A network space security monitoring and anomaly analysis system

Abstract

The application discloses a network space security monitoring and abnormality analysis system, and relates to the technical field of network space security monitoring.The system is provided with a distributed traffic collection module of a whole-network controllable node to collect whole-link bidirectional network messages, and generates a standardized traffic data set after removing duplication, fragmentation, recombination, multi-protocol analysis and feature extraction.A multi-dimensional behavior baseline construction module generates a normal behavior baseline library adapted to multiple service scenarios, and real-time traffic is matched with the baseline to screen suspected abnormalities, cross-verification with a historical behavior and attack feature library is performed to exclude false positives to obtain real abnormalities, and finally, the real abnormalities are graded, pushed, encrypted and stored, and traceability logs are obtained.The application can reduce false positive and false negative rates of abnormality detection, identify encrypted traffic abnormalities without decryption, support cross-region attack link restoration, automatically link and dispose to shorten a response window, adapt to multiple network scene security monitoring requirements, and meet data compliance and security audit requirements.

Description

Technical Field

[0001] This invention relates to the field of cyberspace security monitoring technology, and in particular to a cyberspace security monitoring and anomaly analysis system. Background Technology

[0002] The network architecture of various organizations is becoming increasingly complex, covering multiple partitions such as office networks, production networks, and IoT networks. The volume of cross-network interaction in the north-south direction and internal data transmission in the east-west direction continues to grow. Network attack methods are also showing characteristics of being more covert, diversified, and collaborative across networks. The proportion of encrypted traffic is increasing year by year. The difficulty of tracing and handling security incidents such as APT attacks, ransomware attacks, and data breaches is constantly increasing. As a core component of the proactive defense system, network security monitoring systems need to simultaneously meet multiple requirements such as high detection rate, low false alarm rate, compliance, and multi-scenario adaptability.

[0003] Currently, mainstream network security monitoring technologies are mainly divided into two categories. One category is feature-based rule matching detection technology. This technology identifies attacks by matching real-time traffic against a feature database one by one using pre-stored signatures of known attacks. This type of technology has a high accuracy rate in identifying known attacks and low deployment and maintenance costs. However, it cannot identify unknown attacks or zero-day vulnerability exploits that are not included in the feature database, nor can it detect malicious communication behaviors hidden in encrypted traffic. It also exhibits a significant lag in responding to new types of attacks. The other category is anomaly detection technology based on static behavioral baselines. This technology sets thresholds by pre-statistically analyzing normal traffic characteristics within a fixed period. Traffic exceeding the threshold is judged as abnormal. This type of technology can cover the detection of some unknown attacks, but it cannot adapt to scenarios with dynamic changes in business. In scenarios with legitimate traffic fluctuations such as business peaks, system upgrades, and maintenance operations, it will generate a large number of false alarms, consuming a lot of investigation time for security maintenance personnel. At the same time, this type of technology is mostly based on independent detection of a single node, and it cannot perform correlation analysis on alarms scattered across different network partitions. It is difficult to identify complete attack chains that are coordinated across networks, and it is easy to miss critical attack behaviors.

[0004] Furthermore, some existing encrypted traffic detection technologies require decryption of traffic before feature matching, which not only increases network transmission latency but also poses a risk of privacy leaks of user communication data, failing to meet relevant data security compliance requirements. Alarm responses from some monitoring systems require manual intervention, resulting in long attack response windows and difficulty in blocking attacks before they spread. Monitoring rules for core assets lack dedicated protection mechanisms, making it easy for attacks on core assets to go undetected due to incorrect rule adjustments. Summary of the Invention

[0005] This invention proposes a cyberspace security monitoring and anomaly analysis system to solve the problems mentioned in the prior art.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: a cyberspace security monitoring and anomaly analysis system, comprising the following modules: The distributed traffic acquisition module is deployed on all manageable nodes in the network. It synchronously collects bidirectional network packets in the north-south and east-west directions of the entire link. It performs deduplication, fragmentation and reassembly, and multi-protocol deep parsing operations on the packets in sequence, extracts the traffic features and associated identification information corresponding to the packets, and outputs a standardized traffic dataset after unified standardized encoding. The multi-dimensional behavior baseline construction module retrieves all normal traffic data within a preset period, splits it into three dimensions: network nodes, application services, and user entities, and statistically analyzes the traffic characteristic fluctuation patterns, time-series change rules, and related behavioral constraints under each dimension. It then constructs a full-network normal behavior baseline library adapted to business scenarios and stores the initial thresholds corresponding to each feature. The anomaly screening module matches the real-time standardized traffic dataset with the baseline library dimension by dimension, filters out traffic whose features deviate from the threshold as suspected abnormal traffic, and generates a list of suspected abnormal entries. The anomaly cross-validation module retrieves the historical behavior sequence of the subject corresponding to the suspected anomaly and the behavior sequence of the same group with the same permissions during the same period. It then compares and matches these sequences with the attack feature database, eliminates false alarms, and outputs the real anomaly events. The alarm and source tracing module classifies and marks real abnormal events, matches them with corresponding handling plans, pushes them to the management terminal, and simultaneously generates encrypted and stored abnormal source tracing logs.

[0007] Furthermore, it also includes a baseline threshold dynamic adjustment module, which dynamically calibrates the thresholds of each feature in the baseline library based on abnormal false alarm records and traffic sampling data within a preset period. The adjustment interval is no less than 24 hours, and the single adjustment range does not exceed 20% of the original threshold. The parameters are determined through testing with more than a thousand sets of network samples of different sizes.

[0008] Furthermore, it also includes a multi-anomaly correlation analysis module, which matches all real abnormal events according to multiple dimensions such as associated subject, occurrence time, behavioral characteristics, and attack stage, identifies scattered anomalies belonging to the same attack sequence, and reconstructs the complete attack chain.

[0009] Furthermore, the baseline threshold dynamic adjustment module is configured with a threshold adjustment verification submodule, which automatically verifies whether the adjusted threshold exceeds the allowable adjustment range of the corresponding asset. The allowable adjustment range for core assets is limited to ±20% of the initial threshold, and the allowable adjustment range for ordinary assets is limited to ±50% of the initial threshold. The threshold range is determined by the requirements of the Cybersecurity Classified Protection 2.0 and industry security standards. If the threshold exceeds the range, manual review is triggered, and the threshold replacement is only performed after the review is passed.

[0010] Furthermore, the distributed traffic acquisition module is configured with an encrypted traffic identification submodule. It does not require decryption of the encrypted traffic payload, but only extracts features from the handshake phase and statistical features from the communication process. Combined with a pre-trained lightweight classification model, it identifies hidden anomalies in the encrypted traffic. The model training adopts a federated learning architecture, which does not require uploading local user traffic data and complies with data privacy compliance requirements.

[0011] Furthermore, the multi-anomaly correlation analysis module uses a weighted scoring method to calculate the correlation between two anomaly events. The correlation weights are configured with the subject accounting for 40%, time accounting for 30%, and features accounting for 30%. The weight parameters are determined through a thousand-attack simulation experiment. Anomalies with a correlation higher than a preset threshold are classified into the same attack sequence. The threshold is customized according to the network security level.

[0012] Furthermore, the multi-anomaly correlation analysis module is configured with an attack chain reconstruction submodule, which reconstructs the complete attack path for anomalies in the same attack sequence according to time order, logical correlation, and attack stage order, marks the attack entry point, diffusion path, affected assets and attack targets, and generates a priority ranking of disposal and executable disposal suggestions.

[0013] Furthermore, the anomaly cross-validation module configures an attack rule update submodule, which regularly establishes encrypted communication with the cloud-based threat intelligence database to synchronize the latest attack characteristics, vulnerability exploitation identifiers, and malicious IOC data. After each rule update, historical traffic backtesting is used. The rule takes effect when the false positive rate of the backtest is less than 0.5% and the detection rate increases by more than 10%. The threshold is obtained by testing and optimizing tens of thousands of attack samples.

[0014] Furthermore, the alarm tracing module is configured with a linkage response sub-module, which supports standardized interface docking with various network security protection devices. For high-risk anomalies, it automatically triggers hierarchical linkage response operations according to the principle of minimum impact. All response operations are fully logged and stored. If a business anomaly is triggered after the response, it is automatically rolled back to reduce the impact of the response operation on normal business.

[0015] Furthermore, the baseline threshold dynamic adjustment module configures the core asset threshold protection sub-module, adding the feature dimensions corresponding to core business nodes, key applications, and high-privilege accounts to the protection whitelist. Features in the whitelist are prohibited from automatically adjusting thresholds and can only be manually modified by the highest-privilege administrators. Modification records are stored and cannot be tampered with throughout the process, which meets the requirements of network security auditing.

[0016] Compared with existing technologies, the beneficial effects of this invention are: This invention constructs a multi-dimensional baseline of normal behavior adaptable to various service scenarios, combined with a dynamic threshold calibration mechanism with limited range. This adapts to dynamic changes in network services, effectively reducing the false alarm and false negative rates of anomaly detection. It eliminates the need for frequent manual threshold adjustments, reducing the workload of security operations and maintenance. Simultaneously, it establishes a dedicated protection mechanism for core asset thresholds to prevent the missed detection of anomalies corresponding to core assets, complying with relevant network security audit requirements.

[0017] This invention employs a decryption-free encrypted traffic anomaly identification scheme. Malicious behavior identification can be completed simply by extracting the handshake phase features and communication statistics features of encrypted traffic. It does not require decrypting user communication data, does not increase additional network transmission latency, and complies with data privacy protection compliance requirements. It can cover the detection of abnormal behaviors such as malicious communication, data leakage, and malicious software external connections in encrypted traffic scenarios.

[0018] This invention uses a multi-dimensional weighted anomaly correlation analysis mechanism to correlate and match isolated alarms scattered across different network partitions, identify scattered anomaly events belonging to the same attack sequence, reconstruct the complete cross-network attack chain, and automatically generate actionable handling suggestions. This helps security operations personnel quickly locate the source of the attack and the affected scope, improving the efficiency of security incident investigation and handling.

[0019] This invention supports standardized integration with various existing network security protection devices, and can automatically trigger tiered linkage response operations for high-risk abnormal events. All response operations are fully traceable and support rollback in case of anomalies. While shortening the attack response time window, it avoids the impact of response operations on normal business operations. It can adapt to the security monitoring needs of various network scenarios such as office networks, industrial control networks, and the Internet of Things, and has strong adaptability. Attached Figure Description

[0020] Figure 1 This is the overall flowchart of cyberspace security monitoring and anomaly analysis proposed in this invention; Figure 2 This is a flowchart illustrating the dynamic adjustment of baseline thresholds and security auditing process of this invention. Figure 3 This is a flowchart of the encrypted traffic feature extraction and covert anomaly detection process of the present invention; Figure 4 This is a flowchart of the multi-abnormal event correlation analysis and attack chain reconstruction of the present invention; Figure 5 This is a flowchart illustrating the cloud-based rule synchronization and business linkage process of this invention. Detailed Implementation

[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] In the description of this invention, it should be understood that the terms "center," "longitudinal," "lateral," "length," "width," "thickness," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," "clockwise," and "counterclockwise," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0023] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, features defined with "first" and "second" may explicitly or implicitly include one or more of the stated features. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified. Furthermore, the terms "installed," "connected," and "linked" should be interpreted broadly; for example, they may refer to a fixed connection, a detachable connection, or an integral connection; they may refer to a mechanical connection or an electrical connection; they may refer to a direct connection or an indirect connection through an intermediate medium; and they may refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances. The invention will now be described in further detail with reference to the accompanying drawings.

[0024] Reference Figures 1 to 5 A cyberspace security monitoring and anomaly analysis system, comprising the following modules: The distributed traffic acquisition module is deployed on all manageable nodes in the network access layer, core switching layer, border gateway, virtualized vSwitch, and container cluster. It achieves microsecond-level full-network clock synchronization of all acquisition nodes through the PTP precise time protocol. It supports multi-source traffic acquisition, including SPAN port mirroring, ERSPAN remote mirroring, NetFlow / IPFIX stream data, and terminal sidecar reporting. It synchronously collects all north-south and east-west bidirectional network packets. The acquired packets are processed sequentially with deduplication based on 5-tuple + time sequence tag double verification, IP fragmentation and reassembly, and deep parsing operations covering multiple protocol types such as TCP / IP protocol suite, HTTP3, Modbus, MQTT, and CoAP. The module extracts the 5-tuple information, application layer load characteristics, microsecond-level time sequence tag, and subject identifier corresponding to each packet. All extracted features are standardized and encoded in a unified format, and a standardized traffic dataset in a unified format is output. The multi-dimensional behavior baseline construction module retrieves the full normal traffic dataset within a preset continuous period, splits the traffic data into three dimensions: network nodes, application services, and user entities, distinguishes between multiple scenarios such as weekdays, holidays, and peak business periods, and extracts multiple features such as traffic bandwidth, request frequency, access path, operation behavior, and associated objects under each dimension. It also statistically analyzes the regular fluctuation range, time-series tidal change pattern, and associated behavior constraint rules of each feature, and constructs a multi-dimensional normal behavior baseline library covering the entire network entity, including static non-working period baselines and dynamic peak business baselines. It stores the initial threshold ranges corresponding to each feature to adapt to different scenarios. The anomaly screening module matches the standardized traffic dataset collected in real time with the normal behavior baseline library on a scenario-by-scenario and dimension-by-dimensional basis. It prioritizes matching the feature dimensions corresponding to core assets, automatically filters normal privileged operations within the whitelist of preset operation and maintenance windows, and selects traffic entries with any features deviating from the corresponding threshold range as suspected abnormal traffic. It marks the deviation dimension, deviation degree, associated subject, occurrence time, and priority of each suspected abnormal traffic entry, and generates a list of suspected abnormal entries. The anomaly cross-validation module retrieves the historical behavior sequence of the corresponding associated subject in the past 30 days and the behavior sequence of other subjects in the same group and with the same permissions in the same period for each item in the suspected anomaly item list in order of priority from high to low, and performs cross-comparison with it. At the same time, it combines the attack feature rule base stored locally to perform feature matching, excludes false alarm items that conform to normal business behavior logic, and outputs the verified real anomaly event. The alarm and tracing module classifies and marks real abnormal events according to attack type, scope of impact, and degree of harm, matches them with pre-stored corresponding level handling plans, pushes them to the management terminal with corresponding permissions, and synchronously generates a tracing log containing the entire abnormal interaction information, which is then encrypted and stored in a local tamper-proof log library.

[0025] This invention also includes a baseline threshold dynamic adjustment module. For each feature dimension, it counts the number of times a suspected anomaly was triggered within the past 7 days and subsequently verified as a false alarm, as well as the total traffic sampling count for that dimension within the corresponding period. The automatic threshold adjustment interval for the same feature dimension is set to be no less than 24 hours, and the single threshold adjustment magnitude does not exceed 20% of the original threshold. If a missed real anomaly record is detected in that dimension within the past 7 days, the dynamic adjustment coefficient is forced to the lower limit. The adjusted threshold for that feature dimension is calculated using a preset formula and synchronized to the local cache of all collection nodes, replacing the original threshold in the normal behavior baseline library. The calculation formula is as follows: ; ; in, This is the adjusted upper limit of the feature dimension threshold, with the same dimensions as the corresponding feature dimension. This represents the original upper threshold of the feature dimension, with dimensions consistent with those of the corresponding feature dimension. This is a dynamically adjustable coefficient, dimensionless, with a value range limited to -0.2 to 0.2. This represents the number of times this feature dimension triggered suspected anomalies and were subsequently verified as false alarms within the past 7 days. It is dimensionless. This represents the total number of traffic samples corresponding to this feature dimension over the past 7 days, dimensionless. It is a natural constant, dimensionless, and is first calculated using... and The dynamic adjustment coefficient is obtained by calculating the ratio. ,like If the value exceeds the range of -0.2 to 0.2, the corresponding boundary value is taken and then substituted into the threshold calculation formula to obtain the adjusted threshold. This adapts to the dynamic changes in network services, reduces the false alarm rate of anomaly detection, and avoids missed alarms.

[0026] This invention also includes a multi-anomaly correlation analysis module, which supports correlation matching across multiple network partitions such as office networks, private networks, and IoT for all output real anomaly events. It performs correlation matching according to multiple dimensions such as the associated subject, occurrence time, behavioral characteristics, and network kill chain stage, identifies multiple scattered anomaly events belonging to the same attack sequence, and reconstructs the complete cross-network attack chain.

[0027] In this invention, the baseline threshold dynamic adjustment module is configured with a threshold adjustment verification submodule. After each automatic threshold adjustment, the reasonableness of the adjusted threshold is verified. The maximum allowable adjustment range of the threshold for core assets is ±20% of the initial threshold, and the maximum allowable adjustment range for ordinary assets is ±50% of the initial threshold. If the adjusted threshold exceeds the maximum allowable adjustment range of the corresponding asset, a manual review process is triggered. The system automatically pushes the traffic fluctuation curve of the dimension for the past month, historical false alarm and missed alarm records, threshold comparison data before and after adjustment, and common benchmark thresholds for similar assets in the same industry to assist in the review. The threshold replacement operation is only performed after the review is passed to avoid abnormal missed alarms caused by excessive threshold adjustment.

[0028] In this invention, the distributed traffic acquisition module is configured with an encrypted traffic identification submodule. For TLS, QUIC, and TLS 1.3 encrypted traffic, there is no need to decrypt the traffic payload. Only the encryption suite, extended fields, certificate information, handshake timing features, packet length distribution, packet interval sequence, uplink / downlink traffic ratio, frame length sequence entropy, and frame interval variance features of the handshake phase are extracted. Combined with a lightweight random forest classification model trained by federated learning, malicious communication, data leakage, and abnormal external behavior of malicious software in encrypted traffic can be matched and identified. The model training process does not require uploading local user traffic data, thus meeting privacy compliance requirements.

[0029] In this invention, the multi-anomaly correlation analysis module calculates the correlation between two anomalous events using a preset formula. Users can customize the correlation threshold based on their network security level; the threshold is set to 0.6 for high-security networks and 0.7 for ordinary networks. Anomalous events with a correlation higher than the preset threshold are grouped into the same attack sequence. The calculation formula is as follows: ; in, The correlation between two suspected anomalous events is dimensionless and ranges from 0 to 1. The score represents the overlap of the principal entities of two anomalous events. It is dimensionless, with a value of 1 when the principal entities of the two anomalous events are completely identical, 0.5 when there are common principal entities, and 0 when there are no common principal entities. The score represents the degree of match between two anomalous events, dimensionless. A score of 1 is given when the time interval between the two anomalous events is less than 30 minutes, 0.5 is given when the time interval is between 30 minutes and 24 hours, and 0 is given when the time interval is greater than 24 hours. The score is a dimensionless score for the matching degree of behavioral features between two abnormal events. The score is 1 when the attack features of the two abnormal events belong to the same attack family or the same stage of the network kill chain, 0.8 when they belong to adjacent kill chain stages, 0.5 when there is an indirect relationship, and 0 when there is no relationship. The three weighted coefficients correspond to the influence weights of the subject, time, and feature dimensions on the degree of correlation of the abnormality. The higher the degree of correlation calculated, the higher the probability that the two abnormal events belong to the same attack behavior sequence, which helps the detection personnel quickly identify the complete attack behavior behind the scattered alarms.

[0030] In this invention, the multi-anomaly correlation analysis module is equipped with an attack chain reconstruction submodule. For multiple anomaly events belonging to the same attack sequence, it reconstructs the complete attack path according to the order of occurrence, behavioral logic relationship, and network kill chain stage order. It marks the entry node, diffusion path, affected assets, final attack target, and the degree of compromise of each node. It automatically calculates the potential impact range of the attack, generates a disposal priority ranking based on the asset importance level, and synchronously associates corresponding vulnerability information and threat intelligence descriptions to output directly executable disposal suggestions. It generates a visualized attack chain topology map to provide accurate decision-making basis for subsequent disposal.

[0031] In this invention, the anomaly cross-validation module is equipped with an attack rule update submodule, which periodically establishes a communication connection encrypted with the cloud-based threat intelligence database using the national cryptographic SM4 algorithm. This synchronizes the latest attack characteristics, vulnerability exploitation identifiers, malicious IOC data, 0-day vulnerability exploitation characteristics, attack characteristics of domestic APT groups, communication characteristics of new ransomware, external connection characteristics of IoT malware, and vulnerability exploitation characteristics of industrial control systems. The module updates the locally stored attack characteristic rule database. After each rule update, backtesting is automatically performed using historical traffic from the past 7 days. If the detection rate of the new rule increases by more than 10% and the false positive rate is less than 0.5%, it automatically takes effect. If the false positive rate of the new rule is higher than 1%, it automatically reverts to the previous version of the rule database, thereby improving the identification coverage of new and unknown attacks.

[0032] In this invention, the alarm and tracing module is equipped with a linkage handling submodule, which supports standardized interface docking with network firewalls, intrusion prevention systems, endpoint detection and response platforms, and vulnerability management platforms. For high-risk real abnormal events, the corresponding linkage handling operation is automatically triggered according to the principle of minimum impact. It supports gray-scale execution of handling actions, first blocking access to non-business ports of malicious IPs, and then performing full port blocking after observing for 10 minutes if there is no impact on normal business. All linkage handling operations are fully traced and stored in an immutable audit log library. If business abnormalities occur after handling, the handling is automatically rolled back to cancel the corresponding operation, shortening the attack response and handling time window and avoiding the handling operation from affecting normal business operation.

[0033] In this invention, the baseline threshold dynamic adjustment module is configured with a core asset threshold protection submodule. It pre-adds the feature dimensions corresponding to core business nodes, key application services, and important management accounts to a protection whitelist. Automatic threshold adjustment is prohibited for feature dimensions within the whitelist; only administrators with the highest privileges can manually modify the thresholds. If a feature dimension within the whitelist shows three consecutive suspected anomalies that are verified as a real attack, the system automatically pushes threshold optimization suggestions to the administrator with the highest privileges, reminding them to manually adjust the threshold to improve the detection rate. Each time a threshold is manually modified, the system automatically records the modifier's identity, modification time, the threshold before and after the modification, and the reason for the modification, generating a modification log that is stored on blockchain and is tamper-proof, meeting the audit requirements of the Cybersecurity Law 2.0 and preventing the failure to detect abnormal events corresponding to core assets.

[0034] The following two examples further illustrate specific embodiments of the present invention: Example 1: A network security monitoring and anomaly analysis system applied to government and enterprise office networks This embodiment is applied to a medium-sized government and enterprise office network comprising 2000 terminals and 30 core business servers. The network is divided into four zones: office access zone, data center zone, internet boundary zone, and cloud desktop resource zone. Distributed traffic acquisition modules are deployed on the access layer switches, core switches, boundary firewalls, virtualized vSwitch, and the Sidecar proxy nodes of the cloud desktop terminals in each of the four zones. All acquisition nodes synchronize their clocks at the microsecond level via the PTP protocol. The system supports four acquisition methods: port mirroring, remote mirroring, streaming data acquisition, and terminal proxy reporting, simultaneously acquiring bidirectional network packets in both north-south and east-west directions. The acquired packets undergo dual deduplication based on 5-tuples and time-series tags. After IP fragmentation and reassembly, deep parsing is performed on TCP, UDP, HTTP, HTTPS, SSH, RDP, and government / enterprise-specific office protocols to extract the 5-tuple information, application layer load characteristics, microsecond-level time-series tags, and the identifier of the user or device belonging to each packet. All features are uniformly encoded into a standardized format and output as a standardized traffic dataset.

[0035] The multi-dimensional behavior baseline construction module retrieves all normal traffic data from the past 30 days, breaks it down into three dimensions: network nodes, application services, and user entities, and distinguishes between three scenarios: weekdays, holidays, and monthly maintenance windows. It then statistically analyzes the fluctuation range of traffic bandwidth, request frequency, access path, operational behavior, and related objects, as well as the temporal tidal change patterns and related behavioral constraints for each dimension. This constructs a full-network normal behavior baseline library that includes static non-working period baselines and dynamic business peak baselines. It stores the initial thresholds for each feature corresponding to different scenarios. Among these, the initial threshold fluctuation ranges for core assets such as ERP systems, domain controller servers, and archive servers are narrower, and their priority is marked as the highest.

[0036] The anomaly screening module matches the standardized traffic dataset collected in real time with the baseline library dimension by dimension according to the current scenario. It prioritizes matching the feature dimensions corresponding to core assets, automatically filters the privileged operation and maintenance operations that have been filed within the preset operation and maintenance window, and selects traffic with any feature deviating from the corresponding threshold range as suspected abnormal traffic. It marks the deviation dimension, deviation degree, associated subject, occurrence time, and priority of each suspected anomaly, generating a list of suspected anomaly entries. The anomaly cross-validation module processes the entries in order of priority from high to low. It retrieves the historical behavior sequence of the subject corresponding to the suspected anomaly for the most recent 30 days and the behavior sequence of other subjects with the same department and permissions during the same period for cross-comparison. At the same time, it combines the attack feature rule library stored locally for feature matching to exclude false alarm entries that conform to normal business logic, such as legitimate operations such as the business department's batch export of reports at the end of the month or the operation and maintenance personnel's centralized upgrade of terminal software. Finally, it outputs the verified real anomaly events.

[0037] The baseline threshold dynamic adjustment module counts the number of times each feature dimension triggered suspected anomalies and were verified as false alarms within the past 7 days, as well as the total traffic sampling number for that dimension within the corresponding period. The automatic threshold adjustment interval for the same feature dimension is no less than 24 hours, and the adjustment range for a single instance does not exceed 20% of the original threshold. After the threshold adjustment is completed, the threshold adjustment verification submodule automatically verifies whether the adjusted threshold exceeds the allowable adjustment range for the corresponding asset. The allowable adjustment range for core assets is ±20% of the initial threshold, and the allowable adjustment range for ordinary assets is ±50% of the initial threshold. If the range is exceeded, a manual review process is triggered, pushing the traffic fluctuation curve of that dimension for the past month, historical false alarm and missed alarm records, a comparison of the threshold before and after adjustment, and the general benchmark threshold for similar assets in the same industry to assist in the review. The threshold replacement is only executed after the review is passed. The core asset threshold protection submodule pre-adds all feature dimensions corresponding to core business nodes, key applications, and high-privilege management accounts to a protection whitelist. Features in the whitelist are prohibited from automatic threshold adjustment and can only be manually modified by the highest-privilege administrators. The modification operation is recorded throughout and cannot be tampered with, in compliance with network security audit requirements.

[0038] The encrypted traffic identification submodule configured in the distributed traffic acquisition module targets TLS, QUIC, and TLS 1.3 encrypted traffic. It does not require decrypting the traffic payload, but extracts only 12 features: cipher suites, extended field types, certificate validity, handshake latency, session reuse identifiers during the handshake phase, and packet length distribution entropy, packet interval variance, uplink / downlink traffic ratio, retransmission rate, frame length sequence mean, frame interval mean, and certificate fingerprint hash prefix during the communication process. These features are then input into a pre-trained lightweight random forest classification model to identify malicious behavior. This model is a 3-layer random forest structure with a maximum tree depth of 12. The feature importance is ranked as follows: handshake extended fields > packet interval variance > uplink / downlink traffic ratio > certificate fingerprint hash prefix. Model training uses a horizontal federated learning framework, with multiple government and enterprise units participating by calculating the model gradient locally. After encryption, the gradient is uploaded to a neutral aggregation server for global aggregation, and then the updated model parameters are distributed to each participant. No raw traffic data is transmitted throughout the process, complying with data privacy protection requirements.

[0039] The multi-anomaly correlation analysis module matches all real anomaly events according to four dimensions: associated subject, occurrence time, behavioral characteristics, and attack stage. It uses a weighted scoring method to calculate the correlation between two anomaly events, with weights configured as follows: subject 40%, time 30%, and characteristics 30%. Anomalies with a correlation score higher than 0.7 are grouped into the same attack sequence. The attack chain reconstruction submodule reconstructs the complete attack path for anomalies within the same attack sequence according to chronological order, logical association, and attack stage order. It marks the attack entry point, propagation path, affected assets, and attack targets, and generates a priority ranking of actions and actionable recommendations.

[0040] The attack rule update submodule periodically establishes a national cryptographic SM4 encrypted communication connection with the cloud-based threat intelligence database to synchronize the latest APT group attack characteristics, ransomware communication characteristics, vulnerability exploitation identifiers, and malicious IOC data. After each rule update, backtesting is performed using historical traffic from the most recent 7 days. The new rule officially takes effect when the false positive rate is below 0.5% and the detection rate increases by more than 10%. The coordinated response submodule supports standardized interface integration with firewalls, intrusion prevention systems, endpoint detection and response platforms, and vulnerability management platforms. For high-risk real-world anomalies, it automatically triggers tiered coordinated response based on the principle of minimum impact. For example, when ransomware outbound behavior is detected, non-business port access from malicious IPs is first blocked. If there is no impact on normal business after 10 minutes, a full port block is then executed. All response operations are fully logged and stored. If business anomalies are triggered after the response, a rollback operation is automatically performed.

[0041] The solution of this embodiment adapts to the dynamic service changes of government and enterprise office networks through multi-scenario baseline construction and dynamic threshold calibration, reduces false positives and false negatives in anomaly detection, and lowers the troubleshooting workload of operation and maintenance personnel. The encrypted traffic identification solution without decryption does not need to collect user communication content, meets data security compliance requirements, and can cover malicious behavior detection under encrypted channels. The multi-dimensional anomaly correlation mechanism can identify the complete cross-region attack chain, helping operation and maintenance personnel quickly locate problems. The automatic linkage response mechanism shortens the attack response time, reduces the impact of response operations on normal office services, and adapts to the security protection requirements of government and enterprise office networks.

[0042] Embodiment 2: A cyberspace security monitoring and anomaly analysis system applied to the industrial control network of industrial manufacturing enterprises The application scenario of this embodiment is the industrial control network of a discrete manufacturing enterprise. The network is divided into four levels: on-site device layer, process control layer, manufacturing execution layer, and office network boundary area, including 120 PLC devices, 20 SCADA servers, 8 MES system servers, 300 industrial cameras, and 1500 office terminals. The distributed traffic collection modules are respectively deployed at the industrial control border gateway, core switches of each level, dedicated fieldbus collection probes, and office network border firewall nodes. All collection nodes complete microsecond-level clock synchronization through the PTP protocol, and simultaneously support three collection methods: port mirroring, bus data collection, and flow data reporting, to synchronously collect full-link north-south and east-west bidirectional network packets. The collected packets are first subjected to dual deduplication processing based on the quintuple and time sequence labels. After completing IP fragment reassembly, deep parsing is performed on industrial protocols such as TCP, UDP, HTTP, Modbus, S7, MQTT, and CoAP, to extract the quintuple information, protocol function code, register access address, application layer payload feature, microsecond-level time sequence label, and the subject identifier of the affiliated device or operation account of each packet. All features are uniformly encoded into a standardized format and then output as a standardized traffic dataset.

[0043] The multi-dimensional behavior baseline construction module retrieves all normal industrial control traffic data within the latest 45 days, splits it according to the three dimensions of device node, control application, and operation account, distinguishes three scenarios: day shift production, night shift maintenance, and production shutdown maintenance, separately counts the fluctuation range, time sequence change rule and associated behavior constraint rule of the request frequency, function code range, register access interval, traffic bandwidth, access path, and associated objects under each dimension, constructs a full-network normal behavior baseline library including the static production shutdown time baseline and the dynamic production peak baseline, and stores the initial thresholds of each feature corresponding to different scenarios. Among them, the initial threshold fluctuation range of core assets such as PLCs of the core production line, SCADA servers, and MES systems is narrower, and their priority is marked as the highest.

[0044] The anomaly screening module matches the standardized traffic dataset collected in real time with the baseline library dimension by dimension according to the current scenario. It prioritizes matching the feature dimensions corresponding to core assets, automatically filters the registered operation and maintenance operations within the preset maintenance window, and selects traffic with any feature deviating from the corresponding threshold range as suspected abnormal traffic. Each suspected anomaly is marked with the deviation dimension, deviation degree, associated subject, occurrence time, and priority, generating a list of suspected anomaly entries. Anomalies involving write operations to core PLC registers are marked with the highest priority. The anomaly cross-validation module processes the entries in descending order of priority. It retrieves the historical behavior sequence of the subject corresponding to the suspected anomaly for the past 30 days and the behavior sequence of maintenance personnel in the same position for cross-comparison. At the same time, it combines the feature matching of the locally stored industrial control attack feature rule library to exclude false alarm entries that conform to normal production logic, such as legitimate operations such as batch modification of PLC parameters during maintenance periods or centralized adjustment of control commands during production changeovers. Finally, it outputs the verified real anomaly events.

[0045] The baseline threshold dynamic adjustment module counts the number of times each feature dimension has triggered suspected anomalies and been verified as false alarms within the past 7 days, as well as the total traffic sampling number for that dimension within the corresponding period. The automatic threshold adjustment interval for the same feature dimension is no less than 24 hours, and the adjustment range for a single instance does not exceed 20% of the original threshold. After the threshold adjustment is completed, the threshold adjustment verification submodule automatically verifies whether the adjusted threshold exceeds the allowable adjustment range for the corresponding asset. The allowable adjustment range for core industrial control assets is ±20% of the initial threshold, and the allowable adjustment range for ordinary assets is ±50% of the initial threshold. If the range is exceeded, a manual review process is triggered, pushing the traffic fluctuation curve for that dimension over the past month, historical false alarm and missed alarm records, a comparison of the threshold before and after adjustment, and the general benchmark threshold for industrial control assets in the same industry to assist in the review. Only after the review is passed will the threshold replacement be executed. The core asset threshold protection submodule pre-adds the feature dimensions corresponding to all core production equipment, key control applications, and high-privilege operation and maintenance accounts to a protection whitelist. Features in the whitelist are prohibited from automatic threshold adjustment and can only be manually modified by the highest-privilege administrator. The modification operation is recorded throughout and cannot be tampered with, which complies with industrial network security audit requirements.

[0046] The encrypted traffic identification submodule configured in the distributed traffic acquisition module targets encrypted industrial traffic such as MQTT and TLS. It does not require decrypting the traffic payload, but extracts only 12 features from the handshake phase: cipher suite, extended field type, certificate validity period, handshake latency, session reuse identifier, and function code sequence entropy, packet interval variance, uplink / downlink traffic ratio, retransmission rate, frame length sequence mean, frame interval mean, and certificate fingerprint hash prefix. These features are then input into a pre-trained lightweight random forest classification model to identify malicious behavior. This model is a 3-layer random forest structure with a maximum tree depth of 10. Feature importance is ranked as follows: function code sequence entropy > packet interval variance > uplink / downlink traffic ratio > cipher suite type. Model training employs a horizontal federated learning framework, with multiple industrial manufacturing enterprises participating by calculating model gradients locally. After encryption, the gradients are uploaded to a neutral aggregation server for global aggregation, and then the updated model parameters are distributed to all participants. No original production traffic data is transmitted throughout the process, complying with industrial data security protection requirements.

[0047] The multi-anomaly correlation analysis module matches all real anomaly events according to four dimensions: associated subject, occurrence time, behavioral characteristics, and attack stage. It uses a weighted scoring method to calculate the correlation between two anomaly events, with weights configured as follows: subject 40%, time 30%, and characteristics 30%. Since industrial control networks are high-security scenarios, the correlation threshold is set to 0.6; anomalies with a correlation higher than 0.6 are grouped into the same attack sequence. The attack chain reconstruction submodule reconstructs the complete attack path for anomalies within the same attack sequence according to chronological order, logical association, and attack stage order. It marks the attack entry point, propagation path, affected production equipment, and attack target, generating a priority ranking of actions and executable handling suggestions.

[0048] The attack rule update submodule periodically establishes a national cryptographic SM4 encrypted communication connection with the cloud-based industrial control system threat intelligence database to synchronize the latest industrial vulnerability exploitation characteristics, industrial control ransomware variant characteristics, and malicious IOC data. After each rule update, backtesting is performed using historical traffic from the most recent 7 days. The new rule officially takes effect when the false positive rate is below 0.5% and the detection rate increases by more than 10%. The coordinated response submodule supports standardized interface integration with industrial firewalls, intrusion prevention systems, endpoint detection and response platforms, and vulnerability management platforms. For high-risk real-world anomalies, it automatically triggers tiered coordinated response based on the principle of minimum impact. For example, when illegal modification of PLC registers is detected, the malicious IP's access to the industrial control protocol port is first blocked. If there is no production impact after 5 minutes, full port isolation is then performed. All response operations are fully logged and stored. If a production anomaly is triggered after the response, a rollback operation is automatically performed.

[0049] This embodiment's solution, through multi-scenario baseline construction and dynamic threshold calibration, adapts to changes in the production rhythm of industrial control networks, reducing false alarms caused by production fluctuations and maintenance operations, and avoiding missed detections of anomalies in core production equipment. The decryption-free encrypted traffic identification solution does not require access to industrial production data, complies with industrial data security compliance requirements, and can cover malicious behavior detection under industrial encrypted communication. The multi-dimensional anomaly correlation mechanism can identify complete attack chains across office networks and industrial control networks, helping maintenance personnel quickly locate the source of the attack. The automatic linkage handling mechanism shortens attack response time, avoids disruption to normal production operations, and adapts to the security protection needs of industrial control networks.

[0050] Reference Figure 1 This diagram macroscopically illustrates the complete data flow of the cyberspace security monitoring system, from bottom-level data collection to top-level alarm handling. The system's front end, through collection probes deployed at various levels, captures north-south and east-west traffic without blind spots, and performs rigorous data cleaning and standardization transformation. The core processing stage employs a dual screening mechanism of dynamic baseline comparison and multi-dimensional cross-validation. First, a massive number of suspected anomalies are screened out based on baseline deviation. Then, in-depth cross-comparison is performed by combining the historical behavioral trajectories of the target entity with group behavioral characteristics. This mechanism effectively eliminates noise interference caused by network fluctuations, ensuring that only high-value, genuine alarms are ultimately pushed to the management terminal, and simultaneously establishing an immutable chain of evidence.

[0051] Reference Figure 2 This diagram details the baseline self-healing and access control logic designed by the system to adapt to complex and ever-changing network service environments. To avoid high false alarms caused by fixed thresholds, the system allows dynamic fine-tuning of feature thresholds based on recent sampling feedback. However, in the industrial control and core asset domains, security and stability are paramount. Therefore, the system introduces strict asset classification and over-limit circuit breaker mechanisms. Once a target asset is determined to be on the high-risk whitelist, the system will forcibly revoke the algorithm's automatic modification rights and switch to full manual control; even for ordinary assets, any adjustments that cross the red line will immediately trigger security audit interception, ensuring that the algorithm's self-evolution always remains within the framework of safe production compliance.

[0052] Reference Figure 3 This diagram illustrates the system's defense process against encrypted malicious traffic without infringing on data privacy. Faced with the end-to-end encryption methods commonly used in current cyberattacks, the system abandons the traditional, high-consumption, and compliance-risk brute-force decryption scheme. Instead, it focuses on the handshake phase of message connection establishment and peripheral statistical characteristics such as packet transmission frequency and length to depict a macroscopic behavioral profile of the traffic. By employing a cutting-edge federated learning model, the system accurately identifies various Trojan horse outreach and data theft behaviors hidden beneath encrypted tunnels without accessing the user's original plaintext payload, achieving an optimal balance between security monitoring and privacy protection.

[0053] Reference Figure 4 This diagram illustrates the correlation tracing process of a security analysis system when facing distributed, slowly penetrating advanced persistent threats. Single-point security alerts often only reveal the tip of the iceberg of an attack. This process extracts the deep logical connections from massive amounts of fragmented alerts, using a multi-dimensional weighted scoring algorithm based on subject attributes, timeline arrangement, and attack methods to connect seemingly isolated anomalies. When the correlation density of the event cluster exceeds a threshold, the system initiates a sandbox simulation, accurately tracing back the attacker's initial entry point, lateral movement trajectory within the internal network, and ultimate intent.

[0054] Reference Figure 5 This diagram illustrates the integration mechanism between the security system and external threat intelligence, as well as the defense execution logic for business continuity assurance. The system's immunity relies on rapid detection of unknown threats; therefore, the process design incorporates a high-frequency cloud rule synchronization mechanism and mandates historical traffic sandbox backtesting before new rules are implemented, resolutely preventing poisoned intelligence from contaminating the local defense system. During the automated defense execution phase, the system adheres to the principle of minimal impact. Once a high-risk penetration is identified, the system immediately invokes various security gateways to implement precise blocking. However, if the defense action inadvertently harms core business flows, the system's built-in health monitoring mechanism will instantly detect this and trigger a seamless rollback command, minimizing the disruption of security policies to the company's normal production order.

[0055] The above are merely preferred embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A cyberspace security monitoring and anomaly analysis system, characterized in that, Includes the following modules: The distributed traffic acquisition module is deployed on all manageable nodes in the network. It synchronously collects bidirectional network packets in the north-south and east-west directions of the entire link. It performs deduplication, fragmentation and reassembly, and multi-protocol deep parsing operations on the packets in sequence, extracts the traffic features and associated identification information corresponding to the packets, and outputs a standardized traffic dataset after unified standardized encoding. The multi-dimensional behavior baseline construction module retrieves all normal traffic data within a preset period, splits it into three dimensions: network nodes, application services, and user entities, and statistically analyzes the traffic characteristic fluctuation patterns, time-series change rules, and related behavioral constraints under each dimension. It then constructs a full-network normal behavior baseline library adapted to business scenarios and stores the initial thresholds corresponding to each feature. The anomaly screening module matches the real-time standardized traffic dataset with the baseline library dimension by dimension, filters out traffic whose features deviate from the threshold as suspected abnormal traffic, and generates a list of suspected abnormal entries. The anomaly cross-validation module retrieves the historical behavior sequence of the subject corresponding to the suspected anomaly and the behavior sequence of the same group with the same permissions during the same period. It then compares and matches these sequences with the attack feature database, eliminates false alarms, and outputs the real anomaly events. The alarm and source tracing module classifies and marks real abnormal events, matches them with corresponding handling plans, pushes them to the management terminal, and simultaneously generates encrypted and stored abnormal source tracing logs.

2. The cyberspace security monitoring and anomaly analysis system according to claim 1, characterized in that, It also includes a baseline threshold dynamic adjustment module, which dynamically calibrates the thresholds of each feature in the baseline library based on abnormal false alarm records and traffic sampling data within a preset period. The adjustment interval is no less than 24 hours, and the single adjustment range does not exceed 20% of the original threshold. The parameters are determined through testing with more than a thousand sets of network samples of different sizes.

3. The cyberspace security monitoring and anomaly analysis system according to claim 1, characterized in that, It also includes a multi-anomaly correlation analysis module, which matches all real anomaly events according to multiple dimensions such as associated subject, occurrence time, behavioral characteristics, and attack stage, identifies scattered anomalies belonging to the same attack sequence, and reconstructs the complete attack chain.

4. The cyberspace security monitoring and anomaly analysis system according to claim 2, characterized in that, The baseline threshold dynamic adjustment module is configured with a threshold adjustment verification submodule, which automatically verifies whether the adjusted threshold exceeds the allowable adjustment range of the corresponding asset. The allowable adjustment range for core assets is limited to ±20% of the initial threshold, and the allowable adjustment range for ordinary assets is limited to ±50% of the initial threshold. If the range is exceeded, manual review is triggered, and the threshold replacement is only performed after the review is approved.

5. The cyberspace security monitoring and anomaly analysis system according to claim 1, characterized in that, The distributed traffic acquisition module is configured with an encrypted traffic identification submodule. It does not require decryption of the encrypted traffic payload, but only extracts features from the handshake phase and statistical features from the communication process. Combined with a pre-trained lightweight classification model, it identifies hidden anomalies in the encrypted traffic. The model training adopts a federated learning architecture, which does not require uploading local user traffic data and complies with data privacy compliance requirements.

6. The cyberspace security monitoring and anomaly analysis system according to claim 3, characterized in that, The multi-anomaly correlation analysis module uses a weighted scoring method to calculate the correlation between two anomaly events. The correlation weights are configured with the subject accounting for 40%, time accounting for 30%, and features accounting for 30%. The weight parameters are determined through thousands of attack simulation experiments. Anomalies with a correlation higher than a preset threshold are classified into the same attack sequence. The threshold is customized according to the network security level.

7. A cyberspace security monitoring and anomaly analysis system according to claim 6, characterized in that, The multi-anomaly correlation analysis module is configured with an attack chain reconstruction submodule, which reconstructs the complete attack path for anomalies in the same attack sequence according to time order, logical correlation, and attack stage order, marks the attack entry point, diffusion path, affected assets and attack targets, and generates a priority ranking of disposal and executable disposal suggestions.

8. The cyberspace security monitoring and anomaly analysis system according to claim 1, characterized in that, The anomaly cross-validation module configures an attack rule update submodule, which regularly establishes encrypted communication with the cloud threat intelligence database to synchronize the latest attack characteristics, vulnerability exploitation identifiers and malicious IOC data. After each rule update, historical traffic backtesting is used. The rule takes effect when the false positive rate of the backtest is less than 0.5% and the detection rate increases by more than 10%. The threshold is obtained by testing and optimizing tens of thousands of attack samples.

9. A cyberspace security monitoring and anomaly analysis system according to claim 1, characterized in that, The alarm tracing module is configured with a linkage response sub-module, which supports standardized interface integration with various network security protection devices. For high-risk anomalies, it automatically triggers tiered linkage response operations according to the principle of minimizing impact. All response operations are fully logged and stored. If a business anomaly is triggered after the response, it is automatically rolled back to reduce the impact of the response operation on normal business.

10. A cyberspace security monitoring and anomaly analysis system according to claim 2, characterized in that, The baseline threshold dynamic adjustment module configures the core asset threshold protection sub-module, adding the feature dimensions corresponding to core business nodes, key applications, and high-privilege accounts to the protection whitelist. Features in the whitelist are prohibited from automatically adjusting thresholds and can only be manually modified by the highest-privilege administrators. The modification records are stored as evidence throughout the process and cannot be tampered with, which meets the requirements of network security auditing.

Images