CN116366277A - Network security situation assessment method for information fusion - Google Patents

Abstract

The invention discloses an information fusion network security situation assessment method, which can correlate, synthesize and analyze the collected security data, thereby obtaining problem data related parameters and data related to the problem data. The steps of the method of the present invention are as follows: firstly, establishing a network security situation assessment model; secondly, collecting network security situation information; thirdly, preprocessing the security data; thirdly, the information fusion analysis module fuses and analyzes the collected security data information; thirdly, the network The security situation analysis module integrates the problem data and security information, and obtains the current network security assessment data through quantification; finally, when the network threat index is lower than a certain threshold, the alarm mode is activated, and the address of the fault data is located and displayed.

Description

A network security situation assessment method based on information fusion

technical field

The invention relates to the field of network information security, and more precisely relates to a network security situation assessment method based on information fusion.

Background technique

With the development of science and technology, the network has taken root in people's lives for many years. The network has changed people's lifestyles and made some things easier on the network. It is like a network connecting the world, but the connection end of the network is not just one, The circulation of information is also invisible in the network. Although there is a method of writing encrypted information to make the transmission process have a certain degree of privacy, some hackers will maliciously intercept information, and even maliciously visit the website, causing the website to crash. Therefore, it is an urgent problem to be solved to evaluate the security degree of the network operating environment. In network security situation assessment technology, using information fusion to assess threats is a key technology in the field of network information security.

Network security situation assessment technologies have also emerged in recent years. Patent CN201811291094.7 mentions collecting indicator information through nodes and links in the network, and calculating node and link information based on node data loss rate and link transmission data delay time, congestion rate and loss rate. Road situation, and then measure the network security situation. However, the node situation is often too general, and it will take some time to accurately calculate and analyze the specific threatened location and cause. How to evaluate the network security situation with high quality is the problem to be solved by the present invention.

Contents of the invention

In view of the above problems, the present invention discloses an information fusion network security situation assessment method, which can correlate, synthesize and analyze the collected security data, and obtain relevant parameters and relevant data of problem data.

In order to realize above-mentioned technical effect, the present invention adopts following technical scheme:

A network security situation assessment method based on information fusion, the assessment steps are:

S1: Establish a network security situation assessment model, which is used to analyze the working status of the server, analyze the source of problem information, and issue alarms for problem information;

S2: The server information extraction module collects network security situation information, and the information collection is continuous collection, which continuously collects new network security data and server security data;

S3: Preprocess the collected security data to realize the integration, transformation and reduction of multi-source security data;

S4: The information fusion analysis module fuses and analyzes the collected security data information, and the temporal logic model searches for the cause of the security problem on the security data information, and the association analysis module describes the causal relationship of the security problem through the causal association algorithm based on the found cause of the problem Analysis; the data correlation module conducts multi-level distributed mining processing of security data information to determine the status of security data information and the identity relationship between each other; the valuation synthesis module predicts the problem of network security information through the likelihood-fuzzy algorithm Data information on features and associated issues;

S5: The network security situation analysis module integrates problem data and security information, and obtains network security assessment data at this time through quantification;

S6: When the network threat index is lower than a certain threshold, the problem pre-alarm module starts the alarm mode, and locates and displays the address of the problem data.

As a further solution of the present invention, the security evaluation data presents network threat index, problem data information and data information associated with the problem data.

As a further solution of the present invention, the security data preprocessing implements data calibration and normalization through different levels of algorithms, and is used for preliminary fusion processing of standardized data.

As a further solution of the present invention, the situation analysis processes and calculates the basic data between the server-network-user through the fusion-assessment algorithm, so as to realize the evaluation of the security situation of the upper layer network.

As a further solution of the present invention, the network security situation assessment model includes a server information extraction module, a data preprocessing module, an information fusion analysis module, a network security situation analysis module and a problem pre-alarm module; wherein the server information extraction module is connected to the data preprocessing module, The data preprocessing module is connected to the information fusion analysis module, the information fusion analysis module is connected to the network security situation analysis module, and the network security situation analysis module is connected to the problem pre-alarm module.

As a further solution of the present invention, the problem alarm module includes a red marking unit, a data location tracking unit, a data comparison unit and a priority control unit, and the problem alarm module is written by network system code.

As a further solution of the present invention, the clustering PageRank algorithm is adopted to realize the security situation assessment in the network, and the clustering PageRank algorithm is as follows to the network security situation assessment steps:

S71: Establish a network information sample mean value set

Randomly extract network information data as a sample set, define the sample set as X={x ₁ ,x ₂ ,x ₃ ...x _n }, define the central data set of each type of data in the random sample set as V=(v ₁ , v ₂ ,v ₃ ... v _k ), u _c is defined as the probability value that the sample data x _n belongs to the central data v _k , and the objective function of fuzzy clustering of network information data is:

表示同类网络信息样本数据在模糊划分参数m下数据x_i属于中心数据v_k的概率值，d_ik表示同类网络信息样本数据x_i到中心数据v_k的概率值的欧氏距离，n表示样本数量，k表示中心数据个数，i表示样本集合中第i个子集，其中i∈[1,n]，y表示中心数据集中第y个子集，其中y∈[1,k]，G(u,v)表示目标函数以概率值和中心数据作为基数；In formula (1), m represents the fuzzy partition parameter,

Indicates the probability value of the same kind of network information sample data under the fuzzy partition parameter m that data x _i belongs to the central data v _k , d _ik represents the Euclidean distance between the same kind of network information sample data x _i and the probability value of the central data v _k , n represents the sample Quantity, k represents the number of central data, i represents the i-th subset in the sample set, where i∈[1,n], y represents the y-th subset in the central data set, where y∈[1,k], G(u ,v) indicates that the objective function takes the probability value and the central data as the base;

S72: Update the Euclidean distance between the center data and sample data of each type of data

The relationship between the Euclidean distance and the probability value of each type of data is shown in formula (2):

表示在模糊划分参数中心值时样本数据x_i到中心数据v_k的概率值的欧氏距离；不断更新每类数据的中心数据和样本数据之间的欧氏距离概率值，可以使目标函数不断缩小网络信息的搜搜范围，对每一类网络信息进行最优划分；In formula (2), u _ik represents the probability value that data x _i belongs to the central data v _k ,

Indicates the Euclidean distance of the probability value from the sample data x _i to the central data v _k when the central value of the parameter is fuzzy divided; constantly updating the Euclidean distance probability value between the central data and the sample data of each type of data can make the objective function continuously Narrow the search range of network information, and optimally divide each type of network information;

S73: Perform information security measurement on each type of network information after optimization

The clustering PageRank algorithm measures and evaluates the security of network information, and the calculation formula is:

In formula (3), a represents the security parameter, b represents the threat parameter, N _a is the collection of all network information with security parameter a, K _b is the collection of all network information with threat parameter b, P(a) Represents the network security index, P(b) represents the network threat index; the larger the network security index, the higher the security situation of the corresponding category of network information, otherwise the corresponding category of network information will become more dangerous and must be dealt with in time.

The beneficial positive effect of the present invention is:

Different from the conventional technology, the present invention analyzes the network security threat situation and calculates the quantitative evaluation of the network security threat situation through the information fusion technology. In the information fusion analysis module, the causal association algorithm and the likelihood-fuzzy algorithm are used to analyze the problem data in the security data, and other data related to the problem data are mined. The network security situation analysis module shows the network threat through the calculation and analysis of the problem data. index, problem data information and data information associated with the problem data. The invention performs high-quality assessment on the network security threat situation, and visually displays the address of problem data.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained according to these drawings without creative labor, wherein:

Fig. 1 shows a step diagram of a network security situation assessment method of information fusion in the present invention;

Fig. 2 shows the network security situation analysis diagram of the present invention;

Fig. 3 shows the frequency value diagram of the input network signal of the present invention;

Fig. 4 has shown the traditional network situation assessment method of the present invention detection problem signal characteristic figure;

Fig. 5 shows a signal characteristic diagram of detection problems by the information fusion network situation assessment method of the present invention.

Detailed ways

Preferred embodiments of the present invention will be described below in conjunction with the accompanying drawings. It should be understood that the embodiments described here are only used to illustrate and explain the present invention, and are not intended to limit the present invention;

In a specific embodiment, as shown in Fig. 1-Fig. 5, a network security situation assessment method of information fusion adopts the following steps:

S1: Establish a network security situation assessment model, which is used to analyze the working status of the server, analyze the source of problem information, and issue alarms for problem information;

S2: The server information extraction module collects network security situation information, and the information collection is continuous collection, which continuously collects new network security data and server security data;

S3: Preprocess the collected security data to realize the integration, transformation and reduction of multi-source security data;

S4: The information fusion analysis module fuses and analyzes the collected security data information, and the temporal logic model searches for the cause of the security problem on the security data information, and the association analysis module describes the causal relationship of the security problem through the causal association algorithm based on the found cause of the problem Analysis; the data correlation module conducts multi-level distributed mining processing of security data information to determine the status of security data information and the identity relationship between each other; the valuation synthesis module predicts the problem of network security information through the likelihood-fuzzy algorithm Data information on features and associated issues;

S5: The network security situation analysis module fuses problem data and security information, and obtains network security evaluation data at this time through quantification; in the present invention, the analysis of network threat data is divided into two steps, the first step is to classify problem data according to problem characteristics , according to the problem data information to calculate the threat index of various problems; the second step is to aggregate the threat indexes of various problems to obtain the total network threat index.

S6: When the network threat index is lower than a certain threshold, the problem pre-alarm module starts the alarm mode, and locates and displays the address of the problem data. In the present invention, in order to realize the management and control of network threat events, the calculated network threat index is graded. According to the calculation results of the network threat index, the network threat can be divided into 5 levels: "excellent, good, medium, poor, and dangerous". When the network threat index is greater than or equal to 6, the alarm module will start.

In a specific embodiment, the security assessment data presents a network threat index, problem data information, and data information associated with the problem data.

In a specific embodiment, the security data preprocessing implements data calibration and normalization through different levels of algorithms, and is used to perform preliminary fusion processing on the standardized data.

In a specific embodiment, the situation analysis processes and calculates the basic data between the server-network-user through the fusion-assessment algorithm, so as to realize the evaluation of the security situation of the upper layer network.

In a specific embodiment, the network security situation assessment model includes a server information extraction module, a data preprocessing module, an information fusion analysis module, a network security situation analysis module, and a problem pre-alarm module; wherein the server information extraction module is connected to the data preprocessing module, and the data The preprocessing module is connected to the information fusion analysis module, the information fusion analysis module is connected to the network security situation analysis module, and the network security situation analysis module is connected to the problem pre-alarm module.

In a specific embodiment, as a further solution of the present invention, the problem alarm module includes a red marking unit, a data location tracking unit, a data comparison unit, and a priority control unit, and the problem alarm module is written using network system codes. In the present invention, the red marking unit is used to display and mark the problem data to warn staff that problems occur and network security is threatened; the data location tracking unit is used to track the specific location of the problem data in the network and also track data related to the problem data The network location; the data comparison unit checks and compares the network security situation assessment data through the network security situation table to see if it is at a safe level; the priority control unit is used to lock the threatened area of the network. At this time, processing warnings in the network is the highest priority and cannot be processed other information;.

In a specific embodiment, the information fusion network situation assessment technology of an information fusion network security situation assessment method of the present invention is analyzed and verified.

In a specific embodiment, the clustering PageRank algorithm is used to realize the security situation assessment in the network, and the clustering PageRank algorithm is to the network security situation assessment steps as follows:

S71: Establish a network information sample mean value set

Randomly extract network information data as a sample set, define the sample set as X={x ₁ ,x ₂ ,x ₃ ...x _n }, define the central data set of each type of data in the random sample set as V=(v ₁ , v ₂ ,v ₃ ... v _k ), u _c is defined as the probability value that the sample data x _n belongs to the central data v _k , and the objective function of fuzzy clustering of network information data is:

表示同类网络信息样本数据在模糊划分参数m下数据x_i属于中心数据v_k的概率值，d_ik表示同类网络信息样本数据x_i到中心数据v_k的概率值的欧氏距离，n表示样本数量，k表示中心数据个数，i表示样本集合中第i个子集，其中i∈[1,n]，y表示中心数据集中第y个子集，其中y∈[1,k]；G(u,v)表示目标函数以概率值和中心数据作为基数，本发明中网络信息数据模糊聚类的目标函数是每一类网络信息数据的目标函数，通过对每一种类的网络信息数据优化处理，获得每一类网络信息的优化结果。In formula (1), m represents the fuzzy partition parameter,

Indicates the probability value of the same kind of network information sample data under the fuzzy partition parameter m that data x _i belongs to the central data v _k , d _ik represents the Euclidean distance between the same kind of network information sample data x _i and the probability value of the central data v _k , n represents the sample Quantity, k represents the number of central data, i represents the i-th subset in the sample set, where i∈[1,n], y represents the y-th subset in the central data set, where y∈[1,k]; G(u , v) represents that the objective function takes the probability value and the central data as the base, the objective function of the network information data fuzzy clustering among the present invention is the objective function of each type of network information data, by optimizing the network information data of each type, Obtain optimization results for each type of network information.

S72: Update the Euclidean distance between the center data and sample data of each type of data

The relationship between the Euclidean distance and the probability value of each type of data is shown in formula (2):

表示在模糊划分参数中心值时样本数据x_i到中心数据v_k的概率值的欧氏距离；不断更新每类数据的中心数据和样本数据之间的欧氏距离概率值，可以使目标函数不断缩小网络信息的搜搜范围，对每一类网络信息进行最优划分；In formula (2), u _ik represents the probability value that data x _i belongs to the central data v _k ,

Indicates the Euclidean distance of the probability value from the sample data x _i to the central data v _k when the central value of the parameter is fuzzy divided; constantly updating the Euclidean distance probability value between the central data and the sample data of each type of data can make the objective function continuously Narrow the search range of network information, and optimally divide each type of network information;

S73: Perform information security measurement on each type of network information after optimization

The clustering PageRank algorithm measures and evaluates the security of network information, and the calculation formula is:

In formula (3), a represents the security parameter, b represents the threat parameter, N _a is the collection of all network information with security parameter a, K _b is the collection of all network information with threat parameter b, P(a) Represents the network security index, P(b) represents the network threat index; the larger the network security index, the higher the security situation of the corresponding category of network information, otherwise the degree of danger of the corresponding category of network information will deepen and must be dealt with in time. The present invention calculates the security index of the optimized network information through the clustering PageRank algorithm, where P(a)∈[1,10], only when the security index P(a) is greater than or equal to 8, the calculated network information It is safe information and can be called stably.

The experimental environment is: Tensorflow artificial intelligence framework, Jupyter Notebook programming environment, and Simulink simulation software.

In order to accurately reflect the accuracy of network situation assessment by information fusion, the traditional network situation assessment method is used in this experiment as a comparison. The two methods evaluate the network situation on the collected network signals. The input network signal spectrum is shown in Figure 3.

The traditional network situation assessment method for the situation assessment of the input network signal is shown in FIG. 4 , and the information fusion network situation assessment method of the present invention for the situation assessment of the input network signal is shown in FIG. 5 .

Figures 4 and 5 show the time-frequency characteristics of the two methods for detecting problem data in network signals within a certain period of time. It can be seen that the use of information fusion network situation assessment method can clearly detect the signal characteristics of network problems. The traditional network situation assessment method uses the detection method of the envelope amplitude of the problem signal, which is easy to cause boundary errors, thus dispersing the time-frequency characteristics of the detected problem signal. The information fusion network situation assessment method adopted in the present invention is a method of analyzing and processing problem information characteristics, and the causal correlation algorithm and likelihood-fuzzy algorithm used have certain information specificity and will not cause excessive errors. The description of problem data It is also clearer and easier for research and understanding.

Although the specific embodiments of the present invention have been described above, those skilled in the art should understand that these specific embodiments are only examples, and those skilled in the art can make the above-mentioned Various omissions, substitutions and changes are made to the details of the methods and systems; for example, combining the above method steps so as to perform substantially the same functions in substantially the same way to achieve substantially the same results is within the scope of the present invention; therefore, the present invention The scope is limited only by the appended claims.

Claims (7)

1. A network security situation assessment method for information fusion is characterized in that:

s1: establishing a network security situation assessment model, wherein the model is used for analyzing the working state of a server, analyzing the source of problem information and carrying out alarm processing on the problem information;

s2: the server information extraction module collects network security state information, wherein the information collection is continuous collection, and new network security data and server security data are continuously collected;

s3: preprocessing the collected safety data to realize integration, transformation and reduction of multi-source safety data;

s4: the information fusion analysis module performs fusion analysis on the acquired safety data information, the time sequence logic model performs safety problem cause searching on the safety data information, and the association analysis module performs description analysis on the causal relationship of the safety problem through a causal association algorithm according to the searched problem cause; the data correlation module performs multi-level distributed mining processing on the safety data information, and determines the state and identity relationship between the safety data information; the evaluation comprehensive module predicts the problem characteristics of the network safety information and the data information of the related problems through a likelihood-fuzzy algorithm;

s5: the network security situation analysis module fuses the problem data and the security information, and network security evaluation data at the moment is obtained through quantification;

s6: and if the network threat index is lower than a certain threshold value, the problem pre-alarm module starts an alarm mode and displays the problem data address in a positioning way.

2. The network security posture assessment method for information fusion according to claim 1, wherein: the security assessment data exhibits a network threat index, issue data information, and data information associated with the issue data.

3. The network security posture assessment method for information fusion according to claim 1, wherein: the safety data preprocessing realizes the calibration and normalization of data through different layers of algorithms and is used for carrying out primary fusion processing on the standardized data.

4. The network security posture assessment method for information fusion according to claim 1, wherein: and the situation analysis processes and computes basic layer data among the server, the network and the users through a fusion-evaluation algorithm, so that the evaluation of the security situation of the upper network is realized.

5. The network security posture assessment method for information fusion according to claim 1, wherein: the network security situation assessment model comprises a server information extraction module, a data preprocessing module, an information fusion analysis module, a network security situation analysis module and a problem pre-alarm module; the server information extraction module is connected with the data preprocessing module, the data preprocessing module is connected with the information fusion analysis module, the information fusion analysis module is connected with the network security situation analysis module, and the network security situation analysis module is connected with the problem pre-alarm module.

6. The network security posture assessment method for information fusion according to claim 1, wherein: the problem alarm module comprises a red marking unit, a data position tracking unit, a data comparison unit and a priority control unit, and is written by adopting a network system code.

7. The network security posture assessment method for information fusion according to claim 1, wherein: the security situation assessment in the network is realized by adopting a clustering PageRank algorithm, and the step of evaluating the security situation of the network by the clustering PageRank algorithm is as follows: s71: establishing a network information sample mean value set

Randomly extracting network information data as a sample set, and defining the sample set as X= { X ₁ ,x ₂ ,x ₃ ...x _n Defining the central data set of each type of data in the random sample set as v= (V) ₁ ,v ₂ ,v ₃ ...v _k )，u _c Defined as sample data x _n Belonging to central data v _k The probability value of the network information data fuzzy clustering is as follows:

in the formula (1), m represents a fuzzy dividing parameter,

data x representing similar network information sample data under fuzzy dividing parameter m _i Belonging to central data v _k Probability of (2)Value d _ik Sample data x representing homogeneous network information _i To central data v _k Where n represents the number of samples, k represents the number of center data, i represents the i-th subset of the set of samples, where i e [1, n]Y represents the y-th subset of the central dataset, where y ε [1, k ]]G (u, v) represents the objective function with probability values and center data as cardinalities;

s72: updating Euclidean distance between center data and sample data for each class of data

The relation between Euclidean distance and probability value of each type of data is shown as formula (2):

in the formula (2), u _ik Representing data x _i Belonging to central data v _k Is used to determine the probability value of (1),

representing sample data x at the time of blurring the parameter center value _i To central data v _k Euclidean distance of probability values of (a); the Euclidean distance probability value between the center data and the sample data of each type of data is updated continuously, so that the objective function can continuously reduce the search range of the network information, and the optimal division is carried out on each type of network information;

s73: information security measurement is carried out on each type of optimized network information

The clustering PageRank algorithm carries out measurement and evaluation on the security of network information, and the calculation formula is as follows:

in the formula (3), a represents a security parameter, b represents a threat parameter, and N _a K for all network information sets with security parameters a _b P (a) represents the network for all sets of network information with threatening parameters bA security indicator, P (b) representing a network threat indicator; the larger the network security index is, the higher the network information security situation of the corresponding category is, otherwise, the network information risk degree of the corresponding category is deepened, and the network information security situation must be processed in time.

Images