198 results about "Network security situation awareness" patented technology

The invention relates to a network risk assessment method and system based on a multi-modal data pre-training model. The method comprises the following steps: firstly, collecting multi-source network security data, identifying threat event objects in the multi-source network security data, connecting the threat event objects in series into attack chains, and analyzing to obtain feature information and main attack nodes of each attack chain; risk level information of the attack chain is evaluated and generated; integrating the information, and generating and continuously recording a network security situation report; pre-constructing a network security situation knowledge base; and finally, matching and comparing the feature information of the attack chain with attack chain data in the network security situation knowledge base, predicting potential threat influence, and generating early warning information and protection strategy suggestions. Compared with the prior art, the method has the advantages that the method does not depend on predefined rules, is more suitable for complicated network scenes, and improves the reliability and accuracy of network security situation awareness.

The invention relates to the technical field of network security, in particular to a network security situation awareness method and system, and the method comprises the following steps: extracting a source IP address and a target IP address based on a network behavior record, carrying out the statistics of the number of used ports, the transmission direction and the time interval value, analyzing the direction change times and the time interval difference, and screening abnormal communication pairs. And generating an abnormal communication pair set. According to the invention, through analyzing port usage, transmission direction and time interval value, deeply mining communication features, screening abnormal communication pairs and improving identification accuracy, dividing a time sequence window, analyzing rate fluctuation and frequency distribution, locking an unstable time window, combining with a multi-dimensional data classification behavior mode, and extracting a switching path and priority, a multi-dimensional data classification behavior mode is combined. Potential threat paths are identified independently, global threat situations are identified through node interaction relation statistics and correlation analysis and an expansion range, threat assessment precision and efficiency are enhanced, and comprehensive and reliable risk protection capability is provided for network managers.

The invention relates to a network security situation awareness method and device for multi-source data fusion, equipment and a medium, and the method comprises the steps: respectively collecting kernel logs and network flow data, and carrying out the standardization processing to generate a communication data set; constructing a dynamic process link map, defining a communication type, frequency and data volume, and updating a topological relation in real time; a sliding time window is adopted to count communication time sequence characteristics, and abnormal signals deviating from normal distribution are screened in combination with a time sequence analysis technology; training a robustness classifier model through an adversarial sample enhancement technology, fusing a graph neural network to analyze a dependency relationship between processes, and filtering a false alarm signal; and the hidden channel is accurately identified and alarm information is generated in combination with a dynamic similarity threshold and a threat intelligence gain coefficient, so that the problems of insufficient multi-source data fusion, high false alarm rate of a static rule base, failure in detection of weak signals of the hidden channel and the like in a traditional method are solved. And the real-time perception and response capability of APT attacks in a complex network environment is improved.

The invention relates to the technical field of network security, in particular to a network security situation awareness and early warning method based on big data analysis, and the method comprises the following steps: collecting multi-modal security data, and carrying out the noise reduction and normalization processing; constructing a high-dimensional security feature vector by using feature engineering; establishing an anomaly detection model based on physical constraints and a deep residual network; a self-adaptive loss optimization strategy training model is adopted, so that the detection accuracy is improved; through cross-domain transfer learning, model adaptability is optimized, and unknown attacks can be detected; future attack trends are analyzed in combination with historical data, and defense strategies are dynamically adjusted. Through combination of deep learning and big data analysis, the accuracy, real-time performance and adaptive capability of network security situation awareness are improved, unknown attacks and variant attacks can be effectively detected, the false alarm rate is reduced, the security protection capability is enhanced, and the method is suitable for a security defense system in a complex network environment.

The invention relates to the technical field of artificial intelligence, and discloses a network security situation awareness method based on artificial intelligence, which comprises the following steps: acquiring network security data; performing feature extraction on the network security data by adopting a full-connection neural network based on dynamic group evolution optimization to obtain a first feature; performing feature dimension reduction on the first feature by using a self-encoding neural network based on contrast entropy to obtain a second feature; constructing a classifier model by using a fractional order neural network based on complexity perception, and training the classifier model by using the second feature; and performing network security situation awareness classification by using the trained classifier model. According to the method, the capability of distinguishing the complex network security situation is improved, a more accurate classification effect can be realized, and the applicability of the model in the network security data and the classification accuracy are enhanced.

The invention discloses a risk assessment and prediction method based on a network security situation awareness system, and relates to the technical field of network security. According to the risk assessment and prediction method based on the network security situation awareness system, a current network potential risk data set is obtained, and a current network potential risk assessment value is obtained through comprehensive analysis based on the obtained current network potential risk data set; acquiring a current network traffic data set, and based on the acquired current network traffic data set, performing comprehensive analysis to obtain a current network traffic evaluation value; comprehensively analyzing the current network potential risk assessment value and the current network flow assessment value to obtain a network security risk coefficient and a network security risk level; by comprehensively analyzing the current risk and flow data, a more comprehensive, real-time and dynamic network security management scheme is provided, potential threats can be effectively identified, and the early warning capability is improved. The problem that the existing network security situation awareness system is inconvenient to comprehensively reflect the network security situation is solved.

The invention discloses a network security situation awareness and dynamic analysis method based on a graph neural network, and the method comprises the following steps: S1, collecting network related data, and constructing a dynamic security knowledge graph; s2, preprocessing the collected data to generate a node feature matrix; s3, based on the node feature matrix, generating a node embedding representation through an improved graph neural network and a graph attention mechanism, and optimizing the node embedding representation in combination with the graph attention mechanism; s4, establishing a time sequence prediction model based on the improved support vector regression model, and identifying potential abnormal behaviors and security threats; s5, evaluating the identified security threat, and predicting the risk level of the security threat; s6, generating a response strategy according to a security threat assessment result; and S7, executing the response strategy. According to the method, the improved graph neural network and the support vector regression model are utilized to carry out network security situation awareness and dynamic analysis, and the method has efficient and accurate security threat identification and adaptive response capabilities.

The invention provides a network security perception early warning method and system for a smart power plant, and relates to the technical field of power plant network security early warning, and the method comprises the steps: reading a multi-source monitoring data set of a first time zone, carrying out the abnormality judgment of the multi-source monitoring data set, and carrying out the deviation calculation of the multi-source monitoring data set through employing a parameter reference value if an abnormality index is 0, and performing space-time mapping distribution on the plurality of parameter deviation values according to the position coordinates and the timestamps, constructing a network attack sequence diagram, performing abnormal association identification based on the network attack sequence diagram, determining a global attack chain, performing historical risk backtracking according to the global attack chain, and outputting a risk early warning level. The technical problem that the potential network security risk of the power plant is difficult to warn in time due to the lack of comprehensive monitoring and analysis of the overall network security state of various devices and systems in the power plant in the prior art is solved. The technical effects of overall network security situation awareness and timely potential risk early warning of multiple devices and systems in the smart power plant are achieved.

The invention discloses a computer network security situation awareness system and method, and relates to the technical field of computer network security, and the method comprises the steps: generating a dynamic gene pool through an antigen-antibody matching algorithm based on an initial quantum trust vector, and building a mapping relation table of an antigen feature vector and an antibody defense strategy; triggering a quantum alarm according to an entanglement entropy mutation event in the real-time quantum state flow data, matching a biological antibody strategy corresponding to a current network attack feature based on a mapping relation table, and fusing the quantum alarm and the biological alarm to generate an attack path topological graph; the network security situation is perceived by analyzing the quantum state change of the abnormal node ID and combining an attack path topological graph and a dynamic gene pool. Quantum entanglement pairs are distributed to network nodes through the quantum key distribution center, and initial quantum trust vectors are generated, so that the unknown attack resisting capability of the network is remarkably improved, and efficient and accurate network security situation awareness is realized.

The invention discloses a network security situation awareness and early warning system and method based on artificial intelligence, relates to the technical field of network security situation awareness and early warning, and solves the technical problem that the early warning precision is not high due to the fact that the influence of changes of an encryption traffic proportion and encryption strength on network security monitoring is not considered in the prior art. The method comprises the following steps: acquiring network data in a network in a preset time period; calculating a network security evaluation coefficient based on the network security data; determining whether to send early warning information based on the network security evaluation coefficient and a preset network security threshold; training an artificial intelligence model based on the historical network security data and the corresponding network security assessment coefficient to obtain a network security assessment coefficient prediction model; predicting the network security data based on the network security evaluation coefficient prediction model; whether early warning is carried out or not is judged based on the prediction result and a preset network security threshold value, the network is processed based on the early warning information, and the technical problem is solved.

The invention is suitable for the technical field of network security, and provides a network security sensing method and device based on big data, and the method comprises the following steps: collecting multi-source data, carrying out the preprocessing of the collected data, and carrying out the data fusion; performing classification analysis, clustering analysis and association rule mining on the fused data, extracting feature information associated with security situation assessment from the processed data, and dividing the feature information into a training set and a test set; constructing a security situation awareness model based on a random forest algorithm and evaluation indexes, wherein the evaluation indexes comprise an intrusion detection rate, a false alarm rate, a missing report rate and response time; training the security situation awareness model based on the training set, evaluating the performance of the model through a cross validation method, and performing parameter tuning; and evaluating the security situation awareness model based on the test set. Compared with an existing network security situation awareness scheme, the network security situation awareness method has higher accuracy, robustness and practicability.

The invention relates to a network security situation awareness method based on a deep neural network. The method comprises the following steps: acquiring and preprocessing a network security data set to obtain an initial data set; constructing a situation element extraction model, and inputting the initial data set into the situation element extraction model to obtain network security attack elements; carrying out feature extraction based on the network security attack elements, and carrying out feature-level data fusion to obtain a fused feature vector; constructing a network security situation assessment model, and inputting the fusion feature vector into the network security situation assessment model to obtain a situation assessment result; forming a multi-dimensional time sequence data set based on the network security attack elements and the situation assessment result, and training a deep neural network security situation prediction model based on a sample convolution and interaction module based on the multi-dimensional time sequence data set; and inputting the current situation data into the trained deep neural network security situation prediction model, and outputting a network situation prediction result. And the network security situation awareness evaluation and prediction accuracy is improved.

The invention discloses a network security situation awareness and analysis platform based on AI, and relates to the technical field of network security situation awareness and analysis, and the platform comprises a multi-source data collection module which integrates flow, logs, assets and threat intelligence data, and carries out encryption transmission and standardization; the data preprocessing module purifies and optimizes data, and guarantees data quality and sensitive information security; the AI situation awareness analysis module extracts features through a deep learning model, dynamically evaluates the situation and identifies threats; the threat early warning and decision-making module triggers graded early warning and generates a targeted emergency response scheme; the visual display and interaction module displays information in multiple dimensions and supports query and report generation; and the data storage and tracing module adopts a mixed storage architecture, so that the data security and traceability are ensured. The platform integrates multi-source data and realizes situation accurate perception and intelligent decision by means of an AI technology; the early warning is accurate, the visual interaction is convenient, and the intelligent and efficient level of network security protection is comprehensively improved.

The invention provides a network security situation awareness method and system and computer equipment, and belongs to the technical field of network security. The method comprises the following steps: collecting and standardizing multi-source heterogeneous security data; constructing and dynamically updating a network asset and vulnerability knowledge graph; performing tactical labeling on the security event based on tactical, technology and process behavior model libraries to form a current attack context state; mapping the current state into a knowledge graph to deduce a potential subsequent attack path; performing quantitative risk assessment on the path, and calculating an initiation probability and a potential risk value; outputting situation awareness information containing the path and the probability and risk value thereof; and dynamically determining a key area needing to be updated preferentially in the knowledge graph according to an evaluation result, and triggering incremental updating. According to the method, the crossing from static monitoring to dynamic prediction is realized, the attack path can be actively deduced, quantitative risk assessment is carried out, meanwhile, the real-time performance of the knowledge graph is guaranteed through a focusing updating mechanism, and the initiative and accuracy of network security protection are improved.

The invention relates to the technical field of network security, in particular to a network security situation awareness prediction method and device based on a knowledge graph, and the method comprises the steps: integrating a network topological structure, asset importance, security defects and traffic mode information, and generating a network basic state graph containing initial nodes and edges; according to the application, a knowledge graph structure is constructed on the basis of a network topology structure, and then multi-modal information such as network asset importance, security defects and traffic modes is incorporated to form a network basic state graph model; further, the basic state map model is mapped into a network attack path map structure based on a network attack inherent mode, a probability model is introduced, the security situation of nodes in the network is quantitatively calculated, and a network security situation static map is formed; and finally, carrying out quantitative prediction on high-risk nodes, high-risk attack paths and the overall situation of network security in the network.

The invention relates to a multi-modal network security situation awareness and fusion analysis method and system. The method comprises the following steps: S10, collecting historical multi-modal data within a preset time period; s20, preprocessing the historical multi-modal data, and extracting features of the historical multi-modal data based on a preset algorithm; and S30, based on the convolutional neural network, fusing the historical multi-modal data features, optimizing the fused features based on a feature weighting method, and performing normalization processing on the fused features. And S40, drawing four ROC curves, calculating AUC, comparing the AUC, outputting the maximum value of the AUC of each ROC curve, and constructing a situation awareness model. And S50, when an acquisition instruction is received, acquiring real-time multi-modal data, performing preprocessing and feature extraction on the real-time multi-modal data, and inputting the real-time multi-modal data into the situation awareness model. And S60, when an abnormal event is identified, giving an alarm, generating a network security report and sending the network security report to a user side. The method and the device have the effect of reducing misinformation risk events.

The invention discloses a network security situation awareness system based on federated learning driving, and relates to the technical field of distributed computing. The visual management center is in communication connection with a data acquisition module, a distributed federation learning module, a virtual storage management module, a security policy analysis module and an automatic response processing module, and all the modules are in electric signal connection. Through the federated learning technology, the security situation awareness model is locally trained on the multiple distributed nodes, centralized storage and transmission of data are avoided, the risk problem of data privacy leakage in a traditional network security situation awareness system is effectively solved, each node only processes and analyzes data locally, data uploading is not needed, and the network security situation awareness system is convenient to use. Therefore, on the premise of ensuring data security and privacy, cross-node knowledge sharing and model optimization are realized, and the data privacy protection capability of the system is greatly improved.

The invention relates to the technical field of knowledge graph optimization, in particular to a knowledge graph optimization method and device suitable for network security situation awareness data. The method comprises the following steps: constructing an initial knowledge graph; obtaining an importance degree sequence of the entity category and an importance degree score of each relation category; based on the importance degree sequence of the entity categories, sequentially dividing the entity features in each entity category according to the importance degree from low to high, and obtaining a core entity feature sequence, a key entity feature sequence and an edge entity feature sequence; obtaining a rejected entity feature set; obtaining a rejection relationship category set; deleting triads with entity features in the entity feature set and relation categories in the relation category set from the initial knowledge graph, and obtaining optimized triads; and reconstructing the initial knowledge graph based on the optimized triple. According to the method, the knowledge graph can be optimized well.

The invention discloses a network security situation awareness method based on an adaptive algorithm, and the method comprises the steps: S1, collecting and preprocessing original log information and abnormal alarm records from a plurality of network devices to form structured network security data, s2, distinguishing normal behavior patterns and abnormal activities in the structured network security data based on a machine learning model, and performing deep feature extraction to identify potential security threats and attack behaviors, s3, dynamically adjusting machine learning model parameters and optimizing recognition accuracy based on a real-time updated historical data analysis result and self-adaptive adjustment threshold setting; according to the network security situation awareness method based on the adaptive algorithm, the overall network security situation awareness capability is improved, the defense efficiency of network attacks and the timeliness of early warning are remarkably improved, and the problems of how to improve the accuracy of abnormal behavior recognition and accelerate the threat response speed are solved.

The invention relates to the technical field of knowledge maps, in particular to a knowledge map construction method and device for network security situation awareness. The method comprises the following steps: constructing a plurality of triads; constructing an initial knowledge graph based on the plurality of triads; on the basis of entity category labels, sorting entity categories in the initial knowledge graph according to importance degrees; on the basis of the entity category labels and the relationship category labels, sorting the relationship categories in the initial knowledge graph according to importance degrees, and obtaining an importance degree score of each relationship category; on the basis of the importance order of the entity categories and the importance score of each relationship category, optimizing triples in the initial knowledge graph; and completing the construction of the knowledge graph based on the optimized triple. According to the method, the redundant data and the weak association data in the knowledge graph of the network security situation awareness data can be better eliminated.

The invention provides a network security situation awareness method and system, and the method comprises the steps: monitoring network data in real time, extracting network topology features, node attribute features and interaction relationship features, carrying out the coding, and integrating the features into a feature matrix; constructing a network situation awareness model based on a neural network, taking the feature matrix as input, and converting the input data into output reflecting the network security situation through the nonlinear mapping capability of the neural network; and carrying out parameter optimization on the risk assessment model, taking the network situation awareness vector as the input of the optimized risk assessment model, carrying out risk assessment, and outputting a risk assessment value for assessing the magnitude or severity of the current network security risk. According to the method, links such as fine feature extraction, neural network situation awareness and risk assessment are combined, so that comprehensive awareness of the network security situation and accurate assessment of the network security risk are realized, and potential threats and risks in the network can be found and coped with in time.

The invention relates to the technical field of network security, and particularly discloses a network security situation awareness prediction system and method based on a large model, and the method comprises the steps: carrying out the cleaning analysis and key field extraction of a network security log to generate a structured event stream, carrying out the modal characterization processing to extract the deep semantic feature representation of the structured event stream, and carrying out the modal characterization processing; and meanwhile, time sequence modeling is performed on the network flow data, and a time sequence characteristic mode of the network flow is learned. Then, a cross-modal semantic alignment technology is adopted to realize feature dimension alignment on network security log semantic features and network traffic time sequence features, and fine-grained feature transfer interactive reasoning is performed on the network security log semantic features and the network traffic time sequence features to deeply mine potential association and cooperative behavior modes between the network traffic and log events; and the specific stage of the attack behavior is predicted by using the multi-mode large model subjected to field fine tuning. According to the method, the attack behavior track can be accurately captured by fully utilizing complementary information among heterogeneous data, and the accuracy and foresight of situation awareness are improved.

The invention discloses a network security situation awareness method based on artificial intelligence, and the method comprises the following steps: collecting multi-source heterogeneous data, and generating a standardized data set; spatial-temporal feature decoupling is carried out, and spatial-temporal dimension features are separated; fusing the time-space cross attention, and outputting a fused time-space feature vector; constructing a causal inference engine, and outputting a dynamic causal graph and an anti-fact inference result set; constructing a dynamic risk propagation model, and outputting a whole asset risk value matrix and a risk propagation path diagram; generating a situation quantization matrix, constructing an adversarial training decision network, and outputting a defense strategy set verified by adversarial training; automatically generating a strategy; and a man-machine cooperative verification closed loop is realized. According to the method, dynamic reconstruction of a threat propagation path is realized through spatial-temporal feature decoupling and a causal reasoning engine, and a risk positioning error is reduced; and the adversarial training decision network is combined, so that the misjudgment rate of the defense strategy in the simulation APT attack test is reduced.

The invention provides a network security situation awareness method and system based on a multi-modal large model, and the method comprises the steps: obtaining the information of a single data source through an orthogonal sequence fusion technology, extracting the features of the single data source through a teacher-student model, carrying out the knowledge distillation, and carrying out the cross-modal alignment processing and fusion processing; the method comprises the steps of carrying out cross-modal correlation analysis on multi-modal data, generating an adversarial sample of the multi-modal data, calculating an optimal transmission path of features in an equalization system established by a depth equalization multi-modal fusion technology, carrying out feature integration, constructing a multi-modal depth situation awareness and prediction model based on a bidirectional encoder structure, and carrying out multi-modal depth situation awareness and prediction. And integrating a residual period prediction technology to carry out network security situation awareness. According to the method, multi-modal data of different sources are processed and analyzed, the network security situation can be comprehensively identified, complex network attack threats can be identified and defended, the missing report rate and the false report rate of network security threat identification are reduced, the identification accuracy is improved, and the model interpretability and transparency are enhanced.

The invention provides a network security situation awareness method and system based on a large model and threat assessment, and relates to the technical field of network security intelligence, and the method comprises the steps: collecting situation environment data of current network security, inputting the data into a fine tuning situation awareness large model for analysis and judgment, and obtaining a situation reasoning result; extracting threat assessment parameters from the situation environment data to obtain a situation assessment result; and performing consistency comparison on the situation inference result and the situation assessment result, and outputting a situation awareness result of the current network security. According to the method, the problems of limited sensing granularity, high rule maintenance cost and difficulty in multi-source data fusion in the existing network security protection method are effectively solved.

The invention relates to the technical field of network security, and discloses a network security situation awareness and active defense system, which comprises a micro-feature fine granularity extraction algorithm module, a dynamic abnormal behavior pattern library module, a real-time matching and dynamic evaluation engine module and an intelligent defense strategy generation and execution system module. According to the invention, a convolutional neural network and an attention mechanism are integrated through a micro-feature fine granularity extraction algorithm module, and micro-features of network flow data are extracted; the method comprises the following steps: extracting fine features from a dynamic abnormal behavior pattern library, matching the extracted fine features with abnormal behavior pattern features in the dynamic abnormal behavior pattern library, determining whether the fine features are abnormal features, if the fine features are abnormal features, evaluating the threat level of the abnormal features, and triggering a corresponding defense strategy based on the threat level. According to the network security situation awareness and active defense system, through fine analysis, intelligent identification and active defense strategies, micro flow attacks which are difficult to perceive by traditional security equipment are effectively handled, and the overall security protection capability of the network is improved.

The invention relates to the technical field of network security monitoring, and discloses a network security situation awareness method and system, and the method comprises the steps: collecting a multi-source heterogeneous log, carrying out the standardized analysis, and obtaining log event data; performing real-time analysis by utilizing a dynamic baseline association engine based on the log event data to obtain log association alarm data, analyzing a triple from the log association alarm data, constructing a basic knowledge graph based on the triple, performing rule reasoning and embedded reasoning, and integrating reasoning results to form a situation-enhanced security situation knowledge graph; threat data are extracted according to the security situation knowledge graph, the threat data are optimized in combination with a graph neural network GAT to obtain a final network attack threat value, network security situation awareness is carried out based on the network attack threat value, and the threat data comprise comprehensive criticality and an attack influence range. According to the invention, the efficiency and effect of network security management can be improved.

The invention relates to a network security situation awareness method and system based on big data analysis, and belongs to the technical field of network security. The method comprises the steps of collecting original network data which comprises original network data flow and original protocol data in broadband service, training a network security situation awareness model based on a preset network security situation awareness standard set, the network security situation awareness model comprises a network flow analysis model and a protocol analysis model, generating a network state label through the network security situation awareness model, and evaluating a network security level through a rating rule according to the network state label. And outputting a network security situation awareness instruction through an instruction control script according to the network security level, generating a network security situation report through an automatic reporting tool according to the original network data, the network state label and the network security level, and displaying the network security situation report through a data visualization tool.

The invention discloses a network security situation awareness method for electric power digitization, which relates to the technical field of energy digitization, and comprises the following steps: S1, constructing a situation assessment index system; s2, data acquisition and processing; s3, situation assessment and analysis; and S4, emergency response and recovery. According to the network security situation awareness method for electric power digitization, a more professional and detailed security situation assessment index system is constructed by combining the characteristics and actual requirements of an electric power monitoring system, and the method can be better suitable for the network security of the electric power monitoring system so as to improve the accuracy of situation awareness of the electric power monitoring system; and a sound emergency response mechanism is also established, after security threats are found, an alarm mechanism can be automatically triggered, an emergency response team is notified, and corresponding measures are synchronously taken to automatically carry out disposal and recovery work, so that the response time is effectively shortened, and troubleshooting and root cause analysis can be carried out aiming at fault causes.

The invention relates to a network security situation awareness method and system based on big data analysis, and belongs to the technical field of network security. The method comprises the steps of collecting original network data which comprises original network data flow and original protocol data in broadband service, training a network security situation awareness model based on a preset network security situation awareness standard set, the network security situation awareness model comprises a network flow analysis model and a protocol analysis model, generating a network state label through the network security situation awareness model, and evaluating a network security level through a rating rule according to the network state label. And outputting a network security situation awareness instruction through an instruction control script according to the network security level, generating a network security situation report through an automatic reporting tool according to the original network data, the network state label and the network security level, and displaying the network security situation report through a data visualization tool.