A network security event visualization method based on text processing

Abstract

The invention discloses a network security event visualization method based on text processing, and the method comprises the steps: 1) obtaining a plurality of network security events to generate an event set, and converting the event set into a structured feature vector; 2) carrying out classified labeling on each network security event; 3) annotating the segmented words in each network securityevent according to a set extraction target, and extracting security event contents of each network security event according to the annotations; 4) constructing a basic FP tree according to the security event content of each network security event, obtaining a conditional pattern base from the basic FP tree, and constructing a new conditional FP tree by using the conditional pattern base until thenew conditional FP tree only contains one element item to obtain an associated frequent set of the network security events; And 5) according to the correlation frequency set, determining the correlation degree of the corresponding network security events and the connection relationship between the network security events, and visualizing the event set.

Description

technical field [0001] The invention belongs to the technical field of network security, and further relates to a method for visualizing network security events based on text processing. The invention is mainly used to realize the establishment of the semantic correlation model of the security event, reveal the chain reaction mechanism of the security event, and lay the foundation for proposing the security event description frame and the measurement index system. The model can be applied to the timely processing and response of constantly updated network security events, and also has extremely positive significance for the analysis and prediction of the development trend of offensive and defensive technologies. Background technique [0002] The evaluation and measurement of network security refers to extracting elements related to network security in a certain time and space for analysis, comprehensively processing security data, determining the attack behavior of the syste...

AI Technical Summary

Problems solved by technology

[0006] (1) There is no complete set of solutions for the handling of actual network security incidents, and only countermeasures are proposed for different aspects of different security incidents

[0007] (2) The research on network security incidents mainly focuses on the proposal of the response model, and does not further reveal the mechanism and principle of the internal correlation between security incidents, that is, the relationship between the temporal and spatial semantics of security incidents

[0008] (3) The main sources of security event data are concentrated in intrusion detection data and log data, and there is no analysis and research on the text data of network security events

Images