate results, map the session duration and the change rate of the communication direction parameters to the corresponding positions in the matrix, perform parameter value comparison in the matrix, and obtain the behavior parameter matrix; In this stage, the system will map the rate of change of session duration and communication direction into a matrix based on the session change rate results obtained in step 0021.

[0032] Suppose we have 3 time periods The rates of change of session duration and communication direction for each time period are as follows: , Represent these parameters as a matrix. Let the matrix be... The relationship between time periods and the rate of parameter change: exist The rate of change of session duration over a given time period is: The rate of change of communication direction is ;exist The rate of change of session duration over a given time period is: The rate of change of communication direction is ;exist The rate of change of session duration over a given time period is: The rate of change of communication direction is .

[0033] Next, assuming we need to calculate the difference between the rate of change of session duration and the rate of change of communication direction within each time period, the difference matrix... It can be obtained in the following ways: This means that the elements of the difference matrix in each row represent the difference between the rate of change of session duration and the rate of change of communication direction within that time period. For example: ; ; ; Therefore, the difference matrix It can be represented as: in, Indicates time period The rate of change of the duration of the session; Indicates time period The rate of change of the direction of communication in the middle; This indicates the rate of change in session duration and communication direction within each time period.

[0034] By using such matrix representation and difference calculation, we can more clearly see the parameter differences in different time periods, and further use these difference values ​​for analysis to generate subsequent analysis data such as attack intent boundary difference degree.

[0035] Each position in the matrix represents the change of different parameters (such as session duration, communication direction, etc.) over different time periods. For example, assuming the session duration changes at a rate of 2 seconds per second and the communication direction changes at a rate of 1 second per second, these rates of change are mapped to the corresponding positions in the matrix. In the matrix, the value at each position represents the degree of change of the corresponding parameter within the specified time period.

[0036] When comparing parameter values ​​in the execution matrix, the main method is to calculate the difference between the two parameters over the same time period. For example, if the rate of change of session duration is 2 seconds per second, while the rate of change of communication direction is 1 second per second, the difference can be calculated using simple subtraction: 2 - 1 = 1 second per second. This difference is recorded in the matrix, forming a behavioral parameter matrix. This matrix reflects the relationships and trends between different parameters, providing data support for subsequent analysis.

[0037] Step 0023: Based on the behavior parameter matrix, perform a coupling difference comparison, analyze the difference in coupling between different parameter groups, and generate attack intent boundary difference values.

[0038] Based on the behavioral parameter matrix obtained in step 0022, the system will perform a coupling difference comparison. The purpose of the coupling difference comparison is to measure the degree of coupling and the differences between different parameters. For example, if there is a large difference between the rate of change of session duration and communication direction, then their coupling degree is low; conversely, the coupling degree is high. This comparison process is mainly achieved by calculating the correlation or difference between parameters. Specifically, the degree of coupling can be reflected by calculating the difference between each parameter.

[0039] The difference offset is calculated when comparing different parameter groups, measuring the magnitude of these parameters' changes over different time periods. A larger parameter change results in a higher offset, and vice versa. Ultimately, based on the coupling difference comparison results, the system generates an attack intent boundary difference value. This value includes the rate of change of parameters such as session duration, communication direction, and operation commands, helping the system identify potential attack activities in the network and determine the attack phase boundary based on the changing difference.

[0040] For example, in a network attack scenario, assuming the rate of change of session duration is 2 seconds / second, the rate of change of communication direction is 1 second / second, the rate of change of operation commands is 3 seconds / second, and the difference offset is calculated at 1 second / second, then the final generated attack intent boundary difference value is the combined value of these three rates of change and the difference offset.

[0041] like Figure 4 As shown, in some embodiments of the present invention, step 003 may include steps 0031-0033: Step 0031: Obtain the attack intent boundary difference value. Based on the node set data, calculate the ratio of trust level to resource utilization of each node for the trust level and resource utilization parameters of the network nodes, and generate the node trust level and resource ratio calculation results. For example, in step 0031, the system first obtains the trust level and resource utilization parameters related to each network node based on the attack intent boundary difference value obtained from the previous analysis. Trust level is generally represented by the reputation value of a node's historical behavior in the network, while resource utilization refers to the proportion of computing resources, bandwidth resources, etc., consumed by a node when performing a task. For example, a node may frequently initiate network requests in the past, resulting in a low trust level; conversely, excessively high resource utilization may indicate abnormal behavior from that node. By analyzing all nodes in the node set, the system calculates the proportional relationship between the trust level and resource utilization of each node.

[0042] Specifically, the trust level to resource utilization ratio of each node can be calculated as follows: assuming a node's trust level is... (The numerical range is usually between 0 and 1), resource utilization rate is Then, the relationship between the node's trust level and resource utilization rate is... The calculation formula is: ; For example, for node A, if its trust level resource utilization rate Then the ratio of node A's trust level to its resource utilization rate is: ; Through this calculation process, the system generates a ratio of trust level to resource utilization for each node.

[0043] Step 0032: Based on the calculation results of node trust and resource ratio, compare the ratio with the trust utilization balance benchmark value set by the system, perform ratio difference comparison, determine whether the ratio deviates from the preset balance range, and generate ratio difference judgment result. Furthermore, the system will analyze the ratio of trust level to resource utilization for each node. Specifically, the system will compare the ratio of each node with a preset trust utilization balance benchmark. This represents the balance between trust level and resource utilization for normal nodes, and is usually set based on historical data or industry standards. For example, suppose the system's set trust utilization balance benchmark value is... This means that the system expects the ratio of node trust to resource utilization to be close to 1.

[0044] Next, the system will calculate the difference between the proportion of each node and the baseline value. ,Right now: For node A, if its calculated proportion is The system's baseline value The difference is: ; This difference value will be used to determine whether the node's trust level and resource utilization ratio deviate from a preset balance range. The system will determine whether the ratio difference is too large based on the set threshold. If the difference is too large, it indicates that the node may be in an abnormal state and may require further security testing.

[0045] For example, set a threshold. ,if If the proportion exceeds this threshold, the system will determine that the proportion of node A deviates from the preset balance range. If the ratio of trust level to resource utilization of node A exceeds the normal range, it indicates that there may be risks.

[0046] Step 0033: Based on the results of the proportional difference judgment, the nodes with the offset proportion are divided into levels, and the average value of the trust parameter of each level node is calculated to generate the local risk trust average value.

[0047] In step 0033, the system, based on the proportional difference judgment result in step 0032, performs hierarchical division on nodes with larger offset proportions. The hierarchical division is determined by the proportional difference value, and typically, nodes are divided into several levels. For example, the following hierarchical criteria can be set: like The node belongs to the "normal" level; like The node belongs to the "medium risk" level; like The node belongs to the "high-risk" level.

[0048] After hierarchical division, the system calculates the average trust level parameter of all nodes within each hierarchical level, generating a local risk trust average. For example, assuming there are multiple nodes in the "medium risk" hierarchical level, the system will calculate the average trust level of these nodes. ,For example: The trust level of node B is The trust level of node C is The average trust level for the medium-risk level is: ; By calculating the average local risk trust value, the system can identify the level of risk at that level, further supporting risk management and decision-making.

[0049] like Figure 5 As shown, in some embodiments of the present invention, step 004 specifically includes steps 0041-0042: Step 0041: Based on the local risk trust average value, select the risk trigger frequency, topology connection parameters and delay detection parameters, and calculate the difference between the risk trigger frequency and the node topology connection parameters; For example, in step 0041, the system first selects key parameters to focus on based on the previously calculated local risk trust average value, including risk trigger frequency, topology connectivity parameters, and latency detection parameters. Risk trigger frequency refers to the frequency at which network nodes trigger a specific risk behavior, topology connectivity parameters represent the degree of connection between nodes and other nodes, and latency detection parameters are monitoring indicators of network latency.

[0050] The system then calculates the difference between the risk trigger frequency and the node topology connection parameters. The specific method for calculating this difference is to compare the risk trigger frequency value of each node with its topology connection parameters. Assume that the risk trigger frequency of node A is... (Unit: times / time period), topology connection parameters are: (Unit: number of nodes), then the difference The calculation formula is: For example, assuming node A's risk trigger frequency is 5 times / hour, and the topology connection parameter is 3, then the difference is: ; By calculating the difference between each node, the system can identify the differences in risk triggering and topology connectivity between nodes, thereby helping to conduct further analysis.

[0051] Step 0042: Based on the difference between the risk triggering frequency and the node topology connection parameters, compare the difference with the network latency detection parameters, perform a synchronization offset comparison, calculate the offset range, and obtain the offset comparison result; In this step, the system further compares the difference between the risk triggering frequency and the topology connection parameters from step 0041 with the network latency detection parameters. The network latency detection parameters typically reflect the latency of data transmission between nodes, which may affect the communication efficiency and response speed of the nodes. The system needs to perform a synchronization offset comparison, that is, compare the node difference with the network latency detection parameters to determine the offset between the two. If the network latency is large, it may affect the normal communication of nodes, thus causing offsets between nodes in risk triggering and topology connection.

[0052] The specific offset comparison can be achieved by calculating the difference between the offset and the delay detection parameters. Assume the delay detection parameters for node A are... Then the synchronization offset The calculation formula is: ; For example, suppose the difference of node A The network latency detection parameter is 2. If the value is 1, then the offset is: The calculated offset can further help determine the risk status of a node; the larger the offset, the greater the impact of network latency on the node.

[0053] Step 0043: Based on the offset comparison results, construct the spatial correlation matrix, extract the coupling relationship between nodes, and generate the spatial distribution coefficient of the risk situation.

[0054] Furthermore, in step 0043, the system constructs a spatial correlation matrix based on the offset comparison results obtained in step 0042. The spatial correlation matrix describes the relative positions and influences between nodes, helping to identify the coupling relationships between nodes in the network. By extracting the coupling relationships between nodes, the system can model the interactions between nodes in the network, thereby providing support for subsequent risk situation analysis.

[0055] Specifically, the construction of the spatial correlation matrix first considers factors such as the connection strength, communication latency, and risk triggering frequency between each node, and then maps these parameters into a high-dimensional space. For example, the risk posture distribution coefficient between node A and node B may depend on the difference in their topological connectivity, latency, and risk triggering frequency. Each element in the matrix represents the degree of influence of one node on another, which can be expressed by the formula: ; in, This represents the spatial relationship mapping result between node i and node j. This is the difference between the risk triggering frequency and the topology connection parameters. Let be the topology connection parameters for node i. Let be the delay detection parameters for node j.

[0056] Assuming the risk triggering frequency difference between node A and node B is 2, the topology connection parameters are 3 and 4 respectively, and the delay detection parameters are 1 and 2 respectively, then their spatial relationship mapping result is: ; By calculating the spatial relationships between all nodes, the system ultimately generates a spatial distribution coefficient of the risk posture. This coefficient includes the calculated differences between risk triggering frequency, topology connectivity, and latency detection parameters, as well as the spatial relationship mapping results. It can help network security systems assess the network's risk posture in real time, optimize resource allocation, and take timely countermeasures.

[0057] Please see Figure 6 In some embodiments of the present invention, step 005 specifically includes steps 0051-0052: Step 0051: Monitor the time series changes of the risk trigger frequency parameter, calculate its change over a continuous time period, and obtain the trigger frequency change difference result; For example, the system monitors the time-series changes of risk trigger frequency parameters. This means the system collects data on the changes over time of risk trigger events (such as abnormal behavior, attacks, etc.) at each node in the network and organizes them into a time series. A time series is numerical data arranged in chronological order, representing the changes in risk trigger frequency at various points in time. Next, the system calculates the amount of change in this time series over consecutive time periods, which is typically done through differencing. Difference refers to calculating the amount of change between adjacent time points in order to detect data fluctuations.

[0058] Assume the risk trigger frequency values ​​are as follows over a certain period of time: , respectively representing time periods The system calculates the difference in trigger frequency using the following formula: ; For example, if in a time period If the trigger frequencies are 3, 5, and 8 respectively, then the differential calculation results are: This means that, in arrive Between, the triggering frequency increased by 2 times, while arrive The triggering frequency increased by 3 times. This change provides a basis for subsequent judgments on whether an anomaly exists.

[0059] Step 0052: Based on the differential result of the trigger frequency change, compare it with the preset risk situation stability threshold, perform interval judgment, determine whether the differential result exceeds the stability threshold, and generate the stability threshold judgment result; Furthermore, the system will compare the trigger frequency change difference result calculated in step 0051 with the system's preset risk situation stability threshold. The preset risk situation stability threshold is usually set based on historical network data and experience, representing the maximum allowable range of trigger frequency change under normal circumstances. If the trigger frequency change exceeds this threshold, the system will consider the risk situation potentially unstable and require further detection.

[0060] Assume the system's stability threshold is set to be If the calculated difference is greater than the threshold, the system will consider the risk situation to have exceeded the normal range and generate a stability threshold judgment result.

[0061] For example, if the calculated trigger frequency differential result is and ,but: It does not exceed the stability threshold; Exceeding the stability threshold.

[0062] Therefore, the system will generate a stable threshold judgment result, indicating the time period. arrive If the frequency of triggering changes exceeds the preset stability threshold, it may indicate network anomalies or attack activities.

[0063] Step 0053: Based on the stability threshold judgment result, if the threshold is exceeded, the attack intent boundary difference value is called to relocate the node distribution range and generate a dynamic risk fusion adjustment value.

[0064] Based on the stability threshold judgment result obtained in step 0052, if the trigger frequency change exceeds the preset stability threshold, the system will take further measures. First, the system will call the attack intent boundary difference value, which can be calculated according to the aforementioned steps and represents the intensity of potential attack behaviors in the network. Based on the attack intent boundary difference value, the system will reposition the node distribution range, that is, reassess the node's position in the network according to the node's risk status, in order to adjust the network's security strategy.

[0065] Next, the system generates a dynamic risk fusion adjustment value, which is dynamically adjusted based on factors such as the current network status, the risk level of nodes, and changes in trigger frequency. For example, if the trigger frequency of node A changes beyond a threshold and its attack intent boundary difference value is high, the system may reposition node A to a high-risk area of ​​the network and adjust its security control strategy accordingly.

[0066] Assuming node A's attack intent boundary difference value is 0.8, and the triggering frequency changes beyond a threshold, the system may calculate a dynamic risk fusion adjustment value. This value can be represented as: ; Assumption (Risk level of node A) (Indicates the degree to which the trigger frequency change exceeds the threshold), weight ,but: ; Therefore, node A's risk adjustment value is 1.1, indicating that the node's risk level has been adjusted to high, and it may require enhanced monitoring or other defensive measures.

[0067] In another embodiment of the present invention, as shown in FIG6, after generating the dynamic risk fusion adjustment value, the system also re-evaluates the risk distribution of network nodes based on the value, redefines the risk level and risk area of ​​the nodes according to the adjustment value, marks nodes with higher risks as high-priority monitoring objects, triggers the security early warning mechanism, generates real-time warnings for potentially high-risk areas, and sends an alert to the administrator.

[0068] For example: After generating a dynamic risk fusion adjustment value, the system will reassess the risk distribution of the entire network nodes based on this value.

[0069] First, the system redefines the risk level of each node based on its dynamic risk fusion adjustment value. The risk level is determined by the risk adjustment value of each node. For example, the system compares the node's dynamic risk adjustment value with a preset risk level threshold, assuming the system's preset risk levels are divided into three ranges: low risk, normal risk, and high risk. Based on the adjusted risk value, the system assigns the node to the corresponding risk level.

[0070] Assume that the dynamic risk fusion adjustment value of node A is 1.2, the dynamic risk fusion adjustment value of node B is 0.7, the system's preset high-risk range is above 1.0, the normal risk range is between 0.5 and 1.0, and the low-risk range is below 0.5. In this case, node A will be classified as a high-risk area, while node B will be classified as a normal-risk area.

[0071] Next, the system will redefine the risk zones of nodes based on their risk levels. Once a node is assigned to a high-risk zone, the system will prioritize monitoring these nodes and mark them as high-priority monitoring targets. High-priority nodes are typically critical nodes in the network or potential targets for attack; therefore, these nodes will receive more attention and stricter monitoring. For example, if node A is assigned to a high-risk zone, the system may set that node to require real-time monitoring and equip it with more security measures.

[0072] Then, the system will trigger a security alert mechanism. Based on the dynamic risk fusion adjustment value of each node, the system will activate the alert system and generate real-time warnings for high-risk areas and nodes. For example, if the risk value of node A reaches 1.2, exceeding the threshold of the high-risk range, the system will generate a warning for node A and display the warning in the monitoring system. Simultaneously, the system will also send a notification to the administrator through an automated alarm mechanism. The alarm notification will provide detailed risk information, including the affected nodes, their dynamic risk values, risk types, and the specific location of the node.

[0073] For example, if node A's dynamic risk fusion adjustment value is 1.2, exceeding the high-risk range, the system will generate an alert: "Node A is in a high-risk state with a risk value of 1.2. Please check the security of this node immediately." This alert will be immediately transmitted to the network administrator, ensuring that the administrator can take necessary measures to deal with potential risks or attacks as soon as possible.

[0074] In this way, the system can monitor the risk situation in the network in real time, promptly identify potential high-risk nodes and areas, and ensure rapid response and handling of network security protection through high-priority monitoring and security early warning mechanisms.

[0075] In summary, the situational awareness-based dynamic network risk assessment and security management method disclosed in this invention provides at least the following improvements: ① By reassessing and classifying the risk levels of network nodes through dynamic risk fusion adjustment values, the system can promptly identify and mark high-risk nodes, ensuring that potential threats in the network can be responded to and dealt with quickly. This high-priority monitoring and early warning mechanism enables administrators to take rapid countermeasures when the network encounters potential attacks, effectively reducing the impact of security vulnerabilities and attacks; ② Through real-time monitoring and alert mechanisms for high-risk areas, the system can rationally allocate security resources, centrally protect high-risk nodes, and avoid over-monitoring of low-risk nodes. This precise resource allocation method improves the efficiency of security protection, ensures optimal resource utilization for network security protection, and enhances the flexibility and effectiveness of network management.

[0076] The basic concepts have been described above. Obviously, for those skilled in the art, the detailed disclosure above is merely illustrative and does not constitute a limitation of this specification. Although not explicitly stated herein, those skilled in the art may make various modifications, improvements, and corrections to this specification. Such modifications, improvements, and corrections are suggested in this specification and therefore remain within the spirit and scope of the exemplary embodiments described herein.

[0077] Furthermore, this specification uses specific terms to describe embodiments thereof. For example, "an embodiment," "one embodiment," and / or "some embodiments" refer to a particular feature, structure, or characteristic associated with at least one embodiment of this specification. Therefore, it should be emphasized and noted that references to "an embodiment," "one embodiment," or "an alternative embodiment" in different locations throughout this specification do not necessarily refer to the same embodiment. Moreover, certain features, structures, or characteristics in one or more embodiments of this specification can be appropriately combined.

[0078] Furthermore, those skilled in the art will understand that various aspects of this specification can be described and illustrated in several patentable ways or situations, including any new and useful combination of processes, machines, products, or substances, or any new and useful improvements thereof. Accordingly, various aspects of this specification can be implemented entirely by hardware, entirely by software (including firmware, resident software, microcode, etc.), or by a combination of hardware and software. All of the above hardware or software may be referred to as a “data block,” “module,” “engine,” “unit,” “component,” or “system.” Furthermore, various aspects of this specification may be represented as a computer product located on one or more computer-readable media, including computer-readable program code.

[0079] Computer storage media may contain a propagated data signal containing computer program code, for example, on baseband or as part of a carrier wave. This propagated signal may take various forms, including electromagnetic, optical, and suitable combinations thereof. Computer storage media can be any computer-readable medium other than a computer-readable storage medium, which can be connected to an instruction execution system, apparatus, or device to enable communication, propagation, or transmission of a program for use. The program code located on the computer storage medium can be propagated through any suitable medium, including radio, cable, fiber optic cable, RF, or similar media, or any combination of the above media.

[0080] The computer program code required for the operation of each part of this manual can be written in any one or more programming languages, including object-oriented programming languages ​​such as Java, Scala, Smalltalk, Eiffel, JADE, Emerald, C++, C#, VB.NET, Python, etc.; conventional procedural programming languages ​​such as C, Visual Basic, Fortran2003, Perl, COBOL2002, PHP, ABAP; dynamic programming languages ​​such as Python, Ruby, and Groovy; or other programming languages. This program code can run entirely on the user's computer, or as a standalone software package on the user's computer, or partially on the user's computer and partially on a remote computer, or entirely on a remote computer or processing device. In the latter case, the remote computer can be connected to the user's computer through any network, such as a local area network (LAN) or wide area network (WAN), or connected to an external computer (e.g., via the Internet), or in a cloud computing environment, or used as a service such as Software as a Service (SaaS).

[0081] Furthermore, unless expressly stated in the claims, the order of processing elements and sequences, the use of numbers and letters, or other names described in this specification are not intended to limit the order of the processes and methods described herein. Although various examples have been discussed in the foregoing disclosure of some embodiments of the invention that are currently considered useful, it should be understood that such details are for illustrative purposes only, and the appended claims are not limited to the disclosed embodiments; rather, the claims are intended to cover all modifications and equivalent combinations that conform to the spirit and scope of the embodiments described herein. For example, while the system components described above can be implemented by hardware devices, they can also be implemented solely by software solutions, such as installing the described system on existing processing devices or mobile devices.

[0082] Similarly, it should be noted that, in order to simplify the description disclosed herein and thus aid in the understanding of one or more embodiments of the invention, the foregoing description of embodiments in this specification may sometimes combine multiple features into a single embodiment, drawing, or description thereof. However, this method of disclosure does not imply that the subject matter of this specification requires more features than those mentioned in the claims. In fact, the embodiments contain fewer features than all the features of a single embodiment disclosed above.

[0083] Finally, it should be understood that the embodiments described in this specification are merely illustrative of the principles of the embodiments described herein. Other variations may also fall within the scope of this specification. Therefore, alternative configurations of the embodiments described herein are intended to be illustrative rather than limiting, and should be considered consistent with the teachings of this specification. Accordingly, the embodiments described herein are not limited to those explicitly introduced and described herein.

Claims

1. A dynamic network risk assessment and security management method based on situational awareness, characterized in that, The method includes: Obtain communication frequency, access path depth, operation command type and resource consumption rate parameters from node interaction records, establish a node correspondence table based on node interaction records, group communication frequency and access path depth, compare operation command type and resource consumption rate, calculate deviation and generate node risk relationship value. Based on the node risk relationship value, the session duration, communication direction and operation command parameters are called to calculate the rate of change and generate the attack intent boundary difference value. Based on the attack intent boundary difference value, the trust level and resource utilization parameters are detected, the ratio difference is calculated, the levels are divided, and the local risk trust average value is generated. Based on the local risk trust average value, the risk triggering frequency, topology connection parameters and delay detection parameters are selected. The difference between the risk triggering frequency and the node topology connection parameters is calculated. The difference is then compared synchronously with the network delay detection parameters to generate the risk situation spatial distribution coefficient. Monitor the temporal changes of the spatial distribution coefficient of the risk situation, calculate the difference, and use the attack intent boundary difference value to adjust the interval, generating a dynamic risk fusion adjustment value.

2. The dynamic network risk assessment and security management method based on situational awareness according to claim 1, characterized in that, The node risk correlation value specifically refers to the ratio calculation results of communication frequency parameters, access path depth parameters, operation command type parameters, and resource consumption rate parameters; the attack intent boundary difference value includes the change rate of session duration parameters, communication direction parameters, operation command parameters, difference offset, and the identified attack stage boundary; the local risk trust average value specifically refers to the ratio comparison results of trust level parameters and resource utilization parameters, as well as the node hierarchy division results calculated based on the ratio; the risk situation spatial distribution coefficient includes the difference calculation results and spatial relationship mapping results of risk trigger frequency parameters, topology connection parameters, and network latency detection parameters. The dynamic risk fusion adjustment value is specifically the result of calculating the difference between the risk trigger frequency parameter and the time series change, combined with the attack intent boundary difference value to adjust the node distribution range.

3. The dynamic network risk assessment and security management method based on situational awareness according to claim 1, characterized in that, The comparison between the type of execution operation instruction and the resource consumption rate, the calculation of the deviation, and the generation of node risk correlation values ​​include: Based on the comparison of the fluctuation ratios of the operation instruction type and resource consumption rate parameters, the ratio deviation is calculated to obtain the ratio deviation result. Based on the ratio deviation result, the ratios of the communication frequency parameter and the access path depth parameter and the operation instruction type parameter and the resource consumption rate parameter are normalized. The degree of change is calculated by using the ratio comparison to generate the ratio calculation result. Based on the ratio calculation results, the deviation value is compared with the benchmark value set by the system, the difference is calculated, and the node risk relationship value is obtained by combining the data fluctuation situation.

4. The dynamic network risk assessment and security management method based on situational awareness according to claim 1, characterized in that, The session duration, communication direction, and operation command parameters are derived from intrusion detection logs, communication traffic monitoring records, and behavior instruction audit tables. The specific process for calculating the rate of change and generating the attack intent boundary difference value is as follows: Based on the node risk relationship value, obtain the session duration, communication direction and operation command parameters, calculate the change rate of the session duration and communication direction parameters respectively, and generate the session change rate result; Based on the session change rate results, the session duration and the change rate of the communication direction parameters are mapped to the corresponding positions in the matrix, and the parameter values ​​in the matrix are compared to obtain the behavior parameter matrix. Based on the behavior parameter matrix, a coupling difference comparison is performed to analyze the differences in coupling between different parameter groups and generate attack intent boundary difference values.

5. The dynamic network risk assessment and security management method based on situational awareness according to claim 4, characterized in that, Each row of the behavior parameter matrix represents a network session, and each column represents a parameter type, including the rate of change of the session duration and the rate of change of the communication direction.

6. The dynamic network risk assessment and security management method based on situational awareness according to claim 1, characterized in that, The process of detecting trust and resource utilization parameters based on the attack intent boundary difference value, calculating the ratio difference, dividing into levels, and generating local risk trust average values ​​includes: Obtain the attack intent boundary difference value; for the trust and resource utilization parameters of network nodes, calculate the ratio of trust and resource utilization of each node based on the node set data, and generate the node trust and resource ratio calculation results. Based on the calculation results of node trust and resource ratio, the ratio is compared with the trust utilization balance benchmark value set by the system. The ratio difference comparison is performed to determine whether the ratio deviates from the preset balance range and generate the ratio difference judgment result. Based on the results of the proportional difference judgment, the nodes with the offset proportion are divided into levels, and the average value of the trust degree parameter of each level node is calculated to generate the local risk trust average value.

7. The dynamic network risk assessment and security management method based on situational awareness according to claim 1, characterized in that, The step of synchronously comparing the difference with network latency detection parameters to generate a risk situation spatial distribution coefficient is as follows: Based on the difference between the risk triggering frequency and the node topology connection parameters, the difference is compared with the network latency detection parameters. A synchronization offset comparison is performed to calculate the offset range and obtain the offset comparison result. Based on the offset comparison results, a spatial correlation matrix is ​​constructed, and the coupling relationship between nodes is extracted to generate the spatial distribution coefficient of the risk situation.

8. The dynamic network risk assessment and security management method based on situational awareness according to claim 7, characterized in that, The time variation of the spatial distribution coefficient of the monitored risk situation is calculated, and the difference is used to adjust the interval by calling the attack intent boundary difference value, generating a dynamic risk fusion adjustment value, including: Monitor the time series changes of the risk trigger frequency parameter, calculate its change over a continuous time period, and obtain the trigger frequency change difference result; Based on the differential result of the trigger frequency change, it is compared with the preset risk status stability threshold, and an interval judgment is performed to determine whether the differential result exceeds the stability threshold, and a stability threshold judgment result is generated. If the threshold is exceeded based on the stability threshold judgment result, the node distribution range is repositioned by calling the attack intent boundary difference value, and a dynamic risk fusion adjustment value is generated.

9. The dynamic network risk assessment and security management method based on situational awareness according to claim 8, characterized in that, The method further includes: after generating the dynamic risk fusion adjustment value, reassessing the risk distribution of network nodes based on the value, redefining the risk level and risk area of ​​nodes based on the adjustment value, marking nodes with higher risks as high-priority monitoring objects, triggering a security early warning mechanism, generating real-time warnings for potentially high-risk areas, and issuing alerts to administrators.

Images