Network situation display and auxiliary decision-making system
The network situation display and decision support system solves the problem of fragmented situation elements, realizes comprehensive visualization and optimized allocation of network resources, provides real-time defense strategy support, and improves the efficiency of network situation management and decision-making.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- CHINESE PEOPLES LIBERATION ARMY UNIT 32003
- Filing Date
- 2026-01-27
- Publication Date
- 2026-05-01
AI Technical Summary
The existing network situational awareness system suffers from fragmented situational elements, resulting in low efficiency in global cognition. Furthermore, the system remains static in its information display and cannot achieve real-time prediction, dynamic response, or closed-loop decision-making.
Design a network situation display and decision support system, including a situation display module, a network resource intelligent allocation module, and a network security intelligent analysis module, to achieve multi-source data fusion, resource optimization allocation, and visualization of potential attack paths.
A unified web portal enables comprehensive visualization of the situation, generates optimal resource allocation schemes, and provides defense priority strategies, thereby improving the efficiency of global awareness and enabling the transformation of situation elements into executable strategies.
Smart Images
Figure CN121966997A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the fields of communication networks and cloud computing, and specifically relates to a network situation display and decision support system. Background Technology
[0002] The current network situation awareness system adopts a siloed architecture, with functions such as network resource monitoring, security threat analysis, and target status monitoring implemented in independent subsystems. It can provide basic data visualization capabilities (such as resource balance dashboards, vulnerability lists, host status indicator lights, etc.), and users need to manually switch between multiple systems to obtain fragmented situation views.
[0003] Existing technologies have two major limitations: First, the fragmentation of situational elements leads to low efficiency in global cognition; second, the system remains at the level of static information display, unable to transform situational elements into executable strategies through intelligent algorithms, nor can it perform attack simulations and defense priority generation based on real-time data, ultimately failing to meet the core needs of real-world real-time prediction, dynamic response, and closed-loop decision-making. Summary of the Invention
[0004] (a) Technical problems to be solved The technical problem this invention aims to solve is how to provide a network situation display and decision support system to address the issues of fragmented situation elements leading to low efficiency in global cognition and the system remaining at the level of static information display.
[0005] (II) Technical Solution To address the aforementioned technical problems, this invention proposes a network situation display and decision support system, which includes: a situation display module, a network resource intelligent allocation module, and a network security intelligent analysis module. The situation display module is used to achieve comprehensive visualization of network resources, security situation and target monitoring on a unified web portal based on a multi-source data fusion architecture; The intelligent network resource allocation module is used to generate the optimal resource allocation scheme based on the collected network resource status data when a user submits a resource request. The multi-stage decision-making process includes: location constraint priority screening process and resource fragmentation minimization allocation process. The network security intelligent analysis module uses a three-step approach—threat labeling, path deduction, and defense focusing—to mark high-risk vulnerabilities and weak password assets identified through scanning on the dynamic network topology map of the target monitoring section. Based on node connectivity and attack surface exposure characteristics, it displays potential attack paths to users and generates defense priority strategies.
[0006] (III) Beneficial Effects This invention proposes a network situation display and decision support system, specifically a system integrating "resources, security, and monitoring." The situation display module integrates network resource, network security, and target monitoring data to achieve comprehensive visualization of these metrics within a unified web portal. The intelligent network resource allocation module generates optimal resource allocation schemes based on collected network resource situation data through a multi-stage decision-making process, ensuring minimal network resource fragmentation. The intelligent network security analysis module provides users with visualization of potential attack paths and key defense points through dynamic annotation in the dynamic network topology.
[0007] This invention provides a network situation display and decision support system that integrates "resources, security, and monitoring," overcoming the problem of low efficiency in global cognition caused by the fragmentation of traditional situation elements. At the same time, it ensures the minimization of network resource fragmentation through algorithms, transforms situation elements into executable strategies, and provides users with decision support based on situation. Attached Figure Description
[0008] Figure 1 This is a system architecture diagram of the present invention. Detailed Implementation
[0009] To make the objectives, contents, and advantages of the present invention clearer, the specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples.
[0010] This invention relates to the field of network situational awareness, and is particularly applicable to situational awareness display and decision support within large-scale local area networks.
[0011] The purpose of this invention is to provide a network situation display and decision support system that integrates "resources-security-monitoring" to solve the above-mentioned technical problems.
[0012] To achieve the above objectives, the technical solution adopted by the present invention is as follows: A network situation display and decision support system includes: a situation display module, a network resource intelligent allocation module, and a network security intelligent analysis module.
[0013] The situation display module is used to achieve comprehensive visualization of network resources, security situation and target monitoring on a unified web portal based on a multi-source data fusion architecture; The intelligent network resource allocation module is used to generate the optimal resource allocation scheme based on the collected network resource status data when a user submits a resource request. The multi-stage decision-making process includes: location constraint priority screening process and resource fragmentation minimization allocation process. The network security intelligent analysis module uses a three-step approach—threat labeling, path deduction, and defense focusing—to mark high-risk vulnerabilities and weak password assets identified through scanning on the dynamic network topology map of the target monitoring section. Based on node connectivity and attack surface exposure characteristics, it displays potential attack paths to users and generates defense priority strategies.
[0014] Example 1: This invention provides a network situation display and decision support system, the system comprising: (1) Situation display module This situation display module is based on a multi-source data fusion architecture, enabling comprehensive visualization of network resources, security situation, and target monitoring within a unified web portal. The situation display module includes: a network resource situation layer, a network security situation layer, and a target monitoring situation layer. The network resource status layer monitors the occupancy and idle capacity of cloud host storage resources, wireless spectrum resources, and network bandwidth resources in real time, and renders them dynamically through heat maps and dashboards. The network security situation layer relies on vulnerability scanning probes and weak password detection probes deployed on the existing network to collect device vulnerability information (including CVE number, risk level, and associated host IP) and weak password distribution (type, quantity, and associated host IP) daily, and to mark high-risk threats based on the CVSS v3 standard. The target monitoring situation layer performs full-network host liveness detection (ICMP / TCP SYN scanning) through distributed probe nodes. Combined with asset fingerprinting technology, it transmits host online status, device type, geographical coordinates and affiliated unit data, and drives the dynamic topology engine to realize real-time construction of network architecture. It supports topology self-discovery, dynamic addition and deletion of nodes (automatic access of new hosts and graying of offline nodes) and visual interaction, ensuring that the network topology evolves dynamically with the current network status.
[0015] (2) Intelligent allocation module for network resources When a user submits a resource request, the system generates the optimal resource allocation plan based on collected network resource status data (including the user's organization and geographical coordinates, CPU, memory, storage, spectrum, etc.) through a multi-stage decision-making process. The core idea is as follows: ① Location constraint priority filtering To ensure the allocation scheme meets users' specific geographical location requirements, when a user submits a request, resources are only allocated to those in suitable geographical locations. When a user submits a resource request with geographical constraints (such as Beijing or Shanghai), the system first queries the asset database maintained by the target monitoring situation layer. Based on the resource's "belonging unit" and "geographic coordinates" attributes, it filters out all resource nodes that meet the location conditions, forming an initial candidate node set N. Subsequent resource fragmentation minimization calculations are performed only within this candidate set N.
[0016] ② Minimize resource fragmentation allocation After obtaining the candidate node set N through location constraints, the system calculates a "resource fragmentation rate" for each candidate node n.
[0017] Network resources are allocated based on the minimum fragmentation rate. Resource fragmentation rate is a key indicator measuring the dispersion of remaining resources after allocation. Its core calculation logic is to calculate (remaining resources after allocation / total resources)² for each resource dimension (CPU, memory, spectrum, etc.) of a single node and then sum them. This design leverages the mathematical properties of quadratic functions to impose a stronger penalty on large proportions of remaining resources and a weaker penalty on small proportions, thus guiding the algorithm to prioritize nodes that can form highly aggregated resource blocks after allocation. This mechanism effectively avoids the trap of "large remaining resources but severe fragmentation" in traditional algorithms, ensuring that network resources always remain highly reusable.
[0018] The mathematical principle of the penalty mechanism: the penalty effect of the square term. Squaring the proportion means that when the remaining proportion of a resource is large, its square value will be much larger than itself, resulting in a high penalty weight when summing. Conversely, if the remaining proportion is small, its square value will grow more slowly than when the remaining proportion is large, so the penalty will be weak.
[0019] This invention avoids fragmentation by employing the following approach: Traditional resource allocation algorithms only focus on "maximum remaining amount" or "first-fit," easily leading to resources being fragmented into numerous small pieces, failing to meet the needs of subsequent large-scale tasks. This invention, through the aforementioned strategy of minimizing resource fragmentation, proactively selects nodes with larger and more compact remaining resource blocks after allocation. Because the formula penalizes "high proportion of remaining resources in a single resource dimension," it better selects nodes that "just meet" these criteria, thus avoiding the generation of large, scattered, idle resources across multiple dimensions on a single node, thereby preventing fragmentation.
[0020] The calculation formula is as follows: Where N represents the set of candidate nodes, the set of all nodes that satisfy the geographical location requirement; R represents the set of resource types; The current amount of free space for resource i on node n; The task's requirement for resource i; The total amount of resource i on node n.
[0021] This approach provides users with assistance in developing optimal resource allocation strategies.
[0022] (3) Network security intelligent analysis module This module uses a three-step approach—threat labeling, path deduction, and defense focusing—to mark high-risk vulnerabilities and weak password assets identified through scanning on the dynamic network topology map of the target monitoring section. Based on node connectivity and attack surface exposure characteristics, it displays potential attack paths to users and generates defense priority strategies.
[0023] ① Threat Labeling and Association: The system reads daily vulnerability information (CVE number, risk level, associated IP) and weak password information (type, associated host IP) collected by the network security posture layer. It automatically labels the IP addresses associated with high-risk threats on the real-time network topology map.
[0024] ② Attack Path Simulation: Based on a dynamic topology map labeled with threat nodes, the system utilizes the node connectivity relationships in the topology (such as routing tables, access control list logical relationships, and detected network connections) and the attack surface exposure characteristics of threats (such as attack methods that can be launched corresponding to vulnerability types) to run a lightweight attack graph generation algorithm. This algorithm uses high-risk assets as potential targets or starting points, simulates vulnerability hop paths that attackers might exploit, automatically draws several of the most probable attack paths, and visualizes them on the topology map using dashed lines or connecting lines of different colors.
[0025] Step 1: Input Data Preparation and Modeling Network topology modeling: The network topology constructed in real time by the target monitoring situation layer is abstracted as a directed graph G=(V,E). Here, the vertex set V represents network assets, and each vertex v contains attributes: IP address, device type, and list of open services. The edge set E represents verified network connectivity relationships, and edge e(u,v) indicates a reachable network access path from asset u to asset v.
[0026] Threat knowledge modeling: High-risk vulnerabilities and weak passwords collected from the network security posture layer are transformed into a structured threat knowledge base. Each threat entry is associated with a specific asset (IP) and its attack primitive type is labeled (such as "remote code execution", "privilege escalation", "authentication bypass").
[0027] Rule base definition: A lightweight attack capability propagation rule base R is predefined. Each rule is in the form of: IF precondition THEN postcondition. For example, IF SSH weak password THEN achieves control of the host. This rule base logically maps vulnerability types, weak password types, and attack actions.
[0028] Step 2: Multi-source incremental attack graph construction This algorithm uses known high-risk threats as the source and performs a breadth-first search along the network topology edges to dynamically construct the attack graph.
[0029] S21. Initialize the attack source queue: Traverse the threat knowledge base and add the assets and initial attack capabilities corresponding to all high-risk threats that can be directly used externally as the initial attack state to the attack source queue Q to be expanded.
[0030] S22, Iterative State Expansion: When queue Q is not empty and the preset maximum search depth has not been reached, the following steps are executed in a loop: a. State Retrieval: Retrieve a current attack state S_current from queue Q, and record its asset A_current and the attack capabilities it has acquired.
[0031] b. Neighbor Asset Discovery: In the network topology graph G, find all neighbor asset sets Neighbors(A_current) that are directly accessible from A_current.
[0032] c. Rule matching and state generation: For each neighbor asset A_neighbor, execute: i. Query the list of all threats and vulnerabilities existing on A_neighbor.
[0033] ii. Match the capabilities of the current attack state S_current with the list of weaknesses of A_neighbor in the attack capability propagation rule base R.
[0034] iii. If a match is successful, it means that the attacker may have successfully infiltrated A_neighbor from A_current by exploiting its weaknesses and gained new capabilities. In this case, a new attack state S_new is generated.
[0035] d. State Recording and Enqueueing: Check if the new state S_new has been visited (deduplication is performed based on the combination of assets and core capabilities). If it is a new state, add it to the set of visited states and push it into queue Q for subsequent expansion. Simultaneously, in the attack graph model, add a directed edge from S_current to S_new, and label it with the threat identifier used (e.g., CVE number).
[0036] Step 3: Attack Path Extraction and Criticality Analysis After the algorithm terminates, all paths originating from the initial attack source state and reaching the state marked as a critical asset are extracted from the constructed attack graph model. These paths are then labeled on the network topology graph, displaying the attack paths.
[0037] ③ Defense Priority Strategy Generation: All assets along the attack path are considered high-risk assets and provided to the user as a list of defense assets.
[0038] This invention provides a network situation display and decision support system, specifically a system integrating "resources, security, and monitoring." The situation display module integrates network resource, network security, and target monitoring data to achieve comprehensive visualization of these metrics within a unified web portal. The intelligent network resource allocation module generates optimal resource allocation schemes based on collected network resource situation data through a multi-stage decision-making process, ensuring minimal network resource fragmentation. The intelligent network security analysis module provides users with visualization of potential attack paths and key defense points through dynamic annotation in the dynamic network topology.
[0039] This invention provides a network situation display and decision support system that integrates "resources, security, and monitoring," overcoming the problem of low efficiency in global cognition caused by the fragmentation of traditional situation elements. At the same time, it ensures the minimization of network resource fragmentation through algorithms and transforms situation elements into executable strategies, thereby providing users with decision support based on the situation.
[0040] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.
Claims
1. A network situation display and decision support system, characterized in that, The system includes: a situation display module, a network resource intelligent allocation module, and a network security intelligent analysis module; The situation display module is used to achieve comprehensive visualization of network resources, security situation and target monitoring on a unified web portal based on a multi-source data fusion architecture; The intelligent network resource allocation module is used to generate the optimal resource allocation scheme based on the collected network resource status data when a user submits a resource request. The multi-stage decision-making process includes: location constraint priority screening process and resource fragmentation minimization allocation process. The network security intelligent analysis module uses a three-step approach—threat labeling, path deduction, and defense focusing—to mark high-risk vulnerabilities and weak password assets identified through scanning on the dynamic network topology map of the target monitoring section. Based on node connectivity and attack surface exposure characteristics, it displays potential attack paths to users and generates defense priority strategies.
2. The network situation display and decision support system as described in claim 1, characterized in that, The situation display module includes: a network resource situation layer, a network security situation layer, and a target monitoring situation layer; The network resource status layer monitors the occupancy and idle capacity of cloud host storage resources, wireless spectrum resources, and network bandwidth resources in real time, and renders them dynamically through heat maps and dashboards. The network security posture layer relies on vulnerability scanning probes and weak password detection probes to collect device vulnerability information and weak password distribution daily, and to mark high-risk threats based on the CVSS v3 standard. The target monitoring situation layer implements full-network host liveness detection through distributed probe nodes, and combines asset fingerprinting technology to transmit host online status, device type, geographical coordinates and affiliated unit data. It also drives the dynamic topology engine to realize real-time construction of network architecture, and supports topology self-discovery, dynamic addition and deletion of nodes and visual interaction, ensuring that the network topology evolves dynamically with the current network status.
3. The network situation display and decision support system as described in claim 2, characterized in that, Device vulnerability information includes: CVE number, risk level, and associated host IP. Weak password distribution includes: type, quantity, and associated host IP.
4. The network situation display and decision support system as described in claim 2, characterized in that, The network resource status data includes the user's affiliated unit and geographical coordinates, CPU, memory, storage, and spectrum.
5. The network situation display and decision support system as described in claim 2, characterized in that, The location constraint priority screening process includes: ensuring that the allocation scheme meets the user's specific requirements for geographical location; when the user submits a request, only resources with suitable geographical locations are screened and allocated; when the user submits a resource application containing geographical constraints, the system first queries the asset database maintained by the target monitoring situation layer, and filters out all resource nodes that meet the location conditions based on the resource's "belonging unit" and "geographic coordinates" attributes, forming an initial candidate node set N, and the subsequent resource fragment minimization calculation is only performed within this candidate set N.
6. The network situation display and decision support system as described in claim 5, characterized in that, The resource fragmentation minimization allocation process includes: After obtaining the candidate node set N through position constraints, the system calculates a "resource fragmentation rate" for each candidate node n; Network resources are allocated to the portion with the lowest fragmentation rate. Resource fragmentation rate is a key indicator of the dispersion of remaining resources after allocation. Its core calculation logic is: calculate (remaining resource amount after allocation / total resource amount)² for each resource dimension of a single node and sum them. This design utilizes the mathematical properties of quadratic functions to impose a stronger penalty on large proportions of remaining resources and a weaker penalty on small proportions, thereby guiding the algorithm to prioritize nodes that can form highly aggregated resource blocks after allocation. The calculation formula is as follows: Where N represents the set of candidate nodes, the set of all nodes that satisfy the geographical location requirement; R represents the set of resource types; The current amount of free space for resource i on node n; The task's requirement for resource i; The total amount of resource i on node n.
7. The network situation display and decision support system as described in claim 2, characterized in that, The threat labeling includes: reading vulnerability information and weak password information collected daily by the network security situation layer, and automatically labeling the IP addresses associated with high-risk threats on the real-time network topology map.
8. The network situation display and decision support system as described in claim 7, characterized in that, The path deduction includes: based on a dynamic topology graph labeled with threat nodes, using the node connectivity in the topology and the attack surface exposure characteristics of the threat, running a lightweight attack graph generation algorithm; the algorithm takes high-risk assets as potential targets or starting points, simulates vulnerability jump paths that attackers may exploit, automatically draws several most likely attack paths, and visualizes them on the topology graph using dashed lines or connecting lines of different colors.
9. The network situation display and decision support system as described in claim 8, characterized in that, The path deduction specifically includes the following steps: Step 1: Input Data Preparation and Modeling Network topology modeling: The network topology constructed in real time by the target monitoring situation layer is abstracted into a directed graph G=(V,E); where the vertex set V represents network assets, and each vertex v contains attributes: IP address, device type, and open service list; the edge set E represents the verified network connectivity, and the edge e(u,v) indicates that there is a reachable network access path from asset u to asset v; Threat knowledge modeling: High-risk vulnerabilities and weak passwords collected from the network security posture layer are transformed into a structured threat knowledge base; each threat entry is associated with a specific asset IP and its attack primitive type is labeled. Rule base definition: A lightweight attack capability propagation rule base R is predefined; each rule is in the form of: IF precondition THEN postcondition; this rule base logically maps vulnerability types, weak password types, and attack actions; Step 2: Multi-source incremental attack graph construction A strategy of using known high-risk threats as the source and performing a breadth-first search along the network topology edges is adopted to dynamically construct the attack graph; S21. Initialize the attack source queue: Traverse the threat knowledge base and add the assets and initial attack capabilities corresponding to all high-risk threats that can be directly used by the outside world as the initial attack state to the attack source queue Q to be expanded. S22, Iterative State Expansion: When queue Q is not empty and the preset maximum search depth has not been reached, the following steps are executed in a loop: a. State Retrieval: Retrieve a current attack state S_current from queue Q, and record its asset A_current and the attack capabilities it has acquired; b. Neighbor Asset Discovery: In the network topology graph G, find all neighbor asset sets Neighbors(A_current) that are directly accessible from A_current; c. Rule matching and state generation: For each neighbor asset A_neighbor, execute: i. Query the list of all threats and vulnerabilities existing on A_neighbor; ii. Match the capabilities of the current attack state S_current with the vulnerability list of A_neighbor in the attack capability propagation rule base R; iii. If a match is successful, it means that the attacker may have successfully penetrated A_neighbor from A_current by exploiting the weakness of A_neighbor and gained new capabilities; at this time, a new attack state S_new is generated. d. State recording and enqueueing: Check if the new state S_new has been visited; if it is a new state, add it to the set of visited states and push it into queue Q to wait for further expansion; at the same time, add a directed edge from S_current to S_new in the attack graph model and mark the threat identifier used. Step 3: Attack Path Extraction and Criticality Analysis After the algorithm terminates, all paths from the initial attack source state to the marked critical asset state are extracted from the completed attack graph model; and the attack paths are marked on the network topology graph to show the attack paths.
10. The network situation display and decision support system as described in claim 8, characterized in that, The defense focus includes: treating all assets along the attack path as high-risk assets and providing them to the user as a list of defensive assets.