Network security situation awareness early warning method and system

Abstract

The invention relates to a network security situation awareness early warning method and system. The method comprises the steps of obtaining a network data sample; preprocessing the network data sample; analyzing and processing the preprocessed network data sample to obtain an attribute value of the network data, and judging whether the attribute value of the network data is in safe correspondencewith the network data or not; extracting a feature vector from the attribute value of the network data; establishing a database table structure according to the feature vectors of the network data attribute values to form a network security feature knowledge base; acquiring real-time network data, and extracting a feature vector of a network data attribute value from the real-time network data; matching the feature vector of the network data attribute value with a network security feature knowledge base, and judging a network security situation according to a matching result; and forming a situation analysis report and a network comprehensive situation map according to the network security situation, and performing visual display. According to the invention, network space equipment security situation awareness early warning and visual expression are realized.

Description

technical field [0001] The present invention relates to the field of network technology and information security technology, in particular to a network security situational awareness early warning method and system. Background technique [0002] The network has penetrated into every aspect of modern life, but there are huge hidden dangers in the network security that people pay close attention to. Network security situational awareness is a proactive network defense method. It can not only reflect the current network security situation, but also predict potential attacks in the network, so as to make active defense against potential attacks. Network security situation awareness is to obtain a large amount of log data from software and hardware such as firewalls, security audits, and anti-virus software. Trends are forecasted. [0003] At present, domestic network situational awareness methods and systems are developed based on the combination of X86CPU of Intel Corporation...

AI Technical Summary

Problems solved by technology

[0003] At present, domestic network situational awareness methods and systems are developed based on the combination of X86CPU of Intel Corporation of the United States and Microsoft Windows, and the backdoor vulnerability of X86CPU and the backdoor defect of WINDOWS make the "fuse" virus attack the X86CPU. Therefore, there are major Security flaws and hidden dangers

Images