Real-time network security protection system based on big data analysis

Abstract

The invention discloses a real-time network security protection system based on big data analysis. The real-time network security protection system comprises the following steps: collecting real-time network data and constructing a dynamic network diagram data set; constructing a graph state space model based on the dynamic network graph and completing state space initialization; a parallel selective state scheduling mechanism is introduced into the state updating path, parallel analysis is carried out on network node states, and state importance parameters are generated; reconstructing a state updating process according to the state importance parameters, and only executing state updating on the network nodes meeting conditions; performing security judgment on the corresponding communication behavior based on the updated state space representation, and generating a security risk identifier; and generating and issuing a network security protection control instruction according to the security risk identifier, and updating a state scheduling parameter based on execution feedback. According to the invention, through parallel selective state scheduling and state updating reconstruction, the real-time performance and scheduling efficiency of security protection in a large-scale network environment are improved.

Description

Technical Field

[0001] This invention relates to the fields of network security and big data analytics, and in particular to a real-time network security protection system based on big data analytics. Background Technology

[0002] As information networks continue to expand in scale and business models become increasingly complex, the number of network communication entities, the structure of communication relationships, and communication behavior patterns are all exhibiting highly dynamic and strongly correlated characteristics. Network security protection technologies have gradually evolved from static protection models based on boundary isolation and rule matching to dynamic protection models oriented towards network-wide situational awareness. Existing network security systems typically analyze network operational status by collecting traffic logs, host logs, and security event data, and based on this, achieve intrusion detection, anomaly identification, and security response.

[0003] In existing technologies, one type of solution relies on feature rule bases or policy templates to compare and judge communication behaviors one by one. This type of solution has a clear implementation path and low deployment cost, but its ability to characterize unknown threats, complex attack paths, and cross-temporal related behaviors is limited. Another type of solution introduces big data analysis methods to abstract network nodes and their interaction relationships into a graph structure, model the overall network state, and combine it with time-series analysis to achieve security posture assessment. This type of solution has certain advantages in complex network environments. However, existing graph models mostly adopt a full state synchronous update mechanism, which has coarse state update granularity and computational overhead that increases linearly or even exponentially with network size, making it difficult to meet the requirements of computational efficiency and response timeliness in real-time protection scenarios.

[0004] Furthermore, existing technologies typically execute state evolution sequentially based on time series during state updates, failing to adequately differentiate the varying roles of different network nodes in security posture changes. This results in a large amount of state update computation being concentrated on nodes with insignificant changes, leading to low resource utilization. State analysis and security determination are often loosely coupled, and there is a lack of a unified modeling framework between node state changes and communication behavior analysis, hindering the implementation of refined protection decisions and dynamic scheduling control.

[0005] Therefore, how to provide a real-time network security protection system based on big data analysis is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0006] One objective of this invention is to propose a real-time network security protection system based on big data analytics. Addressing the problems of coarse-grained network state modeling, high computational overhead for state updates, insufficient characterization of node differences, and lack of effective linkage between protection strategies and execution feedback in existing network security protection technologies, this invention proposes a technical solution based on dynamic graphs, with state space modeling as its core, and introducing a parallel selective state scheduling mechanism into the state update path. This solution achieves coordinated linkage between network state analysis, security determination, and protection scheduling by constructing a state space representation of network nodes, analyzing node state changes in parallel, reconstructing the state update process based on state importance parameters, and combining this with communication behavior security judgment and protection control command generation. This invention offers the advantages of improving the targeting of state updates in dynamic network environments, reducing unnecessary computational load, enhancing the consistency of node-level security analysis, and supporting continuous adjustment of protection strategies based on execution feedback.

[0007] A real-time network security protection system based on big data analysis according to an embodiment of the present invention includes the following modules: Dynamic graph construction module: Collects real-time network data, constructs network nodes according to communication entity identification information, constructs the interaction relationship between network nodes according to communication behavior information, and organizes the network nodes and interaction relationship in time sequence according to timestamp information to form a dynamic network graph dataset; State space initialization module: Constructs the input state of the Graph State Space Model based on the dynamic network graph dataset, converts the dynamic network graph under each time series into a graph state representation, and completes the state initialization according to the state space recursion rule to obtain the initial state space representation; Parallel State Scheduling Module: Introduces a parallel selective state scheduling state space update mechanism into the state update path of the Graph State Space Model. Performs parallel analysis on the network node states in the initial state space representation, calculates node state change information, and generates a set of state importance parameters. State update and reconstruction module: Reconstructs the state update process of the Graph State Space Model based on the set of state importance parameters. Only network nodes that meet the preset update conditions are updated in state space, while the other network nodes retain the state space representation of the previous time step, thus obtaining the updated state space representation. Behavioral security assessment module: Based on the updated state space representation, it assesses the security of communication behaviors of network nodes that have undergone state updates and generates security risk identification results for the network nodes. Protection scheduling update module: Generates network security protection control instructions based on security risk identification results, and sends the protection control instructions to the corresponding network control devices for execution. At the same time, it collects execution feedback information and updates the state scheduling parameters in parallel selective state scheduling based on the execution feedback information.

[0008] Optionally, the dynamic graph construction module specifically includes: Real-time network data is collected from network boundary devices, core switching nodes, and terminal security agents. The real-time network data is limited to communication entity identification information, communication behavior information, and timestamp information. The collected real-time network data is processed to unify the data format, converting communication entity identification information into a unified identification format and communication behavior information into a unified behavior description format. A set of network nodes is generated based on communication entity identification information in a unified identifier format; A set of interaction relationships between network nodes is generated based on communication behavior information in a unified behavior description format. The network node set and interaction relationship set are organized temporally based on timestamp information to form a dynamic network graph dataset arranged in chronological order.

[0009] Optionally, the state space initialization module specifically includes: Based on the dynamic network graph dataset, the dynamic network graphs are sorted according to timestamp order and grouped at preset time intervals to obtain a time series network graph set arranged in chronological order. For time series network graphs, read the network nodes and the interaction relationships between them within the corresponding time series, and assign sequential labels to the network nodes based on their order of appearance in the dynamic network graph, forming a set of node labels for node differentiation. Based on the node identifier set and interaction relationship information, a node input vector is constructed for the network node. The node input vector consists of the node identifier information and the interaction relationship information of the node in the current time series, forming a graph structure input representation corresponding to the time series. The state space structure of the Graph State Space Model is constructed based on the graph structure input representation. Each network node is mapped to a state unit in the state space, and a node state vector of fixed dimension is assigned to each state unit to form a set of state space nodes. Based on the interaction relationships in the dynamic network graph, the association relationships between state units are established in the state space, and the interaction relationships are mapped into state transmission paths between state units, forming a state association structure in the state space. Based on the pre-defined state space recursion rules of the Graph State Space Model, the node state vectors in the state space node set are initialized, and the initialized node state vectors are bound to the corresponding time series identifiers to form the initial state space representation.

[0010] Optionally, the parallel state scheduling module specifically includes: Based on the initial state space representation, the node state vector corresponding to each network node in the state space node set is obtained, and the node state vectors are grouped according to the time series identifier to form a node state vector sequence for state analysis. In the state update path of the Graph State Space Model, a state space update mechanism with parallel selective state scheduling is introduced. A parallel analysis channel corresponding to the node state vector sequence is established within the state update path, so that the node state vectors of different network nodes enter an independent parallel analysis process. In each parallel analysis channel, based on the changes in the node state vector in adjacent time series, state change calculation processing is performed on the node state vector to obtain the node state change information of the corresponding network node. The node state change information corresponding to each network node is collected and processed, and the node state change information is converted into state change quantity description data to characterize the degree of node state change. Based on the state change description data, a corresponding state importance parameter is generated for each network node, and a correspondence is established between the state importance parameter and the network node to form a set of state importance parameters.

[0011] Optionally, the state space update mechanism for the parallel selective state scheduling specifically includes: In the state update path of the Graph State Space Model, the state update granularity is divided according to the network nodes in the state space node set, and the original state update process based on time series sequential execution is broken into multiple state analysis paths based on network nodes. Based on the node state vector sequence, the node state vector sequences corresponding to different network nodes are assigned to the corresponding state analysis paths, so that each state analysis path only receives the node state vector sequence of the same network node. In each state analysis path, the temporal evolution order of the node state vector corresponding to the network node is maintained independently, so that the node state vector enters the state change calculation and processing sequentially according to the time series identifier within the state analysis path. Parallel scheduling of each state analysis path is performed at the state update path level, so that multiple state analysis paths can participate in the node state change calculation and processing simultaneously within the same state update cycle. The node state change information output by each state analysis path after parallel scheduling is returned to the state update path aggregation location of the GraphState Space Model, serving as the input data source for subsequent state change information aggregation and state importance parameter generation.

[0012] Optionally, the state update and reconstruction module specifically includes: Based on the set of state importance parameters, the state importance parameters in the set are associated with the corresponding network nodes to form a correspondence between network nodes and state importance parameters. State update judgment conditions are set based on the set of state importance parameters. The state importance parameters corresponding to each network node are compared with the preset update conditions one by one to obtain the node judgment result used to distinguish between updating nodes and non-updating nodes. Based on the node determination results, the network nodes are divided into a first set of nodes that need to perform state space updates and a second set of nodes that maintain their original state space representation, forming a node grouping result for state update scheduling; For the first set of nodes, the node state vector of the corresponding network node is read from the initial state space representation, and the state update operation is performed on the node state vector according to the state space recursion rule of the Graph State Space Model to generate the updated set of node state vectors. For the second set of nodes, keep the node state vectors of the corresponding network nodes in the initial state space representation unchanged, and write the node state vectors directly into the updated state space representation; The updated set of node state vectors is merged with the unchanged set of node state vectors and reorganized according to the order of network nodes to form the updated state space representation.

[0013] Optionally, the behavior security determination module specifically includes: Obtain the node state vector corresponding to the network node that has undergone a state update, and filter the node state vectors according to the network node identifier to form a candidate node state set for security determination and processing. For each network node in the candidate node state set, read the communication behavior information of the network node in the corresponding time series, and align the communication behavior information with the node state vector to form the joint state description data corresponding to the network node. Based on the joint state description data, behavioral feature extraction processing is performed on the communication behavior of network nodes in the current time series, the communication behavior information is converted into behavioral feature description data, and a correspondence is established with the node state vector. The behavioral feature description data is input into a preset set of security judgment rules. The rule matching process is performed on the behavioral feature description data corresponding to the network node to obtain the security judgment result of the network node in the current time series. Based on the security assessment results, a security risk identifier corresponding to the security assessment results is generated for each network node, and the security risk identifier is bound to the network node identifier to form the security risk identifier result corresponding to the network node; The security risk identification results are aggregated according to the order of network nodes to form a security risk identification set.

[0014] Optionally, the protection scheduling update module specifically includes: Based on the set of security risk identifiers, and classifying the security risk identifiers according to the network node identifiers, a risk identifier sequence corresponding to the network node is formed; For each network node in the risk identifier sequence, based on the risk type and risk level corresponding to the security risk identifier, a description of the protection and control strategy corresponding to the network node is generated; The protection and control strategy description information is converted into protection and control instructions that are consistent with the operation instruction format of network control equipment, forming a protection and control instruction sequence corresponding to the network node. Based on the mapping relationship between network nodes and network control devices, the protection control command sequence is sent to the corresponding network control devices, and the network control devices are triggered to execute the protection control commands. After the network control device executes the protection control command, it collects the execution feedback information of the corresponding network node and associates the execution feedback information with the network node identifier to form an execution feedback data set. Based on the execution feedback data set, the state scheduling parameters in the state space update mechanism of parallel selective state scheduling are updated to generate state scheduling parameter update results.

[0015] The beneficial effects of this invention are: This invention constructs a state-space representation based on a dynamic network graph and introduces a parallel selective state scheduling state-space update mechanism into the state update path. This enables node-level parallel analysis and differentiated processing of network node state changes, effectively reducing the overhead of ineffective updates for nodes with insignificant state changes and improving the targeting and overall processing efficiency of the state-space update process. By reconstructing the state update process based on state importance parameters, state-space recursive updates are performed only on network nodes that meet preset update conditions. This optimizes the allocation of computing resources and transforms the granularity of state updates from global synchronization to node-level selective scheduling, exhibiting better real-time performance and operational stability in large-scale dynamic network environments. This invention organically links state-space modeling, communication behavior security judgment, and protection control command generation, and continuously updates state scheduling parameters based on execution feedback. This effectively solves the problems of insufficient coupling between network state analysis and security protection execution, and limited dynamic adjustment capabilities of protection strategies in existing technologies. It breaks through the limitations of traditional protection modes based on fixed rules or full analysis, and achieves significant improvements in dynamic adaptability, judgment consistency, and protection scheduling synergy in real-time network security protection. Attached Figure Description

[0016] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a schematic diagram of the overall structure and processing flow of a real-time network security protection system based on big data analysis proposed in this invention. Figure 2 This is a schematic diagram of the state space update mechanism for parallel selective state scheduling proposed in this invention. Detailed Implementation

[0017] Combination Figures 1-2 The present invention will be described in further detail below. These accompanying drawings are simplified schematic diagrams, illustrating only the basic structure of the invention and showing the main components relevant to the invention. Figure 1 and Figure 2 The present invention provides a real-time network security protection system based on big data analysis, comprising the following modules: Dynamic graph construction module: Collects real-time network data, constructs network nodes according to communication entity identification information, constructs the interaction relationship between network nodes according to communication behavior information, and organizes the network nodes and interaction relationship in time sequence according to timestamp information to form a dynamic network graph dataset; State space initialization module: Constructs the input state of the Graph State Space Model based on the dynamic network graph dataset, converts the dynamic network graph under each time series into a graph state representation, and completes the state initialization according to the state space recursion rule to obtain the initial state space representation; Parallel State Scheduling Module: Introduces a parallel selective state scheduling state space update mechanism into the state update path of the Graph State Space Model. Performs parallel analysis on the network node states in the initial state space representation, calculates node state change information, and generates a set of state importance parameters. State update and reconstruction module: Reconstructs the state update process of the Graph State Space Model based on the set of state importance parameters. Only network nodes that meet the preset update conditions are updated in state space, while the other network nodes retain the state space representation of the previous time step, thus obtaining the updated state space representation. Behavioral security assessment module: Based on the updated state space representation, it assesses the security of communication behaviors of network nodes that have undergone state updates and generates security risk identification results for the network nodes. Protection scheduling update module: Generates network security protection control instructions based on security risk identification results, and sends the protection control instructions to the corresponding network control devices for execution. At the same time, it collects execution feedback information and updates the state scheduling parameters in parallel selective state scheduling based on the execution feedback information.

[0018] In this embodiment, the dynamic graph construction module specifically includes: Real-time network data is collected from network boundary devices, core switching nodes, and terminal security agents. The real-time network data is limited to communication entity identification information, communication behavior information, and timestamp information. The collected real-time network data is processed to unify the data format, converting communication entity identification information into a unified identification format and communication behavior information into a unified behavior description format. A set of network nodes is generated based on communication entity identification information in a unified identifier format; A set of interaction relationships between network nodes is generated based on communication behavior information in a unified behavior description format. The network node set and interaction relationship set are organized temporally based on timestamp information to form a dynamic network graph dataset arranged in chronological order.

[0019] In this embodiment, the state space initialization module specifically includes: Based on the dynamic network graph dataset, the dynamic network graphs are sorted according to timestamp order and grouped at preset time intervals to obtain a time series network graph set arranged in chronological order. For time series network graphs, read the network nodes and the interaction relationships between them within the corresponding time series, and assign sequential labels to the network nodes based on their order of appearance in the dynamic network graph, forming a set of node labels for node differentiation. Based on the node identifier set and interaction relationship information, a node input vector is constructed for the network node. The node input vector consists of the node identifier information and the interaction relationship information of the node in the current time series, forming a graph structure input representation corresponding to the time series. The state space structure of the Graph State Space Model is constructed based on the graph structure input representation. Each network node is mapped to a state unit in the state space, and a node state vector of fixed dimension is assigned to each state unit to form a set of state space nodes. Based on the interaction relationships in the dynamic network graph, the association relationships between state units are established in the state space, and the interaction relationships are mapped into state transmission paths between state units, forming a state association structure in the state space. Based on the pre-defined state space recursion rules of the Graph State Space Model, the node state vectors in the state space node set are initialized, and the initialized node state vectors are bound to the corresponding time series identifiers to form the initial state space representation.

[0020] In this embodiment, the parallel state scheduling module specifically includes: Based on the initial state space representation, the node state vector corresponding to each network node in the state space node set is obtained, and the node state vectors are grouped according to the time series identifier to form a node state vector sequence for state analysis. In the state update path of the Graph State Space Model, a state space update mechanism with parallel selective state scheduling is introduced. A parallel analysis channel corresponding to the node state vector sequence is established within the state update path, so that the node state vectors of different network nodes enter an independent parallel analysis process. In each parallel analysis channel, based on the changes in the node state vector in adjacent time series, state change calculation processing is performed on the node state vector to obtain the node state change information of the corresponding network node. The node state change information corresponding to each network node is collected and processed, and the node state change information is converted into state change quantity description data to characterize the degree of node state change. Based on the state change description data, a corresponding state importance parameter is generated for each network node, and a correspondence is established between the state importance parameter and the network node to form a set of state importance parameters.

[0021] In this embodiment, the state space update mechanism for parallel selective state scheduling specifically includes: In the state update path of the Graph State Space Model, the state update granularity is divided according to the network nodes in the state space node set, and the original state update process based on time series sequential execution is broken into multiple state analysis paths based on network nodes. Based on the node state vector sequence, the node state vector sequences corresponding to different network nodes are assigned to the corresponding state analysis paths, so that each state analysis path only receives the node state vector sequence of the same network node. In each state analysis path, the temporal evolution order of the node state vector corresponding to the network node is maintained independently, so that the node state vector enters the state change calculation and processing sequentially according to the time series identifier within the state analysis path. Parallel scheduling of each state analysis path is performed at the state update path level, so that multiple state analysis paths can participate in the node state change calculation and processing simultaneously within the same state update cycle. The node state change information output by each state analysis path after parallel scheduling is returned to the state update path aggregation location of the GraphState Space Model, serving as the input data source for subsequent state change information aggregation and state importance parameter generation.

[0022] In this embodiment, the state update and reconstruction module specifically includes: Based on the set of state importance parameters, the state importance parameters in the set are associated with the corresponding network nodes to form a correspondence between network nodes and state importance parameters. State update judgment conditions are set based on the set of state importance parameters. The state importance parameters corresponding to each network node are compared with the preset update conditions one by one to obtain the node judgment result used to distinguish between updating nodes and non-updating nodes. Based on the node determination results, the network nodes are divided into a first set of nodes that need to perform state space updates and a second set of nodes that maintain their original state space representation, forming a node grouping result for state update scheduling; For the first set of nodes, the node state vector of the corresponding network node is read from the initial state space representation, and the state update operation is performed on the node state vector according to the state space recursion rule of the Graph State Space Model to generate the updated set of node state vectors. For the second set of nodes, keep the node state vectors of the corresponding network nodes in the initial state space representation unchanged, and write the node state vectors directly into the updated state space representation; The updated set of node state vectors is merged with the unchanged set of node state vectors and reorganized according to the order of network nodes to form the updated state space representation.

[0023] In this embodiment, the behavior security determination module specifically includes: Obtain the node state vector corresponding to the network node that has undergone a state update, and filter the node state vectors according to the network node identifier to form a candidate node state set for security determination and processing. For each network node in the candidate node state set, read the communication behavior information of the network node in the corresponding time series, and align the communication behavior information with the node state vector to form the joint state description data corresponding to the network node. Based on the joint state description data, behavioral feature extraction processing is performed on the communication behavior of network nodes in the current time series, the communication behavior information is converted into behavioral feature description data, and a correspondence is established with the node state vector. The behavioral feature description data is input into a preset set of security judgment rules. The rule matching process is performed on the behavioral feature description data corresponding to the network node to obtain the security judgment result of the network node in the current time series. Based on the security assessment results, a security risk identifier corresponding to the security assessment results is generated for each network node, and the security risk identifier is bound to the network node identifier to form the security risk identifier result corresponding to the network node; The security risk identification results are aggregated according to the order of network nodes to form a security risk identification set.

[0024] In this embodiment, the protection scheduling update module specifically includes: Based on the set of security risk identifiers, and classifying the security risk identifiers according to the network node identifiers, a risk identifier sequence corresponding to the network node is formed; For each network node in the risk identifier sequence, based on the risk type and risk level corresponding to the security risk identifier, a description of the protection and control strategy corresponding to the network node is generated; The protection and control strategy description information is converted into protection and control instructions that are consistent with the operation instruction format of network control equipment, forming a protection and control instruction sequence corresponding to the network node. Based on the mapping relationship between network nodes and network control devices, the protection control command sequence is sent to the corresponding network control devices, and the network control devices are triggered to execute the protection control commands. After the network control device executes the protection control command, it collects the execution feedback information of the corresponding network node and associates the execution feedback information with the network node identifier to form an execution feedback data set. Based on the execution feedback data set, the state scheduling parameters in the state space update mechanism of parallel selective state scheduling are updated to generate state scheduling parameter update results.

[0025] Example 1: To verify the feasibility of this invention in practice, a typical large-scale enterprise-level network operating environment was selected as the application background. This network environment simultaneously includes a large number of terminal access devices, boundary access devices, and core forwarding nodes. Network communication exhibits characteristics of complex connection relationships, high communication frequency, and rapid time-series changes. In this practical scenario, the network needs to continuously process high-concurrency communication requests and perform real-time identification and protection control of potential abnormal communication behaviors. Therefore, high requirements are placed on the network security protection system in terms of real-time performance, analysis accuracy, and scheduling efficiency.

[0026] In this application scenario, existing network security protection methods mostly rely on fixed rule matching or state analysis based on time-series overall updates. These methods typically use preset rules or full state updates as their core implementation path. When faced with a continuously increasing number of network nodes and rapidly changing communication relationships, they are prone to problems such as high state update overhead, redundant calculations for irrelevant nodes, and delayed responses to local anomalies. Furthermore, existing methods struggle to maintain global state consistency while performing high-frequency state analysis on a small number of high-risk nodes, resulting in significant delays between the generation and execution of protection strategies, failing to meet the application requirements of real-time network security protection. To address these issues, this invention proposes a real-time network security protection system based on big data analytics. By constructing a Graph State Space Model and introducing a parallel selective state scheduling state space update mechanism, it achieves refined modeling and efficient scheduling of network node states.

[0027] In practice, the dynamic graph construction module continuously acquires communication entity identification information, communication behavior information, and timestamp information from network boundary devices, core switching nodes, and terminal security agents. After entering the system, the collected data is uniformly converted into a standardized data format. The communication entity identification information is used to construct network nodes, the communication behavior information is used to construct the interaction relationships between network nodes, and the timestamp information is used to organize the nodes and interaction relationships in a temporal sequence, thereby forming a dynamic network graph dataset that reflects the dynamic evolution characteristics of the network structure.

[0028] The state space initialization module performs structured modeling of the network's operational state based on a dynamic network graph dataset. The dynamic network graph is sorted according to timestamps and forms a time-series network graph set at fixed time intervals. The network nodes and their interactions within each time-series network graph are read, and a set of node identifiers is generated based on the order in which the network nodes appear in the dynamic graph. The node identifier set and interaction information are used together to construct the node input vectors, forming the graph structure input representation for the corresponding time series. This graph structure input representation is mapped to the state space structure of the Graph State SpaceModel, assigning each network node a state unit and a fixed-dimensional node state vector to each state unit. The interactions in the dynamic graph are mapped into state propagation paths between state units in the state space, thus constructing a complete state space association structure. The node state vectors are initially assigned values ​​according to a preset state space recursion rule and bound to the corresponding time-series identifiers, forming the initial state space representation.

[0029] The parallel state scheduling module introduces a parallel selective state scheduling state space update mechanism into the state update path of the Graph State Space Model. The node state vector corresponding to each network node in the state space node set is extracted and grouped according to time series identifiers to form a node state vector sequence. The state update path is split into multiple parallel analysis channels based on network nodes. Each parallel analysis channel only receives the node state vectors of the same network node under different time series and independently maintains the temporal evolution order of the node state vectors. Each parallel analysis channel participates in scheduling within the same state update cycle, and the node state vectors undergo state change calculation processing in their corresponding channels. The changes in node state vectors in adjacent time series are used to generate node state change information. Multiple node state change information is aggregated and converted into state change quantity description data, and based on this, a set of state importance parameters corresponding one-to-one with each network node is generated.

[0030] The state update and reconstruction module reconstructs the state update process of the Graph State Space Model based on the set of state importance parameters. A correspondence is established between the state importance parameters and network nodes, and this is compared with preset state update criteria. Network nodes are divided into a set of nodes requiring state space updates and a set of nodes retaining their original state space representation. Network nodes requiring updates perform node state vector update operations according to state space recursion rules; network nodes that do not meet the update criteria directly reuse their original node state vectors. The updated node state vectors and the unchanged node state vectors are reorganized to form a new state space representation.

[0031] The behavioral security assessment module performs communication behavior analysis based on the updated state space representation. The node state vectors corresponding to network nodes that have undergone state updates are filtered and aligned with the communication behavior information within the corresponding time series to form joint state description data. This joint state description data is used to extract behavioral feature description data of the communication behavior and establish a correspondence with the node state vectors. The behavioral feature description data is then fed into a security assessment rule set for rule matching processing, generating a security assessment result for the network node within the corresponding time series, and further forming a set of security risk identifiers bound to the network node identifier.

[0032] The protection scheduling update module generates protection control policy description information based on the security risk identifier set and converts this information into protection control commands executable by the network control device. These commands are issued and executed according to the mapping relationship between network nodes and network control devices. Execution feedback information is collected and associated with the network node identifier. This feedback data is used to update the state scheduling parameters in the parallel selective state scheduling, enabling the state update scheduling mechanism to adjust based on actual execution results.

[0033] In this embodiment, the node state vector dimension of the Graph State Space Model is set to 64, the state space recursion rule adopts a combination structure of linear transformation and nonlinear activation, the state update period is set to 100 milliseconds, and the maximum concurrency of parallel analysis channels is set to 128. The system enters a stable state after running continuously for 3000 state update periods. In the process of communication behavior feature extraction, communication frequency change, connection duration change, number of interactive nodes change, state change amount, and rule matching results are selected as core feature indicators.

[0034] Table 1 shows the comparison between the measured values ​​and the system prediction values ​​of some network nodes over five consecutive time series.

[0035] Table 1 Comparison of Network Node Status and Risk Assessment

[0036] As shown in Table 1, the predicted and measured values ​​of node state changes maintain a high degree of consistency, the predicted behavioral characteristics deviate little from the actual observations, and the security risk identifiers stably reflect the risk level of network nodes within the corresponding time series. Combined with the state-space update mechanism of parallel selective state scheduling, the system achieves more frequent effective state analysis under the same computing resource conditions, maintaining good real-time protection capabilities in complex network environments, thus verifying the feasibility and effectiveness of the technical solution of this invention in practical network security protection scenarios.

Claims

1. A real-time network security protection system based on big data analysis, characterized in that, Includes the following modules: Dynamic graph construction module: Collects real-time network data, constructs network nodes according to communication entity identification information, constructs the interaction relationship between network nodes according to communication behavior information, and organizes the network nodes and interaction relationship in time sequence according to timestamp information to form a dynamic network graph dataset; State space initialization module: Constructs the input state of the Graph State Space Model based on the dynamic network graph dataset, converts the dynamic network graph under time series into a graph state representation, and completes state initialization according to the state space recursion rule to obtain the initial state space representation; Parallel State Scheduling Module: Introduces a parallel selective state scheduling state space update mechanism into the state update path of the Graph State Space Model. Performs parallel analysis on the network node states in the initial state space representation, calculates node state change information, and generates a set of state importance parameters. State update and reconstruction module: Reconstructs the state update process of the Graph State Space Model based on the set of state importance parameters. Only network nodes that meet the preset update conditions are updated in state space, while the other network nodes retain the state space representation of the previous time step, thus obtaining the updated state space representation. Behavioral security assessment module: Based on the updated state space representation, it assesses the security of communication behaviors of network nodes that have undergone state updates and generates security risk identification results for the network nodes. Protection scheduling update module: Generates network security protection control instructions based on security risk identification results, and sends the protection control instructions to the corresponding network control devices for execution. At the same time, it collects execution feedback information and updates the state scheduling parameters in parallel selective state scheduling based on the execution feedback information.

2. The real-time network security protection system based on big data analysis according to claim 1, characterized in that, The dynamic graph construction module specifically includes: Real-time network data is collected from network boundary devices, core switching nodes, and terminal security agents. The real-time network data is limited to communication entity identification information, communication behavior information, and timestamp information. The collected real-time network data is processed to unify the data format, converting communication entity identification information into a unified identification format and communication behavior information into a unified behavior description format. A set of network nodes is generated based on the communication entity identification information in a unified identifier format; A set of interaction relationships between network nodes is generated based on communication behavior information in a unified behavior description format. The network node set and interaction relationship set are organized temporally based on timestamp information to form a dynamic network graph dataset arranged in chronological order.

3. The real-time network security protection system based on big data analysis according to claim 1, characterized in that, The state space initialization module specifically includes: Based on the dynamic network graph dataset, the dynamic network graphs are sorted according to timestamp order and grouped at preset time intervals to obtain a time series network graph set arranged in chronological order. For time series network graphs, read the network nodes and the interaction relationships between them within the corresponding time series, and sequentially identify the network nodes based on their appearance order in the dynamic network graph to form a set of node identifiers for node differentiation. Based on the node identifier set and interaction relationship information, a node input vector is constructed for the network node. The node input vector consists of the node identifier information and the interaction relationship information of the node in the current time series, forming a graph structure input representation corresponding to the time series. The state space structure of the Graph State Space Model is constructed based on the graph structure input representation. Each network node is mapped to a state unit in the state space, and a node state vector of fixed dimension is assigned to each state unit to form a set of state space nodes. Based on the interaction relationships in the dynamic network graph, the association relationships between state units are established in the state space, and the interaction relationships are mapped into state transmission paths between state units, forming a state association structure in the state space. Based on the pre-defined state space recursion rules of the Graph State Space Model, the node state vectors in the state space node set are initialized, and the initialized node state vectors are bound to the corresponding time series identifiers to form the initial state space representation.

4. The real-time network security protection system based on big data analysis according to claim 1, characterized in that, The parallel state scheduling module specifically includes: Based on the initial state space representation, the node state vector corresponding to each network node in the state space node set is obtained, and the node state vectors are grouped according to the time series identifier to form a node state vector sequence for state analysis. In the state update path of the Graph State Space Model, a state space update mechanism with parallel selective state scheduling is introduced. A parallel analysis channel corresponding to the node state vector sequence is established within the state update path, so that the node state vectors of different network nodes enter an independent parallel analysis process. In each parallel analysis channel, based on the changes in the node state vector in adjacent time series, state change calculation processing is performed on the node state vector to obtain the node state change information of the corresponding network node. The node state change information corresponding to each network node is collected and processed, and the node state change information is converted into state change quantity description data to characterize the degree of node state change. Based on the state change description data, a corresponding state importance parameter is generated for each network node, and a correspondence is established between the state importance parameter and the network node to form a set of state importance parameters.

5. A real-time network security protection system based on big data analysis according to claim 4, characterized in that, The state space update mechanism for the parallel selective state scheduling specifically includes: In the state update path of the Graph State Space Model, the state update granularity is divided according to the network nodes in the state space node set, and the original state update process based on time series sequential execution is broken into multiple state analysis paths based on network nodes. Based on the node state vector sequence, the node state vector sequences corresponding to different network nodes are assigned to the corresponding state analysis paths, so that each state analysis path only receives the node state vector sequence of the same network node. In each state analysis path, the temporal evolution order of the node state vector corresponding to the network node is maintained independently, so that the node state vector enters the state change calculation and processing sequentially according to the time series identifier within the state analysis path. Parallel scheduling of state analysis paths is performed at the state update path level, enabling multiple state analysis paths to participate in node state change calculation and processing simultaneously within the same state update cycle. The node state change information output by the parallel-scheduled state analysis path is returned to the state update path aggregation location of the Graph StateSpace Model, serving as the input data source for subsequent state change information aggregation and state importance parameter generation.

6. The real-time network security protection system based on big data analysis according to claim 1, characterized in that, The state update and reconstruction module specifically includes: Based on the set of state importance parameters, the state importance parameters in the set are associated with the corresponding network nodes to form a correspondence between network nodes and state importance parameters. State update judgment conditions are set based on the set of state importance parameters. The state importance parameters corresponding to each network node are compared with the preset update conditions one by one to obtain the node judgment result used to distinguish between updating nodes and non-updating nodes. Based on the node determination results, the network nodes are divided into a first set of nodes that need to perform state space updates and a second set of nodes that maintain their original state space representation, forming a node grouping result for state update scheduling; For the first set of nodes, the node state vector of the corresponding network node is read from the initial state space representation, and the state update operation is performed on the node state vector according to the state space recursion rule of the Graph State Space Model to generate the updated set of node state vectors. For the second set of nodes, keep the node state vectors of the corresponding network nodes in the initial state space representation unchanged, and write the node state vectors directly into the updated state space representation; The updated set of node state vectors is merged with the unchanged set of node state vectors and reorganized according to the order of network nodes to form the updated state space representation.

7. The real-time network security protection system based on big data analysis according to claim 1, characterized in that, The behavior safety determination module specifically includes: Obtain the node state vector corresponding to the network node that has undergone a state update, and filter the node state vectors according to the network node identifier to form a candidate node state set for security determination and processing. For each network node in the candidate node state set, read the communication behavior information of the network node in the corresponding time series, and align the communication behavior information with the node state vector to form the joint state description data corresponding to the network node. Based on the joint state description data, behavioral feature extraction processing is performed on the communication behavior of network nodes in the current time series, the communication behavior information is converted into behavioral feature description data, and a correspondence is established with the node state vector. The behavioral feature description data is input into a preset set of security judgment rules. The rule matching process is performed on the behavioral feature description data corresponding to the network node to obtain the security judgment result of the network node in the current time series. Based on the security assessment results, a security risk identifier corresponding to the security assessment results is generated for each network node, and the security risk identifier is bound to the network node identifier to form the security risk identifier result corresponding to the network node; The security risk identification results are aggregated according to the order of network nodes to form a security risk identification set.

8. The real-time network security protection system based on big data analysis according to claim 1, characterized in that, The protection scheduling update module specifically includes: Based on the set of security risk identifiers, and classifying the security risk identifiers according to the network node identifiers, a risk identifier sequence corresponding to the network node is formed; For each network node in the risk identifier sequence, based on the risk type and risk level corresponding to the security risk identifier, a description of the protection and control strategy corresponding to the network node is generated; The protection and control strategy description information is converted into protection and control instructions that are consistent with the operation instruction format of network control equipment, forming a protection and control instruction sequence corresponding to the network node. Based on the mapping relationship between network nodes and network control devices, the protection control command sequence is sent to the corresponding network control devices, and the network control devices are triggered to execute the protection control commands. After the network control device executes the protection control command, it collects the execution feedback information of the corresponding network node and associates the execution feedback information with the network node identifier to form an execution feedback data set. Based on the execution feedback data set, the state scheduling parameters in the state space update mechanism of parallel selective state scheduling are updated to generate state scheduling parameter update results.

Images