WO2023116565A1 - 智能设计网络安全架构图的方法 - Google Patents

智能设计网络安全架构图的方法 Download PDF

Info

Publication number
WO2023116565A1
WO2023116565A1 PCT/CN2022/139552 CN2022139552W WO2023116565A1 WO 2023116565 A1 WO2023116565 A1 WO 2023116565A1 CN 2022139552 W CN2022139552 W CN 2022139552W WO 2023116565 A1 WO2023116565 A1 WO 2023116565A1
Authority
WO
WIPO (PCT)
Prior art keywords
network
network security
security
model
requirements
Prior art date
Application number
PCT/CN2022/139552
Other languages
English (en)
French (fr)
Inventor
刘钰
贾梦妮
黄鹏
邱杰
刘德安
Original Assignee
中电信数智科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中电信数智科技有限公司 filed Critical 中电信数智科技有限公司
Publication of WO2023116565A1 publication Critical patent/WO2023116565A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/24—Classification techniques
    • G06F18/243—Classification techniques relating to the number of classes
    • G06F18/24323—Tree-organised classifiers
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/30—Information retrieval; Database structures therefor; File system structures therefor of unstructured textual data
    • G06F16/36—Creation of semantic tools, e.g. ontology or thesauri
    • G06F16/367—Ontology
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/25—Fusion techniques
    • G06F18/253—Fusion techniques of extracted features
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/045—Combinations of networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06T—IMAGE DATA PROCESSING OR GENERATION, IN GENERAL
    • G06T11/00—2D [Two Dimensional] image generation
    • G06T11/20—Drawing from basic elements, e.g. lines or circles
    • G06T11/206—Drawing of charts or graphs

Definitions

  • the invention relates to the technical field of network security. More specifically, the present invention relates to a method and device for intelligently designing a network security architecture diagram.
  • the network security architecture diagram is designed by professional network security experts based on the network topology diagram provided by the customer, network security level protection level, budget and other factors. This process requires a lot of labor costs and it is difficult to standardize the style of the network security architecture diagram, and due to the many factors that need to be considered, the work efficiency of designing the network security architecture diagram is low.
  • the purpose of the present invention is to provide a method for intelligently designing a network security architecture diagram, which realizes automatic design of a network security architecture diagram with high accuracy, high intelligence, and high efficiency through a target recognition model, a machine learning model, and a knowledge map.
  • a method for intelligently designing a network security architecture diagram which includes:
  • each device in the network topology diagram is Need to install network security products to do two classifications, if you need to install network security products, then make multiple classifications of what type of network security products need to be installed, and obtain the type of network security products that need to be installed;
  • the security protection requirements of the network system in the network topology diagram at least include: security protection level requirements, security protection score requirements, and security protection budget requirements.
  • the target recognition model is a yolo v3 model
  • a relationship recognition classifier is added in the yolo v3 model
  • the yolo v3 model recognizes the position, type and each pair of upstream and downstream of each device from the network topology diagram
  • the positions of the two ends of the connection line between the devices, and the relationship recognition classifier determines the two devices connected to each other according to the position of each device and the positions of the two ends of the connection line between each pair of upstream and downstream devices.
  • the feature extraction backbone network of the yolo v3 model is a Darknet-53 model, and when the Darknet-53 model fuses features extracted from different receptive fields, a machine learning weight is added before the features extracted by each receptive field. value, and adopt the weighted sum algorithm for feature fusion.
  • the machine learning model is an xgboost decision tree model, and when the xgboost decision tree model performs binary classification on whether each device in the network topology diagram needs to be equipped with a network security product, according to the type of device and its relationship with upstream and downstream devices
  • the connection relationship, security protection level requirements, security protection score requirements calculate the probability of whether each device needs to install network security products, if the probability of needing to install network security products exceeds the preset value, it is determined that network security needs to be installed product, the output is 1, otherwise it is judged that there is no need to install network security products, and the output is 0.
  • the xgboost decision tree model classifies which types of network security products need to be installed, according to the type of equipment and its connection relationship with upstream and downstream equipment, security protection level requirements, and security protection score requirements, calculate The probability of installing each type of network security product, and select the type of network security product whose installation probability exceeds the preset value.
  • the process of selecting network security products includes:
  • the network topology graph in the training set undergoes at least one data enhancement process of twisting, inverting, splicing, and adding interfering pixels.
  • the present invention also provides an electronic device, which includes: at least one processor, and a memory communicated with the at least one processor, wherein the memory stores instructions executable by the at least one processor, so The instructions are executed by the at least one processor, so that the at least one processor executes the above-mentioned method for intelligently designing a network security architecture diagram.
  • the present invention also provides a storage medium on which a computer program is stored.
  • the program is executed by a processor, the above-mentioned method for intelligently designing a network security architecture diagram is realized.
  • the present invention at least includes the following beneficial effects: the present invention uses the target recognition model to obtain device information in the network topology map, uses a machine learning model to judge whether each device needs to be equipped with a security device, and what type of security device to install, and finally combines the knowledge map to automatically Generate a network security architecture design scheme, compared with the traditional method for designing a network security architecture diagram, the present invention realizes automatic design of a network security architecture diagram with high accuracy, high intelligence, and high efficiency.
  • the improvement of the present invention to the existing yolov3 model enables the detection of the relationship between targets, and the improvement of the Darknet-53 model improves the accuracy of target recognition.
  • FIG. 1 is a flowchart of a method for intelligently designing a network security architecture diagram according to an embodiment of the present invention
  • FIG. 2 is a schematic diagram of a network topology diagram according to an embodiment of the present invention.
  • Fig. 3 is a network structure diagram of the Darknet-53 model described in the embodiment of the present invention.
  • FIG. 4 is a schematic diagram of devices in a target recognition model recognition network topology diagram according to an embodiment of the present invention.
  • FIG. 5 is a schematic diagram of a machine learning model making a decision on adding a network security product to a device in a network topology diagram according to an embodiment of the present invention
  • FIG. 6 is a schematic diagram of a network security product type that needs to be added to a device in the network topology diagram according to an embodiment of the present invention
  • FIG. 7 is a schematic diagram of a result of adding a network security product to a device in the network topology diagram according to an embodiment of the present invention.
  • Network topology diagram refers to the physical layout of various devices interconnected by transmission media. It is a network structure diagram composed of network node devices and communication media. Network node devices include various data processing devices, data communication control devices and data terminal devices. Communication media includes physically existing communication lines and logically functioning network paths.
  • Target recognition model A mathematical algorithm used to identify objects in a picture and mark the location and type of the object.
  • Machine learning model A mathematical algorithm that simulates the human thinking process through iterative feature judgment and result decision-making.
  • yolo v3 model It is a convolutional neural network model in deep learning. Through feature extraction, analysis and fusion of input pictures, the corner coordinates and center coordinates of the area occupied by each object in the picture are found, as well as the category code of the object.
  • Darknet-53 model A convolutional neural network model including 52 convolutional layers and 1 fully connected layer.
  • xgboost decision tree model a machine learning algorithm that combines a bunch of decision structures in a tree shape, and the leaf nodes represent the final predicted value or category.
  • a decision tree is essentially making several decisions to determine the category (classification) or value (regression) corresponding to the input data.
  • the current network security architecture diagram is designed by professional network security experts after a comprehensive analysis of various factors such as the network topology diagram provided by the customer, the network security level protection level, and the budget. This process requires a lot of labor costs and it is difficult to standardize the style of the network security architecture diagram, and due to the many factors that need to be considered, the work efficiency of designing the network security architecture diagram is low.
  • the existing knowledge map can simulate the knowledge reserve of experts, and the machine learning model can simulate the expert’s decision-making according to the conditions, and the target recognition model can simulate the expert’s understanding of the network structure in the network topology map, so Provides a method for intelligently designing network security architecture diagrams, combining customer needs with expert knowledge, and automatically designing network security architecture diagrams with high accuracy, high intelligence, and high efficiency through machines.
  • the present invention provides a method for intelligently designing a network security architecture diagram, which includes:
  • the network topology map can be an image file or a screenshot file obtained by a drawing tool (such as Auto-CAD, Visio, PPT, etc.), or it can be obtained by scanning a printout of a picture obtained by a drawing tool or a hand-drawn physical drawing Scanning the image file, the network topology diagram uses different graphics to represent different network devices, and the connection between devices is used to represent the connection relationship between devices, as shown in FIG. 2 .
  • a drawing tool such as Auto-CAD, Visio, PPT, etc.
  • the security protection requirements of the network system in the network topology diagram described here at least include: security protection level requirements, security protection score requirements, and security protection budget requirements.
  • the security protection level is divided into 1-5 levels, and the customer needs the security protection level of the network system in the network topology diagram to reach level 4 or above, then >---level 4 is the security protection level requirement.
  • the security protection score ranges from 0 to 100 points, and the customer needs the security protection score of the network system in the network topology diagram to reach 80 points or more, then ⁇ 80 points is the security protection score requirement.
  • the target recognition model described here can adopt the yolo v3 model, and the yolo v3 model is trained before use, and the marked network topology map is used as the training set during training, and the parameters that need machine learning in the yolo v3 model are adjusted.
  • the commonly used network device types in the data set are respectively configured with a type code, and the connection between devices can also be configured with a code.
  • the marked network topology map is the The position coordinates of each device in the picture (the coordinates of the four corners and the center coordinates of the area occupied by the device), the type code and the coordinates of the connection position (coordinates of both ends), and the type code are marked in advance.
  • the training set Input the network topology map into the model, obtain the position coordinates, type codes and connection position coordinates, and type codes of each device in the map, and then compare them with the results marked in advance, and apply the gradient descent algorithm to continuously correct the machine learning parameter values in the model.
  • the yolo v3 model can basically accurately identify the graphs representing various devices in the network topology diagram, and the connections between the graphs, and then put the yolo v3 model into practical use.
  • the yolo v3 model When the yolo v3 model is used, output the four corner coordinates and center coordinates of each device in the network topology diagram, and the probability that each device belongs to various network device types in the preset data set, and the probability is the largest
  • the network device type is the type of the identified device.
  • the yolov3 model When the yolov3 model is used, it also outputs the coordinates of the two ends of the connection between the devices and the probability of the connection type. If it exceeds 50%, it is determined to be connected, otherwise it is not connected. .
  • the feature extraction backbone network of the yolo v3 model is the Darknet-53 model, and the network structure diagram of the Darknet-53 model is shown in Figure 3, and the input (inputs) is (batch-size, 416, 416, 3), batch-size It is the size of each batch of data.
  • This parameter is a machine learning parameter, which can be adjusted through machine learning training. 416 ⁇ 416 is the resolution of the input image, and 3 is the number of channels (the number of channels for grayscale images is 1, and the number of channels for color images is 1).
  • conv2D 32 ⁇ 3 ⁇ 3 is a convolutional layer containing 32 filters
  • residual block (1 ⁇ 64), residual block (2 ⁇ 128), residual block (8 ⁇ 256) , residual block (8 ⁇ 512), residual block (4 ⁇ 1024) are residual units, these 5 groups of residual units, each group of residual units consists of a separate convolutional layer and a set of repeated convolution Layer composition, the repeated convolution layer is repeated 1 time, 2 times, 8 times, 8 times, 4 times respectively
  • upsimpling2D() is an upsampling function
  • concat() is a feature fusion function, which connects different arrays containing features .
  • a relationship recognition classifier is also added, and the yolo v3 model recognizes the position, type, and position of each pair of upstream and downstream devices of each device from the network topology diagram, and the relationship recognition classification
  • the device determines the two devices connected to each other according to the position of each device and the positions of the two ends of the connection line between each pair of upstream and downstream devices;
  • the yolo v3 model identifies the coordinates of both ends of the connection from the network topology diagram, and then matches the center coordinates of the identified devices. If the center coordinates of the device are close to the endpoint coordinates of the connection, it is judged that the two are connected.
  • the yolo v3 model recognizes that the device in the uppermost block diagram of the network topology diagram is a core switch with a probability of 95%, and the probability of belonging to other types of devices is lower than 95%, so it identifies the device in the uppermost block diagram as a core switch Switches; the probability of switches in the middle layer block diagram is 98%, and the probability of belonging to other types of devices is lower than 98%, so the devices in the middle layer block diagram are identified as core switches; the devices in the bottom left block diagram belong to the computing environment The probability is 92%, and the probability of belonging to other types of equipment is lower than 92%.
  • the equipment in the bottom left block diagram is identified as the computing environment; the probability of the device in the bottom right block diagram belonging to the office network is 95%, and it belongs to other types The probability of the device is lower than 95%, so the device in the right frame at the bottom layer is identified as the office network.
  • the probability that the core switch is connected to the switch is 100%, so it is determined that the core switch is connected to the switch, and the probability that the core switch is connected to the office network is 10%, so it is determined that the core switch is not connected to the office network.
  • each Whether the equipment needs to be equipped with network security products is classified into two categories. If network security products need to be installed, then the type of network security products that need to be installed is further classified to obtain the type of network security products that need to be installed;
  • the machine learning model described here can adopt the xgboost decision tree model, and the xgboost decision tree model can also be trained before it is actually put into use, with a pair of upstream and downstream equipment types, connection relationships, security protection level requirements, security protection score requirements, and Whether security equipment is installed between the upstream and downstream equipment, if security equipment is installed, the type of security equipment is used as a set of data, and several sets of data are collected to train the xgboost decision tree model, so that the loss function converges, and the xgboost decision can be made
  • the tree model basically correctly gives the decision of whether to install and the type of installation, and then put the xgboost decision tree model into practical use.
  • the xgboost decision tree model classifies whether each device in the network topology needs to be equipped with a network security product, according to the type of device and its connection relationship with upstream and downstream devices, security protection level requirements, and security protection score requirements, calculate The probability of whether each device needs to install network security products, if the probability of needing to install network security products exceeds the preset value, it is determined that network security products need to be installed, and the output is 1, otherwise it is determined that network security products do not need to be installed Product, the output is 0, the preset value here can be set to 50%.
  • each type of network security is calculated.
  • the probability of security product installation, and select the network security product type whose installation probability exceeds the preset value, and the default value can also be set to 50%.
  • A1 and A2 are the binary classification output of the xgboost decision tree model on whether the switch needs to be equipped with network security products.
  • the decision result of the xgboost decision tree model is to add network security The probability of products is 95%.
  • the decision result of the xgboost decision tree model is that the probability of adding network security products is 25%. Therefore, the switches on the left need to add network security products, and the switches on the right It is not necessary, and then classify the types of network security products that need to be added to the switch on the left.
  • the probability of adding a firewall is 95%
  • the probability of adding a comprehensive log audit is 92%
  • the probability of adding a database audit is 96%
  • the probability of adding a bastion host is 91%
  • the probability of adding a web vulnerability scan is 15%, so it is necessary to add four types of network security products: firewall, comprehensive log audit, database audit, and bastion host. The results are shown in Figure 6.
  • the process of selecting network security products includes:
  • plan 2 and plan 3 can be excluded first, and then select the plan with the lowest sum of prices and the highest security protection score among other plans, and then generate data in json format for the plan and send it to the drawing software.
  • S105 Call drawing software to draw a network security architecture diagram with network security products installed on the basis of the network topology diagram.
  • the drawing software can use Jtopo, and the drawing software draws a network topology diagram equipped with network security products based on the data in json format, that is, a network security architecture diagram, as shown in Figure 7.
  • the target recognition model is used to obtain the device information in the network topology map, and the machine learning model is used to judge whether each device needs to be equipped with security devices and what type of security device to install, and finally, the network security architecture is automatically generated in combination with the knowledge map
  • the design scheme compared with the traditional method for designing network security architecture diagrams, the present invention realizes automatic design of network security architecture diagrams with high accuracy, high intelligence and high efficiency.
  • the improvement of the present invention to the existing yolov3 model enables the detection of the relationship between targets, and the improvement of the Darknet-53 model improves the accuracy of target recognition.
  • the network topology map in the training set can be subjected to at least one data enhancement process of twisting, inversion, splicing, and adding interference pixels, and the target can be improved through data enhancement processing. Identify the generalization ability of the model.
  • an embodiment of the present application also provides an electronic device, which includes: at least one processor, and a memory connected in communication with the at least one processor, wherein the memory stores information that can be used by the at least one An instruction executed by a processor, the instruction is executed by the at least one processor, so that the at least one processor executes the above-mentioned method for intelligently designing a network security architecture diagram.
  • the processor includes a CPU, a GPU, etc.
  • the method for intelligently designing a network security architecture diagram can be executed by the CPU, or by the GPU, or jointly executed by the CPU and the GPU.
  • an embodiment of the present application also provides a storage medium on which a computer program is stored, and when the program is executed by a processor, the above-mentioned method for intelligently designing a network security architecture diagram is realized.
  • the storage medium can be a USB flash drive, a mobile hard disk, a read-only memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM), a magnetic disk or an optical disk, and other readable devices that can store program codes. storage medium.
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • various aspects of a low-cost radio frequency transceiver batch testing method provided by the present application can also be implemented in the form of a program product, which includes program code, and when the program product runs on the device , the program code is used to make the attacking device execute the steps in a low-cost radio frequency transceiver batch testing method according to various exemplary embodiments of the present application described above in this specification, for example, the implementation shown in FIG. 1 can be executed example.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Data Mining & Analysis (AREA)
  • General Physics & Mathematics (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • General Engineering & Computer Science (AREA)
  • Artificial Intelligence (AREA)
  • Evolutionary Computation (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Computational Linguistics (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Evolutionary Biology (AREA)
  • Health & Medical Sciences (AREA)
  • Biophysics (AREA)
  • Biomedical Technology (AREA)
  • General Health & Medical Sciences (AREA)
  • Molecular Biology (AREA)
  • Computing Systems (AREA)
  • Mathematical Physics (AREA)
  • Software Systems (AREA)
  • Animal Behavior & Ethology (AREA)
  • Databases & Information Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种智能设计网络安全架构图的方法，包括：获取待布置网络安全产品的网络拓扑图、网络拓扑图中网络系统的安全保护要求；利用提前训练好的目标识别模型识别网络拓扑图中设备的位置、类型及其与上下游设备的连接关系；利用提前训练好的机器学习模型，对网络拓扑图中设备是否需要加装网络安全产品做二分类，再对需要加装何种类型的网络安全产品做多分类，获得需要加装的网络安全产品的类型；利用预置的网络安全产品知识图谱，根据需要加装的网络安全产品的类型选取满足安全保护要求的网络安全产品；调用绘图软件在网络拓扑图基础上绘制网络安全架构图。实现了高准确率、高智能化、高效率的自动设计网络安全架构图。

Description

智能设计网络安全架构图的方法 技术领域
本发明涉及网络安全技术领域。更具体地说，本发明涉及一种智能设计网络安全架构图的方法及装置。
背景技术
目前设计网络安全架构图是由专业网安专家根据客户提供的网络拓扑图、网络安全等级保护级别、预算等多种因素综合析后得出。此过程需要耗费大量人工成本且难以规范网络安全架构图样式，并且由于需要考虑的因素繁多导致设计网络安全架构图工作效率低等问题。
发明内容
本发明的目的是提供一种智能设计网络安全架构图的方法，通过目标识别模型和机器学习模型以及知识图谱，实现了高准确率、高智能化、高效率的自动设计网络安全架构图。
为了实现根据本发明的这些目的和其它优点，提供了一种智能设计网络安全架构图的方法，其包括：
获取待布置网络安全产品的网络拓扑图、所述网络拓扑图中网络系统的安全保护要求；
利用提前训练好的目标识别模型识别网络拓扑图中每一设备的位置、类型及其与上下游设备的连接关系；
利用提前训练好的机器学习模型根据网络拓扑图中每一设备的位置、类型及其与上下游设备的连接关系、网络拓扑图中网络系统的安全保护要求，对网络拓扑图中每一设备是否需要加装网络安全产品做二分类，需要加装网络安全产品的，再对需要加装何种类型的网络安全产品做多分类，获得需要加装的网络安全产品的类型；
利用预置的网络安全产品知识图谱，根据需要加装的网络安全产品的类型选取满足网络拓扑图中网络系统的安全保护要求的网络安全产品；
调用绘图软件在网络拓扑图基础上绘制加装有网络安全产品的网络安全架构图。
优选的是，所述网络拓扑图中网络系统的安全保护要求至少包括：安全保护等级要求、安全保护分数要求、安全保护预算要求。
优选的是，所述目标识别模型为yolo v3模型，所述yolo v3模型中增设有关系识别分类器，所述yolo v3模型从网络拓扑图中识别每一设备的位置、类型和每对上下游设备间连线两端的位置，所述关系识别分类器根据每一设备的位置和每对上下游设备间连线两端的位置，确定相互连接的两设备。
优选的是，所述yolo v3模型的特征提取主干网络为Darknet-53模型，所述Darknet -53模型对不同感受野提取的特征融合时，在每一感受野提取的特征前增设有机器学习权值，并采取加权求和算法进行特征融合。
优选的是，所述机器学习模型为xgboost决策树模型，所述xgboost决策树模型对网络拓扑图中每一设备是否需要加装网络安全产品做二分类时，根据设备种类及其与上下游设备的连接关系、安全保护等级要求、安全保护分数要求，计算每一设备是否需要加装网络安全产品的概率，若需要加装网络安全产品的概率超过预设值，则判定为需要加装网络安全产品，输出为1，否则判定为不需要加装网络安全产品，输出为0。
优选的是，所述xgboost决策树模型对需要加装何种类型的网络安全产品做多分类时，根据设备种类及其与上下游设备的连接关系、安全保护等级要求、安全保护分数要求，计算每一类网络安全产品加装的概率，并从中选取出加装概率超过预设值的网络安全产品类型。
优选的是，利用预置的网络安全产品知识图谱，选取网络安全产品的过程包括：
通过查询网络安全产品知识图谱获得需要加装的网络安全产品类型中可选的网络安全产品，每种网络安全产品的安全等级、安全保护分数和产品价格；
将每一需要加装网络安全产品的设备可选的网络安全产品与其他需要加装网络安全产品的设备可选的网络安全产品组合，分别形成不同的网络安全构架设计；
计算每一网络安全构架设计所需的所有网络安全产品的价格总和，根据安全保护等级要求、安全保护分数要求、安全保护预算要求，选取符合要求的网络安全构架设计。
优选的是，所述目标识别模型在训练时，训练集中的网络拓扑图经过扭曲、反转、拼接、加入干扰像素其中至少一种数据增强处理。
本发明还提供一种电子设备，其包括：至少一个处理器，以及与所述至少一个处理器通信连接的存储器，其中，所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器执行上述的智能设计网络安全架构图的方法。
本发明还提供一种存储介质，其上存储有计算机程序，该程序被处理器执行时，实现上述的智能设计网络安全架构图的方法。
本发明至少包括以下有益效果：本发明利用目标识别模型获取网络拓扑图中设备信息，使用机器学习模型对各设备是否需要加装安全设备，加装什么类型安全设备进行判断，最后结合知识图谱自动生成网络安全架构设计方案，与传统设计网络安全架构图方法相比，本发明实现了高准确率、高智能化、高效率的自动设计网络安全架构图。另外，本发明对现有yolo v3模型的改进使其实现了目标间关系检测，对Darknet-53模型的改进提高了目标识别的准确率。
本发明的其它优点、目标和特征将部分通过下面的说明体现，部分还将通过对本发明的 研究和实践而为本领域的技术人员所理解。
附图说明
图1为本发明实施例所述智能设计网络安全架构图的方法的流程；
图2为本发明实施例所述网络拓扑图的示意图；
图3为本发明实施例所述Darknet-53模型的网络结构图；
图4为本发明实施例所述目标识别模型识别网络拓扑图中设备的示意图；
图5为本发明实施例所述机器学习模型对网络拓扑图中设备加装网络安全产品做出决策的示意图；
图6为本发明实施例所述网络拓扑图中设备需要添加网络安全产品类型的示意图；
图7为本发明实施例所述网络拓扑图中设备添加网络安全产品结果的示意图。
具体实施方式
下面结合附图对本发明做进一步的详细说明，以令本领域技术人员参照说明书文字能够据以实施。
需要说明的是，下述实施方案中所述实验方法，如无特殊说明，均为常规方法，所述试剂和材料，如无特殊说明，均可从商业途径获得；在本发明的描述中，术语“横向”、“纵向”、“上”、“下”、“前”、“后”、“左”、“右”、“竖直”、“水平”、“顶”、“底”、“内”、“外”等指示的方位或位置关系为基于附图所示的方位或位置关系，仅是为了便于描述本发明和简化描述，并不是指示或暗示所指的装置或元件必须具有特定的方位、以特定的方位构造和操作，因此不能理解为对本发明的限制。
本发明所用到的缩略语和关键术语定义如下：
网络拓扑图：是指用传输媒体互连各种设备的物理布局，由网络节点设备和通信介质构成的网络结构图，网络节点设备包括各种数据处理设备、数据通信控制设备和数据终端设备，通信介质包括实际存在的通信连线和在逻辑上起作用的网络通路。
目标识别模型：用于在图片中将里面的物体识别出来，并标出物体位置和类型的数学算法。
机器学习模型：通过迭代式的特征判断和结果决策模拟人类思维过程的数学算法。
yolo v3模型：是深度学习中的卷积神经网络模型，通过对输入图片的特征提取分析融合，找出图片中每一物体所占区域的角点坐标和中心坐标，及物体的所属类别编码。
Darknet-53模型：一种卷积神经网络模型，包括52个卷积层和1个全连接层。
xgboost决策树模型：一种机器学习算法，将一堆决策结构以树形组合起来，叶子节点代表最终的预测值或类别。决策树本质上是在做若干个决策，以判定输入的数据对应的类别(分 类)或数值(回归)。
如前所述，目前设计网络安全架构图是由专业网安专家根据客户提供的网络拓扑图、网络安全等级保护级别、预算等多种因素综合析后得出。此过程需要耗费大量人工成本且难以规范网络安全架构图样式，并且由于需要考虑的因素繁多导致设计网络安全架构图工作效率低等问题。
鉴于以上分析，可见现有的主要问题是客户不懂网安知识，不能设计网络安全架构图，而网安专家又不了解客户的网络结构和网安需求，也不能设计网络安全架构图，本申请中考虑到现有的知识图谱可模拟专家的知识储备，而机器学习模型又可模拟专家根据条件的做出决策，同时目标识别模型又可模拟专家读懂网络拓扑图中的网络结构，故提供一种智能设计网络安全架构图的方法，将客户的需求与专家的知识相结合，通过机器实现高准确率、高智能化、高效率的自动设计网络安全架构图。
如图1所示，本发明提供一种智能设计网络安全架构图的方法，其包括：
s101、获取待布置网络安全产品的网络拓扑图、所述网络拓扑图中网络系统的安全保护要求；
这里网络拓扑图可以为画图工具(例如Auto-CAD、Visio、PPT等)得到的图像文件或截图文件，也可以为将画图工具得到的图片的打印件或手画得到的实体图纸进行扫描得到的扫描图像文件，所述网络拓扑图中采用不同的图形代表不同的网络设备，用设备间的连线代表设备问的连接关系，如图2所示。
这里所述网络拓扑图中网络系统的安全保护要求至少包括：安全保护等级要求、安全保护分数要求、安全保护预算要求。如：将安全保护等级分为1～5级，客户需要网络拓扑图中网络系统的安全保护等级达到4级以上，那么>---4级即为安全保护等级要求。又如：安全保护分数范围为0～100分，客户需要网络拓扑图中网络系统的安全保护分数达到80分以上，那么≥80分即为安全保护分数要求。还如：客户对网络拓扑图中网络系统的安全保护的预算在5万元以下，那么≤5万元即为安全保护预算要求。
s102、利用提前训练好的目标识别模型识别网络拓扑图中每一设备的位置、类型及其与上下游设备的连接关系；
这里所述目标识别模型可以采用yolo v3模型，所述yolo v3模型在使用前先进行训练，训练时使用标注好的网络拓扑图作为训练集，对yolo v3模型中需要机器学习的参数进行调整。
具体的，对yolo v3模型进行训练前，可以提前预置数据集，数据集中常用的网络设备类型分别对应配置一个类型编码，设备间连线也可配置编码，标注好的网络拓扑图即是将图片中每个设备位置坐标(设备所占区域的四个角点坐标和中心坐标)、类型编码及连线位置坐标(两端点坐标)、类型编码提前标注，yolo v3模型训练时，将训练集的网络拓扑图输入模型中， 获取图中每个设备位置坐标、类型编码及连线位置坐标、类型编码，再与提前标注的结果进行对照，应用梯度下降算法不断修正模型中机器学习参数数值，使损失函数收敛，即可使yolo v3模型基本准确识别网络拓扑图中代表各种设备的图形，及图形间的连线，再将yolo v3模型投入实际使用。
所述yolo v3模型使用时，输出网络拓扑图中每一设备所占区域的四个角点坐标和中心坐标，及每一设备属于预置的数据集中各种网络设备类型的概率，取概率最大的网络设备类型为被识别的设备的类型，所述yolo v3模型使用时，还输出设备间连线的两端坐标和属于连线类型的概率，超过50％则判定为连接，否则为不连接。
所述yolo v3模型的特征提取主干网络为Darknet-53模型，Darknet-53模型的网络结构图如图3所示，输入(inputs)为(batch-size，416，416，3)，batch-size为每批数据量的大小，此参数为机器学习参数，可通过机器学习训练调整该参数数值，416×416为输入图片的分辨率，3为通道数(灰度图的通道数为1，彩色图的通道数为3)，conv2D(32×3×3)为包含32个过滤器的卷积层，residual block(1×64)、residual block(2×128)、residual block(8×256)、residual block(8×512)、residual block(4×1024)均为残差单元，这5组残差单元，每组残差单元由1个单独的卷积层与一组重复执行的卷积层构成，重复执行的卷积层分别重复1次、2次、8次、8次、4次，upsimpling2D()为上采样函数，concat()为特征融合函数，将包含特征的不同数组进行连接。
所述Darknet-53模型对不同感受野提取的特征融合时，在每一感受野提取的特征前增设有机器学习权值，并采取加权求和算法进行特征融合，即concat()对包含特征的不同数组进行连接时，在每一包含特征的数组前增设机器学习权值，可通过机器学习训练调整该权值数值。
所述yolo v3模型中还增设有关系识别分类器，所述yolo v3模型从网络拓扑图中识别每一设备的位置、类型和每对上下游设备间连线两端的位置，所述关系识别分类器根据每一设备的位置和每对上下游设备间连线两端的位置，确定相互连接的两设备；
具体的，yolo v3模型从网络拓扑图中识别连线的两端坐标，再与已经识别的设备的中心坐标进行匹配，若设备的中心坐标与连线的端点坐标接近，则判断两者连接。
如图4所示，yolo v3模型识别网络拓扑图中最上层框图中的设备为核心交换机的概率为95％，属于其他类型设备的概率低于95％，因此识别最上层框图中的设备为核心交换机；中间层框图中的设备交换机的概率为98％，属于其他类型设备的概率低于98％，因此识别中间层框图中的设备为核心交换机；最下层左侧框图中的设备属于计算环境的概率为92％，属于其他类型设备的概率低于92％，因此识别最下层左侧框图中的设备为计算环境；最下层右侧框图中的设备属于办公网的概率为95％，属于其他类型设备的概率低于95％，因此识别最下层右侧 框图中的设备为办公网。核心交换机与交换机连通的概率为100％，故判定核心交换机与交换机连通，核心交换机与办公网连通的概率为10％，故判定核心交换机与办公网不连通。
S103、利用提前训练好的机器学习模型根据网络拓扑图中每一设备的位置、类型及其与上下游设备的连接关系、网络拓扑图中网络系统的安全保护要求，对网络拓扑图中每一设备是否需要加装网络安全产品做二分类，需要加装网络安全产品的，再对需要加装何种类型的网络安全产品做多分类，获得需要加装的网络安全产品的类型；
这里所述机器学习模型可以采用xgboost决策树模型，xgboost决策树模型在实际投入使用前也可进行训练，以一对上下游设备的种类、连接关系、安全保护等级要求、安全保护分数要求，以及该对上下游设备间是否加装安保设备，若加装了安保设备，安保设备的类型作为一组数据，收集若干组数据对xgboost决策树模型进行训练，使损失函数收敛，即可使xgboost决策树模型基本正确的给出是否加装及加装类型的决策，再将xgboost决策树模型投入实际使用。
所述xgboost决策树模型对网络拓扑图中每一设备是否需要加装网络安全产品做二分类时，根据设备种类及其与上下游设备的连接关系、安全保护等级要求、安全保护分数要求，计算每一设备是否需要加装网络安全产品的概率，若需要加装网络安全产品的概率超过预设值，则判定为需要加装网络安全产品，输出为1，否则判定为不需要加装网络安全产品，输出为0，这里预设值可以设置为50％。
所述xgboost决策树模型对需要加装何种类型的网络安全产品做多分类时，根据设备种类及其与上下游设备的连接关系、安全保护等级要求、安全保护分数要求，计算每一类网络安全产品加装的概率，并从中选取出加装概率超过预设值的网络安全产品类型，这里预设值也可以设置为50％。
如图5所示，A1和A2为xgboost决策树模型对交换机是否需要加装网络安全产品的二分类输出，对于网络拓扑图中间层左侧的交换机，xgboost决策树模型决策的结果为添加网络安全产品的概率是95％，对于网络拓扑图中间层右侧的交换机，xgboost决策树模型决策的结果为添加网络安全产品的概率是25％，因此，左侧的交换机需要添加网络安全产品，右侧的则不需要，再对左侧的交换机需要添加的网络安全产品的类型做多分类，添加防火墙的概率为95％，添加综合日志审计的概率为92％，添加数据库审计的概率为96％，添加堡垒机的概率为91％，添加web漏洞扫描的概率为15％，故需要添加防火墙、综合日志审计、数据库审计和堡垒机四类网络安全产品，结果如图6所示。
S104、利用预置的网络安全产品知识图谱，根据需要加装的网络安全产品的类型选取满足网络拓扑图中网络系统的安全保护要求的网络安全产品；
具体的，利用预置的网络安全产品知识图谱，选取网络安全产品的过程包括：
通过查询网络安全产品知识图谱获得需要加装的网络安全产品类型中可选的网络安全产品，每种网络安全产品的安全等级、安全保护分数和产品价格；
将每一需要加装网络安全产品的设备可选的网络安全产品与其他需要加装网络安全产品的设备可选的网络安全产品组合，分别形成不同的网络安全构架设计；
计算每一网络安全构架设计所需的所有网络安全产品的价格总和，根据安全保护等级要求、安全保护分数要求、安全保护预算要求，选取符合要求的网络安全构架设计。
如图6所示，以左侧需要加装网络安全产品的交换机为例，通过查询网络安全产品知识图谱，可知A、B、C三个厂家均做网络安全产品，价格和安全等级均不同，那么可以产生多种方案，如方案1：堡垒机采用A厂商，其它网络安全产品采用C厂商；方案2：所有网络安全产品均用B厂商；方案3：堡垒机采用C厂商，其它网络安全产品采用A厂商(此处非穷举)。根据客户对网络拓扑图中网络系统的安全保护要求，假如安全保护等级分为5级，客户需求4级以上，但B厂商生产的堡垒机安全等级在3级，A厂商的综合日志审计安全等级在3级，那么方案2和方案3可以先排除，再在其他方案中选择价格总和最低、安全保护分数最高的方案，将该方案生成json格式数据传给绘图软件。
S105、调用绘图软件在网络拓扑图基础上绘制加装有网络安全产品的网络安全架构图。
这里绘图软件可采用Jtopo，绘图软件根据json格式数据绘制出加装有网络安全产品的网络拓扑图，也即网络安全架构图，如图7所示。
在上述实施例中，利用目标识别模型获取网络拓扑图中设备信息，使用机器学习模型对各设备是否需要加装安全设备，加装什么类型安全设备进行判断，最后结合知识图谱自动生成网络安全架构设计方案，与传统设计网络安全架构图方法相比，本发明实现了高准确率、高智能化、高效率的自动设计网络安全架构图。另外，本发明对现有yolo v3模型的改进使其实现了目标间关系检测，对Darknet-53模型的改进提高了目标识别的准确率。
进一步的，在步骤s102中，所述目标识别模型在训练时，训练集中的网络拓扑图可经过扭曲、反转、拼接、加入干扰像素其中至少一种数据增强处理，通过数据增强处理可提高目标识别模型的泛化能力。
基于同一发明构思，本申请实施例还提供一种电子设备，其包括：至少一个处理器，以及与所述至少一个处理器通信连接的存储器，其中，所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器执行上述的智能设计网络安全架构图的方法。
这里，所述处理器包括CPU和GPU等等，所述智能设计网络安全架构图的方法可以由CPU执行，也可以由GPU执行，或者CPU和GPU共同执行。
基于同一发明构思，本申请实施例还提供一种存储介质，其上存储有计算机程序，该程序 被处理器执行时，实现上述的智能设计网络安全架构图的方法。
该存储介质具体可以为U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可存储程序代码的可读存储介质。
在一些可能的实施方式中，本申请提供的一种低成本的射频收发器批量测试方法的各个方面还可以实现为一种程序产品的形式，其包括程序代码，当程序产品在设备上运行时，程序代码用于使攻击设备执行本说明书上述描述的根据本申请各种示例性实施方式的一种低成本的射频收发器批量测试方法中的步骤，例如，可以执行如图1所示的实施例。
尽管本发明的实施方案已公开如上，但其并不仅仅限于说明书和实施方式中所列运用，它完全可以被适用于各种适合本发明的领域，对于熟悉本领域的人员而言，可容易地实现另外的修改，因此在不背离权利要求及等同范围所限定的一般概念下，本发明并不限于特定的细节和这里示出与描述的图例。

Claims (10)

  1. 一种智能设计网络安全架构图的方法，其特征在于，包括：获取待布置网络安全产品的网络拓扑图、所述网络拓扑图中网络系统的安全保护要求；
    利用提前训练好的目标识别模型识别网络拓扑图中每一设备的位置、类型及其与上下游设备的连接关系；
    利用提前训练好的机器学习模型根据网络拓扑图中每一设备的位置、类型及其与上下游设备的连接关系、网络拓扑图中网络系统的安全保护要求，对网络拓扑图中每一设备是否需要加装网络安全产品做二分类，需要加装网络安全产品的，再对需要加装何种类型的网络安全产品做多分类，获得需要加装的网络安全产品的类型；
    利用预置的网络安全产品知识图谱，根据需要加装的网络安全产品的类型选取满足网络拓扑图中网络系统的安全保护要求的网络安全产品；
    调用绘图软件在网络拓扑图基础上绘制加装有网络安全产品的网络安全架构图。
  2. 如权利要求1所述的智能设计网络安全架构图的方法，其特征在于，所述网络拓扑图中网络系统的安全保护要求至少包括：安全保护等级要求、安全保护分数要求、安全保护预算要求。
  3. 如权利要求1所述的智能设计网络安全架构图的方法，其特征在于，所述目标识别模型为yolo v3模型，所述yolo v3模型中增设有关系识别分类器，所述yolo v3模型从网络拓扑图中识别每一设备的位置、类型和每对上下游设备间连线两端的位置，所述关系识别分类器根据每一设备的位置和每对上下游设备间连线两端的位置，确定相互连接的两设备。
  4. 如权利要求3所述的智能设计网络安全架构图的方法，其特征在于，所述yolo v3模型的特征提取主干网络为Darknet-53模型，所述Darknet-53模型对不同感受野提取的特征融合时，在每一感受野提取的特征前增设有机器学习权值，并采取加权求和算法进行特征融合。
  5. 如权利要求2所述的智能设计网络安全架构图的方法，其特征在于，所述机器学习模型为xgboost决策树模型，所述xgboost决策树模型对网络拓扑图中每一设备是否需要加装网络安全产品做二分类时，根据设备种类及其与上下游设备的连接关系、安全保护等级要求、安全保护分数要求，计算每一设备是否需要加装网络安全产品的概率，若需要加装网络安全产品的概率超过预设值，则判定为需要加装网络安全产品，输出为1，否则判定为不需要加装网络安全产品，输出为0。
  6. 如权利要求5所述的智能设计网络安全架构图的方法，其特征在于，所述xgboost决策树模型对需要加装何种类型的网络安全产品做多分类时，根据设备种类及其与上下游设备的连接关系、安全保护等级要求、安全保护分数要求，计算每一类网络安全产品加装的概率，并从中选取出加装概率超过预设值的网络安全产品类型。
  7. 如权利要求5所述的智能设计网络安全架构图的方法，其特征在于，利用预置的网络安全产品知识图谱，选取网络安全产品的过程包括：
    通过查询网络安全产品知识图谱获得需要加装的网络安全产品类型中可选的网络安全产品，每种网络安全产品的安全等级、安全保护分数和产品价格；
    将每一需要加装网络安全产品的设备可选的网络安全产品与其他需要加装网络安全产品的设备可选的网络安全产品组合，分别形成不同的网络安全构架设计；
    计算每一网络安全构架设计所需的所有网络安全产品的价格总和，根据安全保护等级要求、安全保护分数要求、安全保护预算要求，选取符合要求的网络安全构架设计。
  8. 如权利要求1所述的智能设计网络安全架构图的方法，其特征在于，所述目标识别模型在训练时，训练集中的网络拓扑图经过扭曲、反转、拼接、加入干扰像素其中至少一种数据增强处理。
  9. 电子设备，其特征在于，包括：至少一个处理器，以及与所述至少一个处理器通信连接的存储器，其中，所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器执行权利要求1～8中任一项所述的方法。
  10. 存储介质，其上存储有计算机程序，其特征在于，该程序被处理器执行时，实现权利要求1～8中任一项所述的方法。
PCT/CN2022/139552 2021-12-21 2022-12-16 智能设计网络安全架构图的方法 WO2023116565A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111569305.0 2021-12-21
CN202111569305.0A CN114238659A (zh) 2021-12-21 2021-12-21 智能设计网络安全架构图的方法

Publications (1)

Publication Number Publication Date
WO2023116565A1 true WO2023116565A1 (zh) 2023-06-29

Family

ID=80760120

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/139552 WO2023116565A1 (zh) 2021-12-21 2022-12-16 智能设计网络安全架构图的方法

Country Status (2)

Country Link
CN (1) CN114238659A (zh)
WO (1) WO2023116565A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117271936A (zh) * 2023-11-22 2023-12-22 中证数智科技(深圳)有限公司 基于Web的大数据关系图谱渲染方法、系统及设备

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114238659A (zh) * 2021-12-21 2022-03-25 中国电信集团系统集成有限责任公司 智能设计网络安全架构图的方法

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10498609B1 (en) * 2017-07-11 2019-12-03 Amdocs Development Limited System, method, and computer program for enterprise service network design driven by deep machine learning and artificial intelligence
CN110808865A (zh) * 2019-11-13 2020-02-18 北京理工大学 一种被动工控网络拓扑发现方法及工控网络安全管理系统
CN114238659A (zh) * 2021-12-21 2022-03-25 中国电信集团系统集成有限责任公司 智能设计网络安全架构图的方法

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10498609B1 (en) * 2017-07-11 2019-12-03 Amdocs Development Limited System, method, and computer program for enterprise service network design driven by deep machine learning and artificial intelligence
CN110808865A (zh) * 2019-11-13 2020-02-18 北京理工大学 一种被动工控网络拓扑发现方法及工控网络安全管理系统
CN114238659A (zh) * 2021-12-21 2022-03-25 中国电信集团系统集成有限责任公司 智能设计网络安全架构图的方法

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117271936A (zh) * 2023-11-22 2023-12-22 中证数智科技(深圳)有限公司 基于Web的大数据关系图谱渲染方法、系统及设备
CN117271936B (zh) * 2023-11-22 2024-03-12 中证数智科技(深圳)有限公司 基于Web的大数据关系图谱渲染方法、系统及设备

Also Published As

Publication number Publication date
CN114238659A (zh) 2022-03-25

Similar Documents

Publication Publication Date Title
WO2023116565A1 (zh) 智能设计网络安全架构图的方法
TWI742382B (zh) 透過電腦執行的、用於車輛零件識別的神經網路系統、透過神經網路系統進行車輛零件識別的方法、進行車輛零件識別的裝置和計算設備
US10318848B2 (en) Methods for object localization and image classification
EP3289529B1 (en) Reducing image resolution in deep convolutional networks
CN111489358A (zh) 一种基于深度学习的三维点云语义分割方法
CN111915437B (zh) 基于rnn的反洗钱模型的训练方法、装置、设备及介质
CN107392919B (zh) 基于自适应遗传算法的灰度阈值获取方法、图像分割方法
KR20180036709A (ko) 미디어 분류
CN110991435A (zh) 一种基于深度学习的快递运单关键信息定位方法和装置
CN111783505A (zh) 伪造人脸的识别方法、装置和计算机可读存储介质
CN109145766A (zh) 模型训练方法、装置、识别方法、电子设备及存储介质
CN111311702B (zh) 一种基于BlockGAN的图像生成和识别模块及方法
CN110378297A (zh) 一种基于深度学习的遥感图像目标检测方法
CN110175248B (zh) 一种基于深度学习和哈希编码的人脸图像检索方法和装置
CN106295694A (zh) 一种迭代重约束组稀疏表示分类的人脸识别方法
CN110827260A (zh) 一种基于lbp特征与卷积神经网络的布匹缺陷分类方法
CN108710916A (zh) 图片分类的方法及装置
CN110070115A (zh) 一种单像素攻击样本生成方法、装置、设备及存储介质
CN111582033A (zh) 垃圾分类的识别方法、系统及计算机可读存储介质
WO2020114135A1 (zh) 特征识别的方法及装置
CN113159045A (zh) 一种结合图像预处理与卷积神经网络的验证码识别方法
CN111222534A (zh) 一种基于双向特征融合和更平衡l1损失的单发多框检测器优化方法
CN113052217A (zh) 预测结果标识及其模型训练方法、装置及计算机存储介质
CN112784494A (zh) 假阳性识别模型的训练方法、目标识别方法及装置
CN109101984A (zh) 一种基于卷积神经网络的图像识别方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22909879

Country of ref document: EP

Kind code of ref document: A1