WO2023077617A1

WO2023077617A1 - Network security situation adaptive active defense system and method

Info

Publication number: WO2023077617A1
Application number: PCT/CN2021/137767
Authority: WO
Inventors: 游志勇; 陶源; 李末岩; 胡巍
Original assignee: 公安部第三研究所
Priority date: 2021-11-02
Filing date: 2021-12-14
Publication date: 2023-05-11
Also published as: CN113965404B; CN113965404A

Abstract

Disclosed are a network security situation adaptive active defense system and method. In the solution, the network security development trend can be accurately predicted on the basis of a network model built by means of network security situation awareness, situation understanding, and situation mapping. First, information on security elements is collected; next, the collected data information is analyzed and integrated to determine data correlation, and analyze a network attack behavior; and finally, on the basis of data outputted by situation assessment, a network security status is predicted according to the result of network situation assessment. In the solution provided by the present invention, dynamic management of a network is achieved by predicting the network security situation in future development, so as to protect the network predictably.

Description

A network security situation adaptive active defense system and method

technical field

The invention relates to network security technology, in particular to a network security protection system and self-adaptive active defense.

Background technique

Network security technology mainly prevents potential network security risks and prevents malicious code attacks on network resources. A complete network system needs comprehensive application protection, detection, response and recovery. There are many types of network attack protection, such as security routers, firewall technology, disaster recovery and recovery, and network survival technologies.

However, the current network security technology cannot achieve effective monitoring and early warning in terms of network detection and early warning and network security situation awareness, and network attack methods are volatile. Most network security protection systems do not have the ability to learn independently to deal with complex and changeable emergencies event.

Therefore, if the traditional network security protection system can be combined with modern artificial intelligence algorithms, and the static network protection strategy can be transformed into a dynamic adaptive learning network protection system, it can not only predict the attacks that occur in the network system, but also carry out autonomous learning of such attack behaviors. , greatly improving the capabilities of the network security protection system. However, the existing network security protection system solutions cannot be organically integrated with artificial intelligence algorithms to achieve a good dynamic adaptive learning effect, and the active defense capabilities are weak, and the requirements cannot be greatly expected.

It can be seen that how to change the network security system from passive protection to active protection, from dynamic early warning to self-learning early warning, so as to improve the security and reliability of the network system is an urgent problem in this field.

Contents of the invention

Aiming at the problem that the existing network defense methods mainly have weak passive defense or active defense capabilities, an adaptive active network defense solution with strong defense capabilities is needed in this field.

Therefore, the object of the present invention is to provide a network security situation adaptive active defense system, and a method for realizing adaptive active network defense based on the system. The solution provided by the invention can give early warning to the risks of network security hidden dangers, and complete the active defense and self-adaptive network defense of the network.

In order to achieve the above purpose, the network security situation self-adaptive active defense system provided by the present invention includes a network security situation awareness unit, a network security situation understanding unit and a network security situation mapping unit that are linked together,

The network security situational awareness unit collects network data information in real time, analyzes and processes based on the collected information, judges that the network attack behavior is abnormal, and forms corresponding situational awareness data;

The network security situation understanding unit analyzes the relevance of the situation awareness data formed by the network security situation awareness unit, analyzes and understands the attack behavior, and forms network security situation understanding data;

The network security situation mapping unit analyzes and fuses the network security situation understanding data formed by the network security situation understanding unit, evaluates the network security situation, forms network security situation evaluation data, and then uses the BP neural network model based on network security Situation assessment data for quantitative prediction of network security situation.

Further, the adaptive active defense system is also linked with the network expert decision-making system, and the quantified network security situation prediction results are transmitted to the network expert decision-making system.

Further, the network security situation awareness unit includes a network situation information collection module, a data preprocessing module, a data modeling module, and an analysis and judgment module;

The network situation information collection module collects network situation information in real time, and the network situation information is information that can indicate the current network situation;

The data preprocessing module classifies and verifies the network situation information collected by the network situation information collection module;

The data modeling module models the data processed by the data preprocessing module, extracts data features and performs factor analysis;

The analysis and judgment module performs qualitative and quantitative analysis according to the data features extracted by the data modeling module and the results of factor analysis, and judges abnormal behavior according to the analysis results.

Further, the network security situation understanding unit includes an associated attack analysis module and an attack behavior understanding module,

The associated attack analysis module analyzes the data association of the situational awareness data;

The attack behavior understanding module analyzes and understands the attack behavior based on the association analysis data formed by the association attack analysis module, and identifies attack intentions and attack targets to form network security situation understanding data.

Further, the attack behavior understanding module conducts analysis through big data analysis, so as to perform network situation assessment, network threat assessment and network situation prediction.

Further, the network security situation mapping unit includes a situation assessment module and a quantitative prediction module,

The situation assessment module performs network threat assessment and security assessment based on situation understanding data to form network security situation assessment data;

The quantitative prediction module quantifies and predicts the development trend of the network security situation based on the BP neural network combined with the ant colony algorithm for the network security situation assessment data formed by the situation assessment module.

Further, the quantitative prediction module uses the network security situation assessment data as the neuron input of the BP neural network, determines the number of nodes in the input layer and the number of nodes in the output layer, establishes a network model, generates a sample database, and determines the number of nodes in the hidden layer. The number of nodes, using the ant colony algorithm to update the weights and thresholds of the BP neural network.

In order to achieve the above object, the network security situation adaptive active defense method provided by the present invention includes:

Collect network data information in real time, analyze and process based on the collected information, judge abnormal network attack behavior, and form corresponding situational awareness data;

Analyze the correlation of situational awareness data, analyze and understand attack behaviors, and form network security situational understanding data;

Analyze and fuse the network security situation understanding data, evaluate the network security situation, form the network security situation assessment data, and then use the BP neural network model to make quantitative predictions of the network security situation based on the network security situation assessment data.

Further, the method further includes the step of linking with the network expert decision-making system according to the quantitatively predicted network security situation development trend results to form active defense measures.

Further, when forming the corresponding situational awareness data, the method includes:

Collecting network situation information in real time, where the network situation information is information that can indicate current network conditions;

Preprocessing of classification and verification of collected network situation information;

Model the processed data, extract data features and perform factor analysis;

Perform qualitative and quantitative analysis according to the extracted data characteristics and the results of factor analysis, and judge abnormal behavior based on the analysis results.

Further, when the method forms network security situation understanding data, it includes:

Analyzing data correlation for situational awareness data;

Based on the formed association analysis data, analyze and understand the attack behavior, identify the attack intention and attack target, and form the network security situation understanding data.

Further, when the method performs quantitative prediction of the network security situation, it includes:

Network threat assessment and security assessment based on situational understanding data;

Based on the BP neural network combined with the ant colony algorithm, the network security situation assessment data is quantified to predict the development trend of the network security situation.

Further, when the method quantitatively predicts the development trend of the network security situation, the network security situation assessment data is used as the neuron input of the BP neural network, the number of input layer nodes and the number of output layer nodes are determined, a network model is established, and samples are generated. database, and determine the number of nodes in the hidden layer, and use the ant colony algorithm to update the weights and thresholds of the BP neural network.

The network security situation self-adaptive active defense scheme provided by the present invention can actively defend against network security problems and self-adaptive network learning protection, and perform active protection and self-improvement, thereby effectively improving the security capability of the network.

This network security situation adaptive active defense scheme also uses BP neural network combined with ant colony algorithm to process network security situation data, which has good convergence for processing situation assessment data and is not sensitive to initial data.

Furthermore, in this network security situation self-adaptive active defense scheme, BP neural network combined with ant colony algorithm is adopted, based on the good self-learning ability and nonlinear adaptive model of BP neural network, it can adapt to different network models.

Description of drawings

The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments.

Figure 1 is a schematic diagram of the network security situational awareness adaptive active defense system in this example;

Fig. 2 is a schematic diagram of situation prediction of network security situation awareness in this example.

Detailed ways

In order to make the technical means, creative features, goals and effects achieved by the present invention easy to understand, the present invention will be further described below in conjunction with specific illustrations.

Aiming at the security of the network system, the invention provides a scheme of self-adaptive and active defense of the network security situation. This network security situation adaptive active defense scheme organically integrates network security situation assessment, BP neural network, ant colony algorithm, network security situation prediction and expert decision-making system. The organic integration and close cooperation of these four technical means realizes network security issues. Active monitoring, situational awareness, comprehensive analysis, and self-adaptive learning active defense can continuously learn from network security risks and network attack behaviors, and further enhance the active defense capabilities of network security.

Accordingly, the present invention provides a network security situation awareness adaptive active defense system to realize network security situation adaptive active defense. Referring to FIG. 1 , it shows an example of the composition of a network security situation awareness adaptive active defense system provided by the present invention.

As can be seen from the figure, the network security situation awareness self-adaptive active defense system 100 is a network model mainly composed of the network security situation awareness unit 110, the network security situation understanding unit 120 and the network security situation mapping unit 130. The development trend is accurately predicted.

The network security situation awareness self-adaptive active defense system 100 collects information corresponding to the network system to be defended, then analyzes and integrates the collected data information, correlates data correlations, analyzes attacking network status behaviors, and finally The output data of the situation assessment, based on which the network situation assessment results are used to predict the network security status.

Specifically, the network security situational awareness unit 110 in the defense system is used to collect network data information in real time, analyze and process based on the collected information, and determine abnormal behavior to form corresponding situational awareness data.

The behaviors targeted here mainly include a series of network attacks such as denial of service attacks, ransomware, vulnerability attacks, and phishing.

The abnormal behavior here refers to the security behavior of the entire network system, such as a series of network attack behaviors such as denial of service attacks, ransomware, vulnerability attacks, and phishing. The current network operating status can be used to determine whether the network has been attacked.

The network security situation awareness unit 110 can be used to collect multi-source network situation information in real time, and analyze and process the data information to form situation awareness data, which can be used as a data source for the network security situation understanding unit 120 to perform correlation analysis.

As shown in FIG. 1 , it provides an example configuration scheme of a network security situational awareness unit 110 .

As can be seen from the figure, the network security situation awareness unit 110 given in this example is mainly composed of a network situation information collection module 111, a data preprocessing module 112, a data modeling module 113, and an analysis and judgment module 114 in cooperation with each other.

Wherein, the network situation information collecting module 111 collects the network situation information in real time.

The network situation information here is mainly information that can be used to indicate the current network status and the current state of the network. As an example, how many times the network system has defended against network attacks, or what kind of attacks are being suffered, as well as the type, method, status, etc. of the attacks.

Here, the collection of network situation information, including important clues or elements such as network topology information, vulnerability information, and network vulnerability, is detected and obtained, as an important source of network system security assessment, and network security can be evaluated before these elements are attacked. situation, even if necessary defensive measures are taken to ensure the security of information property.

It should be noted here that the collected network situation information is not limited to the above-mentioned network topology information, vulnerability information, and network vulnerability information. In actual operation, there are many types of information data collected, including security, event, network structure data, network service data, vulnerability data, vulnerability data, threat and intrusion data, user abnormal behavior data, etc. To enrich the source of network security data as much as possible, and then to improve the accuracy of situation assessment results.

As an example, this example extracts network data information based on the elements of network perception. The data acquisition methods mainly include host configuration detection tools, firewall intrusion detection tools, password cracking tools, network device configuration detection tools, anti-virus software, database security detection tools, Network scanning tools and system vulnerability detection tools; or through asset lists, event reports, log information, etc. to obtain network data information from detected vulnerabilities and vulnerabilities, and conduct security situation assessment and analysis data.

The data preprocessing module 112 in this unit performs data interaction with the network situation information collection module 111 and preprocesses the network situation information collected by the network situation information collection module 111 .

As an example, the data preprocessing module 112 completes preprocessing by classifying and verifying corresponding data information.

Here, there is no limitation on the implementation methods of classification and verification processing, which can be determined according to actual needs, thereby ensuring the efficiency of data information processing.

For example, the network perception data obtained by intrusion detection systems, scanning tools, or hardware devices can be verified manually, or automatically verified by the verification system, or a combination of the two.

The data modeling module 113 in this unit performs data interaction with the data preprocessing module 112, models the data processed by the data preprocessing module 112, extracts data features and performs factor analysis.

Here, the data modeling module 113 constructs a corresponding data analysis model based on a corresponding data analysis algorithm. The algorithms and model construction methods used in this solution are not limited here, and the details can be determined according to actual needs.

Furthermore, the data analysis model constructed by the data modeling module 113 analyzes three major types of elements by invoking corresponding detection tools, including traffic information, vulnerability information, and log alarm information analysis, to obtain the current network layer Data volume change rate, vulnerability data, threat and intrusion data, abnormal user behavior data, etc.

The analysis and judgment module 114 in this unit performs data interaction with the data modeling module 113, and is used to perform qualitative and quantitative analysis based on the data features extracted by the data modeling module 113 and the results of factor analysis, and to judge behaviors based on the analysis results Abnormalities and analysis of potential network security risks.

When conducting qualitative and quantitative analysis here, the data analysis and synthesis can be completed by constructing corresponding qualitative and quantitative analysis models; the specific analysis model is not limited here and can be determined according to actual needs.

As an alternative, the qualitative and quantitative analysis and synthesis of data can also be completed through subjective judgment and logical reasoning.

Through the corresponding qualitative and quantitative analysis, the corresponding network characteristics, change trends, etc. are obtained, and based on the results obtained from the analysis, we cooperate with the communication between the systems, reading databases, log information, network traffic, etc. to judge abnormal behavior and analyze potential network security risks.

The network security situation understanding unit 120 in this defense system is used to cooperate with the network security situation awareness unit 110 to analyze the correlation of the situation awareness data formed by it, and then analyze and understand the attack behavior to form network security situation understanding data.

As shown in FIG. 1 , it provides an example configuration scheme of the network security situation understanding unit 120 .

The network security situation understanding unit 120 in this example is mainly composed of an associated attack analysis module 121 and an attack behavior understanding module 122 in cooperation with each other.

Here, the associated attack analysis module 121 takes the situational awareness data formed by the network security situational awareness unit 110 as input, and analyzes the data relevance of the situational awareness data.

The data correlation analyzed here for situational awareness data mainly refers to the analysis of all kinds of data attributes, rule matching, behavior detection, etc., to determine the correlation between these information.

As an example, when the associated attack analysis module 121 evaluates and analyzes the situation awareness data, based on multi-source data, it performs data processing and event association on security incidents, response reports, historical data, etc. generated by the network system. Analyze the security situation of the data generated by the network system. This enables linkage with the defense of the network system itself for comprehensive analysis.

The attack behavior understanding module 122 in this unit, which interacts with the associated attack analysis module 121 data, based on the associated analysis data formed by the associated attack analysis module 121, analyzes and understands the attack behavior, identifies attack intentions and attack targets, and forms a network security situation Make sense of the data.

Specifically, the attack behavior understanding module 122 uses a big data analysis method to analyze the associated analysis data formed by the associated attack analysis module 121, thereby realizing network situation assessment, network threat assessment and network situation prediction.

As an example, the big data analysis methods here include but not limited to correlation analysis, data classification, induction, behavior detection, machine learning and other big data analysis methods.

As an example, the attack behavior understanding module 122 identifies the network attack behavior and characteristics existing in the network system according to the static or dynamic network security configuration elements of situational awareness, analyzes and understands the attack behavior by analyzing the correlation of data, and determines the attacker Targets and intentions of the network, locate network vulnerabilities, formulate system defense strategies, and carry out active defense. In this way, it can further realize the linkage with the defense of the network system itself, and carry out all-round analysis.

The network security situation mapping unit 130 in this system, which cooperates with the network security situation understanding unit 120, analyzes and fuses the network security situation understanding data formed by the network security situation understanding unit 120, evaluates the network security situation, and forms a network The security situation assessment data, and then use the BP neural network model to make quantitative predictions of the network security situation based on the network security situation assessment data.

As shown in FIG. 1 , it provides an example configuration scheme of the network security situation mapping unit 130 .

As can be seen from the figure, the network security situation mapping unit 130 is mainly composed of a situation assessment module 131 and a quantitative prediction module 132 in cooperation with each other.

Among them, the situation assessment module 131 performs data interaction with the network security situation understanding unit 120, analyzes and fuses the data based on the situation understanding formed by the network security situation understanding unit 120, to perform network threat assessment and security assessment, and form a network security situation Evaluation data.

Specifically, this situation assessment module 131 evaluates the business security, data security, infrastructure security and overall security status of the network system by evaluating multiple layers and multiple angles, and can target different application backgrounds and different Network size chooses different evaluation methods. As an example, network security situation assessment data can be formed for OODA models, JDL models, and RPD models.

The quantitative prediction module 132 in this unit performs data interaction with the situation assessment module 131 and the network expert decision-making system. It builds a situation assessment prediction model based on the BP neural network combined with the ant colony algorithm, and uses the situation assessment prediction model to evaluate the situation. The network security situation assessment data formed by the module is quantified to predict the development trend of the network security situation.

The quantitative prediction module 132 also predictably activates the network expert decision-making system based on the result of the quantitative prediction of the development trend of the network security situation, thereby improving the system's self-adaptive active defense capability.

Specifically, when this program quantitatively predicts the development trend of the network security situation, the processed network security situation assessment data is used as the data input layer of the BP neural network, and the weights and thresholds of the neural network are continuously trained and updated, combined with the ant colony algorithm Quickly search for optimization, so as to realize the quantitative prediction of the development trend.

As an example, in the specific implementation, the network security situation assessment data is used as the input of the BP neural network algorithm data, the network topology structure is built, and information such as the number of BP neural network neurons, weights and thresholds of each layer is initialized.

Next, the initial ant colony algorithm parameters are used to construct the solution space in the hidden layer of the BP neural network. If any ant selects the path node, the weight and threshold of the previous layer at the path point are selected from the traversed set; otherwise , select another waypoint to jump.

The ant jumps to each path and updates the pheromone concentration of the path in real time. When the ant traverses all the path sets, it judges whether the expected value of the output is within the set error range. If it meets the expected result, it will be sent to the BP neural network. Learning; if the expected value of the output is not within the set error range, accumulatively add 1 current traversal times, clear the path record table, and repeatedly search for the optimal solution of the system.

When the output optimal solution meets the expected objective function, the optimal solution is sent to the BP neural network for repeated learning and training to obtain the weight and threshold of the optimal data, and calculate the error with the optimal output result until the algorithm termination condition is satisfied .

The resulting network security situation mapping unit 130, when running, analyzes and fuses the situation understanding data, uses the situation assessment data as the input data of the BP neural network model, and uses the ant colony algorithm to further search for data The weight of the data, that is, the weight of the data affecting the optimal result, find the initial value that is most suitable for the BP neural network model, and use it as the optimal data source input. Based on the corresponding learning and memory capabilities, the BP neural network model conducts correlation analysis on events, data sources, log data, etc., evaluates the security situation, vulnerability and potential threats of the network, comprehensively evaluates the hidden dangers of the network system, and reports For the network expert decision-making system, the network expert decision-making system provides an active defense emergency plan.

As an example, when the network security situation mapping unit 130 performs network system perception mapping, it can realize the construction of a multi-field perception mapping information system, including security situation analysis of network systems such as artificial intelligence, Internet of Things, cloud computing, and big data. The technical means of this system realize the inspection and comprehensive analysis of network risks, and according to the analysis results and the defense measures given by the expert system, evaluate the current risk status of the network, and take active defense measures in time.

Specifically, the network security situation mapping unit 130 first uses the situation evaluation module 131 to analyze the results of the data output of the entire network system, thereby improving the security of the network system; The ant colony algorithm is used to improve the evaluation method of the network system, further improve the accuracy of the network system security prediction, and send the prediction results to the expert decision-making system to realize the active defense of the network system.

The network security situation awareness self-adaptive active defense system thus constituted, it adapts to the network, has active learning and memory capabilities, can predict hidden dangers existing in the network, realizes active defense, and at the same time can monitor hidden safety hazards existing in the network Analyze and predict the development trend of the future network security status, provide preventive measures and emergency response plans, and continuously improve the ability of active defense.

The following is an example to illustrate the process of this network security situational awareness adaptive active defense system dynamically managing the network, giving early warning to the risks of hidden dangers in network security, and realizing the process of active defense and adaptive defense of the network.

Referring to Figure 1, the network security situational awareness adaptive active defense system is divided into three stages when it dynamically manages the network and proactively and predictably warns and protects the network: situational awareness, situational understanding and situational mapping.

Phase One: Situational Awareness.

First of all, in the network security situation awareness stage, the system collects network data information in real time, analyzes and processes the collected network data, and then judges abnormal behaviors to form corresponding situation awareness data.

That is, by analyzing the security behavior of the entire network system, such as a series of network attack behaviors such as denial of service attacks, ransomware, vulnerability attacks, and phishing, according to the current network operating conditions, it is judged whether the network has been attacked, and then the formation of Corresponding situational awareness data.

When performing network security situation awareness at this stage, first, collect network situation information in real time; the network situation information here includes information such as asset business data, log data, network traffic, firewall information, vulnerability information, and various vulnerability scanning device information.

Next, the collected network situation information is preprocessed by classifying and verifying; here, the collected data can be preprocessed specifically by data processing methods such as data classification, regression, and clustering.

Then, model the preprocessed data, extract data features, and perform element analysis; here, the analysis mainly focuses on the characteristics, data attributes, data quantity, data proportion, etc. of the data.

Then, perform qualitative and quantitative analysis according to the extracted data characteristics and the results of factor analysis, and judge abnormal behavior according to the analysis results. Here, through analysis, data information such as network characteristics and changing trends are obtained, and then combined with internal communication between network systems, database reading, log information, network traffic, etc., to judge abnormal behavior.

Phase 2: Situational understanding.

In the situation understanding stage, the system denormalizes and processes the situation awareness data formed by situation awareness, and analyzes and understands the attack behavior through the association analysis of situation awareness data to form network security situation understanding data.

During the specific implementation of this stage, the situational awareness data is first analyzed for data correlation; the data correlation analysis here includes multi-dimensional data analysis such as network environment security, management, traffic data, and asset information to achieve a comprehensive assessment of network risks. .

Then, based on the formed association analysis data, analyze and understand the attack behavior, identify the attack intention and attack target, and form the network security situation understanding data.

Phase 3: Situation Mapping.

In the situation mapping stage, the system analyzes and fuses the network security situation understanding data, evaluates the network security situation, forms network security situation assessment data, and then conducts quantitative prediction of network security situation based on the network security situation assessment data through the BP neural network model.

Referring to Figure 2, when the system performs quantitative forecasting of the network security situation, first, it conducts network threat assessment and security assessment based on the data of situation understanding to form network security situation assessment data;

When evaluating here, by evaluating multiple levels and multiple angles, the business security, data security, infrastructure security and overall security status of the network can be evaluated, and different application backgrounds and different network scales can be selected according to different application backgrounds. assessment method. For example, OODA model, JDL model, and RPD model form network security situation assessment data.

Then, the data of the network situation assessment is comprehensively analyzed and processed through the BP neural network combined with the ant colony algorithm model to complete the assessment, analysis, and speculation of the network security situation, predict the future network security situation, and drive the network expert decision-making system to give corresponding results. Emergency response measures, response security strategy, active defense.

In this stage, the BP neural network is combined with the ant colony algorithm, and the ant colony algorithm is used to optimize the network weights as a whole, which solves the defect that the BP neural network model is easy to fall into a local optimal solution, and can find the initial value that fits the system. The prediction accuracy of network training and system security is enhanced, ensuring that potential risks can be accurately judged before the network system is attacked.

At the same time, BP neural network and ant colony algorithm have powerful parallel distributed computing capabilities, and the security situation of the network is related to each other at different times. The algorithm has the ability of global optimization, analyzes the internal change rules of the network system, and effectively predicts possible attacks. wait.

In this stage, after the situation assessment data is processed by the algorithm, the system forms the data into a data log and saves it. At the same time, the system performs event correlation analysis based on the data processed by the algorithm to predict potential problems in the network security system. Report the final processing results to the network expert decision-making system.

At the same time, the network expert decision-making system implements the built-in emergency response and defense measures of the network security system based on the network prediction results, provides users with preventive methods that can be taken, issues security disposal strategies to the entire network system, and actively protects the network system , and quantitatively evaluate emergency events, gradually improve the response capabilities for events, save log data, and improve the system's adaptive and active defense capabilities.

Finally, it should be pointed out that the above-mentioned method of the present invention, or specific system units, or some units thereof, are pure software architectures, and can be deployed on physical media through program codes, such as hard disks, optical discs, or any electronic devices (such as smart phone, computer-readable storage medium), when the machine loads and executes the program code (such as a smart phone loads and executes), the machine becomes a device for implementing the present invention. The above-mentioned method and device of the present invention can also be transmitted in the form of program code through some transmission media, such as cables, optical fibers, or any transmission mode. When the program code is received, loaded and executed by a machine (such as a smart phone), A machine is a means for carrying out the invention.

The basic principles, main features and advantages of the present invention have been shown and described above. Those skilled in the industry should understand that the present invention is not limited by the above-mentioned embodiments. What are described in the above-mentioned embodiments and the description only illustrate the principle of the present invention. Without departing from the spirit and scope of the present invention, the present invention will also have Variations and improvements are possible, which fall within the scope of the claimed invention. The protection scope of the present invention is defined by the appended claims and their equivalents.

Claims

The network security situation self-adaptive active defense system is characterized in that it includes a network security situation awareness unit, a network security situation understanding unit and a network security situation mapping unit linked together,

The network security situational awareness unit collects network data information in real time, analyzes and processes based on the collected information, judges that the network attack behavior is abnormal, and forms corresponding situational awareness data;

The network security situation understanding unit analyzes the relevance of the situation awareness data formed by the network security situation awareness unit, analyzes and understands the attack behavior, and forms network security situation understanding data;

The network security situation mapping unit analyzes and fuses the network security situation understanding data formed by the network security situation understanding unit, evaluates the network security situation, forms network security situation evaluation data, and then uses the BP neural network model based on network security Situation assessment data for quantitative prediction of network security situation.
The network security situation adaptive active defense system according to claim 1, wherein the adaptive active defense system is also linked with the network expert decision-making system, and the quantified network security situation prediction results are transmitted to the network expert decision-making system.
The network security situation adaptive active defense system according to claim 1, wherein the network security situation awareness unit includes a network situation information collection module, a data preprocessing module, a data modeling module, and an analysis and judgment module;

The network situation information collection module collects network situation information in real time, and the network situation information is information that can indicate the current network situation;

The data preprocessing module classifies and verifies the network situation information collected by the network situation information collection module;

The data modeling module models the data processed by the data preprocessing module, extracts data features and performs factor analysis;

The analysis and judgment module performs qualitative and quantitative analysis according to the data features extracted by the data modeling module and the results of factor analysis, and judges abnormal behavior according to the analysis results.
The network security situation adaptive active defense system according to claim 1, wherein the network security situation understanding unit includes an associated attack analysis module and an attack behavior understanding module,

The associated attack analysis module analyzes the data association of the situational awareness data;

Based on the association analysis data formed by the association attack analysis module, the attack behavior understanding module analyzes and understands the attack behavior, identifies attack intentions and attack targets, and forms network security situation understanding data.
The network security situation adaptive active defense system according to claim 4, wherein the attack behavior understanding module conducts analysis through big data analysis to perform network situation assessment, network threat assessment and network situation prediction.
The network security situation adaptive active defense system according to claim 1, wherein the network security situation mapping unit includes a situation assessment module and a quantitative prediction module,

The situation assessment module performs network threat assessment and security assessment based on situation understanding data to form network security situation assessment data;

The quantitative prediction module quantifies and predicts the development trend of the network security situation based on the BP neural network combined with the ant colony algorithm for the network security situation assessment data formed by the situation assessment module.
The network security situation self-adaptive active defense system according to claim 6, wherein the quantization prediction module uses the network security situation evaluation data as the neuron input of the BP neural network to determine the number of input layer nodes and output layer nodes number, establish a network model, generate a sample database, and determine the number of nodes in the hidden layer, and use the ant colony algorithm to update the weights and thresholds of the BP neural network.
The network security situation self-adaptive active defense method is characterized in that it includes:

Collect network data information in real time, analyze and process based on the collected information, judge abnormal network attack behavior, and form corresponding situational awareness data;

Analyze the correlation of situational awareness data, analyze and understand attack behaviors, and form network security situational understanding data;

Analyze and fuse the network security situation understanding data, evaluate the network security situation, form the network security situation assessment data, and then use the BP neural network model to make quantitative predictions of the network security situation based on the network security situation assessment data.
The network security situation self-adaptive active defense method according to claim 8, characterized in that the method further comprises the step of linking with the network expert decision-making system based on the quantitatively predicted development trend of the network security situation to form active defense measures.
The network security situation adaptive active defense method according to claim 8, characterized in that, when the method forms corresponding situational awareness data, it comprises:

Collect network situation information in real time, and described network situation information is the information that can show current network condition;

Preprocessing of classification and verification of collected network situation information;

Model the processed data, extract data features and perform factor analysis;

Perform qualitative and quantitative analysis according to the extracted data characteristics and the results of factor analysis, and judge abnormal behavior based on the analysis results.
The network security situation adaptive active defense method according to claim 8, characterized in that, when the method forms network security situation understanding data, it includes:

Analyzing data correlation for situational awareness data;

Based on the formed association analysis data, analyze and understand the attack behavior, identify the attack intention and attack target, and form the network security situation understanding data.
The network security situation adaptive active defense method according to claim 8, characterized in that, when the method performs quantitative prediction of the network security situation, it includes:

Network threat assessment and security assessment based on situational understanding data;

Based on the BP neural network combined with the ant colony algorithm, the network security situation assessment data is quantified to predict the development trend of the network security situation.
The network security situation adaptive active defense method according to claim 12, characterized in that, when said method quantitatively predicts the development trend of the network security situation, the network security situation evaluation data is used as the neuron input of the BP neural network to determine the input The number of layer nodes and the number of output layer nodes, establish a network model, generate a sample database, and determine the number of nodes in the hidden layer, and use the ant colony algorithm to update the weights and thresholds of the BP neural network.