WO2020113981A1 - 网络空间地图模型创建方法及装置 - Google Patents

网络空间地图模型创建方法及装置 Download PDF

Info

Publication number
WO2020113981A1
WO2020113981A1 PCT/CN2019/098874 CN2019098874W WO2020113981A1 WO 2020113981 A1 WO2020113981 A1 WO 2020113981A1 CN 2019098874 W CN2019098874 W CN 2019098874W WO 2020113981 A1 WO2020113981 A1 WO 2020113981A1
Authority
WO
WIPO (PCT)
Prior art keywords
network space
map
coordinate system
cyberspace
address
Prior art date
Application number
PCT/CN2019/098874
Other languages
English (en)
French (fr)
Inventor
王继龙
缪葱葱
庄姝颖
Original Assignee
清华大学
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 清华大学 filed Critical 清华大学
Publication of WO2020113981A1 publication Critical patent/WO2020113981A1/zh
Priority to US17/336,329 priority Critical patent/US12067676B2/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06T—IMAGE DATA PROCESSING OR GENERATION, IN GENERAL
    • G06T17/00—Three dimensional [3D] modelling, e.g. data description of 3D objects
    • G06T17/05—Geographic models
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/22—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks comprising specially adapted graphical user interfaces [GUI]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/29—Geographical information databases
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06T—IMAGE DATA PROCESSING OR GENERATION, IN GENERAL
    • G06T11/00—2D [Two Dimensional] image generation
    • G06T11/20—Drawing from basic elements, e.g. lines or circles
    • G06T11/206—Drawing of charts or graphs
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/12—Discovery or management of network topologies

Definitions

  • the invention relates to the technical field of cyberspace visualization, and in particular to a method and device for creating a cyberspace map model.
  • Cyberspace as an independent space created by human beings as "God” combined with computer networks and virtual reality, is a digital, informational, and intelligent virtual world. It has now developed into the second largest space parallel to geographic space. Human social life. Cyberspace has broken through the time and space limitations of traditional physical space, and the characteristics of traditional geographic space have decreased in cyberspace. Therefore, there are important differences between cyberspace cartography research and traditional geographic cartography research. The research on cyberspace cartography is currently almost blank, and the exploration of the origin of cyberspace is very limited. Basic conceptual models and spatial theoretical foundations have not yet been established, which leads to difficulties in the field of cyberspace map research.
  • the current research on cyberspace cartography mainly focuses on geographic cyberspace maps and topological cyberspace maps.
  • the spatial characteristics of cyberspace have brought opportunities and challenges to cyberspace-related research.
  • the study of spatial theoretical models of cyberspace has focused on geographic cyberspace models and topological cyberspace models, mapping cyberspace through traditional geographic coordinate systems and topological coordinate systems.
  • To geographic space and topological space Geographic cyberspace maps and topological cyberspace maps implement the expression of geographic and topological features in cyberspace, but they all have limitations. Geographic cyberspace maps cannot reveal the spatial origin characteristics of cyberspace. Topological nodes of topological cyberspace maps change dynamically at all times, and they cannot provide a constant method of describing and expressing cyberspace.
  • the present invention aims to solve one of the technical problems in the related art at least to a certain extent.
  • an object of the present invention is to propose a method for creating a network space map model, which visually and effectively visualizes network space into a network space map, and realizes deep analysis and expression of network space.
  • Another object of the present invention is to provide a network space map model creation device.
  • an embodiment of the present invention provides a method for creating a network space map model, which includes the following steps: Step S101: Determine that the network space map model coordinate system uses an IP address as a basic vector; Step S102: According to a preset mapping Way to map the IP address to the two-dimensional coordinate system to meet the basic model of network space map for aggregation, regionality and scalability; step S103: determine the three-dimensional coordinate system to describe the network orthogonally to the logical port, area, topology and IP address For more fine-grained information in the space, the concept of a layer can be abstracted to realize the thematic map of the network space map model; Step S104: Build a scale standard to think that the hierarchical and scalable representation of the complex and diverse network space in the network space map model The resource lays the theoretical foundation; Step S105: Determine the mapping relationship between the network space map and the geographic map to support the screen segmentation to realize the comparative drawing of the same network space scene in different network space maps and geographic maps, and
  • the method for creating a network space map model satisfies the aggregation, regionality, and scalability of the map model by selecting the Hilbert map transformation, and at the same time realizes the key of the map model such as the construction of a three-dimensional coordinate system, thematic maps, and scale design Breakthrough in technological research to fill the theoretical gap in cyberspace map models, and design a multi-scale, multi-dimensional, multi-view cyberspace map device for cyberspace element location and expression, cyberspace monitoring and management, and cyberspace security
  • the network space can be visually and effectively visualized in the network space map, and the deep analysis and expression of the network space can be realized.
  • the method for creating a network space map model according to the above embodiments of the present invention may also have the following additional technical features:
  • the network space map model coordinate system is a two-dimensional coordinate system
  • the basic vector is a two-dimensional coordinate system building basis
  • the step S102 includes: the IP The basic vector corresponding to the address is mapped onto the two-dimensional coordinate system according to a mapping method, and the concept of IP address aggregation is maintained to create a two-dimensional coordinate system of an aggregated, regional, and scalable network space map model.
  • the three-dimensional coordinate system includes a third coordinate axis orthogonal to the two-dimensional coordinate system, wherein the step S103 includes: combining the third coordinate axis with all The two-dimensional coordinate system constructed by the IP address is orthogonal; or the three-dimensional coordinate system is abstracted into the concept of a map model layer, and a thematic map of the network space is established to visualize fine-grained IP information.
  • the scale standard is the scale of the cyberspace map model
  • the cyberspace resource is an entity that can be detected and sensed using cyberspace means
  • the step S104 includes: referring to The GIS (Geographic Information System) system carries out the scale design of the network space map, so that the network space map model has the concept of map; the map model is scaled to present different levels of network space resource information, and the maps with different scales are different
  • the resource visualization effect reflects the original characteristics of cyberspace.
  • the mapping relationship between the network space map and the geographic map includes a mapping between the network space IP address and the geographic space latitude and longitude
  • the step S105 includes: determining the network space map Mapping relationship with the geographic map, combined with the cyberspace map and the geographic space map to simultaneously express cyberspace elements, and comprehensively observe cyberspace from multiple angles.
  • another embodiment of the present invention provides a device for creating a network space map model, including: a determining module for determining that the coordinate system of the network space map model uses an IP address as a basic vector; and a creating module for The default mapping method maps IP addresses to a two-dimensional coordinate system to meet the basic model of network space maps that are aggregated, regional, and scalable; the basic visualization module is used to determine the three-dimensional coordinate system.
  • the IP address orthogonally describes more fine-grained information in the network space, and can be abstracted as a layer to realize the thematic map of the network space map model; a building block is used to build a scale standard, which is thought to be hierarchical, Scalable representation of complex and diverse cyberspace resources lays a theoretical foundation; the mapping module is used to determine the mapping relationship between the cyberspace map and the geographic map, to support screen segmentation to achieve the same cyberspace scene in different cyberspace maps and geographic maps, It also presents cyberspace information in many ways.
  • the network space map model creation device of the embodiment of the present invention satisfies the aggregation, regionality and scalability of the map model by selecting the Hilbert map transformation, and at the same time realizes the key of the map model such as the construction of the three-dimensional coordinate system, thematic map and scale design Breakthrough in technological research to fill the theoretical gap in cyberspace map models, and design a multi-scale, multi-dimensional, multi-view cyberspace map device for cyberspace element location and expression, cyberspace monitoring and management, and cyberspace security
  • the network space can be visually and effectively visualized in the network space map, and the deep analysis and expression of the network space can be realized.
  • network space map model creation device may also have the following additional technical features:
  • the coordinate system of the network space map model is a two-dimensional coordinate system
  • the base vector is a basis for building a two-dimensional coordinate system
  • the creation module is further used to convert the The basic vector corresponding to the IP address is mapped onto the two-dimensional coordinate system according to a mapping method, and the concept of IP address aggregation is maintained to create an aggregated, regional, and scalable network space map model two-dimensional coordinate system.
  • the three-dimensional coordinate system includes a third coordinate axis orthogonal to the two-dimensional coordinate system, wherein the basic visualization module is further used to convert the third coordinate axis It is orthogonal to the two-dimensional coordinate system constructed by the IP address; or the three-dimensional coordinate system is abstracted as a concept of a map model layer, and a thematic map of cyberspace is established to visualize fine-grained IP information.
  • the scale standard is the scale of the cyberspace map model
  • the cyberspace resource is an entity that can be detected and perceived using cyberspace means
  • the construction module is further used
  • the scale design of the network space map is carried out with reference to the GIS system, so that the network space map model has a map concept, and different levels of network space resource information are presented through the map model to expand and contract, and the maps with different scales of granularity present different resource visualization effects, reflecting the network Original characteristics of space.
  • the mapping relationship between the cyberspace map and the geographic map includes a mapping between the IP address of the cyberspace and the latitude and longitude of the geographic space, wherein the mapping module is further used to determine the cyberspace.
  • FIG. 1 is a flowchart of a method for creating a network space map model according to an embodiment of the present invention
  • FIG. 3 is a schematic diagram of a two-dimensional IP address space obtained by performing a Hilbert transform on a part of one-dimensional IP address space according to an embodiment of the present invention
  • FIG. 4 is a network space map model with a logical port as the third coordinate system according to an embodiment of the present invention
  • FIG. 5 is a schematic diagram of a standard scale of a network space map model according to an embodiment of the present invention.
  • FIG. 6 is a schematic structural diagram of an apparatus for creating a network space map model according to an embodiment of the present invention.
  • FIG. 7 is a schematic diagram of a basic visualization module of a network space map according to an embodiment of the present invention.
  • FIG. 8 is a schematic structural diagram of a network space map model creation device according to another embodiment of the present invention.
  • FIG. 9 is a schematic diagram of a DDOS attack scenario of a network space map according to an embodiment of the present invention.
  • FIG. 10 is a schematic diagram of a split screen for mapping a network space map and a geographic map according to an embodiment of the present invention.
  • FIG. 1 is a flowchart of a method for creating a network space map model according to an embodiment of the present invention.
  • the method for creating a network space map model includes the following steps:
  • Step S101 Determine that the coordinate system of the network space map model uses an IP address as a basic vector.
  • the coordinate system is a two-dimensional coordinate system
  • the basic vector is the basis for constructing the two-dimensional coordinate system, in which the IP address is used as the basic vector to represent the IP-based network space elements.
  • cyberspace is an information processing and interactive environment based on network systems such as the Internet, the Internet of Things, and telecommunications networks, including users, services, and data.
  • network systems such as the Internet, the Internet of Things, and telecommunications networks, including users, services, and data.
  • the network space only includes physical network elements with IP in the generalized network space.
  • IP address as the only fingerprint for locating cyberspace elements is the key identifier of cyberspace information communication.
  • Heterogeneous hardware, heterogeneous operating systems, and heterogeneous network systems in cyberspace can all realize spatial positioning and spatial information interaction through a unified IP address.
  • the essence of space construction in cyberspace is IP addresses, and all actions and information interaction in cyberspace need to be implemented based on IP addresses.
  • IP addresses as the basic vector of cyberspace can not only quickly locate the elements of cyberspace, but also realize the flow of information by constructing source and destination IP addresses. At the same time, all spatial measurements can be directly or indirectly converted into IP address measurements.
  • Step S102 The IP address is mapped to a two-dimensional coordinate system according to a preset mapping method to meet the basic model of network space map of aggregation, regionality, and scalability.
  • the coordinate system of the network space map model is a two-dimensional coordinate system
  • the base vector is a basis for building a two-dimensional coordinate system
  • step S102 includes: mapping the base vector corresponding to the IP address to two according to a mapping method On the dimensional coordinate system, and maintain the concept of IP address aggregation to create a two-dimensional coordinate system of aggregative, regional and scalable network space map model.
  • the network space map model uses the IP address as the basic vector for the design of the two-dimensional coordinate system. Considering that the visualization effect of the one-dimensional IP address space is not good, the regionality and scalability of the map cannot be better presented. Analyze some dimensionality-increasing mapping methods and map one-dimensional IP addresses to two-dimensional planes in the network space coordinate system. Among them, the Hilbert mapping method can satisfy the construction of a clustered, regional, and scalable network space map basic model .
  • the aggregation type means that the locality in the one-dimensional space can be maintained in the two-dimensional space, which is very useful for IP addresses.
  • the adjacent IPs are also adjacent in the two-dimensional space, retaining the characteristics of IP aggregation into blocks And present a certain map regionality.
  • Scalability refers to the presentation of cyberspace map information with different granularities through the changes of different Hilbert curve orders.
  • the IP regions formed by every 64 grids are in the Hilbert curve order.
  • the IP address can be continuously expanded from point to block.
  • the main function function ROTCHANGEN algorithm flow is described as follows, the return value is used as an important parameter of the IP mapping transformation.
  • the canvas size is 2 16 x 2 16 based on This design cyberspace map can well present the concepts of scalability and map regionality.
  • a two-dimensional IP address space obtained by performing Hilbert transform for a part of one-dimensional IP address space (10.0.0.0/24 IP address block), and observed that the one-dimensional IP address is in two-dimensional
  • the space is kept adjacent, and a region composed of 64 grids forms an IP prefix aggregation, and the 4 /26 regions are aggregated into the /24 prefix address space again, which reflects the aggregation and regionality of the network space map model.
  • the IP address can be continuously expanded from point to block, the scalability of the map model is presented, and it has a good visualization effect.
  • Step S103 Determine that the three-dimensional coordinate system orthogonally describes the logical port, area, topology and IP address to describe the finer-grained information of the network space, and can be abstracted as a layer to realize the thematic map of the network space map model.
  • the three-dimensional coordinate system includes a third coordinate axis orthogonal to the two-dimensional coordinate system, wherein step S103 includes: the third coordinate axis and the two-dimensional coordinate system constructed by the IP address are positive Or to abstract the three-dimensional coordinate system into the concept of map model layers and establish a thematic map of cyberspace to visualize IP fine-grained information.
  • the three-dimensional coordinate system includes a third coordinate axis that is orthogonal to the two-dimensional coordinate system.
  • the third coordinate axis with the meaning of logical port, area, topology, etc. and the two-dimensional coordinate system constructed by the IP address are constructed Orthogonal; or, abstract the three-dimensional coordinate system as the concept of the map model layer, build a thematic map of cyberspace, and visualize IP fine-grained information such as cyberspace traffic, topology, AS, network, and attributes.
  • the two-dimensional coordinate system constructed with the IP address as the basic vector presents the IP attributes of the network space, and can locate the network space to the corresponding host granularities such as mobile phones, computers, PADs, and routers.
  • the network space map model provided in this application defines some concepts of three-dimensional coordinate vectors, such as logical ports, topology structures, and region information, etc., and orthogonal to the IP address to assist deeper levels. Recognize cyberspace and at the same time abstract the concept of layers in the cyberspace map model to implement thematic maps.
  • the logical port in the network space usually represents a process or network service, and a three-dimensional coordinate system that is orthogonal to the IP address can fine-grainly locate service information related to the network space, such as websites, emails, and ftp.
  • the port flow information can assist in performing network monitoring tasks and data forensics related to network security to achieve abnormal flow monitoring.
  • the network topology can be visualized at different granularities: AS topology, routing topology, IP topology, etc., used to guide the change of the Internet infrastructure connection when subjected to network security attacks It helps network management personnel to check the hardware configuration, determine the location of new routes, and find bottlenecks and faults in the network, which is more stable than the topological coordinate system.
  • the third-dimensional coordinate vector concept is abstracted into layers such as ports, flows, topologies, and regions to draw a network space thematic map.
  • the network space map is given specific application scenarios by adding layers to achieve a diverse display of network space.
  • the IP:PORT can be expressed in coordinates (x, y, z) in the network space coordinate system to visualize the services on a host with a finer granularity.
  • Figure 4 is a network space map model with a logical port as the third dimension coordinate system. As shown in FIG. 4, the IP address corresponds to the two-dimensional plane space at the bottom of the three-dimensional coordinate system, and the logical port corresponds to the vertical space of the three-dimensional coordinate system, which realizes a better visualization of the network space into the three-dimensional coordinate system.
  • a logical port layer to the basic map of the network space, eg. port 80, colorize the IP address of the open port 80 to facilitate the observation of the IP address distribution of the implementation of the hypertext transfer protocol, and realize the visualization of the thematic map of the hypertext protocol service in the network space .
  • Step S104 Build a scale standard to build a theoretical foundation for hierarchical and scalable representation of complex and diverse cyberspace resources in the cyberspace map model.
  • the scale standard is the scale of the cyberspace map model
  • the cyberspace resources are entities that can be detected and perceived using cyberspace means.
  • Step S104 includes: designing the scale of the cyberspace map with reference to the GIS system.
  • the network space map model has a certain map concept; the map model scales to present different levels of network space resource information, and the maps with different scales show different resource visualization effects, reflecting the original characteristics of network space.
  • the network space map will lack intuitiveness, hierarchy, and logical expression, which is not conducive to network resource management and network security analysis. Therefore, it is urgent to build a scale standard of the network space map model, so that different levels of network space resources can be scaled and displayed under different scales of the network space map model.
  • Figure 5 is the standard schematic diagram of the scale of the cyberspace map model. As shown in Figure 5, the preliminary map scale design is carried out with reference to the geographic information system, so that the cyberspace map model has a certain map concept, and different scaling granularities are different Hilbert curve orders. A number of maps present different resource visualization effects.
  • the initial scale of the cyberspace map model is /20
  • the AS information of the cyberspace autonomous system is visualized.
  • the WAN information under the AS is enlarged and displayed.
  • a local area network which expands and displays specific resource categories (switches, routers, etc.) with IP granularity.
  • the scale standard design makes the network space map expression hierarchical, intuitive, and logical.
  • the method for creating a network space map model determines that the coordinate system of the network space map model uses the IP address as the basic vector; the IP address is mapped to the two-dimensional coordinate system according to the preset mapping method to meet the aggregation and area
  • the basic model of network space map for scalability and scalability determine the three-dimensional coordinate system to describe logical ports, areas, topologies and IP addresses orthogonally to the finer-grained information of network space, which can be abstracted as the concept of layers to achieve network space maps Model thematic map; the scale standard is constructed, which lays a theoretical foundation for the hierarchical and scalable representation of complex and diverse cyberspace resources in the cyberspace map model.
  • This method uses a constant and orthogonal network space map model coordinate system architecture based on IP addresses as the base vector to achieve accurate expression of network space elements. Compared with geographic network space maps and topological network space maps, it can be more intuitive and comprehensive. More effectively visualize the unique attributes of cyberspace itself.
  • the dimension enhancement based on Hilbert map transformation achieves a better IP address visualization effect, and satisfies the aggregation, regionality, and scalability of the two-dimensional coordinate system of the map model.
  • the present invention also carries out the corresponding scale standard design, in order to display the complex and diverse resources of the network space in layers at different granularities, and present a scalable map visualization effect.
  • this method can assist in the establishment of multi-scale, multi-dimensional, and multi-view network space maps, and promote the development of network space visualization.
  • the method of the embodiment of the present invention further includes step 105.
  • Step S105 Determine the mapping relationship between the network space map and the geographic map to support the screen segmentation to realize the comparative drawing of the same network space scene in different network space maps and geographic maps, and present the network space information in various aspects.
  • the mapping relationship between the cyberspace map and the geographic map includes the mapping between the cyberspace IP address and the latitude and longitude of the geographic space
  • step S105 includes: determining the mapping relationship between the cyberspace map and the geographic map, and combining the network Space maps and geospatial maps simultaneously express the elements of cyberspace and comprehensively observe cyberspace from multiple angles.
  • the embodiment of the present invention determines the mapping relationship between the network space map and the geographic map, combines the network space map and the geographic space map to simultaneously express the network space elements, and provides a method for comprehensively observing the network space from multiple angles.
  • the embodiment of the present invention changes the backplane of the network space map model to the geographic map space, and then compares it with the corresponding function of the network space map system. It supports screen splitting in the same scenario, and the network space map is displayed on the left.
  • Geographic maps, two kinds of map assistance can help users recognize cyberspace from multiple angles, and can also reflect the superiority of the cyberspace map designed by the present invention through comparison of some scenarios.
  • IP address As the basic vector of the network space map model coordinate system, and visualize the network space from the perspective of the network space source.
  • the virtuality of cyberspace, the complexity of spatial structure, and the instantaneousness of spatial information have brought great challenges to the construction of cyberspace coordinate systems.
  • IP addresses are the only fingerprints for locating cyberspace elements and are the key indicators of cyberspace information communication. Heterogeneous hardware, heterogeneous operating systems, and heterogeneous network systems in cyberspace can all realize spatial positioning and spatial information interaction through a unified IP address.
  • the one-dimensional IP address is mapped to the two-dimensional coordinate system to meet the basic model of network space map of aggregation, regionality and scalability, and the key technologies of network space map model such as three-dimensional coordinate design and scale design
  • the research has laid a theoretical foundation for the construction of thematic maps and the hierarchical and scalable representation of complex and diverse cyberspace resources in the cyberspace map model.
  • the mapping relationship between the network space map and the geographic map is determined. Combining the network space map and the geographic space map to express the elements of the network space at the same time, it provides a method for comprehensive observation of the network space from multiple angles.
  • an embodiment of the present invention designs a multi-scale, multi-dimensional, and multi-view network space map model, which visually and effectively visualizes network space into a network space map, and applies the network space map to the expression of network space resources.
  • Cyberspace element monitoring and management, and cyberspace security visualization and other scenarios to fill the vacancy of the lack of backplanes in the field of cyberspace surveying and mapping, and promote the development of disciplines in the field of cyberspace surveying and mapping.
  • the Hilbert map transformation is selected to satisfy the aggregation, regionality, and scalability of the map model, and at the same time to realize three-dimensional coordinate system construction, thematic maps, scale design and other maps
  • the breakthrough of key technology research of the model has filled the theoretical gap of the cyberspace map model, and designed a multi-scale, multi-dimensional, multi-view cyberspace map device, which is applied to the positioning and expression of cyberspace elements, cyberspace monitoring and management and network
  • the network space can be visually and effectively visualized in the network space map, and the deep analysis and expression of the network space can be realized.
  • FIG. 6 is a schematic structural diagram of a network space map model creation device according to an embodiment of the present invention.
  • the network space map model creation device 10 includes: a determination module 100, a creation module 200, a basic visualization module 300, a construction module 400 and a mapping module 500.
  • the determination module 100 is used to determine that the coordinate system of the network space map model uses the IP address as a basic vector.
  • the creation module 200 is used to map an IP address to a two-dimensional coordinate system according to a preset mapping method to meet the basic model of cyberspace maps that are aggregated, regional, and scalable.
  • the basic visualization module 300 is used to determine that the three-dimensional coordinate system orthogonally describes logical ports, areas, topologies, and IP addresses to describe finer-grained information of the network space, and can be abstracted as a layer to realize the thematic map of the network space map model.
  • the building module 400 is used to build a scale standard to lay a theoretical foundation for hierarchical and scalable representation of complex and diverse cyberspace resources in the cyberspace map model.
  • the mapping module 500 is used to determine the mapping relationship between the network space map and the geographic map to support the screen segmentation to realize the comparative drawing of the same network space scene in different network space maps and geographic maps, and present the network space information in various aspects.
  • the device 10 of the embodiment of the present invention visually and effectively visualizes the network space into the network space map, and realizes deep analysis and expression of the network space.
  • the determination module 100 is used to determine the network space coordinate system based on the IP address of the network space map model.
  • the creation module 200 is used to map an IP address to a two-dimensional coordinate system according to a preset mapping method, so as to create an aggregated, regional, and scalable network space map model coordinate system architecture.
  • the basic visualization module 300 is used for realizing the basic map model of the network space according to the coordinate system and scale standards of the network space map model, and completing the positioning, searching, and description of massive physical resources.
  • the mapping module 500 is a network space map and geographic map mapping module, which is used to support the screen segmentation visualization in the network space map model to realize the mapping between the network space and the geographic space, and present the network space information in various aspects. The different modules will be introduced in detail below.
  • the coordinate system of the network space map model is a two-dimensional coordinate system
  • the basic vector is a two-dimensional coordinate system building foundation
  • the creation module 200 is further used to convert the basic vector corresponding to the IP address according to
  • the mapping method maps to a two-dimensional coordinate system, and maintains the concept of IP address aggregation to create a two-dimensional coordinate system of an aggregated, regional, and scalable network space map model.
  • the creation module 200 is specifically used for: mapping the basic vector corresponding to the IP address to a two-dimensional coordinate system according to a mapping method, performing a Hilbert transform on the IP address to maintain the concept of IP address aggregation to create an aggregation, a region And scalable network space map model 2D coordinate system.
  • the three-dimensional coordinate system includes a third coordinate axis orthogonal to the two-dimensional coordinate system, wherein the basic visualization module 300 is further used to construct the two-dimensional structure of the third coordinate axis and the IP address
  • the coordinate system is orthogonal; or the three-dimensional coordinate system is abstracted as the concept of the map model layer, and the thematic map of the network space is established to visualize the IP fine-grained information.
  • the scale standard is the scale design standard of the network space map model.
  • the basic visualization module 300 is specifically used to: solidify a network space map model created based on the construction of a three-dimensional coordinate system, thematic maps, scale design, etc., and integrate network space resources including autonomous domains AS, networks, organizations, institutions, attributes, etc. with IP addresses. Intersection as a third-dimensional coordinate system presents fine-grained information in cyberspace in layers at different scales. Or, the basic visualization module 300 is specifically used to abstract the three-dimensional coordinate system into the concept of a map model layer, establish a thematic map of cyberspace, visualize information such as AS, networks, organizations, institutions, attributes, etc. of the cyberspace autonomous domain, and build on the IP address. In a two-dimensional coordinate system and scaled according to different scales.
  • the scale standard is the scale of the cyberspace map model
  • the cyberspace resources are entities that can be detected and perceived using cyberspace means.
  • the construction module 400 is further used to refer to the GIS system for network
  • the scale design of the space map makes the network space map model have a map concept, and the map model scales to present different levels of network space resource information.
  • the maps with different scales show different resource visualization effects, reflecting the original characteristics of network space.
  • the device 10 implemented by the present invention further includes: a management visualization module 600.
  • the management visualization module 600 is used to realize the network space management scene visualization in the map model with the IP address as the backplane, and assist the management personnel in more fine-grained asset management.
  • the network space map model uses the IP address as the backplane.
  • the network space visualization is to visualize the characteristics and attributes of the network space IP address; the management visualization module 600 is specifically used to: intuitively reflect the composition and performance indicators of the IP address, and assist the network based on the scalability of the map
  • the management personnel countries, operators, municipal public security, campus network, etc.
  • the network space map model uses the IP address as the backplane.
  • the network space visualization is to visualize the characteristics and attributes of the network space IP address. It provides users with a data interface specification and displays the corresponding map effect after importing the data according to the format.
  • the module defines the data format [Start IP, End IP, scale, chroma, cyberspace resource category 1, description 1, cyberspace resource category 2, description 2,...].
  • the device 10 implemented by the present invention further includes: a security visualization model 700.
  • the security visualization model 700 is used to dynamically display real-time security attacks, botnet distribution, and DDOS attacks in the cyberspace map model to assist security analysts in better understanding and preventing attacks.
  • the security visualization module 700 is specifically used to: dynamically display some existing security attacks, botnet distribution, DDOS attacks and other scenarios in real time, and visualize data statistics results. It can quickly locate security problems, analyze attack behavior, locate botnet C&C servers, and assist security analysts to better understand and prevent attacks.
  • visualizing a DDOS scene in a network space map model with an IP address as a backplane can intuitively express the expansion of infected IP and the distribution of DDoS attack IP and attacked IP addresses. Assist security analysts to better understand and prevent attacks, effectively cut off the propagation path of infection, and achieve network attack shielding and prevention.
  • the device for creating a network space map model determines the network space coordinate system based on the IP address of the network space map model; the IP address is mapped to the two-dimensional coordinate system according to a preset mapping method to create Aggregate, regional, and scalable network space map model coordinate system architecture; realize the physicalization of the network space basic map model according to the network space map model coordinate system and scale standards, and complete the positioning, search, and description of massive physical resources;
  • the IP address is the backplane map model to realize the visualization of cyberspace management scenarios, assisting managers in finer-grained asset management; the cyberspace map model dynamically displays real-time security attacks, botnet distribution, and DDOS attacks in cyberspace And other scenarios to assist security analysts to better understand and prevent attacks.
  • the device uses a constant, orthogonal network space map model coordinate system architecture based on IP addresses as the base vector to achieve accurate expression of network space elements. Compared with geographic network space maps and topological network space maps, it can be more intuitive and comprehensive. More effectively visualize the unique attributes of cyberspace itself.
  • the dimension enhancement based on Hilbert map transformation achieves a better IP address visualization effect and meets the aggregation, regionality and scalability of the two-dimensional coordinate system of the map model.
  • the physical network space map model is materialized, and classic network space map application scenes are extracted to realize visualization, and various classic application scene drawing and visualization such as network space resources, management, security, and measurement are realized.
  • Users can easily filter out specific details of interest, so as to obtain effective display of different areas under different granularities of network space, which is convenient for network users, administrators, and security analysts to realize multi-level recognition of network space, locate network space resources, and understand the network Regional performance, optimized network configuration management, and accurate perception of network security situation. Compared with traditional geographic maps and topological maps, it can better reflect the original characteristics of cyberspace.
  • the mapping module 500 is a network space map and geographic map mapping module, and is also used to support screen segmentation visualization in the network space map model to realize the mapping between network space and geographic space. Presents cyberspace information in many ways.
  • the mapping relationship between the network space map and the geographic map includes the mapping between the network space IP address and the geographic space latitude and longitude, wherein the mapping module 500 is further used to determine the network space map and the geographic map mapping Relationship, combined with cyberspace maps and geospatial maps to simultaneously express cyberspace elements, and comprehensively observe cyberspace from multiple angles.
  • the visualization between the network space and the geographic space represents the mapping between the IP address of the network space and the latitude and longitude of the geographic space.
  • Presenting cyberspace information in various ways includes combining cyberspace maps and geospatial maps to simultaneously express cyberspace elements, providing a method for comprehensively observing cyberspace from multiple angles.
  • the network space map model has the basic concept of map expansion and contraction; the default mapping method is the conversion method of one-dimensional IP address mapping to the two-dimensional coordinate system, which ensures that the basic coordinate system of the network space map model has aggregation and regionality.
  • Scalability is set to the scale of the network space map to achieve the hierarchical visualization of different network space resources at different scales, from AS resources to large networks under a certain AS (backbone network, access network, resident map) , Internet of Things, industrial network, overlay network), and then to small networks (campus networks, computing centers, home networks, etc.), and finally achieve more fine-grained IP resource search, positioning and description, reflecting the network space hierarchy.
  • a DDOS attack scenario is presented, where the target host is a Tsinghua campus network server.
  • the network space map on the left side can display the AS, large network, small network, subnet, IP and other levels to which the DDOS attack source and destination belong in sequence, and the geographic location of the host at the corresponding level on the geographical map.
  • the points aggregated in the geographic location may be scattered in the IP map, which can play a comparison and supplementary role.
  • the embodiments of the present invention construct a multi-scale, multi-dimensional, and multi-view network space map device according to the method for creating a network space map model, and apply it to some classic network space map application scenarios to realize multi-level recognition of network space.
  • the Hilbert map transformation is selected to meet the aggregation, regionality and scalability of the map model, and at the same time realize the construction of 3D coordinate system, thematic map, scale design and other maps
  • the breakthrough of key technology research of the model has filled the theoretical gap of the cyberspace map model, and designed a multi-scale, multi-dimensional, multi-view cyberspace map device, which is applied to the positioning and expression of cyberspace elements, cyberspace monitoring and management and network
  • the network space can be visually and effectively visualized in the network space map, and the deep analysis and expression of the network space can be realized.
  • first and second are used for description purposes only, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated.
  • the features defined with “first” and “second” may include at least one of the features either explicitly or implicitly.
  • the meaning of "plurality” is at least two, such as two, three, etc., unless specifically defined otherwise.

Landscapes

  • Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Databases & Information Systems (AREA)
  • Remote Sensing (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Geometry (AREA)
  • Software Systems (AREA)
  • Data Mining & Analysis (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Graphics (AREA)
  • Human Computer Interaction (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

本发明公开了一种网络空间地图模型创建方法及装置，其中，方法包括：确定网络空间地图模型坐标系采用IP地址作为基础向量；根据预设映射方式将IP地址映射到二维坐标系；确定三维坐标系将逻辑端口、区域、拓扑结构与IP地址正交描述网络空间更细粒度的信息，实现网络空间地图模型专题地图；构建完成比例尺标准，以为在网络空间地图模型中层次化、可伸缩表示复杂多样的网络空间资源奠定理论基础；确定网络空间地图与地理地图映射关系，以支持屏幕切分实现同一网络空间场景在不同网络空间地图与地理地图中对比绘制，并多方面呈现网络空间信息。该方法将网络空间直观、有效的可视化到网络空间地图中，并实现网络空间深层次剖析和表达。

Description

网络空间地图模型创建方法及装置
相关申请的交叉引用
本申请要求清华大学于2018年12月03日提交的、发明名称为“网络空间地图模型创建方法及装置”的、中国专利申请号“201811467533.5”的优先权。
技术领域
本发明涉及网络空间可视化技术领域，特别涉及一种网络空间地图模型创建方法及装置。
背景技术
网络空间作为由人类作为“上帝”结合计算机网络与虚拟现实创造出的独立空间，是一个数字化、信息化、智能化的虚拟世界，目前已经发展为平行于地理空间的第二大空间，深刻影响人类的社会生活。网络空间突破了传统物理空间的时空限制，传统地理空间特征在网络空间重要性降低，因此网络空间地图学研究与传统地理地图学研究存在重要差别。关于网络空间地图学研究目前几乎处于空白，对于网络空间本源探索非常局限，尚未建立基本的概念模型和空间理论基础，导致网络空间地图领域研究举步维艰。
当前关于网络空间地图学的研究主要围绕地理网络空间地图和拓扑网络空间地图展开。网络空间的空间特性对网络空间相关研究带来了机遇和挑战，关于网络空间的空间理论模型研究集中于地理网络空间模型和拓扑网络空间模型，通过传统地理坐标系和拓扑坐标系将网络空间映射到地理空间和拓扑空间。地理网络空间地图和拓扑网络空间地图实现网络空间的地理特征和拓扑特征的表达，但它们都存在局限性。地理网络空间地图无法揭示网络空间的空间本源特性，拓扑网络空间地图的拓扑节点时刻动态变化，无法提供恒定的描述和表达网络空间的方法。
然而，迄今为止，对于网络空间地图领域相关研究并不多，多种网络空间场景难以在统一的绘制背板上呈现，并没有人提出基础网络空间地图模型用于可视化网络空间，亟待解决。
发明内容
本发明旨在至少在一定程度上解决相关技术中的技术问题之一。
为此，本发明的一个目的在于提出一种网络空间地图模型创建方法，该方法将网络空 间直观、有效的可视化到网络空间地图中，并实现网络空间深层次剖析和表达。
本发明的另一个目的在于提出一种网络空间地图模型创建装置。
为达到上述目的，本发明一方面实施例提出了一种网络空间地图模型创建方法，包括以下步骤：步骤S101：确定网络空间地图模型坐标系采用IP地址作为基础向量；步骤S102：根据预设映射方式将IP地址映射到二维坐标系以满足聚合性、区域性和可伸缩性的网络空间地图基础模型；步骤S103：确定三维坐标系将逻辑端口、区域、拓扑结构与IP地址正交描述网络空间更细粒度的信息，以可抽象为图层的概念从而实现网络空间地图模型专题地图；步骤S104：构建完成比例尺标准，以为在网络空间地图模型中层次化、可伸缩表示复杂多样的网络空间资源奠定理论基础；步骤S105：确定网络空间地图与地理地图映射关系，以支持屏幕切分实现同一网络空间场景在不同网络空间地图与地理地图中对比绘制，并多方面呈现网络空间信息。
本发明实施例的网络空间地图模型创建方法，通过选取希尔伯特映射变换满足地图模型的聚合性、区域性和可伸缩性，同时实现三维坐标系构建、专题地图、比例尺设计等地图模型关键技术研究突破，填补了网络空间地图模型理论空缺，并设计了一款多尺度，多维度，多视图的网络空间地图装置，应用于网络空间要素定位和表达、网络空间监控与管理和网络空间安全等场景中，从而将网络空间直观、有效的可视化到网络空间地图中，并实现网络空间深层次剖析和表达。
另外，根据本发明上述实施例的网络空间地图模型创建方法还可以具有以下附加的技术特征：
进一步地，在本发明的一个实施例中，所述网络空间地图模型坐标系为二维坐标系，所述基础向量为二维坐标系构建基础，其中，所述步骤S102包括：将所述IP地址对应的基础向量按照映射方法映射到所述二维坐标系上，并保持IP地址聚合概念以创建聚合性、区域性和可伸缩性网络空间地图模型二维坐标系。
进一步地，在本发明的一个实施例中，所述三维坐标系包括与所述二维坐标系正交的第三坐标轴，其中，所述步骤S103包括：将所述第三坐标轴与所述IP地址构造的二维坐标系正交；或者将所述三维坐标系抽象为地图模型图层的概念，并建立网络空间专题地图，以可视化IP细粒度信息。
进一步地，在本发明的一个实施例中，所述比例尺标准为网络空间地图模型伸缩比例，所述网络空间资源为使用网络空间手段能够探测和感知的实体，其中，所述步骤S104包括：参照GIS(Geographic Information System，地理信息系统)系统进行网络空间地图比例尺设计，使得所述网络空间地图模型具备地图概念；通过地图模型伸缩呈现不同层次的网络空间资源信息，不同伸缩粒度下的地图呈现不同的资源可视化效果，反映网络空间本源特 征。
进一步地，在本发明的一个实施例中，所述网络空间地图与地理地图映射关系包括网络空间IP地址与地理空间经纬度之间的映射，其中，所述步骤S105包括：确定所述网络空间地图与所述地理地图映射关系，并结合所述网络空间地图和所述地理空间地图同时表达网络空间要素，以多角度全面观察网络空间。
为达到上述目的，本发明另一方面实施例提出了一种网络空间地图模型创建装置，包括：确定模块，用于确定网络空间地图模型坐标系采用IP地址作为基础向量；创建模块，用于根据预设映射方式将IP地址映射到二维坐标系以满足聚合性、区域性和可伸缩性的网络空间地图基础模型；基础可视化模块，用于确定三维坐标系将逻辑端口、区域、拓扑结构与IP地址正交描述网络空间更细粒度的信息，以可抽象为图层的概念从而实现网络空间地图模型专题地图；构建模块，用于构建完成比例尺标准，以为在网络空间地图模型中层次化、可伸缩表示复杂多样的网络空间资源奠定理论基础；映射模块，用于确定网络空间地图与地理地图映射关系，以支持屏幕切分实现同一网络空间场景在不同网络空间地图与地理地图中对比绘制，并多方面呈现网络空间信息。
本发明实施例的网络空间地图模型创建装置，通过选取希尔伯特映射变换满足地图模型的聚合性、区域性和可伸缩性，同时实现三维坐标系构建、专题地图、比例尺设计等地图模型关键技术研究突破，填补了网络空间地图模型理论空缺，并设计了一款多尺度，多维度，多视图的网络空间地图装置，应用于网络空间要素定位和表达、网络空间监控与管理和网络空间安全等场景中，从而将网络空间直观、有效的可视化到网络空间地图中，并实现网络空间深层次剖析和表达。
另外，根据本发明上述实施例的网络空间地图模型创建装置还可以具有以下附加的技术特征：
进一步地，在本发明的一个实施例中，所述网络空间地图模型坐标系为二维坐标系，所述基础向量为二维坐标系构建基础，其中，所述创建模块进一步用于将所述IP地址对应的基础向量按照映射方法映射到所述二维坐标系上，并保持IP地址聚合概念以创建聚合性、区域性和可伸缩性网络空间地图模型二维坐标系。
进一步地，在本发明的一个实施例中，所述三维坐标系包括与所述二维坐标系正交的第三坐标轴，其中，所述基础可视化模块进一步用于将所述第三坐标轴与所述IP地址构造的二维坐标系正交；或者将所述三维坐标系抽象为地图模型图层的概念，并建立网络空间专题地图，以可视化IP细粒度信息。
进一步地，在本发明的一个实施例中，所述比例尺标准为网络空间地图模型伸缩比例，所述网络空间资源为使用网络空间手段能够探测和感知的实体，其中，所述构建模块进一 步用于参照GIS系统进行网络空间地图比例尺设计，使得所述网络空间地图模型具备地图概念，并通过地图模型伸缩呈现不同层次的网络空间资源信息，不同伸缩粒度下的地图呈现不同的资源可视化效果，反映网络空间本源特征。
进一步地，在本发明的一个实施例中，所述网络空间地图与地理地图映射关系包括网络空间IP地址与地理空间经纬度之间的映射，其中，所述映射模块进一步用于确定所述网络空间地图与所述地理地图映射关系，并结合所述网络空间地图和所述地理空间地图同时表达网络空间要素，以多角度全面观察网络空间。
本发明附加的方面和优点将在下面的描述中部分给出，部分将从下面的描述中变得明显，或通过本发明的实践了解到。
附图说明
本发明上述的和/或附加的方面和优点从下面结合附图对实施例的描述中将变得明显和容易理解，其中：
图1为根据本发明一个实施例的网络空间地图模型创建方法的流程图；
图2为根据本发明一个实施例的不同阶数(N＝1，2，3，4)的希尔伯特曲线；
图3为根据本发明一个实施例的将部分一维IP地址空间进行希尔伯特变换得到的二维IP地址空间示意图；
图4为根据本发明一个实施例的以逻辑端口为第三维坐标系的网络空间地图模型；
图5为根据本发明一个实施例的网络空间地图模型比例尺标准示意图；
图6为根据本发明一个实施例的网络空间地图模型创建装置的结构示意图；
图7为根据本发明一个实施例的网络空间地图基础可视化模块示意图；
图8为根据本发明另一个实施例的网络空间地图模型创建装置的结构示意图；
图9为根据本发明一个实施例的网络空间地图DDOS攻击场景示意图；
图10为根据本发明一个实施例的网络空间地图与地理地图映射分屏示意图。
具体实施方式
下面详细描述本发明的实施例，所述实施例的示例在附图中示出，其中自始至终相同或类似的标号表示相同或类似的元件或具有相同或类似功能的元件。下面通过参考附图描述的实施例是示例性的，旨在用于解释本发明，而不能理解为对本发明的限制。
下面参照附图描述根据本发明实施例提出的网络空间地图模型创建方法及装置，首先将参照附图描述根据本发明实施例提出的网络空间地图模型创建方法。
图1是本发明一个实施例的网络空间地图模型创建方法的流程图。
如图1所示，该网络空间地图模型创建方法包括以下步骤：
步骤S101：确定网络空间地图模型坐标系采用IP地址作为基础向量。
可以理解的是，网络空间地图模型中坐标系为二维坐标系，基础向量为二维坐标系构建基础，其中，由IP地址作为基础向量以表示有IP化的网络空间要素。
具体而言，网络空间为一种基于互联网、物联网和电信网等网络系统构建的信息处理和交互环境，其中包括用户、服务和数据等。从狭义上讲，网络空间仅包含广义网络空间中具有IP化的实体网元。IP地址作为定位网络空间要素的唯一指纹是网络空间信息通信的关键标识，网络空间中异构硬件、异构操作系统、异构网络系统都可以通过统一的IP地址实现空间定位和空间信息交互。换而言之，网络空间的空间构建本质是IP地址，网络空间中的所有的行为与信息交互都需要基于IP地址实现。以IP地址作为网络空间基础向量不仅能够快速定位网络空间要素，还可以通过构建源IP地址和目的IP地址实现信息的流通，同时所有空间测量都可以直接或者间接的转化为对IP地址的测量。
步骤S102：根据预设映射方式将IP地址映射到二维坐标系以满足聚合性、区域性和可伸缩性的网络空间地图基础模型。
在本发明的一个实施例中，网络空间地图模型坐标系为二维坐标系，基础向量为二维坐标系构建基础，其中，步骤S102包括：将IP地址对应的基础向量按照映射方法映射到二维坐标系上，并保持IP地址聚合概念以创建聚合性、区域性和可伸缩性网络空间地图模型二维坐标系。
可以理解的是，网络空间地图模型采用IP地址作为基础向量进行二维坐标系设计，考虑到一维IP地址空间的可视化效果不佳，不能较好的呈现地图的区域性和可伸缩性，需要分析一些升维的映射方法，将一维IP地址映射到网络空间坐标系中的二维平面，其中希尔伯特映射方法能够满足构建聚合性、区域性和可伸缩性的网络空间地图基础模型。
其中，聚合型指一维空间中的局部性可以保持在二维空间中，这对于IP地址而言非常有用，相邻的IP在二维空间中也相邻，保留了IP聚合成块的特性，并呈现一定的地图区域性。可伸缩性指通过不同的希尔伯特曲线阶数的变化呈现不同粒度的网络空间地图信息。
举例而言，每64个网格形成的IP区域例如10.0.0.0/26与10.0.0.64/26，10.0.0.128/26，10.0.0.192/26等四个IP子域在希尔伯特曲线阶数N＝32的网络空间地图中仍保持相邻。同时，随着Hilbert曲线阶数的变化，可实现IP地址由点到块的不断展开，例如10.0.0.0/24的IP地址块在希尔伯特曲线阶数N＝12的地图中聚合为一个点，N＝13时扩展为4个点形成区域，N＝16时IP块再次展开为256个IP地址，呈现地图模型的可伸缩性。
下面将简要介绍将一维IP地址映射到二维坐标系的预设映射方式希尔伯特映射，其映射算法也相对复杂。如图2所示，不同阶数(N＝1，2，3，4)的希尔伯特曲线，希尔伯特曲 线是一种应用广泛的空间填充曲线，对于给定的象限，其绘制方式是由象限的位置以及所在大方形的曲线走势所决定。图2分别展示了2 1x2 1，2 2x2 2，2 3x2 3，2 4x2 4个网格，其中每个网络代表一个点。具体的算法述如下：
算法1、基于希尔伯特的IP地址映射算法
输入:Hin＝<BH,n>Data＝{0,1,2...n-1}
其中n代表希尔伯特曲线阶数，BH＝(h 2n-1h 2n-2…h 1h 0) 2为IP地址的二进制表示
输出:Hout＝<x,y>
1.<v 0,v 1>＝ROTCHANGEN(Hin,0)
2.for(eachnum k∈Data)do
3.
Figure PCTCN2019098874-appb-000001
4.
Figure PCTCN2019098874-appb-000002
5.end for
6.Hout＝<x,y>＝<(x n-1x n-2…x 0) 2,(y n-1y n-2…y 0) 2>
7.emitHout
其中主要的功能函数ROTCHANGEN算法流程描述如下，返回值作为IP映射变换的重要参数。
算法2.ROTCHANGEN
输入：Hin＝<BH,n>，BH＝(h 2n-1h 2n-2…h 1h 0) 2，起始阶数k
输出：Hout＝<v 0,v 1>
1、If k＝＝n
2、v 0,n-1＝0，v 1,n-1＝0
3、end if k＝＝n
4、else
5、ROTCHANGE(Hin,k+1)
6、
Figure PCTCN2019098874-appb-000003
7、
Figure PCTCN2019098874-appb-000004
8、End
9、Hout＝<v 0,n-1v 0,n-2…v 0,0,v 1,n-1v 1,n-2…v 1,0>
10、Emit Hout
由于IPv4地址空间一共有2 32＝2 16x2 16个点，因此如果要在二维空间中可视化所有IP 地址，需要用16阶希尔伯特曲线进行展示，画布大小为2 16x2 16，基于此设计网络空间地图可以很好的呈现可伸缩性和地图区域性的概念。
进一步地，如图3所示，为部分一维IP地址空间(10.0.0.0/24的IP地址块)进行希尔伯特变换得到的二维IP地址空间，观察发现一维IP地址在二维空间中保持相邻，同时一块64个网格组成的区域形成IP前缀聚合，4个/26的区域再次聚合为/24前缀地址空间，体现了网络空间地图模型的聚合性和区域性。同时通过调整Hilbert曲线的阶数，可实现IP地址由点到块的不断展开，呈现地图模型的可伸缩性，具备较好的可视化效果。
步骤S103：确定三维坐标系将逻辑端口、区域、拓扑结构与IP地址正交描述网络空间更细粒度的信息，以可抽象为图层的概念从而实现网络空间地图模型专题地图。
进一步地，在本发明的一个实施例中，三维坐标系包括与二维坐标系正交的第三坐标轴，其中，步骤S103包括：将第三坐标轴与IP地址构造的二维坐标系正交；或者将三维坐标系抽象为地图模型图层的概念，并建立网络空间专题地图，以可视化IP细粒度信息。
可以理解的是，三维坐标系包括与二维坐标系正交的第三坐标轴，本发明实施例将逻辑端口、区域、拓扑结构等含义的第三坐标轴与IP地址构造的二维坐标系正交；或者，将三维坐标系抽象为地图模型图层的概念，建立网络空间专题地图，可视化网络空间流量、拓扑、AS、网络、属性等IP细粒度信息。
具体而言，以IP地址为基础向量构建的二维坐标系呈现出网络空间的IP属性，可将网络空间定位到相应的主机粒度如手机、电脑、PAD、路由等。同时为了更细粒度的描述和定位网络空间资源，本申请的提供的网络空间地图模型定义一些三维坐标向量的概念，如逻辑端口、拓扑结构、区域信息等，与IP地址正交协助更深层次的认知网络空间，同时在网络空间地图模型中抽象为图层的概念实现专题地图。
具体地，网络空间中逻辑端口通常表示一个进程或者网络服务，与IP地址正交构成三维坐标系可细粒度的定位网络空间相关的服务信息，如网站、邮件、ftp等。其中端口流量信息可协助执行网络监控任务以及与网络安全相关的数据取证，实现流量异常监控。
可视化过程中通过在二维网络空间地图的基础上添加拓扑维度可实现不同粒度下网络拓扑的可视化：AS拓扑，路由拓扑，IP拓扑等，用于指导受到网络安全攻击时更改互联网基础设施的连接性，协助网络管理人员检查硬件配置情况、确定新路由添加位置、发现网络中的瓶颈和故障，相比于拓扑坐标系而言更加稳定。
根据不同级别网络管理人员(国家，运营商、市公安、校园网等层次)需求及已有的网络空间数据可视化区域信息AS、城域网、局域网、机构、组织等，方便进行相应的资产管理和运营维护。
本发明实施例以第三维坐标向量概念抽象为端口、流量、拓扑、区域等图层可绘制网 络空间专题地图。在以IP为背板的二维网络空间坐标系的基础上，通过添加图层的方式赋予网络空间地图具体应用场景，实现网络空间多样化展示。
举例而言，以逻辑端口作为第三维坐标系，在网络空间坐标系中可通过坐标(x,y,z)表达IP:PORT，以更精细的粒度可视化某一主机上的服务。图4为以逻辑端口为第三维坐标系的网络空间地图模型。如图4所示，IP地址对应三维坐标系底部的二维平面空间，逻辑端口对应的是三维坐标系的垂直空间，实现了将网络空间较好的可视化到三维坐标系中。
或者在网络空间基础地图中添加逻辑端口图层，eg.80端口，将开放80端口的IP地址着色显示便于观察执行超文本传输协议的IP地址分布情况，实现网络空间超文本协议服务专题地图可视化。
步骤S104：构建完成比例尺标准，以为在网络空间地图模型中层次化、可伸缩表示复杂多样的网络空间资源奠定理论基础。
在本发明的一个实施例中，比例尺标准为网络空间地图模型伸缩比例，网络空间资源为使用网络空间手段能够探测和感知的实体，其中，步骤S104包括：参照GIS系统进行网络空间地图比例尺设计，使得网络空间地图模型具备一定的地图概念；通过地图模型伸缩呈现不同层次的网络空间资源信息，不同伸缩粒度下的地图呈现不同的资源可视化效果，反映网络空间本源特征。
具体而言，在地图模型构建过程中若是不加区分显示所有的网络空间资源，会使得网络空间地图缺乏直观性、层次感和逻辑表达，不利于网络资源管理和网络安全分析。因此亟需构建网络空间地图模型比例尺标准，使得不同层次的网络空间资源在不同的网络空间地图模型比例尺下伸缩呈现。
图5为网络空间地图模型比例尺标准示意图，如图5所示，参照地理信息系统进行初步的地图比例尺设计，使得网络空间地图模型具备一定的地图概念，不同伸缩粒度即不同希尔伯特曲线阶数的地图下呈现不同的资源可视化效果。
举例而言，网络空间地图模型最初比例尺为/20，绘制IP地址的希尔伯特曲线阶数N＝10，可视化网络空间自治系统AS信息，接下来放大呈现AS下广域网信息，广域网展开为多个局域网，局域网展开显示IP粒度的具体资源类别(交换机、路由器等)，比例尺标准设计使得网络空间地图表达具备层次性、直观性和逻辑性。
综上，本实施例提供的网络空间地图模型的创建方法，确定网络空间地图模型坐标系采用IP地址作为基础向量；根据预设映射方式将IP地址映射到二维坐标系以满足聚合性、区域性和可伸缩性的网络空间地图基础模型；确定三维坐标系将逻辑端口、区域、拓扑结构与IP地址正交描述网络空间更细粒度的信息，可抽象为图层的概念从而实现网络空间地图模型专题地图；构建完成比例尺标准，为在网络空间地图模型中层次化、可伸缩表示复 杂多样的网络空间资源奠定了理论基础。
该方法采用以IP地址为基础向量的恒定、正交的网络空间地图模型坐标体系架构，实现网络空间要素的精准表达，相比于地理网络空间地图和拓扑网络空间地图能够更加直观、更加全面、更加有效地可视化网络空间本身的特有属性。基于希尔伯特映射变换升维实现较好地IP地址可视化效果，满足地图模型二维坐标系的聚合性、区域性和可伸缩性。
在此基础上，添加逻辑端口、区域、拓扑结构等第三维坐标系概念，与IP地址正交协助更深层次的认知网络空间，同时在网络空间地图模型中抽象为图层的概念实现多样化专题地图。此外，本发明还进行相应的比例尺标准设计，为在不同粒度下分层显示网络空间复杂多样的资源，呈现伸缩性的地图可视化效果。该方法作为网络空间地图的基础支撑，可协助建立多尺度、多维度、多视图的网络空间地图，促进网络空间可视化的发展。
基于上述实施例的基础上，本发明实施例的方法还包括步骤105。
步骤S105：确定网络空间地图与地理地图映射关系，以支持屏幕切分实现同一网络空间场景在不同网络空间地图与地理地图中对比绘制，并多方面呈现网络空间信息。
在本发明的一个实施例中，网络空间地图与地理地图映射关系包括网络空间IP地址与地理空间经纬度之间的映射，其中，步骤S105包括：确定网络空间地图与地理地图映射关系，并结合网络空间地图和地理空间地图同时表达网络空间要素，以多角度全面观察网络空间。
可以理解的是，本发明实施例确定网络空间地图与地理地图映射关系，结合网络空间地图和地理空间地图同时表达网络空间要素，提供了一种多角度全面观察网络空间的方法。
具体而言，本发明实施例将网络空间地图模型绘制背板更改为地理地图空间，再与相应功能的网络空间地图系统进行比照，在相同场景下支持屏幕切分，左边显示网络空间地图右边显示地理地图，两种地图协助可以帮助用户从多个角度认知网络空间，也能通过一些场景的对比体现本发明设计的网络空间地图的优越性。
综上，首先确定以IP地址作为网络空间地图模型坐标系基础向量，从网络空间本源的角度可视化网络空间。网络空间的虚拟性，空间结构的复杂性，空间信息的瞬时性为构建网络空间坐标系带来了巨大的挑战，IP地址是定位网络空间要素的唯一指纹，是网络空间信息通信的关键标识。网络空间中异构硬件、异构操作系统、异构网络系统都可以通过统一的IP地址实现空间定位和空间信息交互。进而根据预设映射方式将一维IP地址映射到二维坐标系以满足聚合性、区域性和可伸缩性的网络空间地图基础模型，同时进行三维坐标设计、比例尺设计等网络空间地图模型关键技术的研究，为专题地图构建以及在网络空间地图模型中层次化、可伸缩表示复杂多样的网络空间资 源奠定了理论基础。最后确定网络空间地图与地理地图映射关系，结合网络空间地图和地理空间地图同时表达网络空间要素，提供了一种多角度全面观察网络空间的方法。
进一步地，本发明实施例设计出一种多尺度、多维度、多视图的网络空间地图模型，将网络空间直观、有效的可视化到网络空间地图中，并将网络空间地图应用于网络空间资源表达、网络空间要素监控与管理以及网络空间安全可视化等场景，填补网络空间测绘领域缺乏背板的空缺，促进网络空间测绘领域的学科发展。
根据本发明实施例提出的网络空间地图模型创建方法，通过选取希尔伯特映射变换满足地图模型的聚合性、区域性和可伸缩性，同时实现三维坐标系构建、专题地图、比例尺设计等地图模型关键技术研究突破，填补了网络空间地图模型理论空缺，并设计了一款多尺度，多维度，多视图的网络空间地图装置，应用于网络空间要素定位和表达、网络空间监控与管理和网络空间安全等场景中，从而将网络空间直观、有效的可视化到网络空间地图中，并实现网络空间深层次剖析和表达。
其次参照附图描述根据本发明实施例提出的网络空间地图模型创建装置。
图6是本发明一个实施例的网络空间地图模型创建装置的结构示意图。
如图6所示，该网络空间地图模型创建装置10包括：确定模块100、创建模块200、基础可视化模块300、构建模块400和映射模块500。
其中，确定模块100用于确定网络空间地图模型坐标系采用IP地址作为基础向量。创建模块200用于根据预设映射方式将IP地址映射到二维坐标系以满足聚合性、区域性和可伸缩性的网络空间地图基础模型。基础可视化模块300用于确定三维坐标系将逻辑端口、区域、拓扑结构与IP地址正交描述网络空间更细粒度的信息，以可抽象为图层的概念从而实现网络空间地图模型专题地图。构建模块400用于构建完成比例尺标准，以为在网络空间地图模型中层次化、可伸缩表示复杂多样的网络空间资源奠定理论基础。映射模块500用于确定网络空间地图与地理地图映射关系，以支持屏幕切分实现同一网络空间场景在不同网络空间地图与地理地图中对比绘制，并多方面呈现网络空间信息。本发明实施例的装置10将网络空间直观、有效的可视化到网络空间地图中，并实现网络空间深层次剖析和表达。
具体而言，确定模块100用于确定网络空间地图模型以IP地址为基础的网络空间坐标系。创建模块200用于根据预设映射方式将IP地址映射到二维坐标系，以创建聚合性、区域性和可伸缩性的网络空间地图模型坐标体系架构。基础可视化模块300用于根据网络空间地图模型坐标系和比例尺标准实现网络空间基础地图模型实体化，完成海量实体资源的定位、搜索和描述。映射模块500即为网络空间地图与地理地图映射模块，用于在网络空间地图模型中支持屏幕切分可视化实现网络空间与地理空间之间的映射，多方面呈现网络 空间信息。下面将分别对不同模块进行详细介绍。
进一步地，在本发明的一个实施例中，网络空间地图模型坐标系为二维坐标系，基础向量为二维坐标系构建基础，其中，创建模块200进一步用于将IP地址对应的基础向量按照映射方法映射到二维坐标系上，并保持IP地址聚合概念以创建聚合性、区域性和可伸缩性网络空间地图模型二维坐标系。
可以理解的是，创建模块200具体用于：将IP地址对应的基础向量按照映射方法映射到二维坐标系上，对IP地址进行希尔伯特变换保持IP地址聚合概念以创建聚合性、区域性和可伸缩性网络空间地图模型二维坐标系。
进一步地，在本发明的一个实施例中，三维坐标系包括与二维坐标系正交的第三坐标轴，其中，基础可视化模块300进一步用于将第三坐标轴与IP地址构造的二维坐标系正交；或者将三维坐标系抽象为地图模型图层的概念，并建立网络空间专题地图，以可视化IP细粒度信息。
具体而言，比例尺标准为网络空间地图模型比例尺设计标准。基础可视化模块300具体用于：实体化基于三维坐标系构建、专题地图、比例尺设计等创建的网络空间地图模型，将网络空间资源包括自治域AS、网络、组织、机构、属性等与IP地址正交作为第三维坐标系在不同比例尺下分层呈现网络空间细粒度信息。或者，基础可视化模块300具体用于将三维坐标系抽象为地图模型图层的概念，建立网络空间专题地图，可视化网络空间自治域AS、网络、组织、机构、属性等信息，依附于IP地址构建的二维坐标系中并按照不同的比例尺伸缩呈现。
举例而言，如图7所示，在比例尺/20下采用不同的颜色标识ASN的分配信息与IP地址分布，在比例尺/28下展开AS4538显示其Cernet网络下下骨干网、计算中心、一百多所高校校园网(武汉大学、郑州大学、湖南大学、西安电子科技大学等)的IPv4地址分布情况，接着在比例尺/32的网络空间地图中展开到IP粒度，可视化基于网络空间资源探测技术识别其对应的具体资源类别。参照网络空间地图模型创建方法比例尺设计标准伸缩实现不同比例尺下不同网络空间资源类型可视化，同时支持链接外部代码满足不同层次用户对网络空间的定位、搜索、与描述。
进一步地，在本发明的一个实施例中，比例尺标准为网络空间地图模型伸缩比例，网络空间资源为使用网络空间手段能够探测和感知的实体，其中，构建模块400进一步用于参照GIS系统进行网络空间地图比例尺设计，使得网络空间地图模型具备地图概念，并通过地图模型伸缩呈现不同层次的网络空间资源信息，不同伸缩粒度下的地图呈现不同的资源可视化效果，反映网络空间本源特征。
进一步地，如图8所示，本发明实施的装置10还包括：管理可视化模块600。管理可 视化模块600用于在以IP地址为背板的地图模型中实现网络空间管理场景可视化，协助管理人员进行更细粒度的资产管理。
网络空间地图模型以IP地址为背板，网络空间可视化是对网络空间IP地址特征及属性可视化；管理可视化模块600具体用于：直观的反映IP地址构成及性能指标，基于地图可伸缩性协助网络管理人员(国家，运营商、市公安、校园网等级别)进行相应级别资产管理和运营维护。
进一步地，网络空间地图模型以IP地址为背板，网络空间可视化是对网络空间IP地址特征及属性可视化，为用户提供数据接口规范依照格式导入数据后呈现相应的地图效果，该模块定义数据格式[起始IP，终止IP，比例尺，色度，网络空间资源类别1，描述1，网络空间资源类别2，描述2，…]。
进一步地，如图8所示，本发明实施的装置10还包括：安全可视化模型700。其中，安全可视化模型700用于在网络空间地图模型中实时动态显示网络空间存在的安全攻击、僵尸网络分布、和DDOS攻击等场景，协助安全分析人员更好的认识和防范攻击。
安全可视化模块700具体用于：实时动态显示一些存在的安全攻击、僵尸网络分布、DDOS攻击等场景，并可视化数据统计结果。可快速定位安全问题，分析攻击行为，定位僵尸网络C&C服务器，协助安全分析人员更好的认识和防范攻击。
进一步地，如图9所示，在以IP地址为背板的网络空间地图模型中可视化一DDOS场景，可直观的表达感染IP的扩展情况以及DDoS攻击IP和被攻击IP地址的分布情况。协助安全分析人员更好的认识和防范攻击，有效切断感染传播路径，实现网络攻击屏蔽与防范。
关于本发明实施例中的装置，其中各个模块执行操作的具体方式已经在有关该方法的实施例中进行了详细描述，此处将不做详细阐述说明。
综上，本发明实施例提供的网络空间地图模型的创建装置，确定网络空间地图模型以IP地址为基础的网络空间坐标系；根据预设映射方式将IP地址映射到二维坐标系，以创建聚合性、区域性和可伸缩性的网络空间地图模型坐标体系架构；根据网络空间地图模型坐标系和比例尺标准实现网络空间基础地图模型实体化，完成海量实体资源的定位、搜索和描述；在以IP地址为背板的地图模型中实现网络空间管理场景可视化，协助管理人员进行更细粒度的资产管理；在网络空间地图模型中实时动态显示网络空间存在的安全攻击、僵尸网络分布、和DDOS攻击等场景，协助安全分析人员更好的认识和防范攻击。该装置采用以IP地址为基础向量的恒定、正交的网络空间地图模型坐标体系架构，实现网络空间要素的精准表达，相比于地理网络空间地图和拓扑网络空间地图能够更加直观、更加全面、更加有效地可视化网络空间本身的特有属性。基于希尔伯特映射变换升维实现较好地IP地 址可视化效果，满足地图模型二维坐标系的聚合性、区域性和可伸缩性。
在此基础上实体化网络空间地图模型，提取经典的网络空间地图应用场景实现可视化，实现网络空间资源、管理、安全、测量等多种经典应用场景绘制与可视化。用户可轻松过滤出感兴趣的具体细节，从而获得网络空间不同粒度下不同区域的有效显示，方便网络用户、管理人员、安全分析人员实现网络空间的多层次认知，定位网络空间资源，了解网络区域性能，优化网络配置管理，精准感知网络安全态势。相比于传统的地理地图和拓扑地图而言更能体现网络空间本源特征。
进一步地，基于上述实施例的基础上，映射模块500即为网络空间地图与地理地图映射模块，还用于在网络空间地图模型中支持屏幕切分可视化实现网络空间与地理空间之间的映射，多方面呈现网络空间信息。
进一步地，在本发明的一个实施例中，网络空间地图与地理地图映射关系包括网络空间IP地址与地理空间经纬度之间的映射，其中，映射模块500进一步用于确定网络空间地图与地理地图映射关系，并结合网络空间地图和地理空间地图同时表达网络空间要素，以多角度全面观察网络空间。
可以理解的是，可视化实现网络空间与地理空间之间的映射表示网络空间IP地址与地理空间经纬度之间的映射。多方面呈现网络空间信息包括结合网络空间地图和地理空间地图同时表达网络空间要素，提供了一种多个角度全面观察网络空间的方法。
需要说明的是，网络空间地图模型具备基础的地图伸缩概念；预设映射方式为一维IP地址映射到二维坐标系的转换方法，其保证网络空间地图模型基础坐标系具备聚合性、区域性、可伸缩性；比例尺设标准为网络空间地图伸缩比例，以实现不同尺度下不同网络空间资源的分层可视化，从AS资源，到某一AS下大型网络(骨干网、接入网、驻地图、物联网、工业网络、覆盖网)的分布、再到小型网络(校园网、计算中心、家庭网络等)，最后实现更细粒度的IP资源搜素、定位与描述，体现网络空间层次结构。
例如，如图10所示，呈现一次DDOS攻击场景，其目标主机是清华校园网服务器。左侧在网络空间地图中可依次显示DDOS攻击源与目的所属的AS，大网，小网，子网，IP等层次，在地理地图则显示相应层次主机的地理位置。观察DDOS傀儡主机的地理分布特性与IP分布特性可知，其中在地理位置上聚合的点可能在IP地图中分散，可起到对比和补充作用。
本发明实施例根据网络空间地图模型创建方法构建多尺度、多维度、多视图网络空间地图装置，并应用于一些经典的网络空间地图应用场景，实现网络空间的多层次认知。
根据本发明实施例提出的网络空间地图模型创建装置，通过选取希尔伯特映射变换满足地图模型的聚合性、区域性和可伸缩性，同时实现三维坐标系构建、专题地图、比例尺 设计等地图模型关键技术研究突破，填补了网络空间地图模型理论空缺，并设计了一款多尺度，多维度，多视图的网络空间地图装置，应用于网络空间要素定位和表达、网络空间监控与管理和网络空间安全等场景中，从而将网络空间直观、有效的可视化到网络空间地图中，并实现网络空间深层次剖析和表达。
此外，术语“第一”、“第二”仅用于描述目的，而不能理解为指示或暗示相对重要性或者隐含指明所指示的技术特征的数量。由此，限定有“第一”、“第二”的特征可以明示或者隐含地包括至少一个该特征。在本发明的描述中，“多个”的含义是至少两个，例如两个，三个等，除非另有明确具体的限定。
在本说明书的描述中，参考术语“一个实施例”、“一些实施例”、“示例”、“具体示例”、或“一些示例”等的描述意指结合该实施例或示例描述的具体特征、结构、材料或者特点包含于本发明的至少一个实施例或示例中。在本说明书中，对上述术语的示意性表述不必须针对的是相同的实施例或示例。而且，描述的具体特征、结构、材料或者特点可以在任一个或多个实施例或示例中以合适的方式结合。此外，在不相互矛盾的情况下，本领域的技术人员可以将本说明书中描述的不同实施例或示例以及不同实施例或示例的特征进行结合和组合。
尽管上面已经示出和描述了本发明的实施例，可以理解的是，上述实施例是示例性的，不能理解为对本发明的限制，本领域的普通技术人员在本发明的范围内可以对上述实施例进行变化、修改、替换和变型。

Claims (10)

  1. 一种网络空间地图模型创建方法，其特征在于，包括以下步骤：
    步骤S101：确定网络空间地图模型坐标系采用IP地址作为基础向量；
    步骤S102：根据预设映射方式将IP地址映射到二维坐标系以满足聚合性、区域性和可伸缩性的网络空间地图基础模型；
    步骤S103：确定三维坐标系将逻辑端口、区域、拓扑结构与IP地址正交描述网络空间更细粒度的信息，以可抽象为图层的概念从而实现网络空间地图模型专题地图；
    步骤S104：构建完成比例尺标准，以为在网络空间地图模型中层次化、可伸缩表示复杂多样的网络空间资源奠定理论基础；以及
    步骤S105：确定网络空间地图与地理地图映射关系，以支持屏幕切分实现同一网络空间场景在不同网络空间地图与地理地图中对比绘制，并多方面呈现网络空间信息。
  2. 如权利要求1所述的网络空间地图模型创建方法，其特征在于，所述网络空间地图模型坐标系为二维坐标系，所述基础向量为二维坐标系构建基础，其中，所述步骤S102包括：
    将所述IP地址对应的基础向量按照映射方法映射到所述二维坐标系上，并保持IP地址聚合概念以创建聚合性、区域性和可伸缩性网络空间地图模型二维坐标系。
  3. 如权利要求2所述的网络空间地图模型创建方法，其特征在于，所述三维坐标系包括与所述二维坐标系正交的第三坐标轴，其中，所述步骤S103包括：
    将所述第三坐标轴与所述IP地址构造的二维坐标系正交；或者
    将所述三维坐标系抽象为地图模型图层的概念，并建立网络空间专题地图，以可视化IP细粒度信息。
  4. 如权利要求1所述的网络空间地图模型创建方法，其特征在于，所述比例尺标准为网络空间地图模型伸缩比例，所述网络空间资源为使用网络空间手段能够探测和感知的实体，其中，所述步骤S104包括：
    参照GIS系统进行网络空间地图比例尺设计，使得所述网络空间地图模型具备地图概念；
    通过地图模型伸缩呈现不同层次的网络空间资源信息，不同伸缩粒度下的地图呈现不同的资源可视化效果，反映网络空间本源特征。
  5. 如权利要求1所述的网络空间地图模型创建方法，其特征在于，所述网络空间地图与地理地图映射关系包括网络空间IP地址与地理空间经纬度之间的映射，其中，所述步骤S105包括：
    确定所述网络空间地图与所述地理地图映射关系，并结合所述网络空间地图和所述地理空间地图同时表达网络空间要素，以多角度全面观察网络空间。
  6. 一种网络空间地图模型创建装置，其特征在于，包括：
    确定模块，用于确定网络空间地图模型坐标系采用IP地址作为基础向量；
    创建模块，用于根据预设映射方式将IP地址映射到二维坐标系以满足聚合性、区域性和可伸缩性的网络空间地图基础模型；
    基础可视化模块，用于确定三维坐标系将逻辑端口、区域、拓扑结构与IP地址正交描述网络空间更细粒度的信息，以可抽象为图层的概念从而实现网络空间地图模型专题地图；
    构建模块，用于构建完成比例尺标准，以为在网络空间地图模型中层次化、可伸缩表示复杂多样的网络空间资源奠定理论基础；以及
    映射模块，用于确定网络空间地图与地理地图映射关系，以支持屏幕切分实现同一网络空间场景在不同网络空间地图与地理地图中对比绘制，并多方面呈现网络空间信息。
  7. 如权利要求6所述的网络空间地图模型创建装置，其特征在于，所述网络空间地图模型坐标系为二维坐标系，所述基础向量为二维坐标系构建基础，其中，所述创建模块进一步用于将所述IP地址对应的基础向量按照映射方法映射到所述二维坐标系上，并保持IP地址聚合概念以创建聚合性、区域性和可伸缩性网络空间地图模型二维坐标系。
  8. 如权利要求7所述的网络空间地图模型创建装置，其特征在于，所述三维坐标系包括与所述二维坐标系正交的第三坐标轴，其中，所述基础可视化模块进一步用于将所述第三坐标轴与所述IP地址构造的二维坐标系正交；或者将所述三维坐标系抽象为地图模型图层的概念，并建立网络空间专题地图，以可视化IP细粒度信息。
  9. 如权利要求6所述的网络空间地图模型创建装置，其特征在于，所述比例尺标准为网络空间地图模型伸缩比例，所述网络空间资源为使用网络空间手段能够探测和感知的实体，其中，所述构建模块进一步用于参照GIS系统进行网络空间地图比例尺设计，使得所述网络空间地图模型具备地图概念，并通过地图模型伸缩呈现不同层次的网络空间资源信息，不同伸缩粒度下的地图呈现不同的资源可视化效果，反映网络空间本源特征。
  10. 如权利要求6所述的网络空间地图模型创建装置，其特征在于，所述网络空间地图与地理地图映射关系包括网络空间IP地址与地理空间经纬度之间的映射，其中，所述映射模块进一步用于确定所述网络空间地图与所述地理地图映射关系，并结合所述网络空间地图和所述地理空间地图同时表达网络空间要素，以多角度全面观察网络空间。
PCT/CN2019/098874 2018-12-03 2019-08-01 网络空间地图模型创建方法及装置 WO2020113981A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US17/336,329 US12067676B2 (en) 2018-12-03 2021-06-02 Cyberspace map model creation method and device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201811467533.5 2018-12-03
CN201811467533.5A CN109728934B (zh) 2018-12-03 2018-12-03 网络空间地图模型创建方法及装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/336,329 Continuation US12067676B2 (en) 2018-12-03 2021-06-02 Cyberspace map model creation method and device

Publications (1)

Publication Number Publication Date
WO2020113981A1 true WO2020113981A1 (zh) 2020-06-11

Family

ID=66294705

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/098874 WO2020113981A1 (zh) 2018-12-03 2019-08-01 网络空间地图模型创建方法及装置

Country Status (3)

Country Link
US (1) US12067676B2 (zh)
CN (1) CN109728934B (zh)
WO (1) WO2020113981A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115941495A (zh) * 2022-09-30 2023-04-07 天翼安全科技有限公司 一种网络拓扑构建方法、装置、电子设备及存储介质
WO2023108832A1 (zh) * 2021-12-16 2023-06-22 三六零科技集团有限公司 网络空间地图生成方法、装置、设备及存储介质
CN116795347A (zh) * 2023-06-30 2023-09-22 兰州交通大学 一种面向地图自动综合的图形化编程系统及装置
CN117236439A (zh) * 2023-10-07 2023-12-15 中国科学院地理科学与资源研究所 一种网络空间地理图谱综合分析系统和方法

Families Citing this family (23)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109728934B (zh) * 2018-12-03 2022-05-03 清华大学 网络空间地图模型创建方法及装置
CN110324312A (zh) * 2019-05-22 2019-10-11 北京瀚海思创科技有限公司 网络攻击地图显示方法及存储介质
CN110311924A (zh) * 2019-07-26 2019-10-08 杭州迪普科技股份有限公司 网络安全风险数据显示方法、装置、电子设备
CN111026822A (zh) * 2019-11-19 2020-04-17 东华大学 网络空间测绘模型、网络和物理空间映射模型的构建方法
CN110889182A (zh) * 2019-11-22 2020-03-17 东华大学 面向像素技术的网络空间可视化模型的建立方法
CN111106954B (zh) * 2019-12-17 2023-01-03 北京格林威尔科技发展有限公司 一种基于地图的拓扑节点显示方法和装置
CN111130876B (zh) * 2019-12-20 2021-04-06 北京邮电大学 一种自治域系统在三维地理空间的展示方法及装置
CN111460775B (zh) * 2020-03-05 2022-04-05 北京师范大学 贸易特征网格图生成方法及装置
CN111935331A (zh) * 2020-07-30 2020-11-13 重庆智载科技有限公司 一种网络空间映射方法、可视化方法及系统
CN111865698B (zh) * 2020-07-30 2023-10-17 中国电子信息产业集团有限公司第六研究所 一种基于地理信息的自治域级互联网拓扑可视化方法
CN112532448B (zh) * 2020-11-27 2023-11-28 北京知道创宇信息技术股份有限公司 网络拓扑处理方法、装置和电子设备
CN112838956B (zh) * 2021-01-29 2022-10-21 国家计算机网络与信息安全管理中心 面向用户的网络空间资源分析方法及设备
CN112667765A (zh) * 2021-03-22 2021-04-16 远江盛邦（北京）网络安全科技股份有限公司 网络空间地图构建方法、装置及设备
CN114124719B (zh) * 2021-10-27 2022-09-20 清华大学 网络空间态势感知方法及装置
CN114924822B (zh) * 2022-05-19 2023-09-05 安天科技集团股份有限公司 三维拓扑结构的截图方法、装置、电子设备及存储介质
CN115086181A (zh) * 2022-05-27 2022-09-20 杭州安恒信息安全技术有限公司 网络资产数据可视化系统及方法
CN115086411B (zh) * 2022-06-16 2023-12-05 京东城市(北京)数字科技有限公司 一种ip定位方法、系统、存储介质及电子设备
CN114937364B (zh) * 2022-06-17 2023-09-15 北京交通大学 一种基于拓扑变换的城市轨道交通分层网络的构建方法
CN115063520B (zh) * 2022-08-15 2022-11-29 武汉智景可视科技有限公司 基于三维gis的物联设备可视化渲染方法及系统
CN115499286A (zh) * 2022-11-17 2022-12-20 博智安全科技股份有限公司 工控网络资产的分层管理系统
CN117349463B (zh) * 2023-10-16 2024-09-24 自然资源部第一海洋研究所 一种海岛数据管理方法及系统
CN117076592A (zh) * 2023-10-18 2023-11-17 中国科学院地理科学与资源研究所 一种网络空间地图的创建方法及相关设备
CN117931975B (zh) * 2024-01-26 2024-08-16 烟台海港信息通信有限公司 港口综合管网可视化管理方法、系统、终端及存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130321458A1 (en) * 2012-05-30 2013-12-05 Northrop Grumman Systems Corporation Contextual visualization via configurable ip-space maps
US20150236930A1 (en) * 2004-07-30 2015-08-20 Sean P. Gorman System and method of mapping and analyzing vulnerabilities in networks
CN106980668A (zh) * 2017-03-22 2017-07-25 中国电子科技网络信息安全有限公司 一种网络空间测绘要素的形式化建模方法
CN108023771A (zh) * 2017-12-06 2018-05-11 清华大学 基于ip地址和逻辑端口的网络空间坐标体系架构的创建方法及装置
CN108881346A (zh) * 2017-05-12 2018-11-23 中国人民解放军信息工程大学 面向位置服务的网络空间实体资源可视化方法及系统
CN109728934A (zh) * 2018-12-03 2019-05-07 清华大学 网络空间地图模型创建方法及装置

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7254271B2 (en) * 2003-03-05 2007-08-07 Seadragon Software, Inc. Method for encoding and serving geospatial or other vector data as images
CN106372264B (zh) * 2016-11-15 2020-03-27 努比亚技术有限公司 地图数据的迁移装置和方法

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150236930A1 (en) * 2004-07-30 2015-08-20 Sean P. Gorman System and method of mapping and analyzing vulnerabilities in networks
US20130321458A1 (en) * 2012-05-30 2013-12-05 Northrop Grumman Systems Corporation Contextual visualization via configurable ip-space maps
CN106980668A (zh) * 2017-03-22 2017-07-25 中国电子科技网络信息安全有限公司 一种网络空间测绘要素的形式化建模方法
CN108881346A (zh) * 2017-05-12 2018-11-23 中国人民解放军信息工程大学 面向位置服务的网络空间实体资源可视化方法及系统
CN108023771A (zh) * 2017-12-06 2018-05-11 清华大学 基于ip地址和逻辑端口的网络空间坐标体系架构的创建方法及装置
CN109728934A (zh) * 2018-12-03 2019-05-07 清华大学 网络空间地图模型创建方法及装置

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2023108832A1 (zh) * 2021-12-16 2023-06-22 三六零科技集团有限公司 网络空间地图生成方法、装置、设备及存储介质
CN115941495A (zh) * 2022-09-30 2023-04-07 天翼安全科技有限公司 一种网络拓扑构建方法、装置、电子设备及存储介质
CN116795347A (zh) * 2023-06-30 2023-09-22 兰州交通大学 一种面向地图自动综合的图形化编程系统及装置
CN116795347B (zh) * 2023-06-30 2024-06-04 兰州交通大学 一种面向地图自动综合的图形化编程系统及装置
CN117236439A (zh) * 2023-10-07 2023-12-15 中国科学院地理科学与资源研究所 一种网络空间地理图谱综合分析系统和方法

Also Published As

Publication number Publication date
US12067676B2 (en) 2024-08-20
CN109728934A (zh) 2019-05-07
US20210312709A1 (en) 2021-10-07
CN109728934B (zh) 2022-05-03

Similar Documents

Publication Publication Date Title
WO2020113981A1 (zh) 网络空间地图模型创建方法及装置
US11943249B2 (en) Cyberspace coordinate system creation method and apparatus based on autonomous system
US20230344731A1 (en) Network security monitoring and correlation system and method of using same
Lv et al. Managing big city information based on WebVRGIS
US20130321458A1 (en) Contextual visualization via configurable ip-space maps
KR100979200B1 (ko) Ｇｉｓ 기반의 네트워크 정보 표시장치
CN104063466A (zh) 虚拟-现实一体化的三维显示方法及系统
CN108023771B (zh) 基于ip地址和逻辑端口的网络空间坐标体系架构的创建方法及装置
CN111935331A (zh) 一种网络空间映射方法、可视化方法及系统
US10289283B1 (en) Visual analysis for multi-dimensional data
US20110122132A1 (en) Apparatus and method of managing objects and events with vector-based geographic information system
Xie et al. Multi‐camera video synopsis of a geographic scene based on optimal virtual viewpoint
Kademi et al. Formal perspectives on conceptualization of cyberspace
Nittel et al. Emerging technological trends likely to affect GIScience in the next 20 years
CN114124719B (zh) 网络空间态势感知方法及装置
Ziani et al. Use of cloud computing and GIS on vehicle traffic management
Miao et al. A coordinated view of cyberspace
CN108829827A (zh) 一种基于GeoTools和OGC的空间分析地图服务系统
WO2016205519A1 (en) Hybrid map drawing display
CN118827509A (zh) 一种网络拓扑图的转换方法、装置、设备及存储介质
Zou et al. Survey of cyberspace surveying and mapping
Yang et al. Cloud computing research for geosciences and applications
Zhang et al. Research on Basic Concept and Conceptual Model of Cyberspace Map
Jing et al. SensorMon: An Internet-of-Things System for Maintaining and Monitoring Sensor Device.
Zheng et al. An Interactive Visualization System for Network Security Data

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19894231

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19894231

Country of ref document: EP

Kind code of ref document: A1