Network security protection method and network security protection system

Abstract

The invention discloses a network security protection method and system. The network security protection method comprises the steps of obtaining multi-dimensional data; preprocessing the acquired multi-dimensional data to generate to-be-analyzed data; analyzing the to-be-analyzed data and generating an early warning report, wherein the early warning report is used for forecasting threats; analyzing the to-be-analyzed data and generating an early warning report, wherein the early warning report at least comprises situation awareness, real-time analysis early warning or network intrusion attackpath and threat traceability analysis; wherein the situation awareness comprises the step of extracting a flow upper limit in a normal network state from the to-be-analyzed data by using machine learning, trusted flow data are divided from the to-be-analyzed data according to the flow upper limit, a flow assessment model is established according to the trusted flow data, network flow is assessed according to the flow assessment model, and the early warning report is generated if abnormal flow is monitored. And the real-time analysis early warning is used for carrying out early warning on abnormal data.

Description

technical field [0001] The invention relates to the field of network security, in particular to a network security protection method and a network security protection system. Background technique [0002] In network security protection methods, anomaly detection is one of the protection methods, but due to the limitations of technical conditions, common anomaly detection methods face the following problems: [0003] The problem of model granularity, ordinary anomaly detection methods have limited computing power, and it is difficult to establish a fine-grained model that is sensitive to abnormal behavior, resulting in a high false negative rate. Taking abnormal traffic detection as an example, the modeling object is often based on the traffic between security domains, which makes the attack traffic between individuals submerged in a large amount of background traffic, making it difficult to detect effectively. [0004] The problem of the number of features, ordinary anomaly...

AI Technical Summary

Problems solved by technology

[0003] The problem of model granularity, ordinary anomaly detection methods have limited computing power, and it is difficult to establish a fine-grained model that is sensitive to abnormal behavior, resulting in a high false negative rate

Taking abnormal traffic detection as an example, the modeling object is often based on the traffic between security domains, which makes the attack traffic between individuals submerged in a large amount of background traffic, making it difficult to detect effectively

[0004] The problem of the number of features, ordinary anomaly detection methods have limited computing power, and it is difficult to establish a high-dimensional model that describes network behavior from different dimensions, resulting in a high false positive rate

The limitation of the number of features selected makes it only possible to judge the abnormality of network behavior based on low-dimensional features

[0005] Model training problem, due to limited storage capacity, it is difficult to fully train the model based on long-term data, resulting in insufficient accuracy of the model

Images