CN118157961B - Active simulation intrusion assessment and full-link visual protection system, method and equipment - Google Patents

Abstract

An active simulation intrusion evaluation and full-link visual protection system, method and equipment are provided, wherein the system comprises a test module, a simulation module, a central control module, an attack display module, a monitoring module, an analysis module, a scheme generation module, a defense module and an adaptation module; according to the invention, through mutual cooperation of the modules, the attack is actively simulated, so that potential safety risks and service influences can be timely found and evaluated, thereby helping enterprises take measures in advance, potential losses are reduced, the initiative of safety defense is improved, and the characteristics of a full-link visual attack path are adopted, so that related personnel can intuitively know the attack process and identify weak links, further, quick response and problem solving are performed, the window period of system maintenance is shortened, and safety protection is stronger, continuous and effective.

Description

Active simulation intrusion evaluation and full-link visual protection system, method and equipment

Technical Field

The invention relates to a network protection means, belongs to the technical field of network security, and particularly relates to a system, a method and equipment for actively simulating intrusion evaluation and full-link visual protection.

Background

Network security, generally refers to the security of a computer network, and in fact may also refer to the security of a computer communication network. The computer communication network is a system for interconnecting a plurality of computers with independent functions through communication equipment or transmission media and realizing information transmission and exchange among the computers under the support of communication software. The computer network is a system in which a plurality of independent computer systems, terminal devices and data devices distributed in a region are connected by communication means for the purpose of sharing resources, and data exchange is performed under the control of a protocol. The fundamental purpose of computer networks is resource sharing, and communication networks are ways to achieve network resource sharing, so that computer networks are secure, and corresponding computer communication networks must also be secure, and information exchange and resource sharing should be achieved for network users, so that network security includes both computer network security and computer communication network security.

In the current network security field, enterprises and organizations face an ever-increasing network attack threat, the traditional security defense mechanism is mostly passive response, measures are often taken after attacks occur, the identification and response speed of attack sources, attack links and weak points are insufficient, and the existing network threat analysis technology has the problems of big data processing capacity limitation, threat model deletion, unstable data quality, lack of standards and specifications, poor unknown and small sample data processing and the like, and is insufficient in security.

Disclosure of Invention

The invention aims to overcome the defects and problems of hysteresis and insufficient safety in the prior art and provides an active simulation intrusion evaluation and full-link visual protection system, method and equipment capable of actively protecting to improve communication safety.

In order to achieve the above purpose, the technical solution of the present invention is an active simulation intrusion assessment and full link visualization protection system, the system comprising:

the test module is used for analyzing the internal structure and logic of the protection system and constructing a prediction model;

the simulation module is used for simulating various network attacks according to predefined attack scenes and strategies;

The central control module is used for connecting each module, and coordinating and managing the operation of each module;

the attack display module is used for comparing and displaying network attacks;

the monitoring module is used for continuously monitoring network activities;

the analysis module is used for collecting and analyzing network activity data, and identifying potential threats and weak points of the protection system, wherein the network activity data comprises a network configuration file, a log file and a code base;

the scheme generation module is used for generating a solution to the network problem according to the analysis result of the analysis module and providing a repair suggestion and a network security improvement strategy;

The defending module is used for actively simulating network attack and converting the network attack into a security defending strategy so as to prevent potential threats;

And the adaptation module is used for dynamically adjusting the test scene and the analysis strategy of the prediction model according to the network activity change.

The operation logic of the test module is as follows:

Firstly, adopting a support vector machine algorithm to analyze and extract characteristics which are helpful for identifying security vulnerabilities from network configuration files, log files and code libraries of a protection system, then establishing a prediction model for identifying potential security vulnerabilities and weak points based on the characteristics, and continuously learning and updating the prediction model to adapt to changes of network environments and emerging threats, wherein the characteristics comprise unsafe function call, unexpected port opening or wrong authority setting.

The operation logic of the central control module is as follows:

The central control module monitors the overall state of the system in real time, coordinates and manages each module in the protection system by using an optimization algorithm based on a neural network, intelligently distributes system resources and priorities by evaluating the performance and response time of each module, and processes network environment changes and emerging threats by dynamically adjusting algorithm parameters.

The operation logic of the attack demonstration module is as follows:

Firstly, based on an ATT & CK framework, comparing an on-going attack behavior structure with an attack behavior structure in the ATT & CK framework to determine attack types and strategies, and then displaying attack sources, attack paths and weak points of attack behaviors in a visual mode.

The operation logic of the analysis module is as follows:

s1, acquiring target network related data, carrying out integration processing by utilizing a data integration algorithm to acquire target network data, and then carrying out noise reduction processing on the target network data by utilizing a target network noise reduction algorithm to acquire target network noise reduction data, wherein the target network related data comprises a log file, communication data and API data;

S2, performing feature extraction processing on the target network noise reduction data by using a feature extraction technology to obtain target network data features, and performing data semanteme processing on the target network data features by using a semanteme conversion algorithm to obtain target network semanteme data;

S3, carrying out data preprocessing on the target network semanteme data to obtain a target network semanteme specific data set, and then carrying out target network threat analysis on the target network semanteme specific data set according to a preset large language model to obtain a target network threat reasoning result;

s4, performing fine tuning training processing on the target network threat reasoning result by utilizing a target network fine tuning technology to obtain a target network threat reasoning optimization result, and then performing autonomous adaptation processing on the target network threat reasoning optimization result by utilizing a self-adaptation technology to obtain a target network threat adaptation result;

S5, performing vulnerability correlation analysis on the target network threat adaptation result by utilizing a vulnerability detection analysis algorithm to obtain a target network threat vulnerability detection result, and then formulating a target network threat detection analysis report according to the target network threat vulnerability detection result so as to execute a corresponding target network threat analysis management strategy.

The step of obtaining the target network data in the step S1 includes:

s11, performing behavior data acquisition processing on the log file through a behavior acquisition technology to obtain target network user behavior data, performing communication data acquisition processing on communication data through a data acquisition tool to obtain target network communication data, performing decryption analysis processing on the communication data through a multi-server API interface by using a multi-server API key to obtain target network API decryption data;

and S12, integrating the target network user behavior data, the target network communication data and the target network API decryption data by using a data integration algorithm to obtain target network data.

The operation logic of the scheme generating module is as follows:

the scheme generation module automatically marks and records detailed data when the protection system discovers potential threats and vulnerabilities, and generates specific security reinforcement and repair schemes based on the identified potential threats and vulnerabilities.

An active simulation intrusion assessment and full link visualization protection method, which is applied to the system, comprises the following steps:

testing the internal structure and logic of a protection system based on a white box test method, and simulating various network attacks according to predefined attack scenes and strategies;

step two, comparing attack structures of various network attacks, displaying all links, and continuously monitoring and analyzing network activities;

analyzing and collecting network activity data and a network attack mode, and identifying weak points of potential threats and protection systems;

Generating a problem solution based on the potential threat and the weak point, actively simulating network attack, and converting a security defense strategy to prevent the potential threat;

and fifthly, repeating the first to fifth steps, and dynamically adjusting the test scene, the analysis strategy and the security defense strategy according to the environmental change of network activities or new potential threats.

An active analog intrusion assessment and full link visualization protective device, the device comprising a processor and a memory;

The memory is used for storing computer program codes and transmitting the computer program codes to the processor;

The processor is configured to execute the active simulated intrusion assessment and full link visual protection method according to instructions in the computer program code.

A computer storage medium having stored thereon a computer program which when executed by a processor implements the active simulated intrusion assessment and full link visual protection method described above.

Compared with the prior art, the invention has the beneficial effects that:

The invention relates to an active simulation intrusion evaluation and full-link visual protection system, which comprises a test module, a simulation module, a central control module, an attack display module, a monitoring module, an analysis module, a scheme generation module, a defense module and an adaptation module, wherein the test module is used for simulating an attack of a user; in the application, the attack is actively simulated through the mutual cooperation of the modules, so that potential safety risks and business influences can be timely found and evaluated, an enterprise is helped to take measures in advance, potential losses are reduced, the initiative of safety defense is improved, and relevant personnel can intuitively know the attack process and recognize weak links by adopting the characteristics of a full-link visual attack path, so that the quick response and problem solving are performed, the window period of system maintenance is shortened, and the safety protection is firmer, more durable and effective.

Drawings

Fig. 1 is a schematic diagram of the system architecture of the present invention.

Fig. 2 is a flow chart of the method steps of the present invention.

Fig. 3 is a schematic view of the apparatus structure of the present invention.

In the figure, a test module 1, a simulation module 2, a central control module 3, an attack demonstration module 4, a monitoring module 5, an analysis module 6, a scheme generation module 7, a defense module 8, an adaptation module 9, a processor 10, a memory 11 and computer program codes 110 are shown.

Detailed Description

The invention is described in further detail below with reference to the accompanying drawings and detailed description.

Example 1:

Referring to fig. 1, an active simulated intrusion assessment and full link visualization protection system, the system comprising:

the test module 1 is used for automatically analyzing the internal structure and logic of the protection system and constructing a prediction model;

Further, the operation logic of the test module 1 is as follows:

Firstly, adopting a support vector machine algorithm, analyzing and extracting characteristics which are helpful for identifying security vulnerabilities from a network configuration file, a log file and a code library of a protection system through a white box test method, then establishing a prediction model for identifying potential security vulnerabilities and weak points based on the characteristics, continuously learning and updating the prediction model to adapt to changes of network environments and emerging threats, wherein the characteristics comprise unsafe function call, unexpected port opening or wrong authority setting.

Further, the implementation of the corresponding function by using the support vector machine algorithm comprises the following steps:

1. Data collection and preprocessing;

(1) Collecting data, namely firstly, collecting data from network configuration files, log files, code libraries and other related documents;

(2) Feature extraction, namely analyzing the collected data, and extracting features which are helpful for identifying security holes, such as unsafe function calls, unexpected port opening, wrong authority setting and the like;

(3) Feature selection, selecting the most significant features by technical Principal Component Analysis (PCA) or by knowledge of domain experts;

(4) Data cleaning, namely processing missing values, abnormal values and noise, and normalizing or normalizing characteristic values so as to facilitate SVM processing;

2. Training a model;

(1) Selecting SVM kernel functions, namely selecting proper kernel functions such as linear kernels, polynomial kernels, radial Basis Function (RBF) kernels and the like according to the characteristics of data;

(2) Training the SVM model by using a training data set, wherein the process comprises the steps of selecting optimal super parameters such as penalty parameters C, kernel function parameters and the like;

(3) Cross-validation using k-fold cross-validation to evaluate the performance of the model and select the best parameters;

3. Evaluating a model;

(1) And evaluating the performance of the SVM model by using the test set. Common evaluation indexes comprise accuracy, recall rate, F1 score and the like;

(2) Error analysis, namely analyzing samples with classification errors to understand the deficiency of the model;

4. Deploying a model;

(1) Deploying the model, namely deploying the trained model into an actual environment so as to monitor the safety state of the network system in real time;

(2) Real-time monitoring, namely, after the model is deployed, real-time analysis can be carried out on network flow and configuration change so as to identify security threat;

5. model updating and learning;

(1) Continuously learning, namely periodically updating a model by newly collected data along with the change of network environment and attack means so as to maintain the accuracy of the model;

(2) Adaptive mechanisms-online learning or incremental learning strategies can be introduced to enable models to adapt to new data without requiring retraining.

During the encoding and implementation phase, the SVM may be implemented using a library such as scikit-learn using a programming language such as Python.

The simulation module 2 is used for simulating the anti-attack capability of various network attack test protection systems according to predefined attack scenes and strategies;

The central control module 3 is used for connecting each module and coordinating and managing the operation of each module by utilizing an optimization algorithm based on a neural network, and the working principle comprises monitoring network activity, formulating a defending strategy according to information and analysis results, and controlling the operation of attack display, monitoring, analysis, scheme generation, defending and adaptation modules so as to protect the network safety.

Further, the operation logic of the central control module 3 is as follows:

The central control module 3 monitors the overall state of the system in real time, coordinates and manages each module in the protection system by using an optimization algorithm based on a neural network, intelligently distributes system resources and priorities by evaluating the performance and response time of each module, and processes network environment changes and emerging threats by dynamically adjusting algorithm parameters.

The attack display module 4 is used for comparing and displaying network attacks;

further, the operation logic of the attack presentation module 4 is as follows:

Firstly, based on an ATT & CK framework, comparing an on-going attack behavior structure with an attack behavior structure in the ATT & CK framework to determine attack types and strategies, and then displaying attack sources, attack paths and weak points of attack behaviors in a visual mode.

And the monitoring module 5 is used for continuously monitoring and analyzing the network activities, timely discovering potential threats and vulnerabilities and identifying anomalies and potential threats by monitoring the network traffic and behaviors.

An analysis module 6 for collecting network activity data, analyzing the network attack, identifying potential threats and weak points of the protection system, and using an analysis algorithm to detect the threats and generate reports.

Further, the operation logic of the analysis module 6 is as follows:

s1, acquiring target network related data, carrying out integration processing by utilizing a data integration algorithm to acquire target network data, and then carrying out noise reduction processing on the target network data by utilizing a target network noise reduction algorithm (such as a filter and an outlier detection method) to acquire target network noise reduction data, wherein the target network related data comprises a log file, communication data and API data;

Further, the step of obtaining the target network data in step S1 includes:

S11, performing behavior data acquisition processing on a log file through a behavior acquisition technology (such as a network monitoring tool and a log management system) to obtain target network user behavior data, performing communication data acquisition processing on communication data through a data acquisition tool (such as WIRESHARK, TCPDUMP) to obtain target network communication data, performing decryption analysis processing on the target network API decryption data through a multi-service API interface (such as an AWS API, a Google Cloud API and the like) by utilizing a multi-service API key, and obtaining target network API decryption data;

s12, integrating the target network user behavior data, the target network communication data and the target network API decryption data by using a data integration algorithm (such as a data fusion technology) to obtain the target network data.

S2, performing feature extraction processing on the target network noise reduction data by using a feature extraction technology (such as a feature selection technology in a machine learning algorithm) to obtain target network data features, and performing data semantication processing on the target network data features by using a semantication conversion algorithm to obtain target network semantication data;

s3, carrying out data preprocessing on the target network semanteme data to obtain a target network semanteme specific data set, and then carrying out target network threat analysis on the target network semanteme specific data set according to a preset large language model (such as GPT and BERT) to obtain a target network threat reasoning result;

S4, performing fine tuning training processing on the target network threat reasoning result by utilizing a target network fine tuning technology to obtain a target network threat reasoning optimization result, and then performing autonomous adaptation processing on the target network threat reasoning optimization result by utilizing an adaptive adaptation technology (such as online learning and incremental learning) to obtain a target network threat adaptation result;

S5, performing vulnerability association analysis on the target network threat adaptation result by utilizing a vulnerability detection analysis algorithm (such as signature-based detection and behavior analysis) to obtain a target network threat vulnerability detection result, and then formulating a target network threat detection analysis report according to the target network threat vulnerability detection result so as to execute a corresponding target network threat analysis management strategy. The report should include vulnerability details, affected systems, recommended security reinforcement, etc.

A solution generating module 7, configured to generate a solution to the network problem according to the analysis result of the analyzing module 6, and provide a repair suggestion and a network security improvement policy;

further, the operation logic of the scheme generating module 7 is as follows:

The scheme generation module 7 automatically marks and records detailed data when the protection system discovers potential threats and vulnerabilities, and generates specific security reinforcement and repair schemes based on the identified potential threats and vulnerabilities.

The defending module 8 is used for actively simulating network attack and continuously monitoring, and changing the security defending strategy from passive to active to prevent potential threat, and can automatically respond to the attack and take necessary measures to protect the network.

And the adaptation module 9 is used for dynamically adjusting the test scene and the analysis strategy of the prediction model according to the change of the network environment and the new threat mode, so that the system can adapt to the continuously-changed threat and maintain high alertness and response capability.

Example 2:

referring to fig. 2, an active simulated intrusion assessment and full link visual protection method is applied to the system described in embodiment 1, and the method includes:

testing the internal structure and logic of a protection system based on a white box test method, and simulating various network attacks according to predefined attack scenes and strategies;

step two, comparing attack structures of various network attacks, displaying all links, and continuously monitoring and analyzing network activities;

analyzing and collecting network activity data and a network attack mode, and identifying weak points of potential threats and protection systems;

Generating a problem solution based on the potential threat and the weak point, actively simulating network attack, and converting a security defense strategy to prevent the potential threat;

And fifthly, repeating the first to fifth steps, and dynamically adjusting the test scene, the analysis strategy and the security defense strategy according to the environmental change of the network activity or the newly-appearing potential threat.

Example 3:

referring to fig. 3, an active analog intrusion assessment and full link visualization protective device comprises a processor 10 and a memory 11;

the memory 11 is used for storing computer program code 110 and for transmitting the computer program code 110 to the processor 10;

The processor 10 is configured to perform the active simulated intrusion assessment and full link visual protection method of embodiment 2 according to instructions in the computer program code 110.

Example 4:

A computer storage medium having stored thereon a computer program which when executed by a processor implements the active simulated intrusion assessment and full link visual protection method of embodiment 2.

In general, the computer instructions to implement the methods of the present invention may be carried in any combination of one or more computer-readable storage media. The non-transitory computer-readable storage medium may include any computer-readable medium, except the signal itself in temporary propagation.

The computer readable storage medium can be, for example, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or a combination of any of the foregoing. More specific examples (a non-exhaustive list) of the computer-readable storage medium include an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EKROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device.

Computer program code for carrying out operations of the present invention may be written in one or more programming languages, or combinations thereof, including an object oriented programming language such as Java, SMalltalk, C ++ and conventional procedural programming languages, such as the "C" language or similar programming languages, particularly Python languages suitable for neural network computing and TensorFlow, pyTorch-based platform frameworks may be used. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any number of types of networks, including a Local Area Network (LAN) or a Wide Area Network (WAN), or be connected to an external computer (for example, through the Internet using an Internet service provider).

The above-mentioned devices and non-transitory computer readable storage medium may refer to specific descriptions of active analog intrusion assessment and full-link visual protection systems and beneficial effects, and are not described herein.

While embodiments of the present invention have been shown and described above, it should be understood that the above embodiments are illustrative and not to be construed as limiting the invention, and that variations, modifications, alternatives, and variations may be made to the above embodiments by one of ordinary skill in the art within the scope of the invention.

Claims (4)

Translated fromChinese

1.一种主动模拟入侵评估与全链路可视化防护系统，其特征在于，所述系统包括：1. An active simulated intrusion assessment and full-link visual protection system, characterized in that the system includes:测试模块(1)，用于分析防护系统的内部结构和逻辑，构建预测模型；The test module (1) is used to analyze the internal structure and logic of the protection system and build a prediction model;模拟模块(2)，用于根据预定义的攻击场景和策略，模拟各种网络攻击；A simulation module (2), used for simulating various network attacks according to predefined attack scenarios and strategies;中央控制模块(3)，用于连接各个模块，协调与管理各个模块的运行；Central control module (3), used to connect various modules and coordinate and manage the operation of various modules;攻击展示模块(4)，用于对网络攻击进行比对和展示；An attack display module (4), used for comparing and displaying network attacks;监测模块(5)，用于持续进行监测网络活动；A monitoring module (5), used for continuously monitoring network activities;分析模块(6)，用于收集分析网络活动数据，识别潜在的威胁和防护系统的薄弱点；所述网络活动数据包括网络配置文件、日志文件、代码库；An analysis module (6) is used to collect and analyze network activity data to identify potential threats and weaknesses in the protection system; the network activity data includes network configuration files, log files, and code libraries;方案生成模块(7)，用于根据分析模块(6)的分析结果生成网络问题的解决方案，提供修复建议与网络安全改进策略；A solution generation module (7), used to generate a solution to the network problem based on the analysis result of the analysis module (6), and to provide repair suggestions and network security improvement strategies;防御模块(8)，用于主动模拟网络攻击，并转变安全防御策略，以防范潜在威胁；A defense module (8) for proactively simulating network attacks and transforming security defense strategies to guard against potential threats;适应模块(9)，用于根据网络活动变化，动态调整预测模型的测试场景和分析策略；An adaptation module (9), used for dynamically adjusting the test scenarios and analysis strategies of the prediction model according to changes in network activities;所述测试模块(1)的运行逻辑如下：The operating logic of the test module (1) is as follows:首先采用支持向量机算法，从防护系统的网络配置文件、日志文件、代码库中分析提取有助于识别安全漏洞的特征，然后基于该特征，建立用于识别潜在安全漏洞与薄弱点的预测模型，并持续学习与更新该预测模型，以适应网络环境的变化和新出现的威胁；所述特征包括不安全的函数调用、非预期的端口开放或错误的权限设置；First, the support vector machine algorithm is used to analyze and extract features that are helpful in identifying security vulnerabilities from the network configuration files, log files, and code libraries of the protection system. Then, based on the features, a prediction model for identifying potential security vulnerabilities and weaknesses is established, and the prediction model is continuously learned and updated to adapt to changes in the network environment and emerging threats; the features include insecure function calls, unexpected port openings, or incorrect permission settings;所述中央控制模块(3)的运行逻辑如下：The operation logic of the central control module (3) is as follows:所述中央控制模块(3)实时监控系统的整体状态，运用基于神经网络的优化算法来协调和管理防护系统中的各个模块，并通过评估各模块的性能和响应时间，智能分配系统资源和优先级，同时通过动态调整算法参数处理网络环境变化和新出现的威胁；The central control module (3) monitors the overall status of the system in real time, uses a neural network-based optimization algorithm to coordinate and manage the various modules in the protection system, and intelligently allocates system resources and priorities by evaluating the performance and response time of each module, while dynamically adjusting algorithm parameters to handle changes in the network environment and emerging threats;所述攻击展示模块(4)的运行逻辑如下：The operation logic of the attack display module (4) is as follows:首先基于ATT&CK框架，将进行中的攻击行为结构与ATT&CK框架中的攻击行为结构进行比对，确定攻击类型和策略，然后将攻击行为的攻击源、攻击路径与薄弱点以可视化的形式展示；First, based on the ATT&CK framework, the ongoing attack behavior structure is compared with the attack behavior structure in the ATT&CK framework to determine the attack type and strategy. Then, the attack source, attack path, and weak points of the attack behavior are displayed in a visual form.所述分析模块(6)的运行逻辑如下：The operating logic of the analysis module (6) is as follows:S1、获取目标网络相关数据，并利用数据整合算法进行整合处理，获得目标网络数据，然后利用目标网络降噪算法对目标网络数据进行降噪处理，获得目标网络降噪数据；所述目标网络相关数据包括日志文件、通信数据、API数据；S1. Obtain target network related data, and integrate and process it using a data integration algorithm to obtain target network data, and then use a target network noise reduction algorithm to perform noise reduction on the target network data to obtain target network noise reduction data; the target network related data includes log files, communication data, and API data;S2、利用特征提取技术对目标网络降噪数据进行特征提取处理，获得目标网络数据特征，然后利用语义化转换算法对目标网络数据特征进行数据语义化处理，获得目标网络语义化数据；S2. Use feature extraction technology to perform feature extraction processing on the target network noise reduction data to obtain target network data features, and then use semantic conversion algorithm to perform data semantic processing on the target network data features to obtain target network semantic data;S3、对目标网络语义化数据进行数据预处理，获得目标网络语义化特定数据集，然后根据预设的大语言模型对目标网络语义化特定数据集进行目标网络威胁分析，获得目标网络威胁推理结果；S3, preprocessing the target network semantic data to obtain a target network semantic specific data set, and then performing target network threat analysis on the target network semantic specific data set according to a preset large language model to obtain a target network threat inference result;S4、利用目标网络微调技术对目标网络威胁推理结果进行微调训练处理，获得目标网络威胁推理优化结果，然后利用自适应适配技术对目标网络威胁推理优化结果进行自主适配处理，获得目标网络威胁适配结果；S4, using the target network fine-tuning technology to perform fine-tuning training processing on the target network threat reasoning result to obtain the target network threat reasoning optimization result, and then using the adaptive adaptation technology to autonomously adapt the target network threat reasoning optimization result to obtain the target network threat adaptation result;S5、利用漏洞检测分析算法对目标网络威胁适配结果进行漏洞关联分析，获得目标网络威胁漏洞检测结果，然后根据目标网络威胁漏洞检测结果制定目标网络威胁检测分析报告以执行相应的目标网络威胁分析管理策略；S5. Perform vulnerability correlation analysis on the target network threat adaptation result using a vulnerability detection analysis algorithm to obtain a target network threat vulnerability detection result, and then formulate a target network threat detection analysis report based on the target network threat vulnerability detection result to execute a corresponding target network threat analysis management strategy;所述步骤S1中目标网络数据的获取步骤包括：The step of acquiring the target network data in step S1 includes:S11、通过行为采集技术对日志文件进行行为数据采集处理，获得目标网络用户行为数据；通过数据采集工具获取对通信数据进行通信数据采集处理，获得目标网络通信数据；通过多服务商API接口利用多服务商API密钥对与API数据进行解密分析处理，获得目标网络API解密数据；S11. Collect and process the behavior data of the log files through the behavior collection technology to obtain the user behavior data of the target network; collect and process the communication data through the data collection tool to obtain the communication data of the target network; decrypt and analyze the API data using the API key of the multi-service provider through the multi-service provider API interface to obtain the target network API decryption data;S12、利用数据整合算法对目标网络用户行为数据、目标网络通信数据、目标网络API解密数据进行整合处理，获得目标网络数据；S12, using a data integration algorithm to integrate the target network user behavior data, the target network communication data, and the target network API decryption data to obtain the target network data;所述方案生成模块(7)的运行逻辑如下：The operation logic of the solution generation module (7) is as follows:所述方案生成模块(7)在防护系统发现潜在威胁和漏洞时，自动标记并记录详细数据，并基于识别的潜在威胁和漏洞，生成具体的安全加固和修复方案。The solution generation module (7) automatically marks and records detailed data when the protection system finds potential threats and vulnerabilities, and generates specific security reinforcement and repair solutions based on the identified potential threats and vulnerabilities.2.一种主动模拟入侵评估与全链路可视化防护方法，其特征在于，该方法应用于权利要求1所述的系统，所述方法包括：2. A method for active simulated intrusion assessment and full-link visual protection, characterized in that the method is applied to the system according to claim 1, and the method comprises:步骤一、基于白盒测试方法对防护系统的内部结构和逻辑进行测试，并根据预定义的攻击场景和策略，模拟各种网络攻击；Step 1: Test the internal structure and logic of the protection system based on the white box testing method, and simulate various network attacks according to predefined attack scenarios and strategies;步骤二、将各种网络攻击的攻击结构进行比对并进行全链路展示，并持续对网络活动进行监测与分析；Step 2: Compare the attack structures of various network attacks and display the entire chain, and continuously monitor and analyze network activities;步骤三、分析收集网络活动数据与网络攻击模式，识别出潜在威胁与防护系统的薄弱点；Step 3: Analyze and collect network activity data and network attack patterns to identify potential threats and weaknesses in the protection system;步骤四、基于潜在威胁与薄弱点生成问题解决方案，并主动模拟网络攻击，转变安全防御策略，以防范潜在威胁；Step 4: Generate problem solutions based on potential threats and weaknesses, and proactively simulate network attacks to change security defense strategies to prevent potential threats;步骤五、重复步骤一至五，并根据网络活动的环境变化或新出现的潜在威胁，动态调整测试场景、分析策略与安全防御策略。Step 5: Repeat steps 1 to 5, and dynamically adjust the test scenarios, analysis strategies, and security defense strategies based on changes in the network activity environment or emerging potential threats.3.一种主动模拟入侵评估与全链路可视化防护设备，其特征在于：3. An active simulated intrusion assessment and full-link visual protection device, characterized by:所述设备包括处理器(10)以及存储器(11)；The device comprises a processor (10) and a memory (11);所述存储器(11)用于存储计算机程序代码(110)，并将所述计算机程序代码(110)传输给所述处理器(10)；The memory (11) is used to store computer program code (110) and transmit the computer program code (110) to the processor (10);所述处理器(10)用于根据所述计算机程序代码(110)中的指令执行权利要求2所述的主动模拟入侵评估与全链路可视化防护方法。The processor (10) is used to execute the active simulated intrusion assessment and full-link visual protection method described in claim 2 according to the instructions in the computer program code (110).4.一种计算机存储介质，其上存储有计算机程序，其特征在于：所述计算机程序被处理器执行时实现权利要求2所述的主动模拟入侵评估与全链路可视化防护方法。4. A computer storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the active simulated intrusion assessment and full-link visual protection method described in claim 2 is implemented.