Network security analysis system and method based on security situation awareness system

Abstract

The invention discloses a network security analysis system and method based on a security situation awareness system, and relates to the technical field of network security situation awareness, and the system comprises a data collection module, a processing module, an event reconstruction module, a threat analysis module and a situation generation module which cooperate in sequence. The data acquisition module acquires original data containing encrypted traffic and unstructured alarm from a network boundary probe; the data processing module performs hierarchical decoding and normalization on the data to generate a standardized record with a unified timestamp; the event reconstruction module connects the records into a continuous event sequence according to a time sequence; the threat analysis module compares the event sequence with a threat behavior pattern library, and identifies and marks fragments conforming to an attack chain; and the situation generation module constructs a network security situation portrait accordingly. According to the scheme, effective analysis of encrypted and unstructured security data is realized, a complex and latent attack behavior chain can be identified based on the continuous event sequence, and the depth and accuracy of threat detection are improved.

Description

Network security analysis system and method based on security situation awareness system Technical Field

[0001] This invention belongs to the field of network security situation awareness technology, specifically a network security analysis system and method based on a security situation awareness system. Background Technology

[0002] Current network security analysis systems face limitations in data source processing. Mainstream solutions struggle to directly parse encrypted network traffic payloads, often only able to analyze traffic metadata or relying on pre-decrypted environments, resulting in ineffective detection of threat behaviors within encrypted channels. Furthermore, alert messages from different devices are mostly unstructured text data, requiring existing technologies to rely on numerous customized parsing scripts and manual intervention for standardization, leading to low processing efficiency and poor real-time performance. Encrypted data and heterogeneous logs form isolated data silos, hindering the effective utilization of comprehensive analytical capabilities.

[0003] At the security incident analysis level, common techniques focus on correlating and aggregating generated discrete alerts, identifying co-occurrence relationships through rules or statistical methods. This approach lacks the ability to reconstruct the original activity sequence, fragmenting the attacker's continuous intrusion steps into independent alert points. Because it cannot construct a complete event chain based on precise time sequence, security analysis struggles to characterize progressive attack processes that span multiple time periods and steps, leaving blind spots in the identification of complex attack patterns such as advanced persistent threats.

[0004] This invention aims to solve the above-mentioned problems by achieving the fusion decoding and standardization of encrypted traffic and unstructured alarms. Based on this, it constructs a dynamic event chain that can reflect the continuity of attacks, thereby improving the ability to perceive and trace the source of hidden threats. Summary of the Invention

[0005] This invention aims to at least solve one of the technical problems existing in the prior art. To this end, this invention proposes a network security analysis system based on a security situation awareness system, comprising: a data acquisition module, which collects raw monitoring data streams from probes deployed at the network boundary, the raw monitoring data streams containing encrypted traffic payload data and unstructured alarm message data; a data processing module, which performs layered decoding and normalization operations on the raw monitoring data streams to generate standardized security data records with unified timestamps; an event reconstruction module, which performs event chain reconstruction operations on the standardized security data records, connecting discrete security data records into a continuous event sequence based on timestamps to form an initial security event chain; a threat analysis module, which performs threat pattern injection operations on the initial security event chain, compares the initial security event chain with a predefined threat behavior pattern library, identifies segments in the chain that match known threat patterns, and generates an enhanced security event chain with threat tags; and a situation generation module, which performs situation profile construction operations based on the enhanced security event chain, extracts the distribution characteristics and evolution trends of threat tags in the enhanced security event chain, and generates a current network security situation profile.

[0006] Furthermore, the step of performing layered decoding and normalization operations on the original monitoring data stream to generate standardized security data records with unified timestamps includes: identifying the protocol type and decrypting the encrypted traffic payload data to restore the plaintext application layer session content data; performing field template matching and keyword extraction on the unstructured alarm message data to extract structured alarm data containing source address, destination address, and event type; identifying sensitive operation instructions on the application layer session content data and marking instruction fragments that meet high-risk operation characteristics; synchronizing the structured alarm data with the application layer session content data marked with high-risk operation characteristic instruction fragments at millisecond precision, assigning a unified format timestamp to each data item; and encapsulating all data with the timestamps into the standardized security data record with a preset field structure.

[0007] Furthermore, the step of performing an event chain reconstruction operation on the standardized security data records, connecting discrete security data records into a continuous event sequence based on timestamp markers to form an initial security event chain, includes: reading the timestamp markers in the standardized security data records and sorting all the standardized security data records according to the order of the timestamp markers; analyzing the session correlation between the sorted standardized security data records, and aggregating multiple standardized security data records belonging to the same session into a session unit based on the same network session 5-tuple information; analyzing the causal logic relationship between each session unit, and establishing a causal connection between the two session units when the output data of one session unit is identified as the triggering condition of another session unit; and assembling all the session units with established causal connections into a directed graph structure according to the timestamp marker order and the direction of the causal connection, wherein the directed graph structure is the initial security event chain.

[0008] Further, the step of performing threat pattern injection on the initial security event chain, comparing the initial security event chain with a predefined threat behavior pattern library, identifying segments in the chain that match known threat patterns, and generating an enhanced security event chain with threat tags, includes: loading threat patterns from the predefined threat behavior pattern library, each threat pattern consisting of a series of attack step features arranged in a specific order; dividing the directed graph structure of the initial security event chain into subgraph sliding window segments to generate a series of continuous or overlapping chain segments; performing dynamic programming matching between the session unit feature sequence of each chain segment and the attack step feature sequence of each threat pattern, and calculating a matching score; when the matching score of a chain segment exceeds a preset matching threshold, determining that the chain segment matches the corresponding threat pattern, and adding a corresponding threat type tag to each session unit in the chain segment; and recombining all session units with added threat type tags and their original causal connections to form the enhanced security event chain with threat tags.

[0009] Furthermore, the operation of constructing a situational profile based on the enhanced security event chain extracts the distribution characteristics and evolution trends of threat markers in the enhanced security event chain to generate a security situational profile of the current network. This includes: statistically analyzing the frequency of different threat type markers in the enhanced security event chain to generate a threat type distribution histogram; analyzing the occurrence density of threat markers in the enhanced security event chain over time, calculating the number of threat events per unit time, and generating a threat activity time-series curve; identifying the clustering of threat markers on network topology nodes in the enhanced security event chain, locating the network area most severely affected by the threat, and generating a threat impact range heatmap; and fusing and encapsulating the threat type distribution histogram, threat activity time-series curve, and threat impact range heatmap to form a multi-dimensional security situational profile of the current network.

[0010] Furthermore, the security situation profile is used to perform an adaptive policy generation operation, which specifically includes: parsing the threat type distribution histogram in the security situation profile to determine the current main threat type set; retrieving initial response policy entries for each threat type from a preset policy rule knowledge base based on the threat type set; evaluating the response urgency level of the initial response policy entries by combining the threat activity time series curve in the security situation profile, and sorting the policy execution order according to the response urgency level; integrating the threat impact range heatmap in the security situation profile to fine-grainedly adjust the execution parameters of the sorted initial response policy entries, including adjusting the target network segment range of the policy and adjusting the intensity level of policy execution; and outputting the final policy instruction set after sorting and parameter adjustment.

[0011] Furthermore, the construction and updating of the policy rule knowledge base includes: collecting historical network security incident reports and corresponding effective handling records to form a historical case library; extracting policy elements from each case in the historical case library, the policy elements including the triggered threat type, the handling action adopted, the network device involved, and the handling effect achieved; structuring and storing the extracted policy elements according to the paradigm of "threat type-handling action-participating device-effect evaluation" to form basic policy rules; continuously monitoring the execution feedback data of the final policy instruction set in the actual network environment, and triggering a revision process for the corresponding basic policy rules when the execution feedback data indicates that the policy effect is lower than the expected threshold; and adding, deleting, or modifying the basic policy rules in the policy rule knowledge base according to the conclusion of the revision process.

[0012] Furthermore, after generating the current network security posture profile, the system also includes security posture simulation and early warning operations: based on the evolution trend of threat markers in the enhanced security event chain, a time series prediction model is used to simulate the threat diffusion path and evolution pattern over a future period, generating a threat development simulation map; the threat development simulation map is overlaid and analyzed with the network asset importance map to predict the risk level faced by critical assets at future points in time; when the predicted risk level exceeds a preset early warning threshold, an early warning report is generated that includes details of the predicted threat, affected assets, and suggested preparatory measures; the early warning report is pushed to the security operation and maintenance interface for visualization.

[0013] Furthermore, the process of constructing the network asset importance map includes: automatically discovering active assets in the network, collecting asset type information, business information carried by the assets, and information on the management department to which they belong; quantitatively scoring the business importance, data sensitivity, and service continuity requirements of the assets according to preset asset value assessment rules; classifying the assets into multiple importance levels based on the quantitative scoring results; and integrating the asset importance level information and network topology connection information to create a visualized network asset importance map, wherein assets of different importance levels are distinguished by different colors and icons.

[0014] Furthermore, the present invention also includes a network security analysis method based on a security situation awareness system, the method comprising all the modules and method flow of the network security analysis system based on the security situation awareness system described above.

[0015] Compared to existing technologies, the advantages of this invention are as follows: By deploying probes at the network boundary to collect raw data streams containing encrypted traffic payloads and unstructured alarms, and performing layered decoding and normalization operations, the system achieves unified preprocessing of heterogeneous, raw security monitoring data. This technology directly processes encrypted protocol payloads, decoding them into analyzable plaintext or structured data, while simultaneously parsing and mapping text alarms from different sources and formats to a unified data model. This eliminates technical barriers between data sources, generating standardized security data records with a consistent timeline. This improves the data quality and information density input to the analysis engine, exposing threat indicators that were previously ignored due to encryption or messy formats, providing a reliable and integrated data foundation for subsequent advanced analysis.

[0016] This technology connects standardized discrete data records into a continuous event sequence based on a unified timestamp, forming an initial security event chain. Then, a predefined library of threat behavior patterns describing multi-step attack processes is dynamically compared and matched against this chain. This transforms the analysis object from independent alert points into temporally ordered behavioral trajectories, identifying continuous operational segments that conform to specific attack chain models through pattern injection. It achieves "behavioral chain" level detection for complex attacks, revealing causal and logical connections between discrete events, and improving the detection capability and identification accuracy for attacks with clear tactics, techniques, and processes, such as advanced persistent threats. Attached Figure Description

[0017] Figure 1 is a time sequence diagram of the network security analysis system based on the security situation awareness system described in this invention; Figure 2 is a flowchart of the event chain reconstruction operation; Figure 3 is a dual-axis composite graph of the proportion and growth trend analysis of network security threat types; Figure 4 is a histogram of the frequency distribution of network security threat types; Figure 5 is a time sequence curve of the number of network security predicted threat events. Detailed Implementation

[0018] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] Referring to Figure 1, the implementation scheme of the network security analysis system based on the security situation awareness system includes the collaborative operation of a data acquisition module, a data processing module, an event reconstruction module, a threat analysis module, and a situation generation module. The data acquisition module collects raw monitoring data streams from probes deployed at the network boundary. These raw monitoring data streams contain encrypted traffic payload data and unstructured alarm message data. The data processing module performs layered decoding and normalization operations on the raw monitoring data streams to generate standardized security data records with unified timestamps. The event reconstruction module performs event chain reconstruction operations on the standardized security data records, connecting discrete security data records into a continuous event sequence based on timestamps to form an initial security event chain. The threat analysis module performs threat pattern injection operations on the initial security event chain, comparing the initial security event chain with a predefined threat behavior pattern library, identifying segments in the chain that match known threat patterns, and generating an enhanced security event chain with threat tags. The situation generation module performs situation profile construction operations based on the enhanced security event chain, extracting the distribution characteristics and evolution trends of threat tags in the enhanced security event chain to generate a current network security situation profile.

[0020] In one embodiment of the present invention, referring to Figure 2, the data processing module performs layered decoding and normalization operations on the raw monitoring data stream. This operation is for the mixed data stream collected from network boundary probes, which includes encrypted traffic payload data and unstructured alarm message data. The data processing module first identifies the protocol type of the encrypted traffic payload data, identifying the specific application layer or transport layer protocol carrying the traffic. Then, based on the identified protocol type, it calls the corresponding decryption algorithm or uses a preset decryption key to decrypt and parse the encrypted payload, restoring the plaintext application layer session content data. Simultaneously, the data processing module processes the unstructured alarm message data, matching the raw alarm text one by one with various predefined field templates, selecting the field template with the highest matching degree, and extracting keywords from the alarm text according to the rules defined in the template, thereby extracting structured alarm data containing precise source address, destination address, and clear event type. The data processing module then performs sensitive operation instruction identification on the restored plaintext application layer session content data, scanning the session content using a pattern matching algorithm to mark instruction fragments that conform to high-risk operation characteristics, such as system command execution, privileged file access, or abnormal data download.

[0021] Understandably, the data processing module then performs time synchronization and encapsulation, aligning and correcting the extracted structured alarm data and application-layer session content data marked with high-risk operation characteristics, based on their respective original time information, with millisecond-level precision, and assigning a globally timestamped tag to each data entry. The data processing module ultimately encapsulates all timestamped data according to a preset field structure, generating standardized security data records with unified timestamps. The preset field structure includes at least timestamp, data source type, source address, destination address, protocol, content digest, and high-risk tag fields. In some embodiments, the event reconstruction module performs an event chain reconstruction operation on the standardized security data records. This operation begins by reading the timestamps from all standardized security data records and globally sorting all standardized security data records strictly according to the numerical order of the timestamps, forming a basic sequence based on time.

[0022] The event reconstruction module analyzes the session correlation between the sorted standardized security data records. This correlation analysis is based on the network session quintuple information: source Internet Protocol address, source port, destination Internet Protocol address, destination port, and transport layer protocol. For each standardized security data record, the event reconstruction module calculates its quintuple similarity with other adjacent and nearby standardized security data records in the sequence. The calculation formula is as follows: in: A score representing the session association between two standardized security data records. Representing the The weighting coefficients of the five-element components and These represent the first two standardized security data records. The quantitative values ​​of each of the five components, The function outputs 1 if the two component values ​​are the same, and 0 otherwise. (This refers to the correlation score.) When the preset aggregation threshold is exceeded, the event reconstruction module determines that these standardized security data records belong to the same network session and aggregates them into a logical session unit.

[0023] In its implementation, the event reconstruction module further analyzes the causal relationships between the aggregated session units. Causal analysis is achieved by checking whether the output data of a session unit constitutes the input or triggering condition for a subsequent session unit. For example, when the content of one session unit contains an access token obtained through vulnerability exploitation, and another subsequent session unit uses this token for authentication in its network connection, the event reconstruction module establishes a cause-and-effect causal connection between the two session units. Optionally, the determination of causal relationships can be combined with pattern matching using a predefined causal rule base. The event reconstruction module treats all session units with established causal connections as nodes, and splices and links them in memory according to the time order marked by timestamps and the logical direction of the causal connections. Finally, it constructs a directional directed graph structure that reflects the logical progress and time sequence of an attack or abnormal activity. This directed graph structure is the initial security event chain representing the initial attack chain.

[0024] It is understood that after generating the initial security event chain, each node in its directed graph structure corresponds to a session unit. The node attributes contain aggregated information of all standardized security data records within that session unit, while the edges represent identified causal connections. In some embodiments, to ensure the accuracy of the initial security event chain, the event reconstruction module performs a confidence assessment on the causal connections, discarding those with a confidence level below a threshold. Optionally, for session units that are temporally adjacent but lack a clearly established causal connection, the event reconstruction module marks potential associations with dashed lines based on their temporal proximity and common patterns in the operation sequence, for analysts' reference.

[0025] In one embodiment of the present invention, the threat analysis module performs a threat pattern injection operation on the initial security event chain. This operation relies on a predefined threat behavior pattern library, which stores standardized descriptions of various known attack techniques and tactics. The threat analysis module first loads threat patterns from the predefined library. Each loaded threat pattern consists of a unique identifier and an attack step feature sequence. The attack step feature sequence is a series of feature tuples arranged in a specific order, describing key behaviors at each stage of the attack. These feature tuples may include dimensions such as operation type, access path, and parameter characteristics.

[0026] In some embodiments, the threat analysis module performs subgraph sliding window segmentation on the directed graph structure of the initial security event chain. The subgraph sliding window segmentation uses session unit nodes in the initial security event chain as the basic unit, sets a fixed window length N, and sequentially extracts N consecutive session unit nodes and their causal connections to form a chain segment, starting from the starting node of the directed graph structure. The window slides backward by the distance of one session unit node each time, generating the next chain segment. This process generates a series of continuous and partially overlapping chain segments to ensure coverage of any possible starting point for an attack.

[0027] Understandably, the threat analysis module then performs dynamic programming matching on the session unit feature sequence of each chain segment and the attack step feature sequence of each threat pattern loaded from the threat behavior pattern library. Dynamic programming matching aims to calculate the optimal alignment and similarity between two sequences. The matching process is implemented by constructing a two-dimensional matrix, where rows correspond to session unit features of the chain segment and columns correspond to attack step features of the threat pattern. The value of each cell in the matrix represents the cumulative matching score at the current step. The score accumulation rule is based on the similarity calculation between the current session unit feature and the current attack step feature. Feature similarity calculation involves comparing multiple fields such as operation type, network address, and string pattern. After dynamic programming matching is completed, the optimal matching path is obtained by backtracking from the matrix, and the final matching score, reflecting the degree of matching, is calculated. The formula for calculating the matching score is: in: This represents the calculated matching score. This represents the total number of steps involved in aligning within the best matching path. The feature vector representing the chain segment at the k-th alignment step. The function represents the feature vector of the threat pattern at the k-th alignment step. This is used to calculate the similarity between two feature vectors, and its value ranges from 0 to 1. It is a penalty coefficient. This represents the total interval penalty introduced during the matching process due to insertion or deletion operations.

[0028] After a certain chain segment is dynamically matched with a certain threat pattern, the calculated matching score is obtained. When the preset matching threshold is exceeded, the threat analysis module determines that this chain segment has successfully matched the corresponding threat pattern. Subsequently, the threat analysis module adds a corresponding threat type tag to each session unit node within this successfully matched chain segment. The threat type tag information comes from the unique identifier and description of the successfully matched threat pattern. Optionally, the tag information may also include the matching confidence score and the specific steps involved in the matching process.

[0029] In practice, after scanning and matching all chain segments, the threat analysis module recombines all session unit nodes marked with threat types and their original causal connections in the initial security event chain. This recombination process involves rebuilding a directed graph structure based on the timestamps and causal connections of the session unit nodes. This newly constructed directed graph structure retains the original attack logic and temporal order, while each node is appended with semantic information about the threat type. This structure constitutes the enhanced security event chain with threat tags. In some embodiments, session unit nodes not matched by any threat pattern are retained in the enhanced security event chain without being marked with a threat tag to maintain the integrity of the event chain. It can be understood that the enhanced security event chain, as output, provides a data structure that allows subsequent modules to clearly identify the stages, types, and timeline evolution of the attack activity.

[0030] In one embodiment of the present invention, the situation generation module performs situation profile construction based on the enhanced security event chain. The situation generation module receives the enhanced security event chain with threat tags from the threat analysis module. The enhanced security event chain is a directed graph structure containing multiple session unit nodes, causal connections, and additional threat type tag information. The situation generation module first counts the frequency of different threat type tags in the enhanced security event chain, traverses all session unit nodes in the enhanced security event chain, extracts the additional threat type tags on each node, counts and accumulates each unique threat type tag, and generates a threat type distribution histogram with threat type as the horizontal axis and frequency as the vertical axis. The threat type distribution histogram visually displays the comparison of the number of various threats identified in the current network. The situation generation module then analyzes the density of threat markers in the enhanced security event chain over time. It divides the time axis into fixed time intervals and counts the number of session unit nodes with threat markers within each time unit window. This number represents the number of threat events within that time unit. By connecting the threat event counts of all time unit windows, a curve is formed that changes over time, generating a threat activity time series curve. The threat activity time series curve reflects the fluctuations in threat activity over time.

[0031] Understandably, the situation generation module further identifies the clustering of threat markers on network topology nodes within the enhanced security event chain. These network topology nodes are defined by Internet Protocol addresses, device identifiers, or network segment information. Based on the source and destination address information recorded in the session unit nodes, the situation generation module maps threat markers to corresponding network topology nodes. For each network topology node, it calculates the density or intensity of its associated threat markers to locate the network area most severely affected by the threat. In some embodiments, the color depth or size of each network area in the threat impact range heatmap is determined by the threat clustering value of that area. The threat clustering value is calculated using a formula, expressed as: in: Representing network area Threat clustering value, Represents mapping to network regions The total number of threat tags, Representing the The threat type severity weighting coefficient corresponding to each threat tag Representing the The session events associated with each threat tag are distributed across the network topology to the region. Logical hop distance of the core node It is a distance attenuation coefficient. Based on the calculated values ​​for each network region... The numerical situation generation module generates a threat impact heatmap covering the entire network topology. The heatmap highlights areas with high threat concentration in a visual manner.

[0032] In its implementation, the situational awareness generation module fuses and encapsulates the threat type distribution histogram, threat activity time-series curve, and threat impact range heatmap. This fusion and encapsulation process packages the three types of chart data along with corresponding metadata, such as generation timestamps and enhanced security event chain identifiers of the data source, forming a multi-dimensional, machine-resolvable structured data object. This structured data object constitutes the current network security situational awareness profile. The security situational awareness profile not only includes visualized chart data but also the raw statistical values ​​and coordinate mappings used to generate these charts. Optionally, the time base of different charts is aligned during fusion and encapsulation to ensure that the threat activity time-series curve and the threat impact range heatmap are consistent in the time dimension. In some embodiments, the security situational awareness profile may also include a summary text. This summary text automatically extracts key features from the threat type distribution histogram, threat activity time-series curve, and threat impact range heatmap, such as the most prevalent threat types, peak times of threat activity, and the names of the most severely affected network areas. In essence, the generated security situational awareness profile provides a comprehensive, graphical view of the threat situation for network security management. Optionally, the situation generation module supports automatically executing situation profile construction operations at preset cycles, thereby generating a series of security situation profiles arranged in time sequence to track historical trends in network security situation.

[0033] Referring to Figure 3, this is a dual-axis composite chart analyzing the proportion and growth trend of different network security threat types, used to display the proportion and growth trend of different threat types in network security scenarios. DDoS attacks are a key focus, currently accounting for the highest proportion and growing the fastest. It is recommended to prioritize expanding network bandwidth, deploying traffic scrubbing equipment, and establishing a real-time monitoring and emergency response mechanism for DDoS attacks. While brute-force attacks currently account for only about 12%, their growth trend is significant. It is necessary to strengthen account password complexity requirements, enable multi-factor authentication, and provide real-time alerts for abnormal login behavior. Continuously monitor secondary threats. For threats with a moderate proportion, such as SQL injection and port scanning, it is necessary to regularly update WAF rules and strengthen perimeter firewall policies; for malicious code and data leaks, it is necessary to improve endpoint protection and data anonymization mechanisms. This chart, through its dual-axis design, combines the "current threat level" with the "future growth risk," reflecting both the current threat distribution pattern and revealing potential risk evolution trends, providing intuitive data support for network security teams to develop differentiated protection strategies.

[0034] In one embodiment of the present invention, a security situation profile is used to perform an adaptive strategy generation operation. The adaptive strategy generation operation parses the threat type distribution histogram in the security situation profile. The threat type distribution histogram contains data pairs of different threat types and their frequencies of occurrence. By identifying threat types whose frequencies exceed a set threshold, the current set of major threat types is determined. Based on the threat type set, the adaptive strategy generation module retrieves initial response strategy entries for each threat type from a preset strategy rule knowledge base. The strategy rule knowledge base is a structured database that stores the mapping relationship between threat types and response actions. The adaptive strategy generation module combines the threat activity time-series curve in the security situation profile to evaluate the response urgency level of the initial response strategy entries. The threat activity time-series curve provides the trend of the number of threat events per unit time. The formula for calculating the response urgency level is: in: Represents the type of threat The urgency level value of the response. Represents the threat type within the most recent time window. The number of events, Representative threat type The average number of events over the same historical period or a longer period. The slope of the time series curve representing threat activity in the most recent time window. and It is a weighting coefficient used to balance the current quantity with the changing trend. The execution order of the strategy is sorted according to the calculated response urgency level value, with a higher value indicating a higher ranking.

[0035] The system integrates a threat impact heatmap from the security posture profile, which identifies the most severely affected network areas and their threat concentration. The adaptive policy generation module fine-tunes the execution parameters of the sorted initial response policy entries. This fine-grained adjustment includes adjusting the target network segment range for policy implementation and the intensity level of policy execution. The target network segment range is set based on the Internet Protocol address ranges corresponding to high-threat-density areas in the threat impact heatmap, while the intensity level is adjusted using linear or segmented mapping based on the threat concentration values. The adaptive policy generation module outputs a final set of policy instructions after sorting and parameter adjustment. This final set of instructions contains a series of specific configuration commands or action instructions that can be issued to network protection devices. In some embodiments, the construction and updating of the policy rule knowledge base collects historical network security incident reports and corresponding effective handling records to form a historical case library. Each case record in the historical case library includes an event description, handling actions, involved devices, and effect feedback text. For each case in the historical case library, strategy elements are extracted. Strategy element extraction uses natural language processing technology to identify key entities and actions in the text. Strategy elements include the type of threat that was triggered, the action taken, the network device involved, and the effect achieved.

[0036] It is understandable that the extracted policy elements are structured and stored according to the paradigm of "threat type - response action - affected device - effect evaluation" to form basic policy rules, which are saved in the form of database records. The construction and updating of the policy rule knowledge base continuously monitors the execution feedback data of the final policy instruction set in the actual network environment. The execution feedback data is collected through monitoring probes or device logs deployed in the network, and the feedback data includes information such as whether the policy was successfully executed, changes in the number of alarms, and whether abnormal traffic was blocked. When the execution feedback data indicates that the policy effect is lower than the expected threshold, a revision process for the corresponding basic policy rules is triggered. The revision process is initiated by the analysis module or the administrator to review and modify the triggering conditions, response actions, or effect parameters of the policy. Based on the conclusion of the revision process, the basic policy rules in the policy rule knowledge base are added, deleted, or modified to maintain the effectiveness and adaptability of the policy rule knowledge base. Optionally, some examples of basic policy rules in the policy rule knowledge base are shown in Table 1 below.

[0037] Table 1: Examples of Basic Strategy Rules in the Strategy Rule Knowledge Base In practice, the adaptive policy generation operation and the updating of the policy rule knowledge base form a closed-loop system. In some embodiments, the expected threshold can be set based on the statistical distribution of historical effect evaluation data; for example, policies with effect evaluations below the historical median are deemed to require revision. Optionally, the revision process can automatically suggest modification schemes. For example, when the "action" is "temporarily block the source IP address" but the effect evaluation remains "the number of failed login attempts has not decreased," the system can automatically suggest changing the action to "extend the blocking time and notify the administrator." It is understood that the continuous updating of the policy rule knowledge base ensures that the adaptive policy generation operation can cope with the ever-changing network threat environment.

[0038] Referring to Figure 4, this is a histogram showing the frequency distribution of network security threat types, intuitively displaying the occurrence frequency of different attack methods. Prioritize brute-force attacks, as this attack is the most frequent, indicating a potential large number of weak password accounts or exposed remote login ports on the network. It is recommended to immediately enable multi-factor authentication, regularly enforce the use of complex passwords, and whitelist remote ports such as SSH / RDP. Preventing data leakage risks is also crucial, as the frequency of data transfer attempts is prominent. Therefore, it is necessary to deploy a data loss prevention (DLP) system to monitor the transfer of sensitive files and audit database operations of core business systems. This chart clearly presents the current "heat intensity" ranking of network threats, helping security teams quickly identify the highest priority protection targets, avoid resource dispersion, and thus more efficiently build a layered defense system.

[0039] In one embodiment of the present invention, after generating the current network security posture profile, the process further includes security posture simulation and early warning operations. These operations are based on the evolution trend of threat markers in the enhanced security event chain. The enhanced security event chain includes not only historical and current threat markers but also causal and temporal relationships between threat events. The security posture simulation and early warning operations use a time series prediction model to predict the spread path and evolution of threats over a future period. The time series prediction model uses the threat activity time series curve, threat type distribution data, and relationships between threat events generated in the previous stage as input features. By analyzing the patterns of historical threat events in the time series, such as periodicity, trends, or suddenness, the prediction model extrapolates the changes in the activity of each threat type within the future time window and the possible derivative or chain relationships between different threat types, generating a threat development projection graph with future time as the horizontal axis and the predicted distribution or impact intensity of threat events as the vertical axis.

[0040] In some embodiments, a threat development projection map is overlaid with a network asset importance map. This overlay analysis is performed within a unified spatiotemporal coordinate system, and the geographical or logical location information of predicted future threat events is correlated and matched with the asset location information in the network asset importance map. Security situation simulation and early warning operations predict the risk level faced by critical assets at future points in time. The prediction formula for the risk level is expressed as: in: Represents the predicted future time point ,assets The overall risk level value, This represents the total number of threat types that could potentially affect assets. Representative threat type For assets The potential diffusion probability or likelihood of impact, based on the threat diffusion paths and assets predicted in the threat development projection map. The network topology location is calculated from this. Represents a point in time Threat types The predicted activity level is derived from the threat development projection map. Representative assets Its own importance score, derived from the network asset importance graph. Calculated... The higher the value, the greater the risk the asset will face at the corresponding future point in time.

[0041] When the predicted risk level When the preset warning threshold is exceeded, the security situation simulation and warning operation generate a warning report. The warning report includes details of the predicted threat, affected assets, and recommended preventative measures. The predicted threat details include the predicted threat type, the expected time window, and a description of possible attack paths; the list of affected assets is calculated based on risk levels. Assets exceeding the threshold are listed; suggested measures are generated from a pre-set response plan library, or preliminary inspection and hardening steps are recommended based on a combination of threat type and asset importance. Security posture simulation and early warning operations push early warning reports to the security operations interface for visualization. The visualization can be presented as a pop-up window, a list, or overlaid with predicted information on a network topology map highlighting risk areas and assets.

[0042] It is understandable that the construction of the network asset importance map is independent and precedes the execution of security posture simulation and early warning operations. The construction process automatically discovers active assets in the network. This automatic discovery is achieved through network scanning tools, network traffic analysis, or synchronously from the configuration management database, collecting asset type information, business information, and management department information. Based on preset asset valuation rules, the business importance, data sensitivity, and service continuity requirements of assets are quantitatively scored. Business importance is assigned based on the criticality of the business processes supported by the asset; data sensitivity is assigned based on the security classification of the data stored or processed by the asset; and service continuity requirements are assigned based on the allowable downtime target. Based on the quantitative scoring results, assets are classified into multiple importance levels. The asset importance level information and network topology connection information are integrated to create a visual network asset importance map, where assets of different importance levels are distinguished by different colors and icons, and network topology connections are represented by lines. Optionally, the asset importance map can be drawn using a force-directed graph or a hierarchical layout algorithm to clearly show the logical relationships and importance differences between assets.

[0043] In practice, security situation simulation and early warning operations are a periodic or automated process triggered by specific events. In some embodiments, the time series prediction model can employ an autoregressive integral moving average model, a long short-term memory neural network, or a prediction algorithm based on threat event sequences. Optionally, the early warning threshold can be a globally uniform fixed value or can be set according to the asset's importance level. Dynamic adjustments are made, with lower alert thresholds applied to assets of high importance to improve monitoring sensitivity. Understandably, the construction process of the network asset importance map also supports manual maintenance and adjustment, allowing administrators to manually modify the quantitative scores or importance levels of assets based on business changes. In addition to being pushed to the visual interface, alert reports generated by security posture simulations and alert operations can also be sent to relevant security operations personnel via email, instant messaging tools, and other channels.

[0044] Referring to Figure 5, this is a time-series curve showing the predicted number of cybersecurity threat events, illustrating the changes in the predicted number of threat events between 12:00 and 23:00. For the two peak periods of 14:00 and 22:00, it is recommended to adjust security strategies in advance, increase threat monitoring frequency, and enable real-time alerts; expand bandwidth or perform traffic scrubbing on core business systems to cope with potential DDoS attacks; and strengthen account login verification to prevent brute-force attacks. Although the number of threats decreases after 22:00, it remains high, requiring nighttime security monitoring and the configuration of automated emergency response rules to handle sudden attacks. This graph, by predicting the temporal distribution of threat events, helps security teams achieve proactive defense rather than reactive response. It not only reveals the temporal patterns of attacks but also provides clear time-based information for resource scheduling, strategy adjustments, and emergency preparedness, thereby improving the overall effectiveness of security protection.

[0045] The above embodiments are only used to illustrate the technical methods of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical methods of the present invention without departing from the spirit and scope of the technical methods of the present invention.

Claims

1. A network security analysis system based on a security situation awareness system, characterized in that, The system includes: a data acquisition module, which collects raw monitoring data streams from probes deployed at the network boundary, the raw monitoring data streams containing encrypted traffic payload data and unstructured alarm message data; a data processing module, which performs layered decoding and normalization operations on the raw monitoring data streams to generate standardized security data records with unified timestamps; an event reconstruction module, which performs event chain reconstruction operations on the standardized security data records, connecting discrete security data records into a continuous event sequence based on timestamps to form an initial security event chain; a threat analysis module, which performs threat pattern injection operations on the initial security event chain, compares the initial security event chain with a predefined threat behavior pattern library, identifies segments in the chain that match known threat patterns, and generates an enhanced security event chain with threat tags; and a situation generation module, which performs situation profile construction operations based on the enhanced security event chain, extracts the distribution characteristics and evolution trends of threat tags in the enhanced security event chain, and generates a current network security situation profile.

2. The network security analysis system based on a security situation awareness system according to claim 1, characterized in that, The step of performing layered decoding and normalization on the original monitoring data stream to generate standardized security data records with unified timestamps includes: identifying the protocol type and decrypting the encrypted traffic payload data to restore the plaintext application layer session content data; performing field template matching and keyword extraction on the unstructured alarm message data to extract structured alarm data containing source address, destination address, and event type; identifying sensitive operation instructions on the application layer session content data and marking instruction fragments that meet high-risk operation characteristics; synchronizing the structured alarm data with the application layer session content data marked with high-risk operation characteristic instruction fragments at millisecond precision, assigning a unified format timestamp to each data item; and encapsulating all data with the timestamps into the standardized security data record with a preset field structure.

3. The network security analysis system based on a security situation awareness system according to claim 1, characterized in that, The step of performing an event chain reconstruction operation on the standardized security data records, connecting discrete security data records into a continuous event sequence based on timestamps to form an initial security event chain, includes: reading the timestamps in the standardized security data records and sorting all the standardized security data records according to the order of the timestamps; analyzing the session correlation between the sorted standardized security data records, and aggregating multiple standardized security data records belonging to the same session into a session unit based on the same network session 5-tuple information; analyzing the causal logic relationship between each session unit, and establishing a causal connection between the two session units when the output data of one session unit is identified as the triggering condition of another session unit; and assembling all the session units with established causal connections into a directed graph structure according to the timestamp order and the direction of the causal connection, wherein the directed graph structure is the initial security event chain.

4. The network security analysis system based on a security situation awareness system according to claim 3, characterized in that, The step of performing threat pattern injection on the initial security event chain involves comparing the initial security event chain with a predefined threat behavior pattern library, identifying segments in the chain that match known threat patterns, and generating an enhanced security event chain with threat tags. This includes: loading threat patterns from the predefined threat behavior pattern library, where each threat pattern consists of a series of attack step features arranged in a specific order; dividing the directed graph structure of the initial security event chain into subgraph sliding window segments to generate a series of continuous or overlapping chain segments; performing dynamic programming matching between the session unit feature sequence of each chain segment and the attack step feature sequence of each threat pattern, and calculating a matching score; when the matching score of a chain segment exceeds a preset matching threshold, determining that the chain segment matches the corresponding threat pattern, and adding a corresponding threat type tag to each session unit within the chain segment; and recombining all session units with added threat type tags and their original causal connections to form the enhanced security event chain with threat tags.

5. The network security analysis system based on a security situation awareness system according to claim 1, characterized in that, The process of constructing a situational profile based on the enhanced security event chain involves extracting the distribution characteristics and evolution trends of threat markers within the chain to generate a current network security situational profile. This includes: statistically analyzing the frequency of different threat type markers within the chain to generate a threat type distribution histogram; analyzing the time-series density of threat markers within the chain, calculating the number of threat events per unit time, and generating a threat activity time-series curve; identifying the clustering of threat markers on network topology nodes within the chain, locating the network areas most severely affected by threats, and generating a threat impact range heatmap; and fusing and encapsulating the threat type distribution histogram, threat activity time-series curve, and threat impact range heatmap to form a multi-dimensional security situational profile of the current network.

6. The network security analysis system based on a security situation awareness system according to claim 5, characterized in that, The security posture profile is used to perform adaptive policy generation operations. These operations specifically include: parsing the threat type distribution histogram in the security posture profile to determine the current set of major threat types; retrieving initial response policy entries for each threat type from a pre-defined policy rule knowledge base based on the threat type set; evaluating the urgency level of the initial response policy entries by combining the threat activity time-series curve in the security posture profile, and sorting the policy execution order according to the urgency level; integrating the threat impact range heatmap in the security posture profile to fine-grainedly adjust the execution parameters of the sorted initial response policy entries, including adjusting the target network segment range of the policy's effect and the intensity level of policy execution; and outputting the final policy instruction set after sorting and parameter adjustment.

7. The network security analysis system based on a security situation awareness system according to claim 6, characterized in that, The construction and updating of the policy rule knowledge base includes: collecting historical network security incident reports and corresponding effective handling records to form a historical case library; extracting policy elements from each case in the historical case library, the policy elements including the triggered threat type, the handling action adopted, the network device involved, and the handling effect achieved; structuring and storing the extracted policy elements according to the paradigm of "threat type-handling action-participating device-effect evaluation" to form basic policy rules; continuously monitoring the execution feedback data of the final policy instruction set in the actual network environment, and triggering the revision process of the corresponding basic policy rules when the execution feedback data indicates that the policy effect is lower than the expected threshold; and adding, deleting, or modifying the basic policy rules in the policy rule knowledge base according to the conclusion of the revision process.

8. The network security analysis system based on a security situation awareness system according to claim 1, characterized in that, After generating the current network security posture profile, the process also includes security posture simulation and early warning operations: based on the evolution trend of threat markers in the enhanced security event chain, a time series prediction model is used to simulate the spread path and evolution of threats over a future period, generating a threat development simulation map; the threat development simulation map is overlaid and analyzed with a network asset importance map to predict the risk level faced by critical assets at future points in time; when the predicted risk level exceeds a preset early warning threshold, an early warning report is generated that includes details of the predicted threat, affected assets, and suggested preparatory measures; the early warning report is pushed to the security operations and maintenance interface for visualization.

9. The network security analysis system based on a security situation awareness system according to claim 8, characterized in that, The process of constructing the network asset importance map includes: automatically discovering active assets in the network, collecting asset type information, business information, and management department information; quantitatively scoring the business importance, data sensitivity, and service continuity requirements of the assets according to preset asset value assessment rules; classifying assets into multiple importance levels based on the quantitative scoring results; and integrating the asset importance level information and network topology connection information to create a visualized network asset importance map, in which assets of different importance levels are distinguished by different colors and icons.

10. A network security analysis method based on a security situation awareness system, characterized in that, It includes all modules and method flows of the network security analysis system based on the security situation awareness system as described in any one of claims 1 to 9.

Images