Network security decision management system based on multi-source data processing analysis

Abstract

The application discloses a network security decision management system based on multi-source data processing analysis, relates to the technical field of network security decision, and aims to solve the technical problem that in the prior art, communication behavior security detection cannot be accurately realized according to two types of core metadata, namely, a packet length sequence and a packet arrival time interval sequence. Specifically, a full-dimension security protection system covering single-point communication detection, group device cooperative monitoring and protection effect self-checking is constructed through multi-unit cooperative linkage. Multi-dimension data acquisition and analysis units lay a foundation for accurate detection, device cooperative sensing and detection units fill the gap of IoT device group security monitoring, a network risk self-checking and evaluating unit realizes continuous optimization of the protection effect, and a network security decision management platform guarantees efficient linkage and centralized control of each link, and effectively improves the comprehensiveness of network security detection, the accuracy of abnormality identification, the pertinence of protection measures and the efficiency of system operation.

Description

Technical Field

[0001] This invention relates to the field of network security decision-making technology, specifically to a network security decision-making management system based on multi-source data processing and analysis. Background Technology

[0002] With the rapid development of information technology and the increasing prominence of cybersecurity issues, the role of cybersecurity decision-making systems is becoming increasingly important. A cybersecurity decision-making system is a software system that provides intelligent decision support for diverse and complex cybersecurity issues by modeling cybersecurity-related knowledge and experience. The goal of a cybersecurity decision-making system is to ensure the security and reliability of network systems, protect user privacy and data security, prevent network attacks and illegal intrusions, improve the anti-attack and recovery capabilities of network systems, and ensure the normal operation of network systems and the continuous development of business.

[0003] However, in existing technologies, it is impossible to achieve precise security detection of communication behavior based on two types of core metadata: packet length sequence and packet arrival time interval sequence. Secondly, in response to the pain point that individual intrusion behaviors of IoT device groups are highly concealed, it is impossible to achieve comprehensive monitoring of communication relationships and frequencies between devices through traffic mirroring, log collection, and adjacency matrix analysis. Therefore, a solution is proposed. Summary of the Invention

[0004] The purpose of this invention is to solve the problems mentioned above by proposing a network security decision management system based on multi-source data processing and analysis.

[0005] The objective of this invention can be achieved through the following technical solution: a network security decision management system based on multi-source data processing and analysis, comprising a network security decision management platform, wherein the network security decision management platform has communication connections to:

[0006] The multi-dimensional data acquisition and analysis unit collects metadata about the dynamic behavior of network communication and performs security detection of communication behavior based on the collected and analyzed metadata.

[0007] The device collaborative sensing and detection unit performs collaborative sensing and detection on IoT device groups; and infers the operational security performance of individual devices and the device group within the IoT device group.

[0008] The network risk self-assessment unit conducts risk self-assessment of network communications.

[0009] Furthermore, the process of the multi-dimensional data acquisition and analysis unit is as follows:

[0010] Collect raw data packets from network switches, routers, or traffic mirroring ports;

[0011] Metadata dimensions extracted from the original data packet:

[0012] Packet length sequence: Records the length of each data packet in a complete session, forming a sequence;

[0013] Packet arrival time interval sequence: Records the time intervals between the arrival of consecutive data packets to form a sequence;

[0014] According to the statistics of communication dynamic behavior, if the data deviation of the packet length sequence of the same type of communication dynamic behavior is within the set threshold range during the operation period, the current running segment is marked as a stable running period when the corresponding type of communication dynamic behavior is generated continuously; otherwise, it is marked as a sudden running period.

[0015] Furthermore, during the stable operation of the communication dynamic behavior, metadata of a set threshold period is collected as a training set; features are extracted from the collected metadata sequence, specifically the mean and variance, and the corresponding time points are recorded;

[0016] Obtain the mean and variance of the packet length sequence, and label them as packet length mean and packet length variance, respectively;

[0017] When the average packet length or variance of the packet length corresponding to the dynamic behavior of communication deviates from the preset normal baseline, it is inferred that the communication is abnormal, and the current dynamic behavior of communication is controlled and security protection is carried out simultaneously.

[0018] The mean and variance of the packet arrival time interval sequence are obtained and labeled as the interval mean and interval variance, respectively. If the interval mean decreases abnormally or the interval variance increases abnormally, it is inferred that there is a risk in the dynamic communication behavior, and the dynamic communication behavior is stopped and security protection is implemented.

[0019] If the mean packet length and variance of the corresponding dynamic communication behavior do not deviate from the preset normal baseline, and the mean interval and variance of the interval are within the normal setting range, then the dynamic communication behavior is considered safe, and the IP address, daily cycle characteristics of the communication, and interaction mode identifier of the current dynamic communication behavior are recorded.

[0020] Furthermore, the process of the device collaborative sensing and detection unit is as follows:

[0021] Perform traffic mirroring and log collection, that is, perform traffic mirroring and log collection from network core switches, wireless access point controllers, IoT gateways, etc.

[0022] Periodically collect the communication relationships between devices; generate an N*N adjacency matrix (N is the number of devices), where matrix element A[i][j] indicates whether device i and device j have a communication connection and the frequency of communication within the period; based on the communication relationships of each device, obtain the sudden increase span of the number of communication connections and the sudden increase rate of the communication frequency in the matrix elements at the same running time.

[0023] Furthermore, if the sudden increase in the number of communication connections in the matrix elements exceeds the threshold for sudden increase in number at the same running time, or if the sudden increase in communication frequency exceeds the threshold for sudden increase in frequency, an abnormal device signal is generated and sent to the network security decision management platform along with the device number. After receiving the signal, the network security decision management platform performs network maintenance on the current device and performs network security detection on the communication-related devices.

[0024] If the sudden increase in the number of communication connections in the matrix elements does not exceed the threshold for sudden increase in number at the same running time, and the sudden increase rate of communication frequency does not exceed the threshold for sudden increase rate of frequency, then it is inferred that there is no risk to the operation of the IoT device, and the network security decision management platform will continuously monitor the current device.

[0025] Furthermore, after completing the equipment operation status analysis, the communication of the equipment group is monitored to obtain the access targets of each device in the equipment group. If the number of real-time communication devices for the same access target exceeds the set device number threshold, or if the increase rate of the number of access targets does not exceed the set increase rate threshold when the number of running devices in the equipment group increases, an abnormal signal of the equipment group is generated and sent to the network security decision management platform.

[0026] If the number of real-time communication devices for the same access target does not exceed the set device number threshold, or if the increase rate of the number of access targets exceeds the set increase rate threshold when the number of running devices in the device group increases, a device group security signal is generated and sent to the network security decision management platform.

[0027] Furthermore, the process of the network risk self-assessment unit is as follows:

[0028] During communication security testing, the number of abnormal behaviors and the number of secure behaviors identified in the current network communication dynamic behavior are obtained, and the ratio of the number of identified communication dynamic behaviors is obtained by comparing the values; at the same time, the frequency of abnormal occurrences of the device group when the device in the current network passes the test is obtained.

[0029] If the identification ratio of communication dynamic behavior exceeds the identification ratio threshold, or if the frequency of abnormal occurrence of the device group when the current device in the network is qualified exceeds the frequency of abnormal occurrence, a network security protection inefficiency signal will be generated and sent to the network security decision management platform.

[0030] If the identification ratio of communication dynamic behavior does not exceed the identification ratio threshold, and the frequency of abnormal occurrence of the device group when the current network device is qualified does not exceed the abnormal occurrence frequency, then a high-efficiency network security protection signal is generated and sent to the network security decision management platform.

[0031] Compared with the prior art, the beneficial effects of the present invention are:

[0032] 1. By collecting raw data packets from key nodes such as network switches and routers, two types of core metadata are extracted: packet length sequence and packet arrival time interval sequence. Combined with feature analysis of mean and variance, the system achieves precise detection of communication behavior security. It effectively distinguishes between stable and sudden operation periods, and quickly identifies various abnormal scenarios such as abnormally increased mean (e.g., DDoS attacks, data theft) and abnormal fluctuations in variance (e.g., packet fragmentation attacks, protocol spoofing) based on normal baselines. At the same time, through IP address recording, daily periodic characteristic comparison, and interaction pattern identification, it provides comprehensive behavioral profile support for subsequent security decisions, enabling early warning and accurate location of network communication anomalies, and avoiding the problems of missed or false judgments caused by single-dimensional detection.

[0033] 2. Addressing the pain point of highly concealed individual intrusion behaviors in IoT device clusters, this unit achieves comprehensive monitoring of communication relationships and frequencies between devices through traffic mirroring, log collection, and adjacency matrix analysis. It accurately captures abnormal signals such as sudden increases in the number of communication connections and sudden surges in communication frequency, proactively intercepting risks such as malicious lateral penetration and virus propagation. Simultaneously, by monitoring the concentration and rate of change in the number of targets accessed by the device cluster, it effectively prevents abnormal behaviors of the cluster devices, such as coordinated DDoS attacks. This unit breaks through the limitations of single-device detection, covering security risks at both the individual device and cluster levels from a group collaborative perception perspective, ensuring the stability and security of IoT device cluster operation.

[0034] 3. By calculating the ratio of anomalies in communication dynamic behavior to security identifications and the frequency of anomalies in device groups, a closed-loop evaluation mechanism for network security protection effectiveness is constructed. This mechanism promptly identifies inefficient protection issues in communication monitoring or device detection, triggering the network security decision management platform to optimize and adjust monitoring cycles and detection strategies. This avoids risk omissions due to rigid protection strategies. This unit achieves a shift from "passive detection" to "proactive optimization," continuously improving the adaptability and efficiency of the entire system's protection through self-inspection and evaluation, ensuring that protection measures always match the network security situation. Attached Figure Description

[0035] To facilitate understanding by those skilled in the art, the present invention will be further described below with reference to the accompanying drawings.

[0036] Figure 1 This is a system principle block diagram of the present invention;

[0037] Figure 2 This is a flowchart of the method of the present invention. Detailed Implementation

[0038] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0039] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0040] Please see Figures 1-2 As shown, the network security decision management system based on multi-source data processing and analysis includes a network security decision management platform, which has communication connections with a multi-dimensional data acquisition and analysis unit, a device collaborative perception and detection unit, and a network risk self-inspection and assessment unit.

[0041] The network security decision management platform generates multi-dimensional metadata collection and analysis signals and sends them to the multi-dimensional metadata collection and analysis unit. After receiving the multi-dimensional metadata collection and analysis signals, the multi-dimensional metadata collection and analysis unit collects metadata on the dynamic behavior of network communication and performs security detection on communication behavior based on the metadata collection and analysis.

[0042] Collect raw data packets from network switches, routers, or traffic mirroring ports;

[0043] Metadata dimensions extracted from the original data packet:

[0044] Packet length sequence: Records the length of each data packet in a complete session, forming a sequence [L1, L2, L3, ...]; and records the uplink and downlink separately;

[0045] Packet arrival time interval sequence: Records the time intervals between the arrival of consecutive data packets, forming a sequence [T1, T2, T3, ...]; this reflects the rhythm of communication (such as whether it is bursty or constant).

[0046] According to the statistics of communication dynamic behavior, if the data deviation of the packet length sequence of the same type of communication dynamic behavior is within the set threshold range during the operation period, the current running segment is marked as a stable running period when the corresponding type of communication dynamic behavior is generated continuously; otherwise, it is marked as a sudden running period.

[0047] During the stable operation of the communication dynamic behavior, metadata of a set threshold period is collected as a training set; features are extracted from the collected metadata sequence, specifically the mean and variance, and the corresponding time points are recorded;

[0048] Obtain the mean and variance of the packet length sequence, and label them as packet length mean and packet length variance, respectively; packet length mean: reflects the central tendency of the data packet length of a certain type of business (such as HTTP request, IoT device communication); packet length variance reflects the dispersion of packet length.

[0049] When the average or variance of packet length corresponding to the dynamic behavior of communication deviates from the preset normal baseline, it is inferred that the communication is abnormal; that is, an abnormal increase in the average may be due to attackers stealing data through large-volume packets or DDoS attacks (such as UDP floods); an abnormal increase in the variance may be due to packet fragmentation attacks (such as splitting malicious data into multiple small packets for transmission to evade detection) or protocol spoofing (such as embedding malicious code into the variable-length field of a normal protocol); the current dynamic behavior of communication is controlled and security protection is implemented simultaneously.

[0050] The mean and variance of the packet arrival time interval sequence are obtained and labeled as the interval mean and interval variance, respectively. The interval mean reflects the average frequency of packet arrival, and the interval variance reflects the degree of fluctuation of the time interval.

[0051] If the mean interval decreases abnormally or the variance of the interval increases abnormally, it is inferred that there is a risk in the dynamic communication behavior, and dynamic communication behavior should be stopped and security protection should be implemented. Among them, the abnormal decrease in the mean interval may be due to DDoS attacks (such as SYN floods, ICMP floods), where a large number of data packets arrive in a short period of time, resulting in a significant decrease in the mean interval. The abnormal increase in the variance of the interval may be due to botnet communication (attackers deliberately adjust the packet interval randomly to avoid detection based on fixed frequency) or the covert transmission of APT attacks (intermittent low-frequency communication).

[0052] Combination patterns of mean and variance: For example, "small mean + small variance" may indicate a high-frequency DDoS attack (packets arrive densely and regularly); "large mean + large variance" may indicate a low-rate DDoS attack (packet intervals fluctuate randomly but the overall frequency is high).

[0053] If the average packet length and variance of the corresponding dynamic communication behavior do not deviate from the preset normal baseline, and the average interval and variance of the interval are within the normal setting range, then the dynamic communication behavior is considered safe, and the IP address of the current dynamic communication behavior is recorded. The daily cycle characteristics of the communication are: record the specific time when the session occurs and compare it with the behavior in the same period in history; the interaction mode identifier is: identify whether the session is similar to a request / response (such as HTTP), a long connection heartbeat (such as video stream), or a one-way data push.

[0054] The network security decision management platform generates device collaborative sensing and detection signals and sends them to the device collaborative sensing and detection unit.

[0055] After receiving the device collaborative sensing and detection signal, the device collaborative sensing and detection unit performs collaborative sensing and detection on the IoT device group. This is so that the behavior of a single device may not change significantly after being compromised, but it may launch a DDoS attack in concert, thereby ensuring network security performance.

[0056] Perform traffic mirroring and log collection, that is, perform traffic mirroring and log collection from network core switches, wireless access point controllers, IoT gateways, etc.

[0057] Periodically collect the communication relationships between devices; generate an N*N adjacency matrix (N is the number of devices), where matrix element A[i][j] indicates whether device i and device j have a communication connection and the frequency of communication within the period; based on the communication relationships of each device, obtain the sudden increase span of the number of communication connections in the matrix elements and the sudden increase rate of the communication frequency at the same running time, such as adding a large number of non-business-related devices for communication.

[0058] If the sudden increase in the number of communication connections in the matrix elements exceeds the threshold for sudden increase in number at the same running time, or the sudden increase in communication frequency exceeds the threshold for sudden increase in frequency, it is inferred that there is a risk in the operation of the IoT device, such as malicious lateral penetration (e.g., virus propagation) or device failure. An abnormal device signal is generated and sent to the network security decision management platform along with the device number. After receiving the signal, the network security decision management platform performs network maintenance on the current device and network security detection on the communication-related devices.

[0059] If the sudden increase in the number of communication connections in the matrix elements does not exceed the threshold for sudden increase in number at the same running time, and the sudden increase rate of communication frequency does not exceed the threshold for sudden increase rate of frequency, then it is inferred that there is no risk in the operation of the IoT device, and the network security decision management platform will continuously monitor the current device.

[0060] After completing the equipment operation status analysis, the communication of the equipment group is monitored to obtain the access targets of each device in the equipment group. If the number of real-time communication devices for the same access target exceeds the set device number threshold, or if the increase rate of the number of access targets does not exceed the set increase rate threshold when the number of running devices in the equipment group increases, it is inferred that there is interference in the operation of the equipment group, an abnormal signal of the equipment group is generated and sent to the network security decision management platform. After receiving the signal, the network security decision management platform performs network security protection for the equipment group.

[0061] If the number of real-time communication devices for the same access target does not exceed the set device number threshold, or if the increase rate of the number of access targets exceeds the set increase rate threshold when the number of running devices in the device group increases, it is inferred that the device group is operating normally, a device group security signal is generated and sent to the network security decision management platform.

[0062] The distribution of external IP addresses and ports accessed by the device group as a whole; under normal circumstances, the access targets should be distributed (such as their respective cloud services); under abnormal circumstances, they may be highly concentrated on a few targets.

[0063] The network security decision management platform generates network risk self-assessment signals and sends them to the network risk self-assessment unit.

[0064] After receiving the network risk self-assessment signal, the network risk self-assessment unit performs a risk self-assessment on network communication.

[0065] During communication security detection, the number of abnormal behaviors and the number of secure behaviors identified in the current network communication dynamic behavior are obtained, and the ratio of the number of identified communication dynamic behaviors is obtained by comparing the values.

[0066] Simultaneously, obtain the frequency of anomalies in the device group when the current network devices pass the inspection;

[0067] If the identification rate of dynamic communication behavior exceeds the identification rate threshold, or if the frequency of abnormal occurrence of device groups when the current network devices pass the detection exceeds the frequency of abnormal occurrence, it is inferred that the network risk self-inspection assessment is abnormal, a network security protection inefficiency signal is generated and sent to the network security decision management platform; upon receiving the network security protection inefficiency signal, the network security decision management platform will readjust the monitoring of dynamic communication behavior and device group detection, and shorten the monitoring cycle.

[0068] If the identification ratio of communication dynamic behavior does not exceed the identification ratio threshold, and the frequency of abnormal occurrence of the device group when the current network device is qualified does not exceed the frequency of abnormal occurrence, then it is inferred that the network risk self-inspection assessment is normal, and a high-efficiency network security protection signal is generated and sent to the network security decision management platform.

[0069] Thresholds, preset values, or preset ranges are set for result comparison and analysis to determine whether they are good or bad. The value of these thresholds is determined by a combination of large-scale model analysis of sample data and human experience. They can also be adjusted appropriately based on seasonal or rational factors.

[0070] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to any specific implementation. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. A network security decision management system based on multi-source data processing and analysis, characterized in that, This includes a network security decision management platform, whose communication connections include: The multi-dimensional data acquisition and analysis unit collects metadata about the dynamic behavior of network communication and performs security detection of communication behavior based on the collected and analyzed metadata. The device collaborative sensing and detection unit performs collaborative sensing and detection on IoT device groups; and infers the operational security performance of individual devices and the device group within the IoT device group. The network risk self-assessment unit conducts risk self-assessment of network communications.

2. The network security decision management system based on multi-source data processing and analysis according to claim 1, characterized in that, The process of the multi-dimensional data acquisition and analysis unit is as follows: Collect raw data packets from network switches, routers, or traffic mirroring ports; Metadata dimensions extracted from the original data packet: Packet length sequence: Records the length of each data packet in a complete session, forming a sequence; Packet arrival time interval sequence: Records the time intervals between the arrival of consecutive data packets to form a sequence; According to the statistics of communication dynamic behavior, if the data deviation of the packet length sequence of the same type of communication dynamic behavior is within the set threshold range during the operation period, the current running segment will be marked as a stable running period when the corresponding type of communication dynamic behavior is generated continuously. Conversely, it is marked as a period of emergency operation.

3. The network security decision management system based on multi-source data processing and analysis according to claim 2, characterized in that, During the stable operation of the communication dynamic behavior, metadata of a set threshold period is collected as a training set; features are extracted from the collected metadata sequence, specifically the mean and variance, and the corresponding time points are recorded; Obtain the mean and variance of the packet length sequence, and label them as packet length mean and packet length variance, respectively; When the average packet length or variance of the packet length corresponding to the dynamic behavior of communication deviates from the preset normal baseline, it is inferred that the communication is abnormal, and the current dynamic behavior of communication is controlled and security protection is carried out simultaneously. The mean and variance of the packet arrival time interval sequence are obtained and labeled as the interval mean and interval variance, respectively. If the interval mean decreases abnormally or the interval variance increases abnormally, it is inferred that there is a risk in the dynamic communication behavior, and the dynamic communication behavior is stopped and security protection is implemented. If the mean packet length and variance of the corresponding dynamic communication behavior do not deviate from the preset normal baseline, and the mean interval and variance of the interval are within the normal setting range, then the dynamic communication behavior is considered safe, and the IP address, daily cycle characteristics of the communication, and interaction mode identifier of the current dynamic communication behavior are recorded.

4. The network security decision management system based on multi-source data processing and analysis according to claim 1, characterized in that, The process of the device collaborative sensing and detection unit is as follows: Perform traffic mirroring and log collection; Periodically collect the communication relationships between devices; generate an N*N adjacency matrix (N is the number of devices), where matrix element A[i][j] indicates whether device i and device j have a communication connection and the frequency of communication within the period; based on the communication relationships of each device, obtain the sudden increase span of the number of communication connections and the sudden increase rate of the communication frequency in the matrix elements at the same running time.

5. The network security decision management system based on multi-source data processing and analysis according to claim 4, characterized in that, If the sudden increase in the number of communication connections in the matrix element exceeds the threshold for sudden increase in number, or the sudden increase in communication frequency exceeds the threshold for sudden increase in frequency, a device abnormality signal will be generated and sent to the network security decision management platform along with the device number. After receiving the signal, the network security decision management platform will perform network maintenance on the current device and network security detection on the communication-related devices. If the sudden increase in the number of communication connections in the matrix elements does not exceed the threshold for sudden increase in number at the same running time, and the sudden increase rate of communication frequency does not exceed the threshold for sudden increase rate of frequency, then it is inferred that there is no risk to the operation of the IoT device, and the network security decision management platform will continuously monitor the current device.

6. The network security decision management system based on multi-source data processing and analysis according to claim 5, characterized in that, After completing the equipment operation status analysis, the communication of the equipment group is monitored to obtain the access targets of each device in the equipment group. If the number of real-time communication devices for the same access target exceeds the set device number threshold, or if the increase rate of the number of access targets does not exceed the set increase rate threshold when the number of running devices in the equipment group increases, an abnormal signal of the equipment group is generated and sent to the network security decision management platform. If the number of real-time communication devices for the same access target does not exceed the set device number threshold, or if the increase rate of the number of access targets exceeds the set increase rate threshold when the number of running devices in the device group increases, a device group security signal is generated and sent to the network security decision management platform.

7. The network security decision management system based on multi-source data processing and analysis according to claim 1, characterized in that, The process of the network risk self-assessment unit is as follows: During communication security testing, the number of abnormal behaviors and the number of secure behaviors identified in the current network communication dynamic behavior are obtained, and the ratio of the number of identified communication dynamic behaviors is obtained by comparing the values; at the same time, the frequency of abnormal occurrences of the device group when the device in the current network passes the test is obtained. If the identification ratio of communication dynamic behavior exceeds the identification ratio threshold, or if the frequency of abnormal occurrence of the device group when the current device in the network is qualified exceeds the frequency of abnormal occurrence, a network security protection inefficiency signal will be generated and sent to the network security decision management platform. If the identification ratio of communication dynamic behavior does not exceed the identification ratio threshold, and the frequency of abnormal occurrence of the device group when the current network device is qualified does not exceed the abnormal occurrence frequency, then a high-efficiency network security protection signal is generated and sent to the network security decision management platform.

Images