154 results about "Network security situation awareness" patented technology

The invention relates to a network risk assessment method and system based on a multi-modal data pre-training model. The method comprises the following steps: firstly, collecting multi-source network security data, identifying threat event objects in the multi-source network security data, connecting the threat event objects in series into attack chains, and analyzing to obtain feature information and main attack nodes of each attack chain; risk level information of the attack chain is evaluated and generated; integrating the information, and generating and continuously recording a network security situation report; pre-constructing a network security situation knowledge base; and finally, matching and comparing the feature information of the attack chain with attack chain data in the network security situation knowledge base, predicting potential threat influence, and generating early warning information and protection strategy suggestions. Compared with the prior art, the method has the advantages that the method does not depend on predefined rules, is more suitable for complicated network scenes, and improves the reliability and accuracy of network security situation awareness.

The invention relates to the technical field of network security, in particular to a network security situation awareness method and system, and the method comprises the following steps: extracting a source IP address and a target IP address based on a network behavior record, carrying out the statistics of the number of used ports, the transmission direction and the time interval value, analyzing the direction change times and the time interval difference, and screening abnormal communication pairs. And generating an abnormal communication pair set. According to the invention, through analyzing port usage, transmission direction and time interval value, deeply mining communication features, screening abnormal communication pairs and improving identification accuracy, dividing a time sequence window, analyzing rate fluctuation and frequency distribution, locking an unstable time window, combining with a multi-dimensional data classification behavior mode, and extracting a switching path and priority, a multi-dimensional data classification behavior mode is combined. Potential threat paths are identified independently, global threat situations are identified through node interaction relation statistics and correlation analysis and an expansion range, threat assessment precision and efficiency are enhanced, and comprehensive and reliable risk protection capability is provided for network managers.

The invention relates to a network security situation awareness method and device for multi-source data fusion, equipment and a medium, and the method comprises the steps: respectively collecting kernel logs and network flow data, and carrying out the standardization processing to generate a communication data set; constructing a dynamic process link map, defining a communication type, frequency and data volume, and updating a topological relation in real time; a sliding time window is adopted to count communication time sequence characteristics, and abnormal signals deviating from normal distribution are screened in combination with a time sequence analysis technology; training a robustness classifier model through an adversarial sample enhancement technology, fusing a graph neural network to analyze a dependency relationship between processes, and filtering a false alarm signal; and the hidden channel is accurately identified and alarm information is generated in combination with a dynamic similarity threshold and a threat intelligence gain coefficient, so that the problems of insufficient multi-source data fusion, high false alarm rate of a static rule base, failure in detection of weak signals of the hidden channel and the like in a traditional method are solved. And the real-time perception and response capability of APT attacks in a complex network environment is improved.

The invention relates to the technical field of network security, in particular to a network security situation awareness and early warning method based on big data analysis, and the method comprises the following steps: collecting multi-modal security data, and carrying out the noise reduction and normalization processing; constructing a high-dimensional security feature vector by using feature engineering; establishing an anomaly detection model based on physical constraints and a deep residual network; a self-adaptive loss optimization strategy training model is adopted, so that the detection accuracy is improved; through cross-domain transfer learning, model adaptability is optimized, and unknown attacks can be detected; future attack trends are analyzed in combination with historical data, and defense strategies are dynamically adjusted. Through combination of deep learning and big data analysis, the accuracy, real-time performance and adaptive capability of network security situation awareness are improved, unknown attacks and variant attacks can be effectively detected, the false alarm rate is reduced, the security protection capability is enhanced, and the method is suitable for a security defense system in a complex network environment.

The invention discloses a network security situation awareness and dynamic analysis method based on a graph neural network, and the method comprises the following steps: S1, collecting network related data, and constructing a dynamic security knowledge graph; s2, preprocessing the collected data to generate a node feature matrix; s3, based on the node feature matrix, generating a node embedding representation through an improved graph neural network and a graph attention mechanism, and optimizing the node embedding representation in combination with the graph attention mechanism; s4, establishing a time sequence prediction model based on the improved support vector regression model, and identifying potential abnormal behaviors and security threats; s5, evaluating the identified security threat, and predicting the risk level of the security threat; s6, generating a response strategy according to a security threat assessment result; and S7, executing the response strategy. According to the method, the improved graph neural network and the support vector regression model are utilized to carry out network security situation awareness and dynamic analysis, and the method has efficient and accurate security threat identification and adaptive response capabilities.

The invention discloses a computer network security situation awareness system and method, and relates to the technical field of computer network security, and the method comprises the steps: generating a dynamic gene pool through an antigen-antibody matching algorithm based on an initial quantum trust vector, and building a mapping relation table of an antigen feature vector and an antibody defense strategy; triggering a quantum alarm according to an entanglement entropy mutation event in the real-time quantum state flow data, matching a biological antibody strategy corresponding to a current network attack feature based on a mapping relation table, and fusing the quantum alarm and the biological alarm to generate an attack path topological graph; the network security situation is perceived by analyzing the quantum state change of the abnormal node ID and combining an attack path topological graph and a dynamic gene pool. Quantum entanglement pairs are distributed to network nodes through the quantum key distribution center, and initial quantum trust vectors are generated, so that the unknown attack resisting capability of the network is remarkably improved, and efficient and accurate network security situation awareness is realized.

The invention discloses a network security situation awareness and analysis platform based on AI, and relates to the technical field of network security situation awareness and analysis, and the platform comprises a multi-source data collection module which integrates flow, logs, assets and threat intelligence data, and carries out encryption transmission and standardization; the data preprocessing module purifies and optimizes data, and guarantees data quality and sensitive information security; the AI situation awareness analysis module extracts features through a deep learning model, dynamically evaluates the situation and identifies threats; the threat early warning and decision-making module triggers graded early warning and generates a targeted emergency response scheme; the visual display and interaction module displays information in multiple dimensions and supports query and report generation; and the data storage and tracing module adopts a mixed storage architecture, so that the data security and traceability are ensured. The platform integrates multi-source data and realizes situation accurate perception and intelligent decision by means of an AI technology; the early warning is accurate, the visual interaction is convenient, and the intelligent and efficient level of network security protection is comprehensively improved.

The invention provides a network security situation awareness method and system and computer equipment, and belongs to the technical field of network security. The method comprises the following steps: collecting and standardizing multi-source heterogeneous security data; constructing and dynamically updating a network asset and vulnerability knowledge graph; performing tactical labeling on the security event based on tactical, technology and process behavior model libraries to form a current attack context state; mapping the current state into a knowledge graph to deduce a potential subsequent attack path; performing quantitative risk assessment on the path, and calculating an initiation probability and a potential risk value; outputting situation awareness information containing the path and the probability and risk value thereof; and dynamically determining a key area needing to be updated preferentially in the knowledge graph according to an evaluation result, and triggering incremental updating. According to the method, the crossing from static monitoring to dynamic prediction is realized, the attack path can be actively deduced, quantitative risk assessment is carried out, meanwhile, the real-time performance of the knowledge graph is guaranteed through a focusing updating mechanism, and the initiative and accuracy of network security protection are improved.

The invention relates to the technical field of network security, in particular to a network security situation awareness prediction method and device based on a knowledge graph, and the method comprises the steps: integrating a network topological structure, asset importance, security defects and traffic mode information, and generating a network basic state graph containing initial nodes and edges; according to the application, a knowledge graph structure is constructed on the basis of a network topology structure, and then multi-modal information such as network asset importance, security defects and traffic modes is incorporated to form a network basic state graph model; further, the basic state map model is mapped into a network attack path map structure based on a network attack inherent mode, a probability model is introduced, the security situation of nodes in the network is quantitatively calculated, and a network security situation static map is formed; and finally, carrying out quantitative prediction on high-risk nodes, high-risk attack paths and the overall situation of network security in the network.

The invention discloses a network security situation awareness system based on federated learning driving, and relates to the technical field of distributed computing. The visual management center is in communication connection with a data acquisition module, a distributed federation learning module, a virtual storage management module, a security policy analysis module and an automatic response processing module, and all the modules are in electric signal connection. Through the federated learning technology, the security situation awareness model is locally trained on the multiple distributed nodes, centralized storage and transmission of data are avoided, the risk problem of data privacy leakage in a traditional network security situation awareness system is effectively solved, each node only processes and analyzes data locally, data uploading is not needed, and the network security situation awareness system is convenient to use. Therefore, on the premise of ensuring data security and privacy, cross-node knowledge sharing and model optimization are realized, and the data privacy protection capability of the system is greatly improved.

The invention relates to the technical field of knowledge graph optimization, in particular to a knowledge graph optimization method and device suitable for network security situation awareness data. The method comprises the following steps: constructing an initial knowledge graph; obtaining an importance degree sequence of the entity category and an importance degree score of each relation category; based on the importance degree sequence of the entity categories, sequentially dividing the entity features in each entity category according to the importance degree from low to high, and obtaining a core entity feature sequence, a key entity feature sequence and an edge entity feature sequence; obtaining a rejected entity feature set; obtaining a rejection relationship category set; deleting triads with entity features in the entity feature set and relation categories in the relation category set from the initial knowledge graph, and obtaining optimized triads; and reconstructing the initial knowledge graph based on the optimized triple. According to the method, the knowledge graph can be optimized well.

The invention discloses a network security situation awareness method based on an adaptive algorithm, and the method comprises the steps: S1, collecting and preprocessing original log information and abnormal alarm records from a plurality of network devices to form structured network security data, s2, distinguishing normal behavior patterns and abnormal activities in the structured network security data based on a machine learning model, and performing deep feature extraction to identify potential security threats and attack behaviors, s3, dynamically adjusting machine learning model parameters and optimizing recognition accuracy based on a real-time updated historical data analysis result and self-adaptive adjustment threshold setting; according to the network security situation awareness method based on the adaptive algorithm, the overall network security situation awareness capability is improved, the defense efficiency of network attacks and the timeliness of early warning are remarkably improved, and the problems of how to improve the accuracy of abnormal behavior recognition and accelerate the threat response speed are solved.

The invention relates to the technical field of knowledge maps, in particular to a knowledge map construction method and device for network security situation awareness. The method comprises the following steps: constructing a plurality of triads; constructing an initial knowledge graph based on the plurality of triads; on the basis of entity category labels, sorting entity categories in the initial knowledge graph according to importance degrees; on the basis of the entity category labels and the relationship category labels, sorting the relationship categories in the initial knowledge graph according to importance degrees, and obtaining an importance degree score of each relationship category; on the basis of the importance order of the entity categories and the importance score of each relationship category, optimizing triples in the initial knowledge graph; and completing the construction of the knowledge graph based on the optimized triple. According to the method, the redundant data and the weak association data in the knowledge graph of the network security situation awareness data can be better eliminated.

The invention relates to the technical field of network security, and particularly discloses a network security situation awareness prediction system and method based on a large model, and the method comprises the steps: carrying out the cleaning analysis and key field extraction of a network security log to generate a structured event stream, carrying out the modal characterization processing to extract the deep semantic feature representation of the structured event stream, and carrying out the modal characterization processing; and meanwhile, time sequence modeling is performed on the network flow data, and a time sequence characteristic mode of the network flow is learned. Then, a cross-modal semantic alignment technology is adopted to realize feature dimension alignment on network security log semantic features and network traffic time sequence features, and fine-grained feature transfer interactive reasoning is performed on the network security log semantic features and the network traffic time sequence features to deeply mine potential association and cooperative behavior modes between the network traffic and log events; and the specific stage of the attack behavior is predicted by using the multi-mode large model subjected to field fine tuning. According to the method, the attack behavior track can be accurately captured by fully utilizing complementary information among heterogeneous data, and the accuracy and foresight of situation awareness are improved.

The invention discloses a network security situation awareness method based on artificial intelligence, and the method comprises the following steps: collecting multi-source heterogeneous data, and generating a standardized data set; spatial-temporal feature decoupling is carried out, and spatial-temporal dimension features are separated; fusing the time-space cross attention, and outputting a fused time-space feature vector; constructing a causal inference engine, and outputting a dynamic causal graph and an anti-fact inference result set; constructing a dynamic risk propagation model, and outputting a whole asset risk value matrix and a risk propagation path diagram; generating a situation quantization matrix, constructing an adversarial training decision network, and outputting a defense strategy set verified by adversarial training; automatically generating a strategy; and a man-machine cooperative verification closed loop is realized. According to the method, dynamic reconstruction of a threat propagation path is realized through spatial-temporal feature decoupling and a causal reasoning engine, and a risk positioning error is reduced; and the adversarial training decision network is combined, so that the misjudgment rate of the defense strategy in the simulation APT attack test is reduced.

The invention provides a network security situation awareness method and system based on a multi-modal large model, and the method comprises the steps: obtaining the information of a single data source through an orthogonal sequence fusion technology, extracting the features of the single data source through a teacher-student model, carrying out the knowledge distillation, and carrying out the cross-modal alignment processing and fusion processing; the method comprises the steps of carrying out cross-modal correlation analysis on multi-modal data, generating an adversarial sample of the multi-modal data, calculating an optimal transmission path of features in an equalization system established by a depth equalization multi-modal fusion technology, carrying out feature integration, constructing a multi-modal depth situation awareness and prediction model based on a bidirectional encoder structure, and carrying out multi-modal depth situation awareness and prediction. And integrating a residual period prediction technology to carry out network security situation awareness. According to the method, multi-modal data of different sources are processed and analyzed, the network security situation can be comprehensively identified, complex network attack threats can be identified and defended, the missing report rate and the false report rate of network security threat identification are reduced, the identification accuracy is improved, and the model interpretability and transparency are enhanced.

The invention provides a network security situation awareness method and system based on a large model and threat assessment, and relates to the technical field of network security intelligence, and the method comprises the steps: collecting situation environment data of current network security, inputting the data into a fine tuning situation awareness large model for analysis and judgment, and obtaining a situation reasoning result; extracting threat assessment parameters from the situation environment data to obtain a situation assessment result; and performing consistency comparison on the situation inference result and the situation assessment result, and outputting a situation awareness result of the current network security. According to the method, the problems of limited sensing granularity, high rule maintenance cost and difficulty in multi-source data fusion in the existing network security protection method are effectively solved.

The invention relates to the technical field of network security, and discloses a network security situation awareness and active defense system, which comprises a micro-feature fine granularity extraction algorithm module, a dynamic abnormal behavior pattern library module, a real-time matching and dynamic evaluation engine module and an intelligent defense strategy generation and execution system module. According to the invention, a convolutional neural network and an attention mechanism are integrated through a micro-feature fine granularity extraction algorithm module, and micro-features of network flow data are extracted; the method comprises the following steps: extracting fine features from a dynamic abnormal behavior pattern library, matching the extracted fine features with abnormal behavior pattern features in the dynamic abnormal behavior pattern library, determining whether the fine features are abnormal features, if the fine features are abnormal features, evaluating the threat level of the abnormal features, and triggering a corresponding defense strategy based on the threat level. According to the network security situation awareness and active defense system, through fine analysis, intelligent identification and active defense strategies, micro flow attacks which are difficult to perceive by traditional security equipment are effectively handled, and the overall security protection capability of the network is improved.

The invention relates to the technical field of network security monitoring, and discloses a network security situation awareness method and system, and the method comprises the steps: collecting a multi-source heterogeneous log, carrying out the standardized analysis, and obtaining log event data; performing real-time analysis by utilizing a dynamic baseline association engine based on the log event data to obtain log association alarm data, analyzing a triple from the log association alarm data, constructing a basic knowledge graph based on the triple, performing rule reasoning and embedded reasoning, and integrating reasoning results to form a situation-enhanced security situation knowledge graph; threat data are extracted according to the security situation knowledge graph, the threat data are optimized in combination with a graph neural network GAT to obtain a final network attack threat value, network security situation awareness is carried out based on the network attack threat value, and the threat data comprise comprehensive criticality and an attack influence range. According to the invention, the efficiency and effect of network security management can be improved.

The invention relates to a network security situation awareness method and system based on big data analysis, and belongs to the technical field of network security. The method comprises the steps of collecting original network data which comprises original network data flow and original protocol data in broadband service, training a network security situation awareness model based on a preset network security situation awareness standard set, the network security situation awareness model comprises a network flow analysis model and a protocol analysis model, generating a network state label through the network security situation awareness model, and evaluating a network security level through a rating rule according to the network state label. And outputting a network security situation awareness instruction through an instruction control script according to the network security level, generating a network security situation report through an automatic reporting tool according to the original network data, the network state label and the network security level, and displaying the network security situation report through a data visualization tool.

The invention provides a network security situation awareness method based on artificial intelligence, and relates to the technical field of network security. Real-time monitoring and multi-source data fusion analysis are performed on a network communication behavior, a host operation state, threat alarm information and a relationship between vulnerabilities and a topological structure; constructing a threat intensity parameter, a behavior anomaly rate parameter, a vulnerability exposure degree parameter and a traffic anomaly density parameter, and calculating a risk potential energy index to realize quantitative evaluation of a network risk state; introducing an attack chain dynamic coupling index to perform dynamic analysis on a multi-stage attack evolution trend, and judging an attack chain formation risk; depicting an abnormal flow distribution concentration degree through a risk propagation convergence entropy index, and identifying concentrated penetration and critical path breakthrough risks; and defense strategies such as risk tracing, attack chain blocking and key path reinforcing are given, so that accurate recognition, trend prediction and adaptive defense of complex network attacks are realized.

The invention discloses a remote sensing satellite network security situation awareness method and system with dual prevention mechanisms, and the method comprises the steps: obtaining multi-source heterogeneous data from a remote sensing satellite ground system network, and generating a structured data set through cleaning, denoising and standardization processing; and according to the structured data set, recording network assets by adopting an asset identification algorithm, and generating a risk thermodynamic diagram of the network assets through a Bayesian network model and an entropy weight method. And according to the risk thermodynamic diagram and the structured data set, adopting a deep learning model to detect abnormal traffic and behaviors, and generating a hidden danger list marked with priorities through a general vulnerability scoring standard and a threat intelligence library. And according to the risk thermodynamic diagram and the hidden danger list, constructing a dynamic security situation map by adopting a graph database and a community discovery algorithm. Therefore, the real-time fusion capability of multi-source heterogeneous data is improved, a dynamic attack chain reasoning mechanism is enhanced, and collaborative decision-making of risk early warning and hidden danger treatment is realized.

The invention belongs to the technical field of network security, and discloses a Transform and time sequence prediction-based network security situation awareness method, which comprises the following steps of: performing multi-level feature engineering on traffic data subjected to quality monitoring, and extracting three layers of 78-dimensional features; a situation assessment model based on Transform is constructed, and continuous situation scores are output through association between multi-head self-attention learning features; the continuous situation scores are aggregated according to a time window to form a situation score sequence, and a future situation is predicted by a mixed architecture of a Transform encoder and an LSTM decoder, so that coupling cooperation of evaluation and prediction is realized. According to the method, the real-time performance is guaranteed, meanwhile, good engineering practicability is achieved, and the flow record is converted into the situation scoring sequence with remarkable autocorrelation through window aggregation, so that the short-time prediction stability and learnability are improved.

The invention belongs to the technical field of network security situation awareness, and discloses an intrusion situation prediction method based on SEA-DDQN adaptive reinforcement learning, and the method comprises the following steps: obtaining a network flow data set; preprocessing the obtained network flow data set to obtain a standardized data set; and constructing a deep attention Q network SEA-DDQN model based on double values, and carrying out network security intrusion situation prediction ISP to realize an ISP process. According to the intrusion situation prediction method based on SEA-DDQN adaptive reinforcement learning, through continuous interaction with a traffic environment, the prediction capability is continuously improved, so that the model can flexibly cope with complex and continuously changing threat scenes; the SEA-DDQN uses the advantages of reinforcement learning to optimize the adaptivity and decision making process of the model, thereby enhancing the anti-interference capability of the model in a dynamic environment.

The invention belongs to the technical field of nuclear power, and particularly relates to a nuclear power network security situation awareness and health degree assessment method and device. According to the nuclear power network security situation awareness and health degree assessment method provided by the invention, an intelligent situation awareness platform is constructed by integrating multivariate data fusion, time sequence feature extraction, field matching and association analysis. Compared with a traditional method, the method introduces a self-attention mechanism and a multi-task learning model, so as to improve the precision of feature fusion and event classification. Besides, through an online learning and transfer learning mechanism, the system can continuously optimize an algorithm and adapt to a dynamically changing network environment, so that powerful support is provided for safe operation of a nuclear power network.

The invention discloses a network security situation awareness system supported by computer technology, and relates to the technical field of network security, the network security situation awareness system comprises a data acquisition module, a quality evaluation module, a threat analysis module, a situation prediction module, an interaction analysis module and a system management module, the method has the advantages that the accuracy, integrity, timeliness and correlation of the data are comprehensively evaluated by establishing a dynamic data quality evaluation index system, and the data acquisition and processing frequency is adjusted according to the evaluation result, so that the data quality and the response speed of the system are improved, and the system is ensured to be capable of accurately evaluating the data quality according to the change of the data quality. The data processing flow is flexibly optimized, and the accuracy and timeliness of the data are improved, so that the overall network security situation awareness effect is enhanced.

The invention relates to the technical field of network security, and discloses a network security situation awareness method and system based on multidimensional data fusion, and the method comprises the steps: 1, collecting network behavior data from at least two different data sources; 2, cleaning and formatting the network behavior data; 3, a security situation score is calculated by adopting a formula # imgabs0 #, S is the security situation score, wi is the weight of the ith dimension, and Di is the data value of the network behavior data of the corresponding dimension; and 4, predicting potential security threats according to the security situation scores. The system corresponds to the method. According to the invention, comprehensive monitoring and accurate early warning of the network security state can be realized.

The invention relates to the technical field of network security situation awareness and early warning, and discloses a photovoltaic power station network security situation awareness and early warning method and system, and the method comprises the steps: carrying out the multi-source heterogeneous data collection of a photovoltaic power station and a social network, and carrying out the distributed preprocessing and feature extraction of the collected data, carrying out weighted fusion analysis on the comprehensive feature data through a situation awareness model, predicting potential attacks through an attack prediction model, calculating a network security situation in real time through a deep belief network, and carrying out automatic attack blocking by a centralized control center and a plant station operation and maintenance terminal; encryption protection is carried out through a forward isolation device and a VPDN tunnel technology. According to the invention, situation awareness and risk prediction are carried out through a deep learning algorithm, automatic attack blocking and headquarters-plant-station intensive management and control are realized in combination with a dynamic early warning mechanism, a trapping system and a block chain technology, and the monitoring, early warning and protection capabilities of the network security of the photovoltaic power station are significantly improved.

The invention discloses a network security situation awareness method and system based on deep learning, and the method comprises the steps: generating a time-space sequence data set through integrating a multi-source flow log and a behavior record, extracting the abnormal signal intensity, and generating an embedded vector set representing attack multidimensional through employing a graph representation learning method; and when the abnormal signal intensity exceeds a threshold value, mining time sequence relevance through a sequence analysis model, judging a hidden threat evolution path, updating complex attack chain representation in real time by utilizing a dynamic tracking mechanism, generating future threat probability distribution by fusing a risk prediction method, and determining a high-risk threat priority sequence. For high-risk threats, an early warning mechanism is activated through infrastructure influence assessment, a safety guarantee protocol is integrated, a protection layer is applied, and enhanced network defense configuration is generated. According to the embodiment, through integration of spatio-temporal data fusion, dynamic threat tracking and risk prediction, the detection precision and response speed of hidden threats are remarkably improved, and the safety of key infrastructures is guaranteed.

The invention discloses an unknown attack detection method and system for intelligent network security situation awareness, and the method comprises the steps: obtaining multi-dimensional data of a power grid monitoring system, carrying out the data preprocessing, carrying out the network attack preliminary detection of the multi-dimensional data through a pre-built network security situation awareness framework, and outputting suspected attack data, the method comprises the steps of performing data training on historical attack data through an improved OCN open set classification network, identifying attack features of each known attack type, performing semantic similarity calculation on the attack features and suspected attack data, performing attack feature mapping and clustering on the suspected attack data based on semantic similarity, and obtaining an unknown attack feature clustering result. And according to the unknown attack clustering result, carrying out attack type classification on unknown attacks in the suspected attack data to obtain an unknown attack detection result. The method has the effects of detecting unknown attack means in time, effectively reducing the risk that the power grid system suffers from network attacks and guaranteeing safe and stable operation of the power grid system.