CN110471975B - Internet of things situation awareness calling method and device - Google Patents
Internet of things situation awareness calling method and device Download PDFInfo
- Publication number
- CN110471975B CN110471975B CN201910757457.XA CN201910757457A CN110471975B CN 110471975 B CN110471975 B CN 110471975B CN 201910757457 A CN201910757457 A CN 201910757457A CN 110471975 B CN110471975 B CN 110471975B
- Authority
- CN
- China
- Prior art keywords
- situation
- information
- data
- rule
- single key
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/25—Integrating or interfacing systems involving database management systems
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/25—Integrating or interfacing systems involving database management systems
- G06F16/258—Data format conversion from or to a database
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/27—Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/04—Forecasting or optimisation specially adapted for administrative or management purposes, e.g. linear programming or "cutting stock problem"
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
Abstract
The invention provides a method and a device for calling situation awareness of the Internet of things, which encapsulate interfaces for collecting different information sources, facilitate calling of clients, obtain data streams in a unified format through preprocessing, extract high-frequency project group elements from the data streams, generate high-frequency association rules, send the high-frequency association rules into situation assessment for assessment and quantification, obtain situation values of single equipment and local networks through fusion with different assessment systems and fuzzy processing of the data elements, obtain the situation values of the whole device by combining the architecture composition of the whole network, introduce the situation values of different levels into a neural network model for prediction, finally visually display prediction results, fully assess the whole distributed system and each single equipment, establish association of each equipment and each layer, perform rule detection on different rules, calculate risk values, and further scientifically predict future devices, provides valuable reference suggestions for users.
Description
Technical Field
The application relates to the technical field of network security, in particular to a method and a device for calling situation awareness of the Internet of things.
Background
The situation awareness function needs to be called in the next generation of networks including car networking, internet of things, cloud networks, industrial internet and video monitoring networks, and the situation awareness platform is complex and expensive to build, so that a service provider capable of providing situation awareness service needs to virtualize situation awareness into plug-in or component, and customers can conveniently call the situation awareness.
Meanwhile, the existing situation awareness technology adopts simple situation understanding, so that a safety situation assessment result of the whole device can be obtained, a situation assessment report cannot be quantitatively given, safety situation prediction cannot be performed based on the situation assessment result, and the utilization value of the technology is very limited.
The method and the system aim to fully evaluate the whole Internet of things system and each single device in an algorithm, and can establish association with each device and each layer based on the given situation value, perform rule detection on different rules, and calculate the risk value, so that future devices can be scientifically predicted, and valuable reference suggestions are provided for users.
Disclosure of Invention
The invention aims to provide a method and a device for calling the situation awareness of the Internet of things, which are used for packaging interfaces for acquiring different information sources, facilitating calling of clients, obtaining a data stream in a unified format through preprocessing, extracting high-frequency project group elements from the data stream, generating high-frequency association rules, sending the high-frequency association rules into situation assessment for assessment and quantification, obtaining situation values of single equipment and a local network through fusion with different assessment systems and fuzzy processing of the data elements, combining the framework composition of the whole network to obtain the situation values of the whole device, importing the situation values of different layers into a neural network model for prediction, and finally visually displaying a prediction result.
In a first aspect, the application provides a method for calling situational awareness of an internet of things, the method including:
the interfaces capable of receiving different information sources are virtualized into an external data interface, so that other networks can be conveniently called, the different information sources are mutually independent, the interfaces of other information sources cannot be found, and the corresponding interfaces are self-adaptively corresponding; acquiring running state data of sensors, information platforms and detection equipment from different sources through an external data interface;
after receiving the collected data, clearing redundant information in the data, converting the data format into a uniform format according to the type of a source, dividing the uniform format into corresponding fields, and combining the fields into a data stream;
extracting elements from the merged data stream, finding information of behavior action, access object, source address and instantaneous flow included in the elements, discovering high-frequency project group, generating high-frequency association rule according to the information corresponding to the high-frequency project group, increasing the corresponding weight of the high-frequency project group, and forming a frequent pattern tree structure;
judging whether the rule queue is empty or not, if so, performing matching query with the sub-rule base, taking the queried sub-rule as a specified association rule, and performing rule detection according to the sub-rule; if not, carrying out rule detection; the rule detects and calculates a risk value and sends out corresponding alarm information;
according to the frequent pattern tree structure, calling a distributed database, inquiring the asset situation information adjacent to the address, inquiring the asset situation information of the same layer to which the access object belongs, and inquiring the asset situation information with similar flow speed and flow total;
judging whether a single key device has a security vulnerability identical to the adjacent similar assets of the address, judging whether a concurrent thread, a bandwidth, a network topology and an access frequency of the single key device have an alarm identical to the assets of the same layer, judging whether the inflow increase rate, the distribution proportion of different protocol data packets and the distribution proportion of different size data packets of the single key device have the same change identical to the assets similar to the flow speed and the flow total amount, and calculating the security situation value of the single key device;
and the safety situation value calculation considers the weight Vs of the equipment H, the services in all the services opened by the equipment, the safety situation value Rservice of the service used by the equipment, the defense strength DF on the equipment and the time t in the Internet of things to obtain the safety situation value of a single key equipment in the Internet of things
When R isHostThe larger the value of (A), the larger the threat degree of the equipment H is, and the defense strategy needs to be adjusted in time;
forming a local network by a plurality of adjacent single key devices or a plurality of single key devices with service interaction, calling a distributed database again, introducing fuzzy processing according to service priority to calculate the security situation value of the local network by using the security loophole, concurrent threads, bandwidth, network topology, access frequency, inflow increase rate, data packet distribution proportion of different protocols and data packet distribution proportion of different sizes corresponding to each key device in the local network;
requesting a network topological relation from a distributed equalization server, and calculating a security situation value of the whole network through fuzzy processing according to the topological relations of a plurality of local networks;
respectively importing security situation values of a single key device, a local network and the whole network into a neural network model in a distributed equalization server, obtaining the prediction about the source and the attack range of an attacker in a future period through deduction of the neural network model, and returning the prediction result by the distributed equalization server;
and sending the security situation values of the single key equipment, the local network and the whole network, and the prediction results of the attacker source and the attack range for visual display.
With reference to the first aspect, in a first possible implementation manner of the first aspect, the extracting elements from the merged data stream includes: and calling an evaluation model, an association rule and an index library of the past historical data, and extracting element information from corresponding fields of the data stream.
With reference to the first aspect, in a second possible implementation manner of the first aspect, the removing redundant information in the data, converting the data format into a uniform format according to the type of the source, and processing based on Map Reduce distributed parallel computing.
With reference to the first aspect, in a third possible implementation manner of the first aspect, the fuzzy processing calculation is based on a method that combines a D-S theory and a fuzzy set, and calculates a probability that an attack is supported.
In a second aspect, the present application provides an internet of things situation awareness invoking device, the device comprising:
the external interface unit is used for virtualizing the interfaces capable of receiving different information sources into an external data interface, so that other networks can be conveniently called, the different information sources are mutually independent, the interfaces of other information sources cannot be found, and the corresponding interfaces are self-adaptively corresponding; acquiring running state data of sensors, information platforms and detection equipment from different sources through an external data interface;
the preprocessing unit is used for clearing redundant information in the data after receiving the acquired data, converting the data format into a uniform format according to the type of a source, dividing the uniform format into corresponding fields and combining the fields into a data stream;
the situation understanding unit is used for extracting elements from the merged data stream, finding information of behavior actions, access objects, source addresses and instantaneous flow included in the elements, discovering high-frequency project groups from the information, generating high-frequency association rules according to the information corresponding to the high-frequency project groups, increasing the corresponding weights of the high-frequency project groups and forming a frequent pattern tree structure;
judging whether the rule queue is empty or not, if so, performing matching query with the sub-rule base, taking the queried sub-rule as a specified association rule, and performing rule detection according to the sub-rule; if not, carrying out rule detection; the rule detects and calculates a risk value and sends out corresponding alarm information;
the situation evaluation unit is used for calling the distributed database according to the frequent pattern tree structure, inquiring the asset situation information with adjacent addresses, inquiring the asset situation information of the access object belonging to the same layer, and inquiring the asset situation information with similar flow speed and flow total; judging whether a single key device has a security vulnerability identical to the adjacent similar assets of the address, judging whether a concurrent thread, a bandwidth, a network topology and an access frequency of the single key device have an alarm identical to the assets of the same layer, judging whether the inflow increase rate, the distribution proportion of different protocol data packets and the distribution proportion of different size data packets of the single key device have the same change identical to the assets similar to the flow speed and the flow total amount, and calculating the security situation value of the single key device;
and the safety situation value calculation considers the weight Vs of the equipment H, the services in all the services opened by the equipment, the safety situation value Rservice of the service used by the equipment, the defense strength DF on the equipment and the time t in the Internet of things to obtain the safety situation value of a single key equipment in the Internet of things
When R isHostThe larger the value of (A), the larger the threat degree of the equipment H is, and the defense strategy needs to be adjusted in time;
forming a local network by a plurality of adjacent single key devices or a plurality of single key devices with service interaction, calling a distributed database again, introducing fuzzy processing according to service priority to calculate the security situation value of the local network by using the security loophole, concurrent threads, bandwidth, network topology, access frequency, inflow increase rate, data packet distribution proportion of different protocols and data packet distribution proportion of different sizes corresponding to each key device in the local network;
requesting a network topological relation from a distributed equalization server, and calculating a security situation value of the whole network through fuzzy processing according to the topological relations of a plurality of local networks;
the situation prediction unit is used for respectively importing the security situation values of the single key device, the local network and the whole network into a neural network model in the distributed equalization server, obtaining the prediction about the source and the attack range of an attacker in a future period of time through deduction of the neural network model, and returning the prediction result by the distributed equalization server;
and the situation output unit is used for sending the safety situation values of the single key equipment, the local network and the whole network, the attacker source and the attack range prediction results for visual display.
With reference to the second aspect, in a first possible implementation manner of the second aspect, the extracting, by the situation understanding unit, elements from the merged data stream includes: and calling an evaluation model, an association rule and an index library of the past historical data, and extracting element information from corresponding fields of the data stream.
With reference to the second aspect, in a second possible implementation manner of the second aspect, the preprocessing unit removes redundant information in the data, converts the data format into a uniform format according to the type of the source, and is based on Map Reduce distributed parallel computing processing.
With reference to the second aspect, in a third possible implementation manner of the second aspect, the situation assessment unit calculates the probability of attack occurrence support based on a method that combines a D-S theory and a fuzzy set.
The invention provides a method and a device for calling situation awareness of the Internet of things, which encapsulate interfaces for collecting different information sources, facilitate calling of customers, obtain data streams in a unified format through preprocessing, extract high-frequency project group elements from the data streams, generate high-frequency association rules, send the high-frequency association rules into situation assessment for assessment and quantification, obtain situation values of single equipment and local networks through fusion with different assessment systems and fuzzy processing of the data elements, obtain the situation values of the whole device by combining the architecture composition of the whole network, introduce the situation values of different levels into a neural network model for prediction, finally visually display prediction results, fully assess the whole Internet of things system and each single equipment, establish association of each equipment and each layer, perform rule detection on different rules, calculate risk values, and further scientifically predict future devices, provides valuable reference suggestions for users.
Drawings
In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings needed to be used in the embodiments will be briefly described below, and it is obvious for those skilled in the art that other drawings can be obtained according to these drawings without creative efforts.
FIG. 1 is a flow chart of a situation awareness calling method of the Internet of things according to the invention;
fig. 2 is an architecture diagram of the internet of things situation awareness invoking device of the present invention.
Detailed Description
The preferred embodiments of the present invention will be described in detail below with reference to the accompanying drawings so that the advantages and features of the present invention can be more easily understood by those skilled in the art, and the scope of the present invention will be more clearly and clearly defined.
Fig. 1 is a flowchart of a method for calling situational awareness of an internet of things provided by the present application, where the method includes:
the interfaces capable of receiving different information sources are virtualized into an external data interface, so that other networks can be conveniently called, the different information sources are mutually independent, the interfaces of other information sources cannot be found, and the corresponding interfaces are self-adaptively corresponding; acquiring running state data of sensors, information platforms and detection equipment from different sources through an external data interface;
after receiving the collected data, clearing redundant information in the data, converting the data format into a uniform format according to the type of a source, dividing the uniform format into corresponding fields, and combining the fields into a data stream;
extracting elements from the merged data stream, finding information of behavior action, access object, source address and instantaneous flow included in the elements, discovering high-frequency project group, generating high-frequency association rule according to the information corresponding to the high-frequency project group, increasing the corresponding weight of the high-frequency project group, and forming a frequent pattern tree structure;
judging whether the rule queue is empty or not, if so, performing matching query with the sub-rule base, taking the queried sub-rule as a specified association rule, and performing rule detection according to the sub-rule; if not, carrying out rule detection; the rule detects and calculates a risk value and sends out corresponding alarm information;
according to the frequent pattern tree structure, calling a distributed database, inquiring the asset situation information adjacent to the address, inquiring the asset situation information of the same layer to which the access object belongs, and inquiring the asset situation information with similar flow speed and flow total;
judging whether a single key device has a security vulnerability identical to the adjacent similar assets of the address, judging whether a concurrent thread, a bandwidth, a network topology and an access frequency of the single key device have an alarm identical to the assets of the same layer, judging whether the inflow increase rate, the distribution proportion of different protocol data packets and the distribution proportion of different size data packets of the single key device have the same change identical to the assets similar to the flow speed and the flow total amount, and calculating the security situation value of the single key device;
and the safety situation value calculation considers the weight Vs of the equipment H, the services in all the services opened by the equipment, the safety situation value Rservice of the service used by the equipment, the defense strength DF on the equipment and the time t in the Internet of things to obtain the safety situation value of a single key equipment in the Internet of things
When R isHostThe larger the value of (A), the larger the threat degree of the equipment H is, and the defense strategy needs to be adjusted in time;
forming a local network by a plurality of adjacent single key devices or a plurality of single key devices with service interaction, calling a distributed database again, introducing fuzzy processing according to service priority to calculate the security situation value of the local network by using the security loophole, concurrent threads, bandwidth, network topology, access frequency, inflow increase rate, data packet distribution proportion of different protocols and data packet distribution proportion of different sizes corresponding to each key device in the local network;
requesting a network topological relation from a distributed equalization server, and calculating a security situation value of the whole network through fuzzy processing according to the topological relations of a plurality of local networks;
respectively importing security situation values of a single key device, a local network and the whole network into a neural network model in a distributed equalization server, obtaining the prediction about the source and the attack range of an attacker in a future period through deduction of the neural network model, and returning the prediction result by the distributed equalization server;
and sending the security situation values of the single key equipment, the local network and the whole network, and the prediction results of the attacker source and the attack range for visual display.
In some preferred embodiments, said extracting elements from the merged data stream comprises: and calling an evaluation model, an association rule and an index library of the past historical data, and extracting element information from corresponding fields of the data stream.
In some preferred embodiments, the removing of redundant information in the data, converting the data format into a uniform format according to the type of the source, is based on Map Reduce distributed parallel computing processing.
In some preferred embodiments, the fuzzy processing calculation is based on a method of combining D-S theory and fuzzy sets, and the probability of attack occurrence support is calculated.
Fig. 2 is an architecture diagram of an internet of things situation awareness invoking device provided in the present application, the device including:
the external interface unit is used for virtualizing the interfaces capable of receiving different information sources into an external data interface, so that other networks can be conveniently called, the different information sources are mutually independent, the interfaces of other information sources cannot be found, and the corresponding interfaces are self-adaptively corresponding; acquiring running state data of sensors, information platforms and detection equipment from different sources through an external data interface;
the preprocessing unit is used for clearing redundant information in the data after receiving the acquired data, converting the data format into a uniform format according to the type of a source, dividing the uniform format into corresponding fields and combining the fields into a data stream;
the situation understanding unit is used for extracting elements from the merged data stream, finding information of behavior actions, access objects, source addresses and instantaneous flow included in the elements, discovering high-frequency project groups from the information, generating high-frequency association rules according to the information corresponding to the high-frequency project groups, increasing the corresponding weights of the high-frequency project groups and forming a frequent pattern tree structure;
judging whether the rule queue is empty or not, if so, performing matching query with the sub-rule base, taking the queried sub-rule as a specified association rule, and performing rule detection according to the sub-rule; if not, carrying out rule detection; the rule detects and calculates a risk value and sends out corresponding alarm information;
the situation evaluation unit is used for calling the distributed database according to the frequent pattern tree structure, inquiring the asset situation information with adjacent addresses, inquiring the asset situation information of the access object belonging to the same layer, and inquiring the asset situation information with similar flow speed and flow total; judging whether a single key device has a security vulnerability identical to the adjacent similar assets of the address, judging whether a concurrent thread, a bandwidth, a network topology and an access frequency of the single key device have an alarm identical to the assets of the same layer, judging whether the inflow increase rate, the distribution proportion of different protocol data packets and the distribution proportion of different size data packets of the single key device have the same change identical to the assets similar to the flow speed and the flow total amount, and calculating the security situation value of the single key device;
and the safety situation value calculation considers the weight Vs of the equipment H, the services in all the services opened by the equipment, the safety situation value Rservice of the service used by the equipment, the defense strength DF on the equipment and the time t in the Internet of things to obtain the safety situation value of a single key equipment in the Internet of things
When R isHostThe larger the value of (A), the larger the threat degree of the equipment H is, and the defense strategy needs to be adjusted in time;
forming a local network by a plurality of adjacent single key devices or a plurality of single key devices with service interaction, calling a distributed database again, introducing fuzzy processing according to service priority to calculate the security situation value of the local network by using the security loophole, concurrent threads, bandwidth, network topology, access frequency, inflow increase rate, data packet distribution proportion of different protocols and data packet distribution proportion of different sizes corresponding to each key device in the local network;
requesting a network topological relation from a distributed equalization server, and calculating a security situation value of the whole network through fuzzy processing according to the topological relations of a plurality of local networks;
the situation prediction unit is used for respectively importing the security situation values of the single key device, the local network and the whole network into a neural network model in the distributed equalization server, obtaining the prediction about the source and the attack range of an attacker in a future period of time through deduction of the neural network model, and returning the prediction result by the distributed equalization server;
and the situation output unit is used for sending the safety situation values of the single key equipment, the local network and the whole network, the attacker source and the attack range prediction results for visual display.
In some preferred embodiments, the situation understanding unit extracts elements from the merged data stream, including: and calling an evaluation model, an association rule and an index library of the past historical data, and extracting element information from corresponding fields of the data stream.
In some preferred embodiments, the preprocessing unit removes redundant information in the data, converts the data format into a uniform format according to the type of the source, and is based on Map Reduce distributed parallel computing processing.
In some preferred embodiments, the situation assessment unit calculates the probability of attack occurrence support based on a method of combining D-S theory and fuzzy sets.
In specific implementation, the present invention further provides a computer storage medium, where the computer storage medium may store a program, and the program may include some or all of the steps in the embodiments of the present invention when executed. The storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM) or a Random Access Memory (RAM).
Those skilled in the art will readily appreciate that the techniques of the embodiments of the present invention may be implemented as software plus a required general purpose hardware platform. Based on such understanding, the technical solutions in the embodiments of the present invention may be embodied in the form of a software product, which may be stored in a storage medium, such as a ROM/RAM, a magnetic disk, an optical disk, etc., and includes several instructions for enabling a computer device (which may be a personal computer, a server, or a network device, etc.) to execute the method according to the embodiments or some parts of the embodiments.
The same and similar parts in the various embodiments of the present specification may be referred to each other. In particular, for the embodiments, since they are substantially similar to the method embodiments, the description is simple, and the relevant points can be referred to the description in the method embodiments.
The above-described embodiments of the present invention should not be construed as limiting the scope of the present invention.
Claims (6)
1. An Internet of things situation awareness invoking method is characterized by comprising the following steps:
the interfaces capable of receiving different information sources are virtualized into an external data interface, so that other networks can be conveniently called, the different information sources are mutually independent, the interfaces of other information sources cannot be found, and the corresponding interfaces are self-adaptively corresponding; acquiring running state data of sensors, information platforms and detection equipment from different sources through an external data interface;
after receiving the collected data, clearing redundant information in the data, converting the data format into a uniform format according to the type of a source, dividing the uniform format into corresponding fields, and combining the fields into a data stream;
extracting elements from the merged data stream, finding information of behavior action, access object, source address and instantaneous flow included in the elements, discovering high-frequency project group, generating high-frequency association rule according to the information corresponding to the high-frequency project group, increasing the corresponding weight of the high-frequency project group, and forming a frequent pattern tree structure;
judging whether the rule queue is empty or not, if so, performing matching query with the sub-rule base, taking the queried sub-rule as a specified association rule, and performing rule detection according to the sub-rule; if not, carrying out rule detection; the rule detects and calculates a risk value and sends out corresponding alarm information;
according to the frequent pattern tree structure, calling a distributed database, inquiring the asset situation information adjacent to the address, inquiring the asset situation information of the same layer to which the access object belongs, and inquiring the asset situation information with similar flow speed and flow total;
judging whether a single key device has a security vulnerability identical to the adjacent similar assets of the address, judging whether a concurrent thread, a bandwidth, a network topology and an access frequency of the single key device have an alarm identical to the assets of the same layer, judging whether the inflow increase rate, the distribution proportion of different protocol data packets and the distribution proportion of different size data packets of the single key device have the same change identical to the assets similar to the flow speed and the flow total amount, and calculating the security situation value of the single key device;
and the safety situation value calculation considers the weight Vs of the equipment H, the services in all the services opened by the equipment, the safety situation value Rservice of the service used by the equipment, the defense strength DF on the equipment and the time t in the Internet of things to obtain the safety situation value of a single key equipment in the Internet of things
When R isHostThe larger the value of (A), the larger the threat degree of the equipment H is, and the defense strategy needs to be adjusted in time;
forming a local network by a plurality of adjacent single key devices or a plurality of single key devices with service interaction, calling a distributed database again, introducing fuzzy processing according to service priority to calculate the security situation value of the local network by using the security loophole, concurrent threads, bandwidth, network topology, access frequency, inflow increase rate, data packet distribution proportion of different protocols and data packet distribution proportion of different sizes corresponding to each key device in the local network;
requesting a network topological relation from a distributed equalization server, and calculating a security situation value of the whole network through fuzzy processing according to the topological relations of a plurality of local networks;
respectively importing security situation values of a single key device, a local network and the whole network into a neural network model in a distributed equalization server, obtaining the prediction about the source and the attack range of an attacker in a future period through deduction of the neural network model, and returning the prediction result by the distributed equalization server;
sending the security situation values of a single key device, a local network and the whole network, and the prediction results of the attacker source and the attack range for visual display;
the extracting elements from the merged data stream includes: and calling an evaluation model, an association rule and an index library of the past historical data, and extracting element information from corresponding fields of the data stream.
2. The method of claim 1, wherein the removing of redundant information from the data, the converting of the data format to a unified format based on the type of source, is based on a Map Reduce distributed parallel computing process.
3. The method of claim 1, wherein the fuzzy processing calculation is based on a method of combining D-S theory and fuzzy sets, and calculates the probability of attack support.
4. An internet of things situation awareness invoking device, the device comprising:
the external interface unit is used for virtualizing the interfaces capable of receiving different information sources into an external data interface, so that other networks can be conveniently called, the different information sources are mutually independent, the interfaces of other information sources cannot be found, and the corresponding interfaces are self-adaptively corresponding; acquiring running state data of sensors, information platforms and detection equipment from different sources through an external data interface;
the preprocessing unit is used for clearing redundant information in the data after receiving the acquired data, converting the data format into a uniform format according to the type of a source, dividing the uniform format into corresponding fields and combining the fields into a data stream;
the situation understanding unit is used for extracting elements from the merged data stream, finding information of behavior actions, access objects, source addresses and instantaneous flow included in the elements, discovering high-frequency project groups from the information, generating high-frequency association rules according to the information corresponding to the high-frequency project groups, increasing the corresponding weights of the high-frequency project groups and forming a frequent pattern tree structure;
judging whether the rule queue is empty or not, if so, performing matching query with the sub-rule base, taking the queried sub-rule as a specified association rule, and performing rule detection according to the sub-rule; if not, carrying out rule detection; the rule detects and calculates a risk value and sends out corresponding alarm information;
the situation evaluation unit is used for calling the distributed database according to the frequent pattern tree structure, inquiring the asset situation information with adjacent addresses, inquiring the asset situation information of the access object belonging to the same layer, and inquiring the asset situation information with similar flow speed and flow total; judging whether a single key device has a security vulnerability identical to the adjacent similar assets of the address, judging whether a concurrent thread, a bandwidth, a network topology and an access frequency of the single key device have an alarm identical to the assets of the same layer, judging whether the inflow increase rate, the distribution proportion of different protocol data packets and the distribution proportion of different size data packets of the single key device have the same change identical to the assets similar to the flow speed and the flow total amount, and calculating the security situation value of the single key device;
and the safety situation value calculation considers the weight Vs of the equipment H, the services in all the services opened by the equipment, the safety situation value Rservice of the service used by the equipment, the defense strength DF on the equipment and the time t in the Internet of things to obtain the safety situation value of a single key equipment in the Internet of things
When R isHostThe larger the value of (A), the larger the threat degree of the equipment H is, and the defense strategy needs to be adjusted in time;
forming a local network by a plurality of adjacent single key devices or a plurality of single key devices with service interaction, calling a distributed database again, introducing fuzzy processing according to service priority to calculate the security situation value of the local network by using the security loophole, concurrent threads, bandwidth, network topology, access frequency, inflow increase rate, data packet distribution proportion of different protocols and data packet distribution proportion of different sizes corresponding to each key device in the local network;
requesting a network topological relation from a distributed equalization server, and calculating a security situation value of the whole network through fuzzy processing according to the topological relations of a plurality of local networks;
the situation prediction unit is used for respectively importing the security situation values of the single key device, the local network and the whole network into a neural network model in the distributed equalization server, obtaining the prediction about the source and the attack range of an attacker in a future period of time through deduction of the neural network model, and returning the prediction result by the distributed equalization server;
the situation output unit is used for sending the safety situation values of the single key equipment, the local network and the whole network, the source of the attacker and the prediction result of the attack range out for visual display;
the situation understanding unit extracts elements from the merged data stream, including: and calling an evaluation model, an association rule and an index library of the past historical data, and extracting element information from corresponding fields of the data stream.
5. The apparatus of claim 4, wherein the preprocessing unit removes redundant information from the data, converts the data format to a uniform format according to the type of source, and is based on a Map Reduce distributed parallel computing process.
6. The apparatus according to claim 4, wherein the situation assessment unit is configured to compute the probability of attack support based on a method combining D-S theory and fuzzy set.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910757457.XA CN110471975B (en) | 2019-08-16 | 2019-08-16 | Internet of things situation awareness calling method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910757457.XA CN110471975B (en) | 2019-08-16 | 2019-08-16 | Internet of things situation awareness calling method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN110471975A CN110471975A (en) | 2019-11-19 |
| CN110471975B true CN110471975B (en) | 2022-05-03 |
Family
ID=68510850
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910757457.XA Active CN110471975B (en) | 2019-08-16 | 2019-08-16 | Internet of things situation awareness calling method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110471975B (en) |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114065220B (en) * | 2021-11-25 | 2022-11-22 | 国网四川省电力公司成都供电公司 | Dual-level analysis situation assessment method based on distributed system |
| CN117014230A (en) * | 2023-10-07 | 2023-11-07 | 天云融创数据科技（北京）有限公司 | Network security situation awareness method and system based on big data |
Family Cites Families (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102263410B (en) * | 2010-05-31 | 2015-01-14 | 河南省电力公司 | Security risk assessment model, assessment method and assessment parameter determining method |
| CN102624696B (en) * | 2011-12-27 | 2014-11-05 | 中国航天科工集团第二研究院七〇六所 | Network security situation evaluation method |
| CN102821007B (en) * | 2012-08-06 | 2016-12-21 | 河南科技大学 | A kind of network security situation sensing system based on Autonomic computing and processing method thereof |
| WO2016172514A1 (en) * | 2015-04-24 | 2016-10-27 | Siemens Aktiengesellschaft | Improving control system resilience by highly coupling security functions with control |
| CN107404400B (en) * | 2017-07-20 | 2020-05-19 | 中国电子科技集团公司第二十九研究所 | Network situation awareness implementation method and device |
| CN108769048A (en) * | 2018-06-08 | 2018-11-06 | 武汉思普崚技术有限公司 | A kind of secure visualization and Situation Awareness plateform system |
| CN108494810B (en) * | 2018-06-11 | 2021-01-26 | 中国人民解放军战略支援部队信息工程大学 | Attack-oriented network security situation prediction method, device and system |
| CN110059939A (en) * | 2018-12-13 | 2019-07-26 | 成都亚信网络安全产业技术研究院有限公司 | A kind of risk checking method and device |
-
2019
- 2019-08-16 CN CN201910757457.XA patent/CN110471975B/en active Active
Also Published As
| Publication number | Publication date |
|---|---|
| CN110471975A (en) | 2019-11-19 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110445801B (en) | Situation sensing method and system of Internet of things | |
| CN110493043B (en) | Distributed situation awareness calling method and device | |
| Kumar et al. | A Distributed framework for detecting DDoS attacks in smart contract‐based Blockchain‐IoT Systems by leveraging Fog computing | |
| US10855545B2 (en) | Centralized resource usage visualization service for large-scale network topologies | |
| Aljawarneh et al. | Anomaly-based intrusion detection system through feature selection analysis and building hybrid efficient model | |
| CN110460608B (en) | Situation awareness method and system including correlation analysis | |
| US9647904B2 (en) | Customer-directed networking limits in distributed systems | |
| CN111786950B (en) | Network security monitoring method, device, equipment and medium based on situation awareness | |
| CN110474904B (en) | Situation awareness method and system for improving prediction | |
| CN114679338A (en) | Network risk assessment method based on network security situation awareness | |
| CN107733834B (en) | Data leakage protection method and device | |
| CN110471975B (en) | Internet of things situation awareness calling method and device | |
| CN110493218B (en) | Situation awareness virtualization method and device | |
| CN109873790A (en) | Network security detection method, device and computer readable storage medium | |
| Yao et al. | Multi-source alert data understanding for security semantic discovery based on rough set theory | |
| CN110493217B (en) | Distributed situation perception method and system | |
| CN110493044B (en) | Quantifiable situation perception method and system | |
| Manimaran et al. | The conjectural framework for detecting DDoS attack using enhanced entropy based threshold technique (EEB-TT) in cloud environment | |
| CN114362994A (en) | Multilayer different-granularity intelligent aggregation railway system operation behavior safety risk identification method | |
| CN110474805B (en) | Method and device for situation awareness analysis capable of being called | |
| CN109871711B (en) | Ocean big data sharing and distributing risk control model and method | |
| CN114205816B (en) | Electric power mobile internet of things information security architecture and application method thereof | |
| CN110460472B (en) | Weighted quantization situation perception method and system | |
| Su et al. | Detection ddos of attacks based on federated learning with digital twin network | |
| Arora et al. | Minimized False Alarm Predictive Threshold for Cloud Service Providers |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |