Network shooting range data acquisition system and method

Abstract

The invention provides a network target range data acquisition system and method, and the system comprises a data control module which is used for formulating an acquisition strategy of traffic data of a network target range, analyzing the acquisition strategy, determining a physical calculation node where a traffic acquisition virtual machine is located, and transmitting the acquisition strategy to an acquisition soft probe on the physical node; each acquisition soft probe is arranged on the physical computing node, is connected with a virtual network card of the virtual machine, receives an acquisition strategy, acquires the flow of the virtual network card of the virtual machine according to the acquisition strategy, and sends the acquired flow data to the data analysis node through an independent host network card; and the data analysis node module is deployed on the physical computing node and is used for receiving and collecting the flow data sent by the soft probe and transmitting the flow data outwards.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a data collection system and method for a network shooting range. Background technique [0002] Cyber ​​shooting ranges have become an essential cyberspace security core infrastructure for countries to conduct cyberspace security research, learning, testing, verification, and drills. All countries in the world attach great importance to the construction of cyber shooting ranges and regard it as an important means of supporting security capacity building. [0003] Data acquisition and analysis is the core capability of the network range platform. The network architecture, business system, and access behavior in the shooting range are mainly realized through virtualization technology, but virtualization brings many problems to the collection of network traffic. The original applicable static mirror port collection and operation and maintenance methods It is no longer app...

AI Technical Summary

Problems solved by technology

[0006] 1. The network traffic of each virtual machine must be mirrored at least twice, the first time is at the virtual switch of the virtual machine, and the second time is at the physical switch, which increases the complexity of configuration management and increases the performance overhead of computing nodes

[0007] 2. The amount of traffic that can be mirrored is determined by the performance of the virtual switch, which has a certain impact on the stability of the virtual switch. If the number of virtual machines on the computing node is large, once the internal traffic is large, the stability of the virtual switch will be affected, which will directly lead to normal damage to business

[0008] 3. In the KVM (Keyboard Video Mouse) environment, the virtual management control node needs to uniformly issue the image flow table, which makes management and maintenance complicated

Images