1.

INTRODUCTION

Nowadays, people enjoy the great convenience brought by the network in their work, study and life, but at the same time, they are puzzled by the frequent internet safety problems. Especially, in the rapid evolution of the Internet environment, the internet safety threats and the diversification of network attack means have surpassed the launching speed of preventive measures ¹. Society is increasingly dependent on computer networks. Moreover, the security problem of computer network has become increasingly prominent, and many network systems have suffered a lot of economic losses due to security problems ². With the growth of the Internet, network attack means emerge in endlessly, and internet safety issues are becoming more and more important. Antivirus software and firewalls generate a large amount of alarm information, so network managers can’t grasp the security status of network system in the face of such massive data, and can’t take corresponding preventive measures in time ³. Evaluating the security of computer network system in advance is an effective means to prevent various internet safety problems ⁴. In recent years, some computer internet safety assessment products have appeared on the market, which have played a certain role in strengthening the security of the network system. However, most of these internet safety assessment products are limited to the detection and analysis of security vulnerabilities in the network system, lacking in-depth analysis of internet safety assessment data, making it difficult to form an overall understanding of the security of computer network systems ⁵.

Internet safety situation prediction can provide network managers with the past and current internet safety status, at the same time, it can predict the future internet safety situation and reduce the data pressure of managers, so it has become a hot topic in current internet safety research ⁶. At present, in essence, most of the internet safety assessment methods are based on security vulnerabilities, and then the corresponding assessment results and solutions are given by scanning the network for some known vulnerabilities ⁷. The disadvantage of this method is that it takes a long time, occupies a large amount of bandwidth, and interferes with the normal operation of the network. In the design of network networking, a large number of data bit sequence streams are transmitted and controlled by the network. Because of the openness of network networking and the randomness of node distribution, network communication is easily invaded, which threatens the security of the network ⁸. Accurately mastering the security level of the computer network system is of great significance to ensure the normal operation of the network system. In this paper, an intelligent network anti-risk index assessment system based on improved machine learning algorithm is proposed. The convergence of internet safety risk prediction is controlled by machine learning algorithm, and the internet safety situation is predicted by this system.

2.

METHODOLOGY

2.2

Internet safety situation prediction model

Internet safety situation prediction is a new technology to realize internet safety monitoring, which can find potential and malicious attacks and effectively reduce the harm caused by attacks. When a certain research object has a relatively large scope, a relatively complex structure and is influenced by many factors, the comprehensive performance of its state can be explained by the situation, and the battlefield situation in the military field is one of them. The main purpose of introducing the concept of situation into internet safety management is to establish a set of internet safety situation system, which requires high feasibility and accuracy, so that network managers can fully and timely understand the overall security situation of the network. On the basis of statistical analysis of network data, feature extraction analysis is carried out, and fusion clustering processing is carried out according to the feature extraction results of risk statistical distribution. The data processing platform deployment is shown in Figure 1.

Figure 1.

Deployment of data processing platform

Internet safety situation is a kind of data collected in chronological order, so it can be treated as a time series. As the input variable of the prediction model, the situation value of the previous time series is the situation value of the next time of the internet safety situation. In order to evaluate the anti-risk index of intelligent networking, it is needy to first analyze the statistical characteristics of big data transmitted by the network and the bit sequence data transmitted by the network. A multivariate statistical characteristic equation is used to describe the high-dimensional spatial storage state model of network transmission bit sequence data as follows:

Among them:

Through the discrete analysis of data, the information entropy of distribution characteristics of network transmission bit sequence data is obtained:

Network situation prediction management is weighted according to the relevant parameters of internet safety incidents, such as frequency, times, degree of threat to the network, etc., which integrates a large amount of internet safety information to obtain a situation value that can accurately reflect the running state of the network, and then combines the historical situation value and real-time situation value of the network to predict the future security development trend of the network ¹¹. The internet safety situation is collected according to the time sequence, so it can be regarded as a time series in the process of processing. The input variable of the prediction model is the situation value of the previous time series, and the situation value of the next time of the internet safety situation is taken as the output.

Internet safety assessment refers to evaluating the possible design and implementation vulnerability of the system through an assessment procedure, which is used to ensure that the network system is protected from accidental or intentional damage. Security assessment is a very valuable method for establishing internet safety information system. Internet safety assessment technology can effectively find the security defects in the system, and it is an effective and direct method to ensure the security of host system and network system to the maximum extent.

Let the probability distribution of random variable set X = {X₁,X₂,…,X_n} be P(X₁,X₂,…,X_n). If all variables are {0, 1}, 2ⁿ –1parameters are needed to determine the joint distribution. And through Bayesian formula, the joint distribution can be written as:

For ∀X_i∈X, if π(X_i)⊆{X₁,X₂,…,X_i–1} exists, the conditions of X_i assimilation {X₁, X₂,…,X_i–1}/π(X_i) are independent when π(X_i) is given, and the above formula can be changed to:

3.

RESULT ANALYSIS AND DISCUSSION

Network situation analysis system is a comprehensive system. The system mainly obtains security events and status information from some common security devices or assets, such as firewalls, intrusion detection, anti-virus, routers, servers, etc. Through data merging, cleaning, and correlation analysis, the internet safety situation values are calculated according to different security situation indicators, and the overall internet safety is evaluated. To analyze the security situation of network information system, an important part is to analyze the known weaknesses and establish the utilization rules of the weaknesses. Vulnerability rule is a description of the attacker’s attack behavior by exploiting the vulnerability from the attacker’s point of view, and it is an important basis for analyzing the possible attack path of a specific attacker. There may be many weaknesses in a network-based information system, which are distributed on different hosts. In network attacks, attackers usually make use of the weakness of the target host to gain more privileges on the attacked host, and after the attacker gains enough privileges on the target host, he can continue to attack other hosts from the captured host. The deviation curve of the main risk characteristics of networking is shown in Figure 2.

Figure 2.

Selection of risk characteristic deviation curve

Security situation assessment is mainly to analyze and calculate the related security event information and asset status information cycle to assess the overall internet safety status. The security situation system needs to perform data format conversion, data filling, information merging and other processes on the security information elements reported by the two sources to form a unified format security incident message, which is convenient for correlation analysis and security. It is the process of assessment and other processes. The model in this paper is compared with random forest (RF) model and support vector machine (SVM) model. The recall rate comparison results are shown in Figure 3. The accuracy comparison results are shown in Figure 4.

Figure 3.

Comparison of recall rates of different models

Figure 4.

Comparison of accuracy of different models

The results show that this model can get 93.7% recall and 94.5% accuracy. The results are all better than the compared models. The internet safety situation factor is the weight of the security situation index, which can be determined by the analysis of internet safety experts, or by data mining based on historical data according to the influence of the three factors on the internet safety situation. Due to the numerous products and different types of internet safety equipment, the collected raw data is rather messy. After sorting and analyzing, the information which is important to internet safety and exists in most events is screened out and formatted into a unified form, which not only ensures the normalized data expression ability, but also integrates the efficiency of data message transmission in the system. The security comparison results of different network risk prediction schemes are shown in Figure 5.

Figure 5.

Security comparison of different schemes

According to the data in Figure 5, the network risk prediction method in this paper is safe and has practical application value for the safe operation of intelligent networking. Compared with the traditional forecasting methods, this method can accurately predict the situation and accurately reflect the overall change of internet safety situation. The forecasting results are helpful to guide network administrators to take appropriate countermeasures for possible future internet safety incidents and internet safety change trends.

4.

CONCLUSIONS

Society is increasingly dependent on computer networks. Moreover, the security problem of computer network has become increasingly prominent. Internet safety situation prediction can provide network managers with the past and current internet safety status, and predict the internet safety situation in the future. In this paper, an intelligent network anti-risk index assessment system based on improved machine learning algorithm is proposed. The convergence of internet safety risk prediction is controlled by machine learning algorithm, and the internet safety situation is predicted by this system. The results show that the model can get 93.7% recall and 94.5% accuracy. The results are all better than the compared models. The proposed network risk prediction method is safe and has practical application value for the safe operation of intelligent networking. Due to the small number of internet safety samples used, the obtained decision rules can’t fully reflect the decision-making process of computer internet safety, but basically reflect the law that the larger the assessment index value, the better the security.