CN104601604A - Network security situation analyzing method - Google Patents

Abstract

The invention provides a network security situation analysis method. It involves the field of network security; it solves the problems of low accuracy and processing efficiency of the existing network security situation analysis methods. A. Collect the log information of each device in the network through the SYSLOG protocol and the Flow protocol, and extract the IP address information from it, and stratify the obtained IP addresses based on geographic information or business information to obtain multiple levels; B. Calculate the IP addresses of each level separately Address entropy value; C. Continuously calculate the value of global address entropy, calculate the reference point of address entropy value with a time period of 5 minutes, establish a long-term entropy value baseline with the collection of address entropy value reference point data for a long time in history, and use the latest time A collection of address entropy reference point data to establish a short-period entropy baseline; D. Convert the overall deviation between the measured value of the global address entropy and the long-period entropy baseline and short-period entropy baseline into a security situation indicator Data; E. When the security situation index exceeds the preset threshold, it is determined that the security situation is abnormal, and the abnormality is located by comparing the address entropy values of each level. Accurate and efficient security situation analysis is realized.

Description

Network Security Situation Analysis Method

technical field

The invention relates to the field of network security, in particular to a network security situation analysis method.

Background technique

With the increasing scale of the power information network environment, the number of various devices in the network has increased sharply, and various security and attacks from outside and inside have also increased sharply, threatening the network information security. In order to continuously respond to new security challenges, the power information network has deployed anti-virus systems, firewalls, intrusion detection systems, vulnerability scanning systems, UTM, and so on. Under this complex security system, the network has the characteristics of resource distribution and sharing, user decentralization and management distribution, which provides a basis for realizing diversified and intelligent information services. However, the security problem in this complex network display has become a major obstacle restricting its development. The security situation assessment technology can comprehensively and macroscopically reflect the dynamic security situation of the network, and predict and warn the development trend of the security situation. Therefore, the security situation analysis model and key technologies for the power information network have become the research field of network security hot spot.

At present, some valuable theoretical and applied research has been carried out on the security situation analysis of power information network, such as: research on network security event grouping method based on fuzzy theory; establishment of fuzzy time series model; research on support vector machine regression network security Situation forecasting methods, etc. In practice, common security situation analysis methods include: (1) Situation visualization display, which mainly utilizes people’s sensitivity to intuitive images to present the network interconnection status in a visual view, so that security analysts Have an intuitive understanding of the current network status, and use experience to judge whether the network is threatened by attacks, but the disadvantage of this method is that it requires high experience levels for security analysts, and it is difficult to accurately quantify and analyze. (2) Comprehensively collect the security logs of various security devices, analyze the security situation of the computer network, and evaluate the security of the computer network through the data mining scheme, but the disadvantage of this method is that the information source is single, only the security log information, and Poor performance due to inefficient collection and processing of heterogeneous security events. (3) Using the combination of security log information and equipment vulnerability information, using a risk calculation algorithm to obtain an intuitive security situation map, but the situation evaluation indicators selected in this way are not comprehensive enough, and the results of the quantitative algorithm are not accurate enough, and for large-scale power information The collection of network, security log information, and device vulnerability information is difficult to be comprehensive, resulting in distortion of the final calculation results.

Contents of the invention

The invention provides a network security situation analysis method, which solves the problems of low accuracy and processing efficiency of the existing network security situation analysis methods.

A security situation analysis method comprising:

A. Collect the log information of each device in the network through the SYSLOG protocol and the Flow protocol, and extract the IP address information from it, and stratify the obtained IP addresses based on geographic information or business information to obtain multiple levels;

B. Calculate the address entropy value of each level separately;

C. Continuously calculate the value of the global address entropy, calculate the reference point of the address entropy value with a time period of 5 minutes, establish a long-term entropy value baseline based on the collection of historical address entropy value reference point data for a long time, and use the latest address entropy value The collection of benchmark data establishes a short-period entropy baseline;

D. Converting the comprehensive deviation between the measured value of the global address entropy and the long-period entropy baseline and the short-period entropy baseline into security situation index data;

E. When the security situation index exceeds the preset threshold, it is determined that the security situation is abnormal, and the abnormality is located by comparing the address entropy values of each level.

Preferably, collecting the log information of each device in the network through the SYSLOG protocol and the Flow protocol, and extracting the IP address information therefrom includes:

Distributed collection points extract IP addresses from any or more of the following information:

Network security device logs, application system logs, routing and switching device flow information,

The IP address includes a source IP address and a destination IP address.

Preferably, collecting the log information of each device in the network through the SYSLOG protocol and the Flow protocol, and extracting the IP address information therefrom also includes:

obtain a geotag for said IP address;

Mapping the IP address into a plastic data structure, storing the geographical mark of the plastic data structure and the IP address in a multi-layer nested HashMap data structure;

The shaping data structure of the IP address is added to the IP mapping cache table, and the IP mapping cache table stores the shaping data structure of the IP address and the number of times the IP address is collected.

Preferably, the method also includes:

According to the preset update cycle, periodically sort the IP addresses in the IP mapping cache table in the previous cycle according to the traffic of each IP address;

The number of times of collection corresponding to the higher-ranked IP addresses after sorting is updated.

Preferably, calculating the address entropy values of each level respectively includes:

The source address entropy of the base layer is calculated according to the following expression:

$\mathrm{<span\; class="notranslate">\; h</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; SRC</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\frac{<span\; class="notranslate">\; (</span><span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; N</span>}}<span\; class="notranslate">\; (</span>\frac{{\mathrm{<span\; class="notranslate">\; no</span>}}_{\mathrm{<span\; class="notranslate">\; ipi</span>}}}{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; )</span>{\mathrm{<span\; class="notranslate">\; log</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; (</span>\frac{{\mathrm{<span\; class="notranslate">\; no</span>}}_{\mathrm{<span\; class="notranslate">\; ipi</span>}}}{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; )</span>}{{\mathrm{<span\; class="notranslate">\; log</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; ,</span>$

Calculate the destination address entropy of the base layer according to the following expression:

$\mathrm{<span\; class="notranslate">\; h</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; DEST</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\frac{<span\; class="notranslate">\; (</span><span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; N</span>}}<span\; class="notranslate">\; (</span>\frac{{\mathrm{<span\; class="notranslate">\; no</span>}}_{\mathrm{<span\; class="notranslate">\; ipi</span>}}}{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; )</span>{\mathrm{<span\; class="notranslate">\; log</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; (</span>\frac{{\mathrm{<span\; class="notranslate">\; no</span>}}_{\mathrm{<span\; class="notranslate">\; ipi</span>}}}{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; )</span>}{{\mathrm{<span\; class="notranslate">\; log</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; ,</span>$

in, Indicates the total number of occurrences of IP addresses during the observation period;

The entropy of the intermediate layer is calculated according to the following expression:

H(MIDDLE)=a*H(SRC)+b*H(DEST),

Wherein, the value range of a and b is [0, 1], and a+b=1;

The entropy of the global layer is calculated according to the following expression:

Preferably, establishing a long-period entropy baseline with a collection of historically long-term address entropy benchmark data includes:

Taking a longer cycle as the cycle length, calculate the global entropy value after each first time interval, and form a group of entropy value arrays with multiple points;

A weighted average is performed on the entropy value of this longer period and the baseline entropy value of the last longer period to obtain a new baseline entropy value, and a plurality of the baseline entropy values form a dynamic long-period entropy baseline.

Preferably, the longer period is a time period of one day or more.

Preferably, establishing a short-period entropy baseline with a collection of recent address entropy benchmark data includes:

Calculate the global entropy value periodically according to a shorter cycle;

The entropy data is formed by the global entropy values of the most recent multiple periods, and the curve formed by the entropy data is the short-period entropy baseline.

Preferably, converting the address entropy value into security situation indicator data includes:

Extracting the entropy value corresponding to the current moment from the long-period entropy value baseline, which is the long-period entropy prediction value at the current moment;

The entropy prediction value corresponding to the short-period baseline is obtained according to the following expression:

H _t+1 =H _t +a(y _t -H _t ),

Let the entropy sequence in the current short-period baseline be:

y ₁ , y ₂ , y ₃ , y ₄ ….y _t is the entropy value sequence in the current short-period baseline, a is the weighting system (0<a<1), Ht is the predicted entropy value in the t-th period;

Calculate the entropy value deviation rate μT according to the following expression:

${\mathrm{<span\; class="notranslate">\; \&mu;</span>}}_{\mathrm{<span\; class="notranslate">\; T</span>}}<span\; class="notranslate">\; =</span>\frac{\mathrm{<span\; class="notranslate">\; 1</span>}}{\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; *</span><span\; class="notranslate">\; (</span><span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; h</span>}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; h</span>}}_{\mathrm{<span\; class="notranslate">\; l</span>}}<span\; class="notranslate">\; |</span><span\; class="notranslate">\; /</span>{\mathrm{<span\; class="notranslate">\; h</span>}}_{\mathrm{<span\; class="notranslate">\; l</span>}}<span\; class="notranslate">\; +</span><span\; class="notranslate">\; |</span>{\mathrm{<span\; class="notranslate">\; h</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; h</span>}}_{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; |</span><span\; class="notranslate">\; /</span>{\mathrm{<span\; class="notranslate">\; h</span>}}_{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; ,</span>$

Wherein, H is the measured global entropy value, H ₁ is the predicted entropy value obtained based on the long-period entropy value baseline, and H _s is the predicted entropy value obtained based on the short-period entropy value baseline;

The Security Situation Indicator (SSI) is converted according to the following expression:

Preferably, when an abnormality occurs in the SSI, by sorting the address entropy values of each layer, the network layer with the largest address entropy value is determined as the location of the abnormal network security situation.

The present invention provides a security situation analysis method. A. Collect the log information of each device in the network through the SYSLOG protocol and the Flow protocol, and extract IP address information therefrom, and layer the obtained IP addresses based on geographical information or business information to obtain Multiple levels; B. Calculate the address entropy value of each level separately; C. Continuously calculate the value of the global address entropy, calculate the reference point of the address entropy value with a time period of 5 minutes, and use the address entropy value reference point data for a long time in history Set up a long-period entropy baseline, and establish a short-period entropy baseline with a collection of address entropy reference point data at the latest time; D. Combine the measured value of the global address entropy with the long-period entropy baseline and short-period The comprehensive deviation degree of the value baseline is converted into security situation indicator data; E. When the security situation indicator exceeds the preset threshold, it is determined that the security situation is abnormal, and the abnormality is located by comparing the address entropy values of each level. Accurate and efficient security situation analysis is realized, and the problems of low accuracy and processing efficiency of the existing network security situation analysis methods are solved.

Description of drawings

FIG. 1 is a schematic diagram of the principle of establishing and updating an IP mapping cache table.

Detailed ways

Common security situation analysis methods include: (1) Situation visualization display, which mainly uses people’s sensitivity to intuitive images to present the network interconnection status in a visual view, so that security analysts can understand the current network There is an intuitive understanding of the state, and through experience to judge whether the network is threatened by an attack, but the disadvantage of this method is that it requires a high level of experience for security analysts, and it is difficult to accurately quantify and analyze. (2) Comprehensively collect the security logs of various security devices, analyze the security situation of the computer network, and evaluate the security of the computer network through the data mining scheme, but the disadvantage of this method is that the information source is single, only the security log information, and Poor performance due to inefficient collection and processing of heterogeneous security events. (3) Using the combination of security log information and equipment vulnerability information, using a risk calculation algorithm to obtain an intuitive security situation map, but the situation evaluation indicators selected in this way are not comprehensive enough, and the results of the quantitative algorithm are not accurate enough, and for large-scale power information The collection of network, security log information, and device vulnerability information is difficult to be comprehensive, resulting in distortion of the final calculation results.

In order to solve the above problems, an embodiment of the present invention provides a network security situation analysis method. Embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings. It should be noted that, in the case of no conflict, the embodiments in the present application and the features in the embodiments can be combined arbitrarily with each other.

First, Embodiment 1 of the present invention will be described with reference to the accompanying drawings.

The embodiment of the present invention provides a network security situation analysis method for the electric power information network based on large-scale address entropy model calculation, and conducts a comprehensive, in-depth, indexed and hierarchical security situation analysis on the electric power information network. Firstly, IP addresses are collected by each distributed collection point, and then the central situation analysis system stores the IP addresses collected by each distributed collection point, and analyzes the security situation in the form of address entropy model. Specifically include the following steps:

A. Acquisition and stratification of IP information: Collect log information of each device in the network through the SYSLOG protocol and Flow protocol, and extract IP address information from it, and stratify the received IP addresses to obtain multiple levels.

B. Calculate the address entropy value of each level separately;

C. Construct the global entropy baseline: continuously calculate the global entropy value, obtain the global entropy benchmark point in units of 5 minutes, establish a long-term entropy baseline based on the collection of entropy benchmark data for a long time in history, and use the recent time entropy value The collection of benchmark data establishes a short-period entropy baseline;

D. Calculating the security situation index value: converting the comprehensive deviation degree between the measured address entropy value and the long-period entropy baseline and short-period entropy baseline into security situation index data.

E. Judgment of security situation abnormality: When the security situation indicator is abnormal, the abnormality is located by comparing the address entropy values of each level.

Preferably, in the acquisition of IP information in step A, the log information of each device in the network is collected through the SYSLOG protocol and the Flow protocol, and the IP address information is extracted therefrom.

Data sources for IP data collection include network security device logs, application system logs, and routing and switching device flow data. The IP information extraction method is as follows:

The IP address data format field extraction structure in the power information network is as follows:

<block index="2"name="src"type="source address"default="">

<field match="^[0,1]" value="aa"/>

<field match="^[2-4]"value="bb"/>

</block>

The block field is defined as follows:

index: The field index corresponding to the information extraction, the group number of the regular expression in the Match corresponding to the log or flow information, starting from 1;

name: the corresponding field name;

type: corresponds to the field type, including source address, destination address and time;

default: direct assignment to this field;

If you directly use the extracted result, you don’t need to configure the field. If you need to perform secondary extraction based on the extracted result, you need to configure the field.

The field is the IP parsing rule. The original information such as the IP information contained in the syslog log can be directly identified as IP data, so there is no need to configure the field; the original information such as the IP information contained in the netflow is bytecode, and the field needs to be configured for analysis.

field is defined as follows:

match: extract the regular expression of the field from the extracted field;

value: field assignment, assign according to the Match matching result, if it is empty, directly use the extracted result.

Preferably, in the layering of IP address information in step A, the IP address information is layered based on the geographical level, and the address entropy value is calculated based on the layering, which can not only achieve the purpose of distributed operation, but also can be sent in a safe situation. In case of anomalies, the source of the anomalies can be located based on network layers to assist security managers in analyzing problems.

The embodiment of the present invention builds a layered network IP model, divides the network into three levels based on the geographical location of the IP, the basic layer, the middle layer and the global layer, and can determine the division granularity according to the needs, and the middle layer can be analyzed according to the actual situation Continue to divide into multiple levels. For example, for a network such as the China Southern Power Grid, its IP hierarchy division is shown in Table 1.

Table 1

global layer All IPs of China Southern Power Grid middle layer Including Guangdong, Guangxi, Yunnan, Guizhou, and Hainan provinces IP base layer Provincial and municipal IP

The division of this level is based on IP geographic information or service information.

Preferably, the real-time construction and update of the layered data of IP address information in step A, due to the large scale of the power information network and complex equipment, the IP data in the power information network is a high-throughput data composed of uncontrollable activity data flow. For the processing of IP data, the traditional log file system analysis method cannot meet the requirements. Therefore, the embodiment of the present invention adopts the IP address partition mapping algorithm in the power information network to effectively improve the efficiency of IP-related operations and reduce the cache space , making complex calculations for large-scale IP addresses possible.

The system maintains the IP address mapping cache table. When the IP address data is collected, according to the IP geographic information knowledge base provided by the power information network specification, the geographical mark of each IP address is obtained and the IP address partition mapping algorithm is used for mapping and caching. The IP address partition mapping algorithm maps the IP address data of the String data structure into an integer data structure that is easy to store and calculate; the geographical mark of the IP address marks the geographical location information of the IP address in the power information network. The shaping data structure of the IP address is stored in the IP mapping cache table. The embodiment of the present invention adopts the multi-layer nested HashMap data structure to realize the IP mapping cache table, and the data structure of the IP mapping cache table is respectively layer by layer:

HashMap<Integer, HashMap<String, Integer>> = new HashMap<Integer, HashMap<String, Integer>>.

The key of the first layer of HashMap is Integer, the content corresponds to the geographical mark, the value is HashMap, and the content corresponds to the IP address data mapping table of the geographical area.

The key of the second layer HashMap is String, the content corresponds to the IP address, the value is Integer, and the content corresponds to the shaping mark of the IP.

In addition to recording the shaping data structure of the IP address, the IP mapping cache table also saves the number of times the IP address is corresponding to being collected.

The principle of establishing and updating the IP mapping cache table is shown in FIG. 1 . The establishment of the IP mapping cache table is driven by the acquisition engine. Every time a piece of IP data information of a distributed collection point is received, the central situation analysis system will add the IP address into the IP mapping cache table, and IP mapping until the scale of the mapping cache table reaches 100 Ten thousand (that is, the number of IPs stored in it, which is a configurable value), and the IPs outside the mapping cache table are uniformly identified as ELSE, which not only controls the IP complexity, but also ensures that the total amount of IP information will not be lost. The establishment time of the IP mapping cache table in the present invention can basically be ignored.

In order to control the scale and efficiency of the IP address mapping cache table. When the size of the mapping cache table reaches 1 million (that is, the number of IPs stored in it is a configurable value), the IPs outside the mapping cache table are uniformly identified as ELSE, which not only controls the IP complexity, but also ensures the total amount of IP information There will be no loss. The establishment time of the IP mapping cache table in the present invention can basically be ignored.

The IP address mapping cache table adopts a dynamic update mechanism to update the IP comparison table according to the IP sorting of the previous cycle. Based on efficiency considerations, the IP comparison table will not be fully updated every cycle to obtain the top 100 IPs in traffic ranking. If the IP comparison table does not include these 100 IPs, it will be forced to join the IP comparison table. This solution ensures that the update time of the IP comparison table is within 10ms.

Preferably, step B calculates the address entropy values of each level respectively. After obtaining massive IP data information, the present invention adopts a hierarchical address entropy algorithm based on a layered network IP model.

IP address is the basic element of power information network, how to quantify and analyze the distribution of addresses is the foundation of security situation analysis. The address entropy model uses information entropy to measure the degree of dispersion or concentration of address distribution.

Information entropy (subsequently referred to as entropy) is a concept proposed by C.E. Shannon, the father of information theory, in 1948. He borrowed from the entropy in thermodynamics and made the average amount of information after excluding redundancy from information into information entropy. Information entropy is an important tool used in information theory to measure the degree of ordering of information. The value of information entropy is inversely proportional to the degree of ordering of information sources: the higher the degree of order, the lower the value of information entropy; the lower the degree of order, the higher the value of information entropy.

Applying the theory of information entropy to information network analysis, the embodiment of the present invention designs a calculation model of address entropy.

Set IP statistical set N _ip ={N _ip1 ,, N _ip2 ,, N _ip3 ,, ..., N _ipn }, N _ipn represents the number of occurrences of IP address n within a certain period of time, and the defined base is 2. For the convenience of display, Here, the value range of the entropy value can be limited between 0 and 1, so the original entropy value needs to be divided by logN. Therefore, according to the definition formula of entropy:

H(IP)=H(N _ip )=

in, Indicates the total number of occurrences of IP addresses during the observation period. According to the definition, the smaller the entropy value, the more concentrated the IP address distribution, and the larger the entropy value, the more discrete the IP address distribution.

Based on the IP hierarchy, we perform address entropy calculations.

Among them, the calculation formula of the base layer is:

Source address entropy: $h\left(\mathrm{SRC}\right)=\frac{(-{\mathrm{\&Sigma;}}_{i=1}^N\left(\frac{{\mathrm{no}}_{\mathrm{ipi}}}{\mathrm{the\; s}}\right){\log }_2\left(\frac{{\mathrm{no}}_{\mathrm{ipi}}}{\mathrm{the\; s}}\right))}{{\log }_2\mathrm{the\; s}},$

Destination address entropy: $h\left(\mathrm{DEST}\right)=\frac{(-{\mathrm{\&Sigma;}}_{i=1}^N\left(\frac{{\mathrm{no}}_{\mathrm{ipi}}}{\mathrm{the\; s}}\right){\log }_2\left(\frac{{\mathrm{no}}_{\mathrm{ipi}}}{\mathrm{the\; s}}\right))}{{\log }_2\mathrm{the\; s}}.$

in, Indicates the total number of occurrences of IP addresses during the observation period.

The calculation formula of the middle layer is:

H(MIDDLE)＝a*H(SRC)+b*H(DEST)

Wherein, the value range of a and b is [0, 1], and a+b=1. The values of a and b are set according to the specific practice of the network.

The global layer, that is, the formula for calculating the global address entropy value is:

The hierarchical address entropy algorithm can quickly obtain the global IP active situation of the network, and can also analyze the local IP active situation layer by layer. The basic composition of the IP address network, the IP active situation can reflect the network activities macroscopically, and the IP can be expressed through the entropy value active state (H),

The change of H value is time-series steady-state. The calculation of SSI is to obtain multiple H values in continuous time, and then predict the H value at the next moment. The SSI is obtained by the deviation between the predicted value and the actual value, thereby expressing the network security situation.

Preferably, step C continuously calculates the global address entropy value, periodically and continuously calculates and records the global address entropy value to form an entropy baseline, and observes and indexes the fluctuation of the global address entropy value through the deviation between the measured address entropy and the baseline predicted entropy value Condition. In the embodiment of the present invention, the entropy baseline is constructed by combining long-period analysis and short-period analysis.

Long-term baseline analysis is to divide a long period into multiple periods and calculate the average value of the global address entropy of the same period in each period. The average value of the global address entropy of these consecutive different periods forms the baseline; the baseline reflects the normal behavior of the network The change trend of the global address entropy value presented below, and once an abnormality occurs in the network, it will be directly reflected in the change of the global address entropy value.

The short-period baseline analysis is the actual measurement value of several sampling time points moving forward from the current time. It is a data queue composed of a set of global address entropy values, which represents the recent trend of the entire network address entropy. The global address entropy value of the next cycle can be calculated through the prediction algorithm, and the short-term sudden change of the global address entropy can be analyzed by comparing the measured value with the predicted value in the next cycle.

The method of establishing the long-term entropy baseline is as follows: take days as the cycle time, calculate the global entropy every 5 minutes, and form a set of entropy arrays with 288 points. The entropy value at the time point corresponding to the new day is the same as the original The weighted average of the baseline entropy values is obtained to obtain a new baseline entropy value, thus forming a dynamic long-period entropy baseline. The calculation method of the forecast value corresponding to the long-period entropy baseline is as follows: extract the entropy value corresponding to the current moment from the long-period entropy baseline, which is the long-period entropy forecast value at this moment.

The establishment method of the short-period entropy baseline is as follows: calculate the global entropy value every minute, update it in real time, and use the entropy values of the last 10 periods to form a set of entropy data with 10 points, thus forming a dynamic short-period entropy value baseline. The predicted value corresponding to the short-period entropy baseline is obtained by exponential smoothing method.

The exponential smoothing method is a time series analysis and prediction method developed on the basis of the moving average method. It predicts the future of the phenomenon by calculating the exponential smoothing value and cooperating with a certain time series prediction model. The principle is that the exponential smoothing value of any period is the weighted average of the actual observed value in this period and the exponential smoothing value of the previous period.

The formula for calculating the predicted entropy value corresponding to the short-period entropy value baseline is:

Let the entropy value sequence in the current short-period baseline be

y ₁ ,y ₂ ,y ₃ ,y ₄ ….y _t ,

Then the calculation method of predicted entropy value is:

Ht ₊₁ = _Ht +a( _yt - _Ht ).

Among them, a is the weighting system (0<a<1), and Ht is the predicted entropy value of the tth period.

Preferably, in the calculation of the security situation index in step D, the comprehensive deviation degree between the measured global address entropy value and the long-period entropy value baseline and the short-period entropy value baseline is converted into security situation index data.

In the embodiment of the present invention, the formula for calculating the security situation index (Secution Index, SSI) is:

Calculate the entropy value deviation rate μT according to the following expression:

${\mathrm{<span\; class="notranslate">\; \&mu;</span>}}_{\mathrm{<span\; class="notranslate">\; T</span>}}<span\; class="notranslate">\; =</span>\frac{\mathrm{<span\; class="notranslate">\; 1</span>}}{\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; *</span><span\; class="notranslate">\; (</span><span\; class="notranslate">\; |</span>{\mathrm{<span\; class="notranslate">\; h</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; h</span>}}_{\mathrm{<span\; class="notranslate">\; l</span>}}<span\; class="notranslate">\; |</span><span\; class="notranslate">\; /</span>{\mathrm{<span\; class="notranslate">\; h</span>}}_{\mathrm{<span\; class="notranslate">\; l</span>}}<span\; class="notranslate">\; +</span><span\; class="notranslate">\; |</span>{\mathrm{<span\; class="notranslate">\; h</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; h</span>}}_{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; |</span><span\; class="notranslate">\; /</span>{\mathrm{<span\; class="notranslate">\; h</span>}}_{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; ,</span>$

Among them, H is the measured global entropy value, H _l is the predicted entropy value obtained based on the long-period entropy value baseline, and H _s is the predicted entropy value obtained based on the short-period entropy value baseline.

According to the following method, calculate the security situation index SSI =

Preferably, in Step E, the abnormality determination of the security situation, when the security situation index is greater than a specified threshold, it can be determined that the network situation is abnormal. At this time, the layer where the network anomaly occurs is located by comparing the address entropy values of each layer. By sorting the address entropy values of each level, it is determined that the network layer with the largest address entropy value is the location where the network security situation is abnormal.

The embodiment of the present invention provides a security situation analysis method. A. Collect the log information of each device in the network through the SYSLOG protocol and the Flow protocol, and extract IP address information therefrom, and layer the obtained IP addresses based on geographic information or business information , to obtain multiple levels; B. Calculate the address entropy value of each level separately; C. Continuously calculate the value of the global address entropy, calculate the reference point of the address entropy value with a time period of 5 minutes, and use the reference point of the address entropy value for a long time in history The collection of data establishes a long-period entropy baseline, and the collection of address entropy reference point data at the latest time establishes a short-period entropy baseline; D, combining the measured value of the global address entropy with the long-period entropy baseline and short The comprehensive deviation degree of the cycle entropy baseline is converted into security situation indicator data; E. When the security situation indicator exceeds the preset threshold, it is determined that the security situation is abnormal, and the abnormality is located by comparing the address entropy values of each level. Accurate and efficient security situation analysis is realized, and the problems of low accuracy and processing efficiency of the existing network security situation analysis methods are solved.

Those of ordinary skill in the art can understand that all or part of the steps of the above-mentioned embodiments can be implemented using a computer program flow, the computer program can be stored in a computer-readable storage medium, and the computer program can be run on a corresponding hardware platform (such as system, device, device, device, etc.), and when executed, includes one or a combination of the steps of the method embodiment.

Optionally, all or part of the steps in the above embodiments can also be implemented using integrated circuits, and these steps can be fabricated into individual integrated circuit modules, or multiple modules or steps among them can be fabricated into a single integrated circuit module accomplish. As such, the present invention is not limited to any specific combination of hardware and software.

The devices/functional modules/functional units in the above embodiments can be realized by general-purpose computing devices, and they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices.

When each device/functional module/functional unit in the above-mentioned embodiments is realized in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. The computer-readable storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, and the like.

Any person familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present invention, and all should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope described in the claims.

Claims (10)

1. A network security situation analysis method, characterized in that the specific steps include: A. Collect the log information of each device in the network through the SYSLOG protocol and the Flow protocol, and extract the IP address information from it, and stratify the obtained IP addresses based on geographic information or business information to obtain multiple levels; B. Calculate the address entropy value of each level separately; C. Continuously calculate the value of the global address entropy, calculate the reference point of the address entropy value with a time period of 5 minutes, establish a long-term entropy value baseline based on the collection of historical address entropy value reference point data for a long time, and use the latest address entropy value The collection of benchmark data establishes a short-period entropy baseline; D. Converting the comprehensive deviation between the measured value of the global address entropy and the long-period entropy baseline and the short-period entropy baseline into security situation indicator data; E. When the security situation index exceeds the preset threshold, it is determined that the security situation is abnormal, and the abnormality is located by comparing the address entropy values of each level. 2. the network security situation analysis method according to claim 1, is characterized in that, collects each device log information in the network by SYSLOG agreement and Flow agreement, and therefrom extracts IP address information and comprises: Distributed collection points extract IP addresses from any or more of the following information: Network security device logs, application system logs, routing and switching device flow information, The IP address includes a source IP address and a destination IP address. 3. the network security situation analysis method according to claim 1, is characterized in that, collects each device log information in the network by SYSLOG agreement and Flow agreement, and therefrom extracts IP address information and also comprises: obtain a geotag for said IP address; Mapping the IP address into a plastic data structure, storing the geographical mark of the plastic data structure and the IP address in a multi-layer nested HashMap data structure; The shaping data structure of the IP address is added to the IP mapping cache table, and the IP mapping cache table stores the shaping data structure of the IP address and the number of times the IP address is collected. 4. The network security situation analysis method according to claim 3, characterized in that the method further comprises: According to the preset update cycle, periodically sort the IP addresses in the IP mapping cache table in the previous cycle according to the traffic of each IP address; The number of times of collection corresponding to the higher-ranked IP addresses after sorting is updated. 5. The network security situation analysis method according to claim 1, wherein calculating the address entropy values of each level respectively comprises: The source address entropy of the base layer is calculated according to the following expression: $\mathrm{<span\; class="notranslate">\; h</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; SRC</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\frac{<span\; class="notranslate">\; (</span>{<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; N</span>}}<span\; class="notranslate">\; (</span>\frac{{\mathrm{<span\; class="notranslate">\; no</span>}}_{\mathrm{<span\; class="notranslate">\; ipi</span>}}}{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; )</span>{\mathrm{<span\; class="notranslate">\; log</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; (</span>\frac{{\mathrm{<span\; class="notranslate">\; no</span>}}_{\mathrm{<span\; class="notranslate">\; ipi</span>}}}{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; )</span>}{{\mathrm{<span\; class="notranslate">\; log</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}\mathrm{<span\; class="notranslate">\; S</span>}}<span\; class="notranslate">\; ,</span>$ Calculate the destination address entropy of the base layer according to the following expression: $\mathrm{<span\; class="notranslate">\; h</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; DEST</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\frac{<span\; class="notranslate">\; (</span>{<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; N</span>}}<span\; class="notranslate">\; (</span>\frac{{\mathrm{<span\; class="notranslate">\; no</span>}}_{\mathrm{<span\; class="notranslate">\; ipi</span>}}}{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; )</span>{\mathrm{<span\; class="notranslate">\; log</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; (</span>\frac{{\mathrm{<span\; class="notranslate">\; no</span>}}_{\mathrm{<span\; class="notranslate">\; ipi</span>}}}{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; )</span>}{{\mathrm{<span\; class="notranslate">\; log</span>}}_{\mathrm{<span\; class="notranslate">\; 2</span>}}\mathrm{<span\; class="notranslate">\; S</span>}}<span\; class="notranslate">\; ,</span>$ in, Indicates the total number of occurrences of IP addresses during the observation period; The entropy of the intermediate layer is calculated according to the following expression: H(MIDDLE)=a*H(SRC)+b*H(DEST), Wherein, the value range of a and b is [0, 1], and a+b=1; The entropy of the global layer is calculated according to the following expression: 6. The network security situation analysis method according to claim 1, characterized in that, establishing a long-period entropy baseline with a collection of address entropy benchmark data for a long time in history comprises: Taking a longer cycle as the cycle length, calculate the global entropy value after each first time interval, and form a group of entropy value arrays with multiple points; A weighted average is performed on the entropy value of this longer period and the baseline entropy value of the last longer period to obtain a new baseline entropy value, and a plurality of the baseline entropy values form a dynamic long-period entropy baseline. 7. The network security situation analysis method according to claim 6, wherein the longer period is a time period of one day or more. 8. The network security situation analysis method according to claim 1, characterized in that, establishing a short-period entropy baseline with the collection of address entropy benchmark data of the latest time comprises: Calculate the global entropy value periodically according to a shorter cycle; The entropy data is formed by the global entropy values of the most recent multiple periods, and the curve formed by the entropy data is the short-period entropy baseline. 9. The network security situation analysis method according to claim 1, wherein converting the address entropy value into security situation index data comprises: Extracting the entropy value corresponding to the current moment from the long-period entropy value baseline, which is the long-period entropy prediction value at the current moment; The entropy prediction value corresponding to the short-period baseline is obtained according to the following expression: H _t+1 =H _t +a(y _t -H _t ), Let the entropy value sequence in the current short-period baseline be: y ₁ , y ₂ , y ₃ , y ₄ .... y _t is the entropy value sequence in the current short-period baseline, a is the weighting system (0<a<1), and Ht is the predicted entropy value in the t-th period; Calculate the entropy value deviation rate μ _T according to the following expression: ${\mathrm{<span\; class="notranslate">\; \&mu;</span>}}_{\mathrm{<span\; class="notranslate">\; T</span>}}<span\; class="notranslate">\; =</span>\frac{\mathrm{<span\; class="notranslate">\; 1</span>}}{\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; *</span><span\; class="notranslate">\; (</span><span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; h</span>}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; h</span>}}_{\mathrm{<span\; class="notranslate">\; l</span>}}<span\; class="notranslate">\; |</span><span\; class="notranslate">\; /</span>{\mathrm{<span\; class="notranslate">\; h</span>}}_{\mathrm{<span\; class="notranslate">\; l</span>}}<span\; class="notranslate">\; +</span><span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; h</span>}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; h</span>}}_{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; |</span><span\; class="notranslate">\; /</span>{\mathrm{<span\; class="notranslate">\; h</span>}}_{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; ,</span>$ Wherein, H is the measured global entropy value, H ₁ is the predicted entropy value obtained based on the long-period entropy value baseline, and H _s is the predicted entropy value obtained based on the short-period entropy value baseline; The Security Situation Indicator (SSI) is converted according to the following expression: 10. The network security situation analysis method according to claim 1, wherein when an abnormality occurs in the SSI, the network layer with the largest address entropy value is determined to be the network security situation abnormality by sorting the address entropy values of each level Location.