Application of nonlinear recursion equation in network security risk detection

3.1 Concept of cybersecurity risk

In the information security risk assessment specification promulgated by our country, the composition of network security risk assessment is shown in Figure 2. The main content is aimed at the interaction between threats and vulnerabilities, vulnerability, the impact relationship with assets, and the possible loss caused by security threat events and threats under the two effects, quantifying the risk.

Figure 2

Network security risk principles.

3.2 Research status of network security risk assessment and detection technology

Network security risk assessment, control and prediction technology, by analyzing the vulnerabilities of network systems, the threats they face, and the security measures adopted, comprehensively perceives the security risks faced by the network and provides corresponding solutions to ensure the normal operation of the network, which is a means of qualitative and quantitative analysis of network security; it is a fine measurement of network security and the overall process of determining, controlling, and mitigating security incidents affecting network resources. The process includes three levels of network security risk assessment, network security risk control and network security risk prediction [10]. At present, there are more and more studies on these three levels at home and abroad, but the corresponding technical framework has not yet been perfected, and the research on specific evaluation models and evaluation algorithms is still in its infancy and lacks systematic quantitative analysis tools and supporting platforms; it is very necessary to do in-depth research on these issues. Next, the research status of this problem is introduced from the three aspects of network security risk assessment, control and prediction.

3.3 Status quo of network security risk assessment

The research on security risk generally revolves around risk assessment and risk management, the former assesses and predicts the possibility and impact of system losses under the interaction of existing assets, vulnerabilities and threats; the latter uses the risk calculation results of the former to construct a security patching strategy, adjusts the defense configuration of the system, and then reduces the risk to an acceptable level. The two complement each other and complete the overall mastery and control of system security risks to ensure system security.

Network security risk assessment mainly focuses on a comprehensive analysis of various factors of the system, calculation and evaluation of risks, generally divided into qualitative analysis and quantitative analysis. For the qualitative analysis such as model-based security risk assessment, the researchers proposed methods such as attack tree fault tree, privilege graph and attack graph to deduce the vulnerability correlation of the network and demonstrate potential threat paths. The quantitative analysis focuses on the single-point risk calculation for different levels of assessment objects, and the overall comprehensive risk calculation, generally starting from the harm of single-point vulnerability and the possibility of vulnerability being exploited, for example, the Bayesian method11, D–S evidence theory method, etc., is used to determine the risk probability. Then, based on considering the value of inherent assets, single point VaR and composite VaR are calculated to assist risk management.

The diversity, complexity and security threats of network systems continue to escalate, uncertain network security problems emerge in an endless stream, traditional single-function protection methods such as firewalls and intrusion detection, and the new means and technical methods are not enough to defend against advanced network attacks, and comprehensive strategies and methods of active defense must be considered in order to be integrated and prevent problems before they occur [11]. As an important measure of active defense, network security risk assessment has been widely used in the field of network information; it has been highly valued by the government, enterprises, military and scientific research institutions, and established a series of evaluation standards such as ITSEC and ISO/IEC 13335. The method has played a guiding and promoting role in the development of network security risk assessment technology. Based on the specifications and guidance given by the standard, methods and technologies for specific implementation have been widely carried out in academia and industry: continuous innovation, using failure mode impact analysis in the preparation stage of risk assessment; logic analysis method; Dephi method in qualitative analysis; analytic hierarchy process analytic hierarchy process in quantitative analysis. In terms of risk assessment tools, there has been a knowledge-based risk assessment system CycSecunity; MulVAL systems based on logical reasoning are constantly emerging.

3.4 Development status of network security technology

The root of the network security problem is the vulnerability of the network system itself, if a system without any vulnerability can be designed; then, all security problems can be solved easily; eliminating system vulnerabilities has long been studied as the most primitive line of defense for system security. At the beginning of computer technology, system designers adopted various technical and management measures. They are all used to design safe systems, but the practice has proved that it is impossible to design an safe system. Any artificial system inevitably has various weak links, but if the vulnerability of the system can be detected and repaired in time, then various security hazards can be reduced [12]. The purpose of vulnerability detection technology is to detect computer network systems, or network equipment performing security-related detection, in order to identify security risks and vulnerabilities that may be exploited by hackers; network administrators can repair and reduce potential threats on time before failures occur. Vulnerability detection technology mainly includes host detection technology, operating system detection technology, access control rule detection technology, port scanning technology and vulnerability identification technology. With the rise of mobile Internet, the development of cloud computing, industrial control and other technologies, the difference between internal and external networks is gradually weakened, and the business is gradually pulled to the external network processing. Especially in the past, banks, governments and other institutions, only counter business, can also be processed online, and network security is becoming more and more serious.

3.5 Application advantages of artificial intelligence technology in the field of network security risk detection

1. Accurately handle network information

   The use of artificial intelligence technology in the field of network security can fully demonstrate the advantages and characteristics of the use of artificial intelligence technology, improve the efficiency of network security management, and ensure network security [13]. Compared with traditional network security management technology, artificial intelligence technology has great advantages in processing network security information. It can use functions similar to those of human intelligence to deal with some unknown network security problems; the accuracy of network security information processing is high. A large amount of ambiguous information or vocabulary will be generated during network operation, which will cause certain difficulties in network security management. The application of artificial intelligence technology can process such network security information using fuzzy logic reasoning, and quickly searching and processing it, so as to obtain a good processing effect [14].

2. Strong learning and processing ability

   The biggest advantage of artificial intelligence technology in the field of network security is that it can self-learn; this is a function that traditional network security technology does not have. In the process of specific application, the application of artificial intelligence technology can find effective information in massive network data information, and the processing efficiency of data information is very high. In the process of applying artificial intelligence technology in the field of network security, the given data information can be used for self-reasoning and learning, finding the law and method of data information search, so as to accurately find effective information in a very short period of time and improve the efficiency of network security management.

4.1 Design of network security risk detection system

4.1.1 Hardware design

The hardware of the network security risk detection system based on the N-gram algorithm includes a data preprocessing module and a collaborative analysis module [15].

The data preprocessing module is mainly responsible for processing captured data packets with security risks and consists of a detection engine and a packet decoder [16]. For the collected data packets, the actual elements contained in the packets are first decoded by the packet decoder, and the specific decoder workflow is shown in Figure 3.

Figure 3

Specific decoder workflow.

The packet decoder first concatenates the decoded data, builds a network stack, and then decodes the protocol elements in a way that moves from the bottom layer to the top layer. Finally, each decoded packet is combined into a data structure and sent to the detection engine for analysis [17].

The main function of the detection engine is to check the decoded data packets, test whether there are suspicious behaviors that threaten network security, and modify the suspicious behaviors. Since some packets can disguise themselves through methods such as payload transformation, before checking for suspicious behavior, the detection engine first needs to modify the rules of the data packet. In addition to this, the detection engine is able to normalize traffic patterns to accurately match packet characteristics [18].

4.1.2 Collaborative analysis module

The collaborative analysis module is mainly composed of a collaborative collector, a collaborative analyzer, a collaborative sensor and a collaborative manager. The specific module diagram is shown in Figure 4.

Figure 4

Module diagram.

In the collaborative analysis module, the collaborative collector is mainly responsible for receiving the relevant detection data of each node, reported to the synergy analyzer through the synergy sensor.

4.2 Optimized vector parallel algorithm for recursive equations

The author presents a parallel method for solving this kind of recursive equations; the algorithm combines the idea of recursive multiplication (RD) and the idea of vertical and horizontal processing (V–H).

In the overvoltage protection algorithm, we assume that the number of processors is p, the scale of the recurrence equation is N, and N = mk. The algorithm is divided into three steps: The task is divided into mk segments, and the size of each segment is k.

1. The mk segment is calculated serially at the same time, and the relative value of each segment is obtained.

2. For the relative endpoint values of each segment obtained in step 1, the RD method is applied to find the final endpoint value of each segment.

3. Each segment uses the endpoint value of the upper segment obtained in step 2 as the initial value for simultaneous serial calculation, and the final result is obtained.

The specific algorithm is as follows:

For t = 1, then k − 1;

For i = 0, then p − 1

The recurrence equation defined by the author is a formal description of a large class of recurrences; therefore, the time taken to calculate the functions f, g, and h varies with the specific application problem (usually for addition, multiplication, square, etc.). For the convenience of formal analysis, here we assume that the execution time of f, g and h is all one computation step. The first and third statements in the algorithm can be completed in five (k−1) steps, while the second statement can be completed in 3 L = 3 log 3p steps. Therefore, the algorithm can be completed in 5 ( k − 1 ) 3 log 2 : P steps, and its time complexity is O ( k ) = O ( N / P ) [19].

4.3 Security risk assessment methods

Since qualitative risk calculations only use estimates such as “high,” “medium” and “low” to determine the level of risk, it is difficult to establish a comprehensive method of overall risk; there are too many subjective factors, and the difference is large. In order to measure and quantify the risk calculation more accurately and facilitate the comparison and synthesis, the National Bureau of Standards provides a basic risk calculation method as shown in formula (1) [20].

If we estimate the size of this intermediate variable, estimates will jump, because when m = 14, the result has hundreds of 100 million, 100 million digits, each number has 14 bits long, and to get m = 15 results, we need to store m = 14 results in memory variables for iterative calculation, no matter what format, almost will encounter a single machine memory limitations, if the arrangement combination number continues to increase; the result will memory overflow. Where n = {0, 1, 2 ….} is the set of risk sources existing in the target system, I(0) is the quantified value of the loss caused by each risk 0 and F represents the risk 0; the possibility of occurrence – generally used probability representation. In this way, ALE can be used as the risk quantification value of the target system; this calculation method is scientific and objective and has been widely adopted since then. As for how to establish the loss caused by risk and the probability of risk occurrence, later generations began to carry out a series of researches on the probability of attack and the loss or impact caused by attack [21]. Generally, the target network to be investigated is calculated and analyzed at the level of risk, which is divided into three levels: component level (service level), host level, and network level (system level) for weight accumulation; let v denote an attacking node for a certain service, and P(v) denote the attack success probability; then, the service risk is expressed as shown in formula (2).

4.4 Cyber risk assessment model

4.4.1 Basic concepts

Network security risk assessment is an assessment of computer networks and the services running on them, according to the external attack data in the computer network and the impact of its own vulnerability on network assets, and comprehensively analyzes the security of each link of the computer network, thereby assessing the security of the entire network. It is the foundation of the network security management system, by understanding the current risk of the system and assessing the degree of security threat and impact that the risk may bring, so as to reduce the risk of the system to an acceptable level; it provides a direct basis for reducing network risks and implementing risk management [22].

Network security risk assessment can be done by mapping its assessment steps to those of a network attack, in order to achieve anti-network security risk assessment; the assessment steps can be matched with the steps of network attacks, so as to achieve the purpose of preventing the network from being attacked. Network attacks are generally the purpose of remote information collection, data analysis, remote attacks, and local attacks on the network. A network attack is generally composed of several steps, such as remote information collection, data analysis, remote attack, local attack, and local information collection, the network security risk assessment is composed of several steps such as data collection, data attack, and local information collection; it is a process of data collection, data processing and data analysis, which mainly includes three stages: information collection, data association and fusion processing, and comprehensive assessment. The method of processing and data analysis mainly include three stages: information collection, data association and fusion processing, and comprehensive evaluation; the general steps are local information collection, data analysis, remote data collection, data analysis, and comprehensive evaluation. From the above-mentioned two-step analysis, it can be seen that the steps of risk assessment and network attack are opposite. Therefore, the two-step analysis of network security risk assessment shows that risk assessment and the steps of network attack are contrary. Therefore, the research on network security risk assessment is closely related to network attacks [23,24,25,26,27]. The studies assessed are closely related to cyberattacks as shown in Figure 5.

Figure 5

Security risk model.

4.5 Experimental method and process

In order to verify the performance of the network security risk detection system based on the N-gram algorithm, experiments are carried out. First, the experimental environment server of the network security risk detection system is configured based on the N-gram algorithm, including server hardware configuration and server software configuration; the hardware configuration is shown in Table 1.

The software configuration is shown in Table 2. Real network data as is taken as experimental data, and boundary value processing is performed on it to form typical experimental data. The experimental data after processing are shown in Table 3.

The experimental data are input into the network security risk detection system based on the N-gram algorithm, and the network security risk detection is performed based on the server [28]. In order to ensure the fairness and effectiveness of this experiment, the traditional network security risk detection system and the network security risk detection system based on the N-gram algorithm proposed by the author are jointly tested, comparing the packet inspection performance of various network security risk detection systems. The basis for judging the performance of data packet detection is mainly the average detection time of various types of data packets. The author selects five kinds of data packets for experiments, when the sum of the average detection time of various types of data packets is smaller; this proves that its packet detection performance is stronger. On the contrary, it proves that its packet detection performance is worse.