Multidimensional security situation real-time representation method and system and applicable to network security

A multidimensional security situation real-time presentation system applicable to network security, comprising:

• a selection module, configured to select security testing cases of at least one dimensionality based on a test instruction to generate a target test set, and generate a corresponding target log set according to the target test set;
• pre-allocate security testing cases of various types of dimensionalities, each type of the security testing cases being used for testing corresponding network security units in a network security processing system of a platform, and each of the security testing cases having a test tag corresponding thereto;
• receive quantity selection information inputted by a user, randomly select a corresponding quantity of test tags according to the quantity selection information and selection weights of the test tags, and determine corresponding security testing cases based on the test tags and generating a target test set;
• and
• determine a corresponding target test log according to the test tag of each of the security testing cases in the target test set to obtain a target log set, wherein each of the target test logs has a test tag corresponding thereto;
• a running module, configured to run each of the security testing cases in the target test set, and count monitoring event logs produced by the network security processing system of the platform to generate a monitoring log set;
• a determination module, configured to, in a case where the test events in the target log set do not correspond to the monitoring event logs in the monitoring log set, determine a difference log set according to the target log set and the monitoring log set;
• an acquisition module, configured to acquire first processing path sets corresponding to the target log set, each of the first processing path sets having a first sub-processing path corresponding to the test event log, determine a second processing path set according to the target log set and the monitoring log set, and perform screening based on the first processing path sets to obtain the second processing path set corresponding to the monitoring log set, the second processing path set comprising at least one second sub-processing path;
• acquire an initial node and a cut-off node of the second sub-processing path, and monitor behaviors of a staff based on the initial node and the cut-off node to generate a corresponding monitoring processing path;
• sequence processing nodes in the second sub-processing path according to a node sequence to obtain a sequencing result, a first sub-processing node in the sequencing result being taken as the initial node and the last processing node being taken as the cut-off node;
• select the initial node as a first type node and all nodes from a second processing node to the cut-off node as second type nodes;
• and
• perform locking processing on all the second type nodes according to a preset condition, so that all the second type nodes can be unlocked to be further triggered only after preposed nodes thereof are triggered;
• a comparison module;
• configured to acquire an initial node and a cut-off node of the second sub-processing path, monitor behaviors of a staff based on the initial node and the cut-off node to generate a corresponding monitoring processing path, compare each of the monitoring nodes in the monitoring processing path with each of the processing nodes in the second sub-processing path to obtain a test processing time period and an enhanced training node and a test processing efficiency;
• in a case where it is judged that the staff has a behavior of triggering the initial node, collect a moment at the time as a first time, and in a case where it is judged that the staff has a behavior of triggering the cut-off node, collect the moment at the time as a second time;
• determine a time period between the first time and the second time as the test processing time period;
• pre-allocate effective triggering behaviors, and after the initial node is effectively triggered, monitor all the effective triggering behaviors and generate the monitoring processing path;
• sequence all the monitoring nodes in the monitoring processing path according to a time sequence, through which the monitoring nodes are effectively triggered, to obtain a first monitoring sequencing result, wherein each of the monitoring nodes corresponds to one effective triggering behavior;
• compare each of the monitoring nodes in the first monitoring sequencing result with each of the processing nodes in the second sub-processing path, and divide the first monitoring sequencing result into a plurality of monitoring;
• sub-segments;
• and
• count the quantity of the monitoring nodes in each of the monitoring sub-segments to obtain the quantity of fault-tolerant paragraphs of the processing nodes corresponding to the monitoring sub-segment, the processing nodes with the quantity of fault-tolerant paragraphs greater than a preset quantity being taken as the enhanced training nodes;
• and
• a display module, configured to perform real-time output display of difference log events, test processing time periods, enhanced training nodes and the test processing efficiency corresponding to the difference log set.