Network security operation multi-dimensional intelligent evaluation grade determination system

Abstract

The application relates to the technical field of network security evaluation, in particular to a network security operation multidimensional intelligent evaluation grade judgment system, which comprises a log collection module, a feature generation module, a deviation measurement module and a coupling analysis module.The log collection module acquires network entity basic logs; the feature generation module extracts standardized logs in a specified time window according to a preset time period, and generates an original feature data vector through field screening and aggregation; the deviation measurement module inputs the vector into a pre-trained behavior baseline model, calculates the deviation degree of the vector from a historical normal behavior baseline, and outputs deviation measurement values of each dimension; and the coupling analysis module identifies composite anomalies caused by multidimensional slight abnormal coupling through a multidimensional coupling analysis engine, and outputs related labels and intensity indexes.The system can standardize feature extraction, accurately measure anomalies, reduce false and missed judgments, comprehensively capture composite anomalies, and improve the accuracy and comprehensiveness of network security evaluation.

Description

Technical Field

[0001] This invention relates to the field of network security assessment technology, and in particular to a multi-dimensional intelligent assessment and level determination system for network security operations. Background Technology

[0002] In the current field of network security operation assessment, conventional techniques rely on collecting log data generated by network entities, performing simple filtering of the log data to extract relevant features, and then using manually preset anomaly thresholds to make a preliminary judgment on network anomalies. This type of technology does not standardize the collected log data, nor does it combine preset time periods and specified time windows for precise log extraction and aggregation. It can only obtain scattered and disorganized feature information, failing to form a standardized and effective assessment basis.

[0003] Conventional techniques rely on manually set fixed thresholds for anomaly detection, lacking behavioral baseline models trained on historical normal-cycle log data. This makes it difficult to accurately measure the degree of anomaly deviation across various assessment dimensions, leading to frequent false positives or false negatives. Furthermore, existing technologies are often limited to single-dimensional anomaly identification, failing to consider the interrelationships and transmission patterns between anomalies across different assessment dimensions. This makes it difficult to identify complex anomalies resulting from the coupling of minor anomalies across multiple dimensions, resulting in a one-sided approach to cybersecurity assessments and failing to meet the needs of comprehensive and accurate cybersecurity operations assessments. A technical solution is needed that can standardize log processing, measure anomaly deviations based on historical baselines, and analyze the coupling relationships between multi-dimensional anomalies to address the shortcomings of existing technologies. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies by proposing a multi-dimensional intelligent assessment and level determination system for network security operations.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: a multi-dimensional intelligent assessment and level determination system for network security operations, comprising: The log collection module acquires the basic log repository generated by network entities; The feature generation module extracts standardized log records within a specified time window from the basic log warehouse according to a preset time period. Based on the definition of the evaluation dimension, it performs field filtering and aggregation on the extracted standardized log records to generate an original feature data vector for evaluation. The deviation measurement module inputs the generated original feature data vector into the pre-trained behavior baseline model, which is trained based on standardized log records of historical normal cycles. It is used to calculate the degree of deviation between the current original feature data vector and the historical normal behavior baseline, and outputs the behavior deviation measurement values ​​of each dimension. The coupling analysis module inputs the behavioral deviation metrics of each dimension into the multi-dimensional coupling analysis engine. The multi-dimensional coupling analysis engine analyzes the linkage and transmission patterns between behavioral deviation metrics of different dimensions, identifies composite abnormal patterns caused by slight abnormal coupling of multiple dimensions, and outputs composite abnormal pattern identification markers and their intensity indices.

[0006] As a further aspect of the present invention, the method for obtaining the basic log repository generated by the network entity is as follows: The probe program deployed on the network security monitoring node continuously collects raw operation log data generated by network entities. The raw operation log data includes network device operating status, user access behavior traces, external threat alarm events, and internal asset configuration change records. The collected raw operation log data is standardized, cleaned, and timestamp aligned to transform heterogeneous log formats into standardized log records with a unified structure. The standardized log records are then stored in the basic log warehouse according to the time sequence. The standardization and timestamp alignment of the collected raw operational log data, transforming heterogeneous log formats into standardized log records with a unified structure, includes: Parse the original format of each raw operation log data, identify the log source type, and extract key information fields based on the pre-set regular expression template corresponding to the log source type; Data cleaning is performed on the extracted key information fields. The cleaning operations include removing invisible characters, correcting obviously erroneous field values, and filling in field default values ​​caused by transmission loss. From the cleaned key information fields, the time points of log events are parsed out and converted into a unified global co-location timestamp format; The converted global coordination time timestamp, log source type identifier, and all other key information fields are combined according to the predefined structured field order and encapsulated into a single standardized log record. The standardized log records are appended with the data arrival timestamp and stored together in the corresponding partition of the basic log warehouse.

[0007] As a further aspect of the present invention, the step of filtering and aggregating the extracted standardized log records according to the definition of the evaluation dimension to generate an original feature data vector for evaluation includes: Multiple independent evaluation dimensions are predefined, each associated with a specific set of standardized log record fields, and independent feature calculation rules are set for each evaluation dimension; Based on a preset time period, extract all standardized log records within the time period from the basic log warehouse; For each evaluation dimension, relevant field values ​​are selected from the extracted standardized log records according to their associated field groups; Based on the feature calculation rules corresponding to each evaluation dimension, statistical aggregation calculations are performed on the selected relevant field values. The statistical aggregation calculations include frequency statistics, numerical distribution statistics, unique value quantity statistics, and time interval statistics. The aggregated results calculated for each evaluation dimension are arranged in a predetermined dimensional order and combined to form the original feature data vector representing the operational status of the time period.

[0008] As a further aspect of the present invention, the generated original feature data vector is input into a pre-trained behavioral baseline model. This behavioral baseline model is trained based on standardized log records from historical normal periods and is used to calculate the deviation between the current original feature data vector and the historical normal behavioral baseline. The output is a behavioral deviation metric for each dimension, including: The behavioral baseline model includes a probability distribution model independently constructed for each evaluation dimension, which is trained using multiple raw feature data vectors generated from historical normal cycles. The original feature data vector generated in the current time period is split according to the dimensions to obtain the current feature value corresponding to each evaluation dimension; Input the current feature value of each evaluation dimension into the probability distribution model corresponding to the evaluation dimension, and calculate the probability or probability density value of the current feature value under the historical normal behavior distribution. Based on the calculated occurrence probability or probability density value, it is mapped to a standardized deviation score through a preset transformation function. The magnitude of the deviation score directly represents the degree to which the current feature value deviates from the historical normal baseline. The deviation scores calculated for all evaluation dimensions are arranged in dimensional order according to the original feature data vector, and the output is a vector of behavioral deviation metrics for each dimension.

[0009] As a further aspect of the present invention, the multi-dimensional coupling analysis engine analyzes the linkage and transmission patterns between behavioral deviation metrics of different dimensions, identifies composite anomaly patterns caused by slight anomaly coupling in multiple dimensions, and outputs composite anomaly pattern identification markers and their intensity indices, including: The multi-dimensional coupling analysis engine has a built-in coupling relationship matrix that describes the normal correlation between different evaluation dimensions. The coupling relationship matrix defines the degree to which a deviation in one dimension should be accompanied by a deviation in other dimensions under normal conditions. Receive the behavioral deviation measure vectors for each dimension, and calculate the correlation coefficient and covariance between the actual observed deviation measures for each dimension; The calculated actual correlation coefficients and covariances are compared with the normal correlations defined in the coupling matrix to identify abnormal dimensional combinations that violate the normal coupling relationships. Analyze the identified abnormal dimensional combinations to determine whether a deviation in one dimension occurs before a deviation in another dimension, thereby inferring the potential path of abnormal propagation; For each identified anomalous dimension combination and its transmission path, a comprehensive intensity score is calculated based on the severity of its violation of normal coupling relationships and the clarity of transmission. The anomalous dimension combination, transmission path, and intensity score are then encapsulated together into a composite anomalous pattern recognition tag.

[0010] As a further aspect of the present invention, the system further includes: The weighting module receives the behavioral deviation metric vectors for each dimension, dynamically calculates the current weight value for each evaluation dimension according to a predefined strategy, and generates a weighted deviation metric. The impact assessment module is used to receive composite anomaly pattern identification tags and their intensity indicators, and map different composite anomaly patterns to corresponding basic impact deduction values ​​according to a predefined rule base. The rating determination module is used to aggregate the weighted deviation metric value and the basic impact deduction value. According to the preset aggregation algorithm, the weighted deviation metric value is aggregated into an overall deviation index, and the basic impact deduction value of all composite anomaly modes is aggregated into a total mode impact deduction. The overall deviation index and the total mode impact deduction are added together to obtain the final evaluation score of network security operation. The final evaluation score is compared with the preset rating threshold range to determine the current rating of network security operation.

[0011] As a further aspect of the present invention, the step of dynamically calculating the current weight value of each evaluation dimension according to a predefined strategy includes: A baseline weight value is preset for each evaluation dimension, and a set of weight adjustment strategies are preset. The weight adjustment strategies are associated with the time period, historical alarm frequency, or external threat intelligence level. Based on the current time attribute of the assessment, the recent alarm frequency of the assessment dimension, or the level of external threat intelligence received, the corresponding weight adjustment strategy is triggered. The calculation logic defined in the triggered weight adjustment strategy is executed, and the calculation logic adjusts the base weight value by raising or lowering it based on the current input condition parameters. The weight adjustment results for all evaluation dimensions are normalized to ensure that the sum of all weight values ​​is constant, and the current weight value for each evaluation dimension is generated. The weighted deviation metric of each evaluation dimension is obtained by multiplying the current weight value of each evaluation dimension by its corresponding behavioral deviation metric.

[0012] As a further aspect of the present invention, the step of mapping different composite anomaly patterns to corresponding basic impact deduction values ​​according to a predefined rule base includes: The rule base stores multiple rules, each of which defines a specific composite anomaly pattern feature and a basic impact deduction value. The composite anomaly pattern feature is composed of a specific combination of anomaly dimensions, a transmission path, and an intensity threshold. Receive composite anomaly pattern recognition tags and match the anomaly dimension combination, propagation path, and intensity index contained therein with the rules in the rule base; When a composite anomaly pattern recognition tag satisfies all the feature conditions defined in a rule, it is determined that the rule has been hit; Obtain the basic impact deduction value mapped by the hit rule, as the initial deduction value for the composite anomaly pattern recognition marker; Based on the ratio between the actual intensity index of the matched composite anomaly pattern recognition marker and the intensity threshold defined in the rules, the initial deduction value is linearly scaled to obtain the final basic impact deduction value.

[0013] As a further aspect of the present invention, the overall deviation index is added to the total pattern impact deduction to obtain the final evaluation score for network security operations, including: The overall deviation index is a scalar value calculated by a nonlinear aggregation function using the weighted deviation measures of each dimension. The nonlinear aggregation function is used to amplify the impact of the deviation dimensions. The total pattern impact deduction is a scalar value obtained by arithmetic summation of the basic impact deduction values ​​of all composite anomaly patterns. The overall deviation index and the total pattern impact deduction are normalized in terms of numerical range so that the overall deviation index and the total pattern impact deduction are in the same numerical range. The normalized overall deviation index and the total pattern influence deduction are weighted and summed according to a preset synthesis ratio to calculate the final evaluation score. The final evaluation score is a continuous numerical value. The lower the value, the better the network security operation status, and the higher the value, the worse the network security operation status.

[0014] As a further aspect of the present invention, the final evaluation score is compared with a preset level threshold range to determine the evaluation level of the current network security operation, including: A set of level thresholds are preset and arranged in numerical order. Each level threshold defines an upper or lower limit of an evaluation level score range. The calculated final evaluation score is compared sequentially with the preset grade threshold. Based on the specific grade threshold range into which the final evaluation score falls, determine the corresponding evaluation grade identifier; Record the time range of this assessment cycle, the final assessment score, the assessment level indicator, and the details of deviations in the key dimensions that constitute the final assessment score, as well as a list of triggered composite anomaly patterns; The recorded results are packaged into a cybersecurity operations assessment report, which is used to characterize the overall level of cybersecurity operations within the current time period.

[0015] Compared with the prior art, the advantages and positive effects of the present invention are as follows: Standardized log records are extracted within a specified time window according to a preset time period. Based on the definition of the evaluation dimensions, the extracted standardized log records are filtered and aggregated to generate raw feature data vectors for evaluation. The generated raw feature data vectors are then input into a pre-trained behavior baseline model. This behavior baseline model is trained based on standardized log records from historical normal periods and is used to calculate the deviation between the current raw feature data vector and the historical normal behavior baseline. The output is a behavior deviation metric for each dimension. The precise extraction and aggregation of standardized logs can eliminate messy and invalid log information, making the generated feature data vectors more targeted and standardized. The deviation metric based on the historical normal behavior baseline can accurately capture abnormal changes in each dimension, avoiding the limitations of fixed threshold judgments in conventional techniques. This approach better reflects the actual operating state of the network and reduces the occurrence of false positives and false negatives.

[0016] The behavioral deviation metrics from each dimension are input into a multi-dimensional coupling analysis engine. This engine analyzes the linkage and transmission patterns between these metrics, identifying composite anomaly patterns caused by the coupling of minor anomalies across multiple dimensions. The output is a composite anomaly pattern identification marker and its strength index. This multi-dimensional coupling analysis approach overcomes the limitations of conventional single-dimensional anomaly identification, capturing composite anomalies that cannot be revealed by minor single-dimensional anomalies. It clearly presents the correlation patterns between anomalies across different dimensions, enabling the timely discovery of potential security vulnerabilities arising from the coupling of multi-dimensional anomalies. This compensates for the inability of conventional technologies to identify composite anomalies, making cybersecurity assessments more comprehensive and in-depth. Attached Figure Description

[0017] Figure 1 This is a sequence diagram of the multi-dimensional intelligent assessment and level determination system for network security operations described in this invention. Figure 2 A flowchart for generating the original feature data vector; Figure 3 A flowchart for composite anomaly pattern recognition; Figure 4 This is a comparison chart of the intensity and threshold of composite anomaly patterns; Figure 5 This is a time-series analysis chart of 24-hour network log volume. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0019] In the description of this invention, it should be understood that the terms "length," "width," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," and "outer," etc., indicating orientation or positional relationships, are based on the orientation or positional relationships shown in the accompanying drawings and are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. Furthermore, in the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0020] See Figure 1This invention provides a multi-dimensional intelligent assessment and level determination system for network security operations. The system comprises: an implementation of a multi-dimensional intelligent assessment and level determination system for network security operations, based on the collaborative work of a log collection module, a feature generation module, a deviation measurement module, and a coupling analysis module. The log collection module is used to acquire a basic log repository generated by network entities. The feature generation module is connected to the log collection module and extracts standardized log records within a specified time window from the basic log repository according to a preset time period. Based on the definition of the assessment dimensions, the extracted standardized log records are filtered and aggregated to generate raw feature data vectors. The deviation measurement module is connected to the feature generation module and has a pre-trained behavioral baseline model. This behavioral baseline model is trained based on standardized log records from historical normal periods. The deviation measurement module inputs the generated raw feature data vector into the behavioral baseline model, calculates the degree of deviation between the current raw feature data vector and the historical normal behavioral baseline, and outputs behavioral deviation measurement values ​​for each dimension. The coupling analysis module is connected to the deviation measurement module and has a built-in multi-dimensional coupling analysis engine. This engine receives behavioral deviation measurement values ​​from each dimension, analyzes the linkage and transmission patterns between behavioral deviation measurement values ​​from different dimensions, identifies composite abnormal patterns caused by slight abnormal coupling in multiple dimensions, and outputs composite abnormal pattern identification markers and their intensity indices.

[0021] In one embodiment of the present invention, the log collection module acquires the basic log repository generated by network entities. This is achieved by deploying a probe program at a network security monitoring node. The probe program continuously collects raw operational log data generated by network entities. This raw operational log data includes network device operating status, user access behavior traces, external threat alarm events, and internal asset configuration change records. The collected raw operational log data undergoes standardization cleaning and timestamp alignment processing to transform heterogeneous log formats into standardized log records with a unified structure. The standardization cleaning and timestamp alignment process includes parsing the original format of each raw operational log data entry, identifying the log source type, and extracting key information fields based on a pre-defined regular expression template corresponding to the log source type. Data cleaning is then performed on the extracted key information fields, including removing invisible characters, correcting obviously erroneous field values, and filling in field default values ​​caused by transmission loss. The time point of the log event is parsed from the cleaned key information fields and converted into a unified global coordinated time (GCT) timestamp format. The converted GCT timestamp, log source type identifier, and all other key information fields are combined according to a predefined structured field order and encapsulated into a single standardized log record. The packaged standardized log records are appended with the data arrival timestamp and stored in the corresponding partition of the basic log repository. The feature generation module, based on the definition of the evaluation dimensions, performs field filtering and aggregation on the extracted standardized log records to generate the raw feature data vector for evaluation. This process includes, as described in [reference needed] Figure 2 The system predefines multiple independent evaluation dimensions, each associated with a set of standardized log record fields. Independent feature calculation rules are set for each evaluation dimension. Based on a preset time period, all standardized log records within that time period are extracted from the basic log repository. For each evaluation dimension, relevant field values ​​are selected from the extracted standardized log records according to their associated field groups. Based on the feature calculation rules corresponding to each evaluation dimension, statistical aggregation calculations are performed on the selected relevant field values. These calculations include frequency statistics, numerical distribution statistics, unique value count statistics, and time interval statistics. The aggregation results calculated for each evaluation dimension are arranged according to a predetermined dimensional order and combined to form an original feature data vector representing the operational status of the time period.

[0022] In practice, the log collection module acquires the basic log repository generated by network entities. Probe programs deployed on network boundary firewalls, core switches, and servers continuously collect raw operational log data. This raw operational log data includes network device operating status logs, user access behavior logs to application systems, external threat alarm event logs generated by the intrusion prevention system, and internal asset configuration change records issued by the configuration management database. The probe programs then send the collected raw operational log data to the central processing unit. In the specific implementation, the collected raw operation log data is standardized, cleaned and timestamped. The original format of a raw operation log data is parsed as “2023-10-26T14:35:22.123ZFW-01%SEC-6-IPACCESSLOGP:list101deniedtcp10.1.1.15(12345)->203.0.113.5(80),1packet”. The log source type is identified as “firewall access control”. Based on the preset regular expression template corresponding to the “firewall access control” type, the key information fields are extracted, including the source IP address “10.1.1.15”, the source port “12345”, the destination IP address “203.0.113.5”, the destination port “80”, the action “denied” and the protocol “tcp”. The extracted key information fields undergo data cleaning to remove invisible characters and correct obviously erroneous field values. For example, port numbers that are clearly out of range are replaced with default values, and field default values ​​caused by transmission loss are filled in. From the cleaned key information fields, the time point of the log event "2023-10-26T14:35:22.123Z" is parsed out. Since the time point is already in UHT format, it is used directly. The UHT timestamp, the log source type identifier "FW_ACCESS", and all other key information fields are combined according to the predefined structured field order and encapsulated into a single standardized log record. Its structure can be represented as [timestamp, source type, source IP, source port, destination IP, destination port, protocol, action,...]. The encapsulated standardized log record is appended with the data arrival time stamp of the system and stored in the corresponding partition of the basic log warehouse. The partition can be divided according to the log source type and date.

[0023] In some embodiments, the feature generation module performs field filtering and aggregation on the extracted standardized log records according to the definition of the evaluation dimensions. Three independent evaluation dimensions are predefined: "External Attack Surface," "Internal User Behavior," and "Asset Security Status." The "External Attack Surface" dimension is associated with the alarm level field of the log source type "IPS_ALERT" in the standardized log records; the "Internal User Behavior" dimension is associated with the login result field and username field of the log source type "AUTH"; and the "Asset Security Status" dimension is associated with the change type field of the log source type "CMDB_CHANGE." Independent feature calculation rules are set for each evaluation dimension: the feature calculation rule for the "External Attack Surface" dimension is to count the frequency of high-risk alarms; the feature calculation rule for the "Internal User Behavior" dimension is to calculate the login failure rate and the number of unique users; and the feature calculation rule for the "Asset Security Status" dimension is to count the frequency of high-risk configuration change operations. Based on a preset 1-hour time period, all standardized log records within that 1-hour period are extracted from the basic log repository. For the "Internal User Behavior" evaluation dimension, records with a log source type of "AUTH" are selected from the extracted standardized log records according to their associated field groups, and the login result field and username field are read from these records. Based on the feature calculation rules corresponding to the "Internal User Behavior" evaluation dimension, statistical aggregation calculations are performed on the selected relevant field values. The login failure rate aggregation calculation involves counting the number of records with a login result of "FAILURE" and the number of records with a login result of "SUCCESS". The number of unique users is counted by counting the number of unique values ​​in the username field. In specific implementation, the formula for calculating the login failure rate can be expressed as:

[0024] in: Represents the login failure rate. This represents the number of failed login attempts within the statistical period. This represents the number of successful logins within the statistical period. The aggregated results calculated for each evaluation dimension are arranged in the predetermined order of "external attack surface," "internal user behavior," and "asset security status" to form an original feature data vector representing the operational status of that 1-hour time period. For example, a possible vector form is [5, 0.15, 120, 2], where 5 represents the number of external high-risk alerts, 0.15 represents the login failure rate, 120 represents the number of unique active users, and 2 represents the number of high-risk configuration changes.

[0025] Optionally, the basic log warehouse is built using a distributed columnar database. Each data partition is physically stored according to log source type and hour to optimize query performance for batch data extraction by time range and type. It is understood that the regular expression template library needs to be pre-configured and periodically updated based on the actual log device types existing in the network environment to ensure the parsing capability for logs from newly connected devices. Optionally, in addition to frequency statistics, numerical distribution statistics, and unique value count statistics, the statistical aggregation calculation in the feature calculation rules can also include time interval statistics to calculate the average time interval between alarms triggered by the same source address. This requires sorting the selected relevant log records by timestamp and then performing difference calculations. In some embodiments, the structured field order of standardized log records is predefined and fixed. The field order includes timestamp, log source type identifier, event severity level, operation object, operation action, operation result, etc. For fields that do not exist for certain log source types, null values ​​are used to maintain structural consistency. It is understood that the dimensional order of the original feature data vector strictly corresponds to the defined order of the evaluation dimensions to ensure the consistency of dimension indexes during subsequent module processing.

[0026] In one embodiment of the present invention, the deviation measurement module inputs the generated original feature data vector into a pre-trained behavior baseline model. The behavior baseline model is trained based on standardized log records of historical normal periods and is used to calculate the degree of deviation between the current original feature data vector and the historical normal behavior baseline. The output is a behavior deviation measurement value for each dimension. The implementation includes: the behavior baseline model includes a probability distribution model independently constructed for each evaluation dimension. The probability distribution model is trained using multiple original feature data vectors generated in the historical normal period. The original feature data vector generated in the current time period is split according to the dimension to obtain the current feature value corresponding to each evaluation dimension. The current feature value of each evaluation dimension is input into the probability distribution model corresponding to the evaluation dimension. The probability or probability density value of the current feature value under the historical normal behavior distribution is calculated. Based on the calculated probability or probability density value, it is mapped to a standardized deviation score through a preset transformation function. The magnitude of the deviation score directly represents the degree of deviation of the current feature value from the historical normal baseline. The deviation scores calculated for all evaluation dimensions are arranged in dimensional order of the original feature data vector and output as a behavior deviation measurement value vector for each dimension.

[0027] The multi-dimensional coupling analysis engine in the coupling analysis module analyzes the linkage and transmission patterns between behavioral deviation metrics in different dimensions, identifies composite anomaly patterns caused by slight coupling of multiple dimensions, and outputs composite anomaly pattern identification tags and their intensity indices. Its implementation includes, see [reference needed]. Figure 3The multi-dimensional coupling analysis engine has a built-in coupling relationship matrix describing the normal correlation between different evaluation dimensions. The coupling relationship matrix defines the degree to which deviation of one dimension should be accompanied by deviation of other dimensions under normal conditions. It receives the behavioral deviation measurement vector of each dimension and calculates the correlation coefficient and covariance between the actual observed deviation measurement values ​​of each dimension. It compares the calculated actual correlation coefficient and covariance with the normal correlation defined in the coupling relationship matrix to identify abnormal dimension combinations that violate the normal coupling relationship. It analyzes the identified abnormal dimension combinations to determine whether the deviation of one dimension occurs before the deviation of another dimension, thereby inferring the potential path of abnormal transmission. For each identified abnormal dimension combination and its transmission path, a comprehensive intensity score is calculated based on the severity of its violation of the normal coupling relationship and the clarity of its transmission. The abnormal dimension combination, transmission path and intensity score are encapsulated together into a composite abnormal pattern recognition tag.

[0028] In practice, the deviation measurement module inputs the generated raw feature data vector into a pre-trained behavioral baseline model. This model, trained on standardized log records from historical normal periods, is used to calculate the deviation between the current raw feature data vector and the historical normal behavioral baseline. The behavioral baseline model includes a probability distribution model independently constructed for each evaluation dimension. This model is trained using multiple raw feature data vectors generated from historical normal periods. Historical normal periods typically refer to a time window in the past where no known security events have occurred; for example, all raw feature data vectors generated during the same period over 30 consecutive days constitute the training dataset. The raw feature data vector generated in the current time period is then split according to its dimensions to obtain the current feature value for each evaluation dimension. For example, if the raw feature data vector is [5, 0.15, 120, 2], then the current feature value for the "external attack surface" dimension is 5, the current feature value for the login failure rate in the "internal user behavior" dimension is 0.15, the current feature value for the number of unique users is 120, and the current feature value for the "asset security status" dimension is 2. The current feature value of each evaluation dimension is input into the probability distribution model corresponding to that dimension. The probability or probability density value of the current feature value under the historical normal behavior distribution is calculated. For the login failure rate feature in the "internal user behavior" dimension, its probability distribution model may be fitted to a beta distribution, and the probability density value of the feature value 0.15 under this beta distribution is calculated. Based on the calculated probability or probability density value, it is mapped to a standardized deviation score through a preset transformation function. The magnitude of the deviation score directly represents the degree to which the current feature value deviates from the historical normal baseline. The transformation function can be designed as follows:

[0029] in: Representing the Deviation scores for each assessment dimension Represents the current eigenvalue In the The probability density values ​​under the probability distribution model corresponding to each evaluation dimension are calculated. The negative logarithm operation makes the deviation score higher when the probability density is lower. The deviation scores calculated for all evaluation dimensions are arranged in the dimensional order of the original feature data vector, and the output is a vector of behavioral deviation values ​​for each dimension. For example, the vector [1.2, 3.5, 0.3, 2.1] may be obtained.

[0030] In some embodiments, the multi-dimensional coupling analysis engine of the coupling analysis module analyzes the linkage and transmission patterns between behavioral deviation metrics of different dimensions. The multi-dimensional coupling analysis engine has a built-in coupling relationship matrix describing the normal correlation between different evaluation dimensions. This coupling relationship matrix defines, under normal conditions, the degree to which deviation in one dimension should be accompanied by deviation in other dimensions. The coupling relationship matrix can be obtained based on long-term historical normal data statistics. This indicates the dimension within a normal historical cycle. Deviation score and dimension The expected correlation coefficient between deviation scores is calculated. The system receives the behavioral deviation metric vectors for each dimension and calculates the correlation coefficient and covariance between the actually observed deviation metric values ​​for each dimension. This calculation can be based on a sequence of behavioral deviation metric vectors from the current assessment period and several previous consecutive periods. The calculated actual correlation coefficients and covariances are compared with the normal correlations defined in the coupling matrix to identify anomalous dimension combinations that violate normal coupling relationships. For example, if the coupling matrix indicates that the deviations between the "external attack surface" and "asset security status" dimensions should normally show a weak positive correlation, but the actual calculated correlation coefficient is -0.8, then the anomalous dimension combination of "external attack surface" and "asset security status" is identified. The identified anomalous dimensional combinations are analyzed to determine if a deviation in one dimension precedes a deviation in another, thereby inferring potential transmission paths for the anomalies. The analysis is based on the changes in the behavioral deviation metric vector sequence over time. If the deviation score for the "External Attack Surface" dimension significantly increased in the previous assessment period, while the deviation score for the "Asset Security Status" dimension only significantly increased in the current period, then a potential transmission path from the "External Attack Surface" to the "Asset Security Status" is inferred. For each identified anomalous dimensional combination and its transmission path, a comprehensive strength score is calculated based on the severity of its violation of normal coupling relationships and the clarity of the transmission. It can be represented as:

[0031] in: It is the observed actual correlation coefficient. It is the expected correlation coefficient in the coupling matrix. It is a coefficient calculated based on the clarity of the transmission path, and the combination of abnormal dimensions, transmission path and intensity score are encapsulated into a composite abnormal pattern recognition tag. The tag format is, for example, {abnormal dimension combination: [dimension A, dimension B], transmission path: dimension A->dimension B, intensity score: 7.5}.

[0032] Optionally, the specific type of probability distribution model can be selected based on the data characteristics of the evaluation dimension features. For continuous numerical features such as login failure rate, Gaussian or Beta distributions can be used for modeling; for count features such as alarm counts, Poisson or negative binomial distributions can be used. It is understood that the behavioral baseline model needs to be retrained or incrementally updated periodically using the latest historical normal data to adapt to the gradual changes in the network environment and business models. Optionally, the coupling relationship matrix is ​​not static and can be designed to be dynamically updated based on historical normal data within a sliding time window to reflect the slow evolution of normal relationships over time. In some embodiments, the analysis of transmission paths not only considers adjacent evaluation periods but can also be extended to longer time windows, inferring the transmission direction by calculating the Granger causality or transition entropy of deviation score sequences across multiple time periods. It is understood that the calculation method of the comprehensive intensity score can introduce more factors, such as the absolute value of the deviation score of each dimension and the number of dimensions included in the combination of anomalous dimensions, to more comprehensively quantify the significance of composite anomalous patterns.

[0033] In one embodiment of the present invention, the system further includes a weight allocation module, an impact assessment module, and a level determination module. The weight allocation module receives behavioral deviation metric vectors for each dimension, dynamically calculates the current weight value for each assessment dimension according to a predefined strategy, and generates a weighted deviation metric. The impact assessment module receives composite anomaly pattern identification markers and their intensity indices, and maps different composite anomaly patterns to corresponding basic impact deduction values ​​according to a predefined rule base. The level determination module aggregates the weighted deviation metric and the basic impact deduction values, aggregates the weighted deviation metric into an overall deviation index according to a preset aggregation algorithm, aggregates the basic impact deduction values ​​of all composite anomaly patterns into a total pattern impact deduction, adds the overall deviation index to the total pattern impact deduction to obtain the final assessment score for network security operations, and compares the final assessment score with a preset level threshold range to determine the current network security operation assessment level. The multi-dimensional intelligent assessment level determination system for network security operations also includes a weight allocation module, an impact assessment module, and a level determination module. In practical implementation, the weight allocation module receives behavioral deviation metric vectors for each dimension. It dynamically calculates the current weight value for each evaluation dimension based on a predefined strategy and generates a weighted deviation metric. The impact assessment module receives composite anomaly pattern identification markers and their intensity indicators. Based on a predefined rule base, it maps different composite anomaly patterns to corresponding basic impact deduction values. The level determination module aggregates the weighted deviation metric and the basic impact deduction values. Following a preset aggregation algorithm, it aggregates the weighted deviation metric into an overall deviation index and aggregates the basic impact deduction values ​​of all composite anomaly patterns into a total pattern impact deduction. The overall deviation index and the total pattern impact deduction are added to obtain the final evaluation score for network security operations. This final evaluation score is compared with a preset level threshold range to determine the current evaluation level of network security operations.

[0034] In some embodiments, the behavior deviation metric vector received by the weight allocation module is [1.2, 3.5, 0.3, 2.1], corresponding to the four dimensions of "external attack surface", "internal user behavior - failure rate", "internal user behavior - number of users", and "asset security status", respectively. One of the predefined strategies within the weight allocation module is "during office hours (9:00-18:00), the baseline weight of the internal user behavior-related dimensions is increased by 20%". If the current evaluation period falls within office hours, this strategy is triggered, affecting the "internal user behavior - failure rate". The baseline weights of the "Internal User Behavior - Number of Users" dimension are adjusted. Assuming the baseline weights of the four dimensions are [0.2, 0.3, 0.3, 0.2], the adjusted weights become [0.2, 0.36, 0.36, 0.2]. After normalization, the current weight values ​​are [0.178, 0.321, 0.321, 0.178]. The current weight value of each evaluation dimension is multiplied by its corresponding behavior deviation metric value to obtain the weighted deviation metric value vector [0.214, 1.124, 0.096, 0.374]. In some embodiments, the predefined rule base of the impact assessment module contains a rule whose composite anomaly pattern features are: anomaly dimension combination includes "external attack surface" and "asset security status", the transmission path is "external attack surface" -> "asset security status", and the intensity index is greater than 5.0. The basic impact deduction value mapped by this rule is 15 points. If the impact assessment module receives a composite anomaly pattern recognition tag {anomaly dimension combination: [external attack surface, asset security status], transmission path: external attack surface -> asset security status, intensity score: 7.5} that meets all the above features, then the rule is hit, and an initial deduction value of 15 points is obtained. Based on the ratio of the actual intensity score of 7.5 to the intensity threshold of 5.0 in the rule (7.5 / 5.0=1.5), a linear scaling is performed to obtain a final basic impact deduction value of 22.5 points. Optionally, the nonlinear aggregation function that aggregates the weighted deviation metrics into an overall deviation index by the level determination module can adopt the form of taking the p-norm (p>1), for example:

[0035] in: Represents the overall deviation index. Representing the The weights of each evaluation dimension, Representing the The behavioral deviation measure for each evaluation dimension To assess the total number of dimensions, This function, being a constant greater than 1, can amplify the impact of larger deviations. The total pattern impact deduction is understood to be the arithmetic sum of the base impact deductions for all hit composite anomalous patterns. If two composite anomalous patterns are hit within the same assessment period, with base impact deductions of 22.5 and 10 respectively, the total pattern impact deduction is 32.5. Optionally, before adding the overall deviation index and the total pattern impact deduction, both need to be normalized in terms of their numerical range. For example, the overall deviation index can be scaled to the 0-100 range by dividing by a historical maximum reference value, and the total pattern impact deduction can also be scaled to the 0-100 range by dividing by a preset maximum possible deduction value. Then, the normalized overall deviation index and the total pattern impact deduction are weighted and summed according to a preset composite ratio to obtain the final assessment score. It is understandable that the preset level threshold range can be set as follows: [0,60) corresponds to the "Excellent" level, [60,80) corresponds to the "Good" level, [80,90) corresponds to the "Attention" level, and [90,100] corresponds to the "Urgent" level. If the final evaluation score is 72 points, then the current network security operation evaluation level is determined to be "Good". The level determination module records the time range of this evaluation cycle, the final evaluation score, the evaluation level identifier, and the details of the deviation of the key dimensions that constitute the final evaluation score and the list of the compound abnormal patterns triggered. The recorded results are encapsulated into a network security operation evaluation report.

[0036] In one embodiment of the present invention, the weight allocation module dynamically calculates the current weight value of each evaluation dimension according to a predefined strategy. This includes: presetting a baseline weight value for each evaluation dimension and presetting a set of weight adjustment strategies. These weight adjustment strategies are associated with time periods, historical alarm frequencies, or external threat intelligence levels. Based on the time attribute of the current evaluation, the recent alarm frequency of the evaluation dimension, or the level of received external threat intelligence, the corresponding weight adjustment strategy is triggered. The calculation logic defined in the triggered weight adjustment strategy is executed. Based on the currently input condition parameters, the calculation logic adjusts the baseline weight value upwards or downwards. The weight adjustment results of all evaluation dimensions are normalized to ensure that the sum of all weight values ​​is constant. The current weight value of each evaluation dimension is generated. The current weight value of each evaluation dimension is multiplied by its corresponding behavior deviation metric to obtain the weighted deviation metric of the evaluation dimension. The impact assessment module maps different composite anomaly patterns to corresponding basic impact deduction values ​​based on a predefined rule base. This is achieved by storing multiple rules in the rule base, each defining a specific composite anomaly pattern feature and a basic impact deduction value. The composite anomaly pattern feature consists of anomaly dimension combinations, transmission paths, and intensity thresholds. The module receives composite anomaly pattern identification markers and matches their contained anomaly dimension combinations, transmission paths, and intensity indices with the rules in the rule base. When a composite anomaly pattern identification marker satisfies all the feature conditions defined in a rule, the rule is considered hit. The basic impact deduction value mapped by the hit rule is obtained as the initial deduction value for the composite anomaly pattern identification marker. Based on the ratio between the actual intensity index of the hit composite anomaly pattern identification marker and the intensity threshold defined in the rule, the initial deduction value is linearly scaled to obtain the final basic impact deduction value.

[0037] In practice, the weight allocation module dynamically calculates the current weight value of each evaluation dimension according to a predefined strategy, presets a baseline weight value for each evaluation dimension, and presets a set of weight adjustment strategies. The weight adjustment strategies are associated with the time period, historical alarm frequency, or external threat intelligence level. For example, the preset evaluation dimensions include "external attack surface", "internal login failure", "number of internal users", and "asset security status", with a baseline weight value vector of [0.25, 0.25, 0.25, 0.25]. The preset weight adjustment strategies can include: Strategy A, triggered during the "working hours (09:00-18:00)," increasing the weight of the "internal login failure" and "internal user count" dimensions by 20%; Strategy B, triggered during the "non-working hours," increasing the weight of the "external attack surface" dimension by 30%; Strategy C, when the "historical alarm frequency in the last 24 hours" of a certain dimension exceeds the threshold X, increasing the weight of that dimension by 50%; Strategy D, when the "external threat intelligence level" reaches "high risk," increasing the weight of the "external attack surface" and "asset security status" dimensions by 40%. The weight allocation module triggers the corresponding weight adjustment strategy based on the current time attribute of the assessment, the recent alarm frequency of the assessment dimension, or the level of the received external threat intelligence. For example, if the current time is 14:00 on a working day and the level of the received external threat intelligence is "medium," then Strategy A is triggered. The weight allocation module executes the calculation logic defined in the triggered weight adjustment strategy. Based on the current input condition parameters, the calculation logic adjusts the baseline weight value upwards or downwards. According to strategy A, the baseline weights for the dimensions "Internal Login Failure" and "Number of Internal Users" are increased by 20%, resulting in weights of [0.25, 0.30, 0.30, 0.25]. The weight allocation module normalizes the weight adjustment results for all evaluation dimensions, ensuring the sum of all weight values ​​is a constant 1, generating the current weight value for each evaluation dimension. The normalized calculation is 0.25 + 0.30 + 0.30 + 0.25 = 1.1, and the current weight values ​​for each dimension are [0.25 / 1.1, 0.30 / 1.1, 0.30 / 1.1, 0.25 / 1.1], approximately [0.227, 0.273, 0.273, 0.227]. The weighting module multiplies the current weight value of each evaluation dimension with its corresponding behavioral deviation metric value to obtain the weighted deviation metric value for each evaluation dimension. Assuming the behavioral deviation metric value vector is [1.2, 3.5, 0.3, 2.1], then the weighted deviation metric value vector is [1.2]. 0.227, 3.5 0.273, 0.3 0.273, 2.1 [0.227], i.e., [0.272, 0.956, 0.082, 0.477]. For the weight adjustment strategy and calculation, please refer to Table 1. Table 1: Calculation Table for Dynamic Weight Adjustment

[0038] In some embodiments, the impact assessment module maps different composite anomaly patterns to corresponding basic impact deduction values ​​based on a predefined rule base. The rule base stores multiple rules, each defining a specific composite anomaly pattern feature and a basic impact deduction value. The composite anomaly pattern feature consists of anomaly dimension combinations, transmission paths, and intensity thresholds. For example, the rule base contains rule R1, which defines the composite anomaly pattern feature as follows: the anomaly dimension combination includes "external attack surface" and "asset security status," the transmission path is "external attack surface" -> "asset security status," and the intensity index is greater than 5.0. The basic impact deduction value mapped by this rule is 15 points. Rule R2 defines the composite anomaly pattern feature as follows: the anomaly dimension combination includes "internal login failure" and "number of internal users," the transmission path is "number of internal users" -> "internal login failure," and the intensity index is greater than 3.0. The basic impact deduction value mapped by this rule is 10 points. The impact assessment module receives composite anomaly pattern recognition tags and matches their anomaly dimension combinations, propagation paths, and strength indices with rules in the rule base. Assuming two composite anomaly pattern recognition tags are received: tag M1 is {anomaly dimension combination: [external attack surface, asset security status], propagation path: external attack surface -> asset security status, strength score: 7.5}, and tag M2 is {anomaly dimension combination: [internal login failure, number of internal users], propagation path: number of internal users -> internal login failure, strength score: 2.8}. When a composite anomaly pattern recognition tag satisfies all the feature conditions defined in a rule, the rule is considered hit. Tag M1 satisfies all the feature conditions of rule R1, so rule R1 is hit. Tag M2's strength score of 2.8 is less than the strength threshold of 3.0 required by rule R2, so rule R2 is not hit. The impact assessment module obtains the basic impact deduction value mapped to the hit rule as the initial deduction value for the composite anomaly pattern recognition tag. For tag M1, the initial deduction value is 15 points. The impact assessment module linearly scales the initial deduction value based on the ratio between the actual intensity index of the matched composite anomaly pattern recognition marker and the intensity threshold defined in the rules, to obtain the final basic impact deduction value. The scaling calculation formula is as follows:

[0039] in: This represents the final base impact deduction value. The base impact deduction value mapped in the representative rule, Represents the actual intensity score in the composite anomaly pattern recognition marker. This represents the intensity threshold defined in the rule. For marker M1, , , The final base impact deduction value is calculated. .

[0040] Optionally, the weight adjustment strategy can be based on more complex logic, such as calculating weights based on a combination of multiple conditional parameters, and the calculation formula can be designed as follows:

[0041] in: This represents the adjusted weight. Representing the The baseline weights for each dimension, These are strategy parameters. These are the conditional coefficients corresponding to the time period, historical alarm frequency, and external threat intelligence level. It is understood that the rule base of the impact assessment module needs to be defined and maintained by domain experts based on historical security event analysis to reflect the actual risk level of different composite anomaly patterns. Optionally, linear scaling can employ more complex nonlinear functions; for example, when the actual intensity index far exceeds the threshold, exponential scaling can be used to amplify the impact of high-threat anomalies. In some embodiments, a composite anomaly pattern identification tag may simultaneously satisfy the characteristic conditions of multiple rules. In this case, the impact assessment module will select the highest preliminary deduction value mapped from all hit rules as the calculation benchmark, or superimpose multiple preliminary deduction values ​​for calculation. It is understood that the intensity threshold setting is used to filter out composite anomaly signals with lower intensity that may be caused by random fluctuations, ensuring that only significant anomaly patterns will generate a deduction impact.

[0042] See Figure 4 This is a comparison chart of the strength and threshold of composite anomaly patterns. It is used to compare the actual strength scores of different composite anomaly patterns with the rule thresholds to determine whether security deductions are triggered. Attack Surface → Asset actual strength (7.5) is much higher than the threshold (5.0), belonging to a high-risk composite anomaly, meeting the triggering conditions of rule R1 in the patent, and will result in a high security impact deduction. Multi-dimensional Coupling actual strength (4.2) is slightly higher than the threshold (4.0), belonging to a medium-risk composite anomaly, and needs to be included in the assessment deduction. Login → The strength of user count, single-point anomaly, and baseline fluctuation are all lower than the corresponding thresholds, indicating that these are random fluctuations or low-threat signals, and will not trigger deductions, avoiding false alarms. It intuitively shows the gap between anomaly strength and rule thresholds, helping security operations personnel quickly locate high-risk patterns. It provides a direct basis for the calculation of deduction values ​​in the subsequent impact assessment module, and is a key link from "anomaly identification" to "risk quantification".

[0043] In one embodiment of the present invention, the rating module adds the overall deviation index and the total pattern impact deduction to obtain the final evaluation score of network security operation. In this implementation, the overall deviation index is a scalar value calculated by a nonlinear aggregation function through the weighted deviation measure values ​​of each dimension. The nonlinear aggregation function is used to amplify the impact of the deviation dimension. The total pattern impact deduction is a scalar value obtained by arithmetic summation of the basic impact deduction values ​​of all composite abnormal patterns. The overall deviation index and the total pattern impact deduction are normalized in terms of numerical range so that the overall deviation index and the total pattern impact deduction are in the same numerical range. The normalized overall deviation index and the total pattern impact deduction are weighted and summed according to a preset synthesis ratio to calculate the final evaluation score. The final evaluation score is a continuous value. The lower the value, the better the network security operation status, and the higher the value, the worse the network security operation status. The rating determination module compares the final evaluation score with a preset rating threshold range to determine the current network security operation rating. This is achieved by: presetting a set of rating thresholds arranged in numerical order, each rating threshold defining an upper or lower limit for a rating score range; sequentially comparing the calculated final evaluation score with the preset rating thresholds; determining the corresponding rating identifier based on the specific rating threshold range the final evaluation score falls into; recording the time range of this evaluation period, the final evaluation score, the rating identifier, details of deviations in key dimensions constituting the final evaluation score, and a list of triggered composite anomaly patterns; and encapsulating the recorded results into a network security operation evaluation report, which characterizes the overall level of network security operations within the current time period.

[0044] In practical implementation, the rating module adds the overall deviation index to the total pattern impact deduction to obtain the final evaluation score for network security operations. The overall deviation index is a scalar value calculated by using a nonlinear aggregation function to amplify the impact of each deviation dimension, based on the weighted deviation metrics of each dimension. Assuming the weighted deviation metric vector received from the weight allocation module is [0.272, 0.956, 0.082, 0.477], and the corresponding evaluation dimensions are in the order of "external attack surface," "internal login failure," "number of internal users," and "asset security status," the nonlinear aggregation function can be calculated using a weighted p-norm, for example:

[0045] in: This represents the calculated overall deviation index. Representing the The weighted deviation measure of each evaluation dimension. Represents the total number of evaluation dimensions. It is a constant greater than 1, used to amplify the impact of larger deviations on the overall index. To perform the calculation, The total mode impact deduction is a scalar value obtained by arithmetically summing the base impact deduction values ​​of all composite anomalous modes. Assuming the base impact deduction values ​​of the multiple composite anomalous modes received from the impact assessment module are 22.5, 10, and 5 respectively, then the total mode impact deduction... The overall deviation index and the total pattern impact deduction are normalized in terms of numerical range, ensuring that they fall within the same numerical range. For example, a normalization reference value for the overall deviation index can be set. A normalized reference value for the total pattern influence deduction is set based on the historical maximum overall deviation index estimate of 10. Given a maximum possible deduction of 100 based on the rule base, the normalized overall deviation index is... The total pattern after normalization affects the deduction score. The normalized overall deviation index and the total pattern influence deduction are weighted and summed according to a preset composite ratio to calculate the final evaluation score. The preset composite ratio is 40% for the overall deviation index and 60% for the total pattern influence deduction. The final evaluation score is a continuous numerical value. The lower the value, the better the network security operation status, and the higher the value, the worse the network security operation status.

[0046] In some embodiments, the rating determination module compares the final evaluation score with a preset rating threshold range to determine the current network security operation rating. A set of rating thresholds is preset, arranged in numerical order. Each rating threshold defines an upper or lower limit for a rating score range. For example, the preset rating threshold ranges are: a score in the [0, 20) range corresponds to a rating of "Excellent," a score in the [20, 40) range corresponds to a rating of "Good," a score in the [40, 60) range corresponds to a rating of "Attention," a score in the [60, 80) range corresponds to a rating of "Poor," and a score in the [80, 100] range corresponds to a rating of "Critical." The rating determination module compares the calculated final evaluation score sequentially with the preset rating thresholds. If the final evaluation score of 26.504 is greater than or equal to 20 and less than 40, the rating is determined to be "Good" based on the specific rating threshold range into which the final evaluation score falls. The rating module records the time range of this assessment period, the final assessment score, the assessment rating identifier, and details of deviations in key dimensions constituting the final assessment score, as well as a list of triggered composite anomaly patterns. Key dimension deviation details can be recorded as "Weighted deviation value for external attack surface dimension: 0.272; Weighted deviation value for internal login failure dimension: 0.956." The list of triggered composite anomaly patterns can be recorded as "Pattern ID: M001, Base Deduction: 22.5; Pattern ID: M002, Base Deduction: 10." The rating module encapsulates the recorded results into a network security operation assessment report. This report characterizes the overall level of network security operations within the current time period and may include the assessment period, final assessment score, assessment rating, key dimension contribution analysis, and a list of identified composite anomaly patterns.

[0047] Alternatively, the nonlinear aggregation function that deviates from the exponential form is not limited to the p-norm form; other functions with convex properties, such as exponentially weighted sums, can also be used.

[0048] in: This is an adjustment parameter greater than 0. It can be understood that this is the normalized reference value for the overall deviation index and the overall pattern's impact on the deduction score. and It can be set to a dynamic value, for example Take the moving average of the overall deviation from the index over the most recent 30 assessment periods plus three standard deviations. The sum of the maximum base deduction values ​​for all rules in the rule base is taken. Optionally, the synthesis ratio can be configured and adjusted according to the organization's different levels of emphasis on "normal deviation risk" and "sudden compound anomaly risk". In some embodiments, in addition to the level name, the assessment level identifier can also be associated with a specific color code and handling recommendations, such as "good" level associated with green code and routine monitoring recommendations. It is understood that the cybersecurity operations assessment report can be output in a structured data format or in the form of visual charts for use by downstream security operations platforms or human analysts.

[0049] See Figure 5 This is a 24-hour network log volume time-series analysis chart, showing the changes in core indicators of the network security operations system's log collection module over 24 hours, intuitively reflecting the traffic fluctuation patterns of different types of logs. All three types of logs were continuously collected 24 hours a day, with complete data coverage and no interruptions or missing data. Network device logs are strongly correlated with working hours, with peak traffic every 3-4 hours corresponding to peak business startup periods, demonstrating the system's real-time collection of "device operating status." The U-shaped trend of user access logs reflects the diurnal difference in user access; the nighttime traffic rebound may be due to remote work / cross-time zone access. The stable fluctuations in threat alarm logs indicate that the threat alarm mechanism is continuously operating, with no alarm storms or silent periods, ensuring the continuity of security operations. The chart clearly presents the time-series distribution of log collection, helping operations personnel quickly locate periods of abnormal traffic.

[0050] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments that can be applied to other fields. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A multi-dimensional intelligent assessment and level determination system for network security operations, characterized in that, include: The log collection module acquires the basic log repository generated by network entities; The feature generation module extracts standardized log records within a specified time window from the basic log warehouse according to a preset time period. Based on the definition of the evaluation dimension, it performs field filtering and aggregation on the extracted standardized log records to generate an original feature data vector for evaluation. The deviation measurement module inputs the generated original feature data vector into the pre-trained behavior baseline model, which is trained based on standardized log records of historical normal cycles. It is used to calculate the degree of deviation between the current original feature data vector and the historical normal behavior baseline, and outputs the behavior deviation measurement values ​​of each dimension. The coupling analysis module inputs the behavioral deviation metrics of each dimension into the multi-dimensional coupling analysis engine. The multi-dimensional coupling analysis engine analyzes the linkage and transmission patterns between behavioral deviation metrics of different dimensions, identifies composite abnormal patterns caused by slight abnormal coupling of multiple dimensions, and outputs composite abnormal pattern identification markers and their intensity indices.

2. The network security operation multi-dimensional intelligent assessment level determination system according to claim 1, characterized in that, The method for obtaining the basic log repository generated by the network entity is as follows: The probe program deployed on the network security monitoring node continuously collects raw operation log data generated by network entities. The raw operation log data includes network device operating status, user access behavior traces, external threat alarm events, and internal asset configuration change records. The collected raw operation log data is standardized, cleaned, and timestamp aligned to transform heterogeneous log formats into standardized log records with a unified structure. The standardized log records are then stored in the basic log warehouse according to the time sequence. The standardization and timestamp alignment of the collected raw operational log data, transforming heterogeneous log formats into standardized log records with a unified structure, includes: Parse the original format of each raw operation log data, identify the log source type, and extract key information fields based on the pre-set regular expression template corresponding to the log source type; Data cleaning is performed on the extracted key information fields. The cleaning operations include removing invisible characters, correcting obviously erroneous field values, and filling in field default values ​​caused by transmission loss. From the cleaned key information fields, the time points of log events are parsed out and converted into a unified global reconciliation time timestamp format; The converted global coordination time timestamp, log source type identifier, and all other key information fields are combined according to the predefined structured field order and encapsulated into a single standardized log record. The packaged standardized log records are appended with the data arrival timestamp and stored together in the corresponding partition of the basic log warehouse.

3. The network security operation multi-dimensional intelligent assessment level determination system according to claim 2, characterized in that, The process involves filtering and aggregating the extracted standardized log records according to the definition of the evaluation dimensions to generate a raw feature data vector for evaluation, including: Multiple independent evaluation dimensions are predefined, each associated with a specific set of standardized log record fields, and independent feature calculation rules are set for each evaluation dimension; Based on a preset time period, extract all standardized log records within the time period from the basic log warehouse; For each evaluation dimension, relevant field values ​​are selected from the extracted standardized log records according to their associated field groups; Based on the feature calculation rules corresponding to each evaluation dimension, statistical aggregation calculations are performed on the selected relevant field values. The statistical aggregation calculations include frequency statistics, numerical distribution statistics, unique value quantity statistics, and time interval statistics. The aggregated results calculated for each evaluation dimension are arranged in a predetermined dimensional order and combined to form the original feature data vector representing the operational status of the time period.

4. The network security operation multi-dimensional intelligent assessment level determination system according to claim 3, characterized in that, The generated raw feature data vector is input into a pre-trained behavioral baseline model. This behavioral baseline model is trained based on standardized log records from historical normal periods and is used to calculate the deviation between the current raw feature data vector and the historical normal behavioral baseline. The output is a behavioral deviation metric for each dimension, including: The behavioral baseline model includes a probability distribution model independently constructed for each evaluation dimension, which is trained using multiple raw feature data vectors generated from historical normal cycles. The original feature data vector generated in the current time period is split according to the dimensions to obtain the current feature value corresponding to each evaluation dimension; Input the current feature value of each evaluation dimension into the probability distribution model corresponding to the evaluation dimension, and calculate the probability or probability density value of the current feature value under the historical normal behavior distribution. Based on the calculated occurrence probability or probability density value, it is mapped to a standardized deviation score through a preset transformation function. The magnitude of the deviation score directly represents the degree to which the current feature value deviates from the historical normal baseline. The deviation scores calculated for all evaluation dimensions are arranged in dimensional order according to the original feature data vector, and the output is a vector of behavioral deviation metrics for each dimension.

5. The network security operation multi-dimensional intelligent assessment level determination system according to claim 4, characterized in that, The multi-dimensional coupling analysis engine analyzes the linkage and transmission patterns between behavioral deviation metrics in different dimensions, identifies composite anomaly patterns caused by slight coupling of multiple dimensions, and outputs composite anomaly pattern identification markers and their intensity indices, including: The multi-dimensional coupling analysis engine has a built-in coupling relationship matrix that describes the normal correlation between different evaluation dimensions. The coupling relationship matrix defines the degree to which a deviation in one dimension should be accompanied by a deviation in other dimensions under normal conditions. Receive the behavioral deviation measure vectors for each dimension, and calculate the correlation coefficient and covariance between the actual observed deviation measures for each dimension; The calculated actual correlation coefficients and covariances are compared with the normal correlations defined in the coupling matrix to identify abnormal dimensional combinations that violate the normal coupling relationships. Analyze the identified abnormal dimensional combinations to determine whether a deviation in one dimension occurs before a deviation in another dimension, thereby inferring the potential path of abnormal propagation; For each identified anomalous dimension combination and its transmission path, a comprehensive intensity score is calculated based on the severity of its violation of normal coupling relationships and the clarity of transmission. The anomalous dimension combination, transmission path, and intensity score are then encapsulated together into a composite anomalous pattern recognition tag.

6. The network security operation multi-dimensional intelligent assessment level determination system according to claim 5, characterized in that, The system also includes: The weighting module receives the behavioral deviation metric vectors for each dimension, dynamically calculates the current weight value for each evaluation dimension according to a predefined strategy, and generates a weighted deviation metric. The impact assessment module is used to receive composite anomaly pattern identification tags and their intensity indicators, and map different composite anomaly patterns to corresponding basic impact deduction values ​​according to a predefined rule base. The rating determination module is used to aggregate the weighted deviation metric value and the basic impact deduction value. According to the preset aggregation algorithm, the weighted deviation metric value is aggregated into an overall deviation index, and the basic impact deduction value of all composite anomaly modes is aggregated into a total mode impact deduction. The overall deviation index and the total mode impact deduction are added together to obtain the final evaluation score of network security operation. The final evaluation score is compared with the preset rating threshold range to determine the current rating of network security operation.

7. The network security operation multi-dimensional intelligent assessment level determination system according to claim 6, characterized in that, The step of dynamically calculating the current weight value of each evaluation dimension according to a predefined strategy includes: A baseline weight value is preset for each evaluation dimension, and a set of weight adjustment strategies are preset. The weight adjustment strategies are associated with the time period, historical alarm frequency, or external threat intelligence level. Based on the current time attribute of the assessment, the recent alarm frequency of the assessment dimension, or the level of external threat intelligence received, the corresponding weight adjustment strategy is triggered. The calculation logic defined in the triggered weight adjustment strategy is executed, and the calculation logic adjusts the base weight value by raising or lowering it based on the current input condition parameters. The weight adjustment results for all evaluation dimensions are normalized to ensure that the sum of all weight values ​​is constant, and the current weight value for each evaluation dimension is generated. The weighted deviation metric of each evaluation dimension is obtained by multiplying the current weight value of each evaluation dimension by its corresponding behavioral deviation metric.

8. The network security operation multi-dimensional intelligent assessment level determination system according to claim 7, characterized in that, The process of mapping different composite anomaly patterns to corresponding basic impact deduction values ​​based on a predefined rule base includes: The rule base stores multiple rules, each of which defines a specific composite anomaly pattern feature and a basic impact deduction value. The composite anomaly pattern feature is composed of a specific combination of anomaly dimensions, a transmission path, and an intensity threshold. Receive composite anomaly pattern recognition tags and match the anomaly dimension combination, propagation path, and intensity index contained therein with the rules in the rule base; When a composite anomaly pattern recognition tag satisfies all the feature conditions defined in a rule, it is determined that the rule has been hit; Obtain the basic impact deduction value mapped by the hit rule, as the initial deduction value for the composite anomaly pattern recognition marker; Based on the ratio between the actual intensity index of the matched composite anomaly pattern recognition marker and the intensity threshold defined in the rules, the initial deduction value is linearly scaled to obtain the final basic impact deduction value.

9. The network security operation multi-dimensional intelligent assessment level determination system according to claim 8, characterized in that, The final evaluation score for cybersecurity operations is obtained by adding the overall deviation index to the total pattern impact deduction, including: The overall deviation index is a scalar value calculated by a nonlinear aggregation function using the weighted deviation measures of each dimension. The nonlinear aggregation function is used to amplify the impact of the deviation dimensions. The total pattern impact deduction is a scalar value obtained by arithmetic summation of the basic impact deduction values ​​of all composite anomaly patterns. The overall deviation index and the total pattern impact deduction are normalized in terms of numerical range so that the overall deviation index and the total pattern impact deduction are in the same numerical range. The normalized overall deviation index and the total pattern influence deduction are weighted and summed according to a preset synthesis ratio to calculate the final evaluation score. The final evaluation score is a continuous numerical value. The lower the value, the better the network security operation status, and the higher the value, the worse the network security operation status.

10. The network security operation multi-dimensional intelligent assessment level determination system according to claim 9, characterized in that, The final evaluation score is compared with a preset level threshold range to determine the current network security operation evaluation level, including: A set of level thresholds are preset and arranged in numerical order. Each level threshold defines an upper or lower limit of an evaluation level score range. The calculated final evaluation score is compared sequentially with the preset grade threshold. Based on the specific grade threshold range into which the final evaluation score falls, determine the corresponding evaluation grade identifier; Record the time range of this assessment cycle, the final assessment score, the assessment level indicator, and the details of deviations in the key dimensions that constitute the final assessment score, as well as a list of triggered composite anomaly patterns; The recorded results are packaged into a cybersecurity operations assessment report, which is used to characterize the overall level of cybersecurity operations within the current time period.

Images