Network security detection method and system based on distributed gateway troubleshooting

Abstract

The invention relates to the field of network security, in particular to a network security detection method and system based on distributed gateway troubleshooting, and the method comprises the steps: sending a test message to all gateways of a distributed network, and recognizing a suspicious gateway based on the forwarding state of the gateway to the test message and the real data transmission condition; dividing the distributed network into a plurality of sub-networks based on the positions of the suspicious gateways, and performing time-sharing data sampling on all the sub-networks to obtain a plurality of data sample sets; a data transmission abnormal link in the sub-network is determined through data transmission tracing, and the troubleshooting of the gateway is reduced to be within the range of the data transmission link, so that the troubleshooting workload is reduced; based on data stream transmission loss characteristic information of all gateways subordinate to a data transmission abnormal link, a non-security gateway is checked and determined, so that data transmission link resetting is carried out on a distributed network, efficient, accurate and secure detection of the gateways and reliable adjustment of the data transmission link are realized, and normal operation of the whole network is maintained.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a network security detection method and system based on distributed gateway screening. Background Art

[0002] A large number of gateways are set up inside the distributed network, and these gateways are key nodes that constitute the data transmission links within the network. Distributed networks need to carry out massive data transmission in the daily operation process. Gateways, as transit nodes for data transmission, can ensure that data is smoothly transmitted within the corresponding data transmission links. However, in actual situations, distributed networks are affected by external factors such as intrusion, resulting in some gateways being hijacked. Once data is transmitted through the hijacked gateway, data loss or tampering will occur, and data security transmission cannot be guaranteed, which also reduces the security of the overall operation of the distributed network. In view of the large number of gateways within the distributed network and the complex connection relationship of the gateways, the existing gateway troubleshooting method cannot accurately troubleshoot gateways with security issues from within the distributed network, and cannot efficiently and accurately adjust the data transmission links within the distributed network. It can be seen that efficient and accurate gateway security detection and troubleshooting and reliable adjustment of data transmission links within the distributed network are of great significance to maintaining the normal operation of the distributed network as a whole. Summary of the invention

[0003] In view of the defects in the prior art, the present invention provides a network security detection method and system based on distributed gateway screening, which sends a test message to all gateways in the distributed network, identifies suspicious gateways based on the forwarding status of the test message and the actual data transmission of the gateway, and preliminarily screens the gateways with security problems in the distributed network; divides the distributed network into several sub-networks based on the location of the suspicious gateway, and performs time-sharing data sampling on all sub-networks to obtain several data sample sets, which provide data support for the subsequent judgment of whether a security anomaly occurs in the sub-network; also determines the abnormal data transmission link within the sub-network through data transmission tracing, narrows the screening of gateways to the range of data transmission links, and reduces the screening workload; based on the data flow transmission loss characteristic information of all gateways under the abnormal data transmission link, screens and determines the non-safe gateway, thereby resetting the data transmission link of the distributed network, realizing efficient and accurate security detection of the gateway and reliable adjustment of the data transmission link, and maintaining the normal operation of the network as a whole.

[0004] The present invention provides a network security detection method based on distributed gateway screening, comprising the following steps: Step S1, based on the bandwidth usage status of the distributed network, sending a test message to all gateways of the distributed network respectively; obtaining forwarding status information of each gateway for the test message, and judging whether the gateway is a suspicious gateway based on the forwarding status information and the real-time data transmission information of each gateway; Step S2, based on the locations of all suspicious gateways within the distributed network, the distributed network is divided into a plurality of sub-networks; based on the gateway connection characteristics of all sub-networks, time-sharing data sampling is performed on all sub-networks to obtain a plurality of data sample sets corresponding to each sub-network; Step S3, analyzing the data sample set to determine whether a security anomaly event occurs within the sub-network; tracing the data transmission within the sub-network where the security anomaly event occurs, and determining the abnormal data transmission link within the sub-network; Step S4, obtaining the data flow transmission loss characteristic information of all gateways under the abnormal data transmission link, and based on the data flow transmission loss characteristic information, checking and determining the non-safe gateways included in the abnormal data transmission link; based on the position of the non-safe gateway inside the distributed network, resetting the data transmission link of the distributed network.

[0005] In one embodiment disclosed in the present application, in the step S1, based on the bandwidth usage status of the distributed network, a test message is sent to all gateways of the distributed network respectively; forwarding status information of each gateway for the test message is obtained, and based on the forwarding status information and the data transmission live information of each gateway, whether the gateway is a suspicious gateway is determined, including: Determine the message transmission data volume that all active data transmission links can bear based on the available bandwidth of each of all data transmission active links within the distributed network; construct a test message with a periodic code distribution feature based on the message transmission data volume, and send the test message to all gateways of the distributed network respectively; Monitor the forwarding process of each gateway after receiving the test message, and obtain the forwarding status information of each gateway for the test message; wherein the forwarding status information includes the forwarding progress status information of all message subpackets after the test message is decomposed into a plurality of message subpackets with the same code content at the gateway; Based on the forwarding status information and the transmission live process information corresponding to the queue of data packets to be transmitted of each gateway, it is determined whether the gateway delays forwarding the message packet; if so, it is determined that the gateway is a suspicious gateway; if not, it is determined that the gateway is not a suspicious gateway.

[0006] In one embodiment disclosed in the present application, in step S2, the distributed network is divided into several sub-networks based on the locations of all suspicious gateways within the distributed network; based on the gateway connection characteristics of all sub-networks, time-sharing data sampling is performed on all sub-networks to obtain several data sample sets corresponding to each sub-network, including: Based on the locations of all suspicious gateways within the distributed network, cluster analysis is performed on all suspicious gateways to estimate the probability of data interaction between any two suspicious gateways, thereby dividing all suspicious gateways into a number of gateway clusters; and based on the coverage of all gateway clusters within the distributed network, the distributed network is divided into a number of sub-networks; Based on the number and bandwidth of gateway external links of all subnetworks, estimate the external data transmission flow rate of all subnetworks; based on the external data transmission flow rate, determine the length of time occupied by data extraction of each subnetwork during the time-sharing data sampling process of all subnetworks, so as to obtain several data sample sets corresponding to all subnetworks one by one.

[0007] In one embodiment disclosed in the present application, in step S3, the data sample set is analyzed to determine whether a security anomaly event occurs inside the subnetwork; data transmission inside the subnetwork where the security anomaly event occurs is traced to determine an abnormal data transmission link inside the subnetwork, including: Performing a neural network model analysis on the data sample set to determine whether data packets corresponding to the data sample set have data omissions or illegal data tampering during transmission within the subnetwork; if so, determining that a security anomaly has occurred within the subnetwork; if not, determining that no security anomaly has occurred within the subnetwork; Obtain the transmission path label of the data packet in which data omission or illegal data tampering occurs within the subnet where the security anomaly event occurs, and based on the transmission path label, trace the data transmission of the subnet where the security anomaly event occurs to determine the abnormal data transmission link within the subnet.

[0008] In one embodiment disclosed in the present application, in the step S4, data flow transmission loss characteristic information of all gateways under the abnormal data transmission link is obtained, and based on the data flow transmission loss characteristic information, the non-secure gateway included in the abnormal data transmission link is checked and determined; based on the position of the non-secure gateway inside the distributed network, the data transmission link of the distributed network is reset, including: Compare the changes in the feature code positions of the data packets received by all gateways under the abnormal data transmission link to determine the data code loss amount of all gateways when receiving the same data packet; based on the data code loss amount of all gateways, determine the data stream transmission loss feature information of all gateways; wherein the data stream transmission loss feature information includes the data stream transmission loss ratio of each gateway and the data stream interval where the transmission loss occurs; Based on the data stream transmission loss characteristic information, determine the probability of occurrence of data stream transmission errors for all gateways under the data transmission abnormality link; based on the probability of occurrence of data stream transmission errors, identify the non-secure gateways included in the data transmission abnormality link; based on the position of the non-secure gateway inside the distributed network, determine the shortest data transmission link that bypasses the non-secure gateway to maintain the current normal data transmission operation, thereby resetting the data transmission link of the distributed network.

[0009] The present invention also provides a network security detection system based on distributed gateway troubleshooting, comprising: A test message sending module, used for sending test messages to all gateways of the distributed network respectively based on the bandwidth usage status of the distributed network; A suspicious gateway identification module, used to obtain the forwarding status information of each gateway for the test message, and determine whether the gateway is a suspicious gateway based on the forwarding status information and the actual data transmission information of each gateway; A sub-network division module, configured to divide the distributed network into a plurality of sub-networks based on the locations of all suspicious gateways within the distributed network; The data time-sharing sampling module is used to perform time-sharing data sampling on all sub-networks based on the gateway connection characteristics of all sub-networks, and obtain a number of data sample sets corresponding to each sub-network; A security abnormal event judgment module, used to analyze the data sample set to determine whether a security abnormal event occurs within the sub-network; A data transmission abnormal link determination module is used to trace the data transmission inside the sub-network where the security abnormality event occurs, and determine the data transmission abnormal link inside the sub-network; A non-secure gateway identification module is used to obtain data flow transmission loss characteristic information of all gateways under the abnormal data transmission link, and based on the data flow transmission loss characteristic information, identify the non-secure gateways included in the abnormal data transmission link; The data transmission link resetting module is used to reset the data transmission link of the distributed network based on the position of the non-secure gateway inside the distributed network.

[0010] In one embodiment disclosed in the present application, the test message sending module is used to send test messages to all gateways of the distributed network respectively based on the bandwidth usage status of the distributed network, including: Determine the message transmission data volume that all active data transmission links can bear based on the available bandwidth of each of all data transmission active links within the distributed network; construct a test message with a periodic code distribution feature based on the message transmission data volume, and send the test message to all gateways of the distributed network respectively; The suspicious gateway identification module is used to obtain the forwarding status information of each gateway for the test message, and judge whether the gateway is a suspicious gateway based on the forwarding status information and the data transmission real-time information of each gateway, including: Monitor the forwarding process of each gateway after receiving the test message, and obtain the forwarding status information of each gateway for the test message; wherein the forwarding status information includes the forwarding progress status information of all message subpackets after the test message is decomposed into a plurality of message subpackets with the same code content at the gateway; Based on the forwarding status information and the transmission live process information corresponding to the queue of data packets to be transmitted of each gateway, it is determined whether the gateway delays forwarding the message packet; if so, it is determined that the gateway is a suspicious gateway; if not, it is determined that the gateway is not a suspicious gateway.

[0011] In one embodiment disclosed in the present application, the subnetwork division module is used to divide the distributed network into several subnetworks based on the locations of all suspicious gateways within the distributed network, including: Based on the locations of all suspicious gateways within the distributed network, cluster analysis is performed on all suspicious gateways to estimate the probability of data interaction between any two suspicious gateways, thereby dividing all suspicious gateways into a number of gateway clusters; and based on the coverage of all gateway clusters within the distributed network, the distributed network is divided into a number of sub-networks; The data time-sharing sampling module is used to perform time-sharing data sampling on all sub-networks based on the gateway connection characteristics of all sub-networks to obtain a number of data sample sets corresponding to each sub-network, including: Based on the number and bandwidth of gateway external links of all subnetworks, estimate the external data transmission flow rate of all subnetworks; based on the external data transmission flow rate, determine the length of time occupied by data extraction of each subnetwork during the time-sharing data sampling process of all subnetworks, so as to obtain several data sample sets corresponding to all subnetworks one by one.

[0012] In one embodiment disclosed in the present application, the security abnormal event judgment module is used to analyze the data sample set to determine whether a security abnormal event occurs inside the sub-network, including: Performing a neural network model analysis on the data sample set to determine whether data packets corresponding to the data sample set have data omissions or illegal data tampering during transmission within the subnetwork; if so, determining that a security anomaly has occurred within the subnetwork; if not, determining that no security anomaly has occurred within the subnetwork; The abnormal data transmission link determination module is used to trace the data transmission inside the sub-network where the abnormal security event occurs, and determine the abnormal data transmission link inside the sub-network, including: Obtain the transmission path label of the data packet in which data omission or illegal data tampering occurs within the subnet where the security anomaly event occurs, and based on the transmission path label, trace the data transmission of the subnet where the security anomaly event occurs to determine the abnormal data transmission link within the subnet.

[0013] In one embodiment disclosed in the present application, the non-secure gateway identification module is used to obtain data flow transmission loss characteristic information of all gateways under the abnormal data transmission link, and based on the data flow transmission loss characteristic information, to identify the non-secure gateways included in the abnormal data transmission link, including: Compare the changes in the feature code positions of the data packets received by all gateways under the abnormal data transmission link to determine the data code loss amount of all gateways when receiving the same data packet; based on the data code loss amount of all gateways, determine the data stream transmission loss feature information of all gateways; wherein the data stream transmission loss feature information includes the data stream transmission loss ratio of each gateway and the data stream interval where the transmission loss occurs; Based on the data stream transmission loss characteristic information, determine the probability of occurrence of data stream transmission error time for all gateways under the abnormal data transmission link; based on the probability of occurrence of data stream transmission error time, check and determine the non-secure gateways included in the abnormal data transmission link; The data transmission link resetting module is used to reset the data transmission link of the distributed network based on the position of the non-secure gateway inside the distributed network, including: Based on the position of the non-secure gateway inside the distributed network, the shortest data transmission link that bypasses the non-secure gateway to maintain the current normal data transmission operation is determined, thereby resetting the data transmission link of the distributed network.

[0014] Compared with the prior art, the network security detection method and system based on distributed gateway screening sends test messages to all gateways of the distributed network, identifies suspicious gateways based on the forwarding status of the test messages and the actual data transmission of the gateways, and preliminarily screens gateways with security problems within the distributed network; divides the distributed network into several sub-networks based on the locations of the suspicious gateways, and performs time-sharing data sampling on all sub-networks to obtain several data sample sets, providing data support for subsequent judgment on whether security anomalies occur in the sub-networks; also determines the abnormal data transmission links within the sub-networks through data transmission tracing, narrows the screening of gateways to the range of data transmission links, and reduces the screening workload; based on the data flow transmission loss characteristic information of all gateways under the abnormal data transmission links, screens and determines non-secure gateways, thereby resetting the data transmission links of the distributed network, achieving efficient and accurate security detection of gateways and reliable adjustment of data transmission links, and maintaining the normal operation of the network as a whole.

[0015] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings.

[0016] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 A schematic diagram of the process of a network security detection method based on distributed gateway troubleshooting provided by the present invention; Figure 2 A schematic diagram of the framework of a network security detection system based on distributed gateway troubleshooting provided by the present invention. DETAILED DESCRIPTION

[0019] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0020] See also Figure 1 , is a flow chart of a network security detection method based on distributed gateway screening provided by an embodiment of the present invention. The network security detection method based on distributed gateway screening includes: Step S1, based on the bandwidth usage status of the distributed network, send a test message to all gateways of the distributed network respectively; obtain the forwarding status information of each gateway for the test message, and determine whether the gateway is a suspicious gateway based on the forwarding status information and the actual data transmission information of each gateway; Step S2, based on the locations of all suspicious gateways within the distributed network, the distributed network is divided into several sub-networks; based on the gateway connection characteristics of all sub-networks, time-sharing data sampling is performed on all sub-networks to obtain several data sample sets corresponding to each sub-network; Step S3, analyzing the data sample set to determine whether a security anomaly event occurs within the sub-network; tracing the data transmission within the sub-network where the security anomaly event occurs, and determining the abnormal data transmission link within the sub-network; Step S4, obtaining the data flow transmission loss characteristic information of all gateways under the abnormal data transmission link, and based on the data flow transmission loss characteristic information, checking and determining the non-secure gateways included in the abnormal data transmission link; based on the position of the non-secure gateway inside the distributed network, resetting the data transmission link of the distributed network.

[0021] The network security detection method based on distributed gateway screening sends test messages to all gateways of the distributed network, identifies suspicious gateways based on the forwarding status of the test messages and the actual data transmission of the gateways, and preliminarily screens gateways with security problems in the distributed network; divides the distributed network into several sub-networks based on the locations of the suspicious gateways, and performs time-sharing data sampling on all sub-networks to obtain several data sample sets, which provide data support for subsequent judgment on whether security anomalies occur in the sub-networks; also determines the abnormal data transmission links within the sub-networks through data transmission tracing, narrows the screening of gateways to the range of data transmission links, and reduces the screening workload; based on the data flow transmission loss feature information of all gateways under the abnormal data transmission links, screens and determines non-secure gateways, thereby resetting the data transmission links of the distributed network, achieving efficient and accurate security detection of gateways and reliable adjustment of data transmission links, and maintaining the normal operation of the network as a whole.

[0022] Preferably, in step S1, based on the bandwidth usage status of the distributed network, a test message is sent to all gateways of the distributed network respectively; forwarding status information of each gateway for the test message is obtained, and based on the forwarding status information and the data transmission live information of each gateway, whether the gateway is a suspicious gateway is determined, including: Based on the available bandwidth of all active data transmission links within the distributed network, determine the message transmission data volume that all active data transmission links can bear; based on the message transmission data volume, construct a test message with periodic code distribution characteristics, and send the test message to all gateways of the distributed network respectively; Monitor the forwarding process of each gateway after receiving the test message, and obtain the forwarding status information of the test message by each gateway; wherein the forwarding status information includes the forwarding progress status information of all message subpackets after the test message is decomposed into a plurality of message subpackets with the same code content at the gateway; Based on the forwarding status information and the transmission live process information corresponding to the queue of data packets to be transmitted of each gateway, it is determined whether the gateway delays forwarding the message packet; if so, it is determined that the gateway is a suspicious gateway; if not, it is determined that the gateway is not a suspicious gateway.

[0023] In the above technical solution, a large number of gateways are arranged inside the distributed network, and each gateway can serve as a data transmission node of the corresponding data transmission link inside the distributed network, so that the data transit transmission performance of the gateway itself directly affects the overall data transmission performance of the data transmission link where it is located. In view of the huge number of gateways inside the distributed network, if all gateways are checked one by one, it will not only cost a lot of manpower and material resources and the checking efficiency will be low, but also the normal data transmission operation of the corresponding data transmission link during the checking process cannot be guaranteed. For this reason, by sending a test message to all gateways, the forwarding situation of the test message by each gateway after receiving the test message is obtained, so as to make a preliminary judgment on the data transmission performance of each gateway. Specifically, the available bandwidth of each of the active data transmission links inside the distributed network is obtained, and the active data transmission link can be but not limited to the data transmission link that continuously performs data transmission operations within a preset time interval, and the available bandwidth can be but not limited to the remaining available bandwidth value of the active data transmission link; the minimum available bandwidth of each of the available bandwidths of all active data transmission links is determined, and based on the minimum available bandwidth, the message transmission data volume that all active data transmission links can bear is determined, wherein the message transmission data volume matches the minimum available bandwidth. Based on the data volume transmitted by the message, a test message with periodic code distribution characteristics is constructed, so that the data volume of the test message is less than or equal to the data volume transmitted by the message, and the code content is periodic. This ensures that the test message is quickly transmitted to each gateway within the distributed network and facilitates identification of the test message from the code content level.

[0024] When each gateway receives the test message, it will forward the test message according to the preset transmission target address of the test message. Each gateway forwards the test message by decomposing the test message into several message packets and forming a message packet queue, so as to forward all the message packets in the message packet queue in sequence. If there is a security problem with the gateway, the gateway will delay the forwarding of all message packets under the message packet queue, and it cannot be guaranteed that all message packets can be forwarded within the specified time. Therefore, by monitoring the forwarding process of each gateway after receiving the test message, the forwarding status information of each gateway for the test message is obtained, and the forwarding status information is compared with the transmission live process information corresponding to the queue of data packets to be transmitted of each gateway to determine the time difference between the two. If the time difference is greater than the preset difference threshold, it is determined that the gateway forwards the message packet with a delay, and the gateway is determined to be a suspicious gateway; otherwise, it is determined that the gateway forwards the message packet without delay, which is convenient for further investigation of suspicious gateways in the future, and improves the efficiency of investigation and detection of gateways inside the distributed network.

[0025] Preferably, in step S2, based on the positions of all suspicious gateways in the distributed network, the distributed network is divided into several sub-networks; based on the gateway connection characteristics of all sub-networks, time-sharing data sampling is performed on all sub-networks to obtain several data sample sets corresponding to each sub-network, including: Based on the locations of all suspicious gateways in the distributed network, cluster analysis is performed on all suspicious gateways to estimate the probability of data interaction between any two suspicious gateways, so as to divide all suspicious gateways into several gateway clusters; based on the coverage of all gateway clusters in the distributed network, the distributed network is divided into several sub-networks; Based on the number and bandwidth of external links of the gateways of all subnetworks, the data transmission flow rate of all subnetworks is estimated; based on the data transmission flow rate, the length of time occupied by data extraction of each subnetwork in the process of time-sharing data sampling of all subnetworks is determined, so as to obtain several data sample sets corresponding to all subnetworks one by one.

[0026] In the above technical solution, the suspicious gateway will have an adverse impact on the data transmission of other gateways within the adjacent network range centered on itself, making it possible for other gateways to be invaded or hijacked and cause security problems. In order to conduct a comprehensive gateway inspection of the distributed network, all suspicious gateways are clustered and analyzed based on their positions within the distributed network, and the probability of data interaction between any two suspicious gateways is estimated, wherein the cluster analysis can be implemented through a deep neural network model, which is not described in detail here. If the probability of data interaction between two suspicious gateways exceeds the preset probability threshold, the corresponding two suspicious gateways are divided into the same gateway cluster. Based on the coverage of all gateway clusters within the distributed network, the distributed network is divided into several subnetworks, so that each gateway cluster uniquely corresponds to a subnetwork. In addition, based on the number and bandwidth of the external links of all subnetworks, the external data transmission flow rate of all subnetworks is estimated, wherein the external data transmission flow rate refers to the total flow rate of data transmission from the gateways under the subnetwork to the gateways outside the subnetwork. The greater the rate of external data transmission of the sub-network, the longer the time taken for data extraction of the sub-network during the time-sharing data sampling of all sub-networks. This ensures balanced and equal data sampling of all sub-networks, so that the collected data sample set can accurately and comprehensively reflect the data forwarding status of the corresponding sub-network, providing a sufficient and reliable data basis for the subsequent identification of abnormal security events within the sub-network.

[0027] Preferably, in step S3, the data sample set is analyzed to determine whether a security anomaly event occurs in the sub-network; data transmission is traced in the sub-network where the security anomaly event occurs to determine the abnormal data transmission link in the sub-network, including: Performing a neural network model analysis on the data sample set to determine whether there is data omission or illegal data tampering during the transmission of the data packet corresponding to the data sample set within the sub-network; if so, determining that a security anomaly has occurred within the sub-network; if not, determining that no security anomaly has occurred within the sub-network; Obtain the transmission path label of the data packet in which data omission or illegal data tampering occurs within the subnet where the security anomaly event occurs. Based on the transmission path label, trace the data transmission of the subnet where the security anomaly event occurs to determine the abnormal data transmission link within the subnet.

[0028] In the above technical scheme, a convolutional neural network model is used to learn and analyze the data sample set to determine whether there is data omission or illegal data tampering during the transmission of the data packet corresponding to the data sample set within the sub-network, and to accurately judge the data transmission security within the sub-network. In addition, the transmission path label of the data packet with data omission or illegal data tampering within the sub-network where the security anomaly occurs is obtained. The transmission path label refers to the path address label of the data transmission link passed by the data packet with data omission or illegal data tampering within the sub-network; and based on the transmission path label, the data transmission of the sub-network where the security anomaly occurs is traced, and the abnormal data transmission link within the sub-network is determined, thereby narrowing the gateway security inspection and detection of the distributed network to the gateway security inspection of the abnormal data transmission link, greatly reducing the scope of the gateway security inspection and reducing the workload of the gateway security inspection.

[0029] Preferably, in step S4, the data flow transmission loss characteristic information of all gateways under the abnormal data transmission link is obtained, and based on the data flow transmission loss characteristic information, the non-secure gateway included in the abnormal data transmission link is checked and determined; based on the position of the non-secure gateway in the distributed network, the data transmission link of the distributed network is reset, including: Compare the changes in the characteristic code positions of the data packets received by all gateways under the abnormal data transmission link to determine the data code loss amount of all gateways when receiving the same data packet; based on the data code loss amount of all gateways, determine the data stream transmission loss characteristic information of all gateways; wherein the data stream transmission loss characteristic information includes the data stream transmission loss ratio of each gateway and the data stream interval where the transmission loss occurs; Based on the data stream transmission loss characteristic information, determine the probability of occurrence of data stream transmission errors for all gateways under the data transmission abnormality link; based on the probability of occurrence of data stream transmission errors, identify the non-secure gateways included in the data transmission abnormality link; based on the position of the non-secure gateway inside the distributed network, determine the shortest data transmission link that bypasses the non-secure gateway to maintain the current normal data transmission operation, thereby resetting the data transmission link of the distributed network.

[0030] In the above technical scheme, the data packets received by all gateways under the abnormal data transmission link are compared for changes in the feature code positions. If the abnormal data transmission link contains a non-safe gateway, the data packet will be partially lost after being transferred by the non-safe gateway, so the feature code position inside the data packet will also change accordingly. The greater the change in the feature code position inside the data packet, the more data code content the data packet has lost. Therefore, the data packets received by all gateways under the abnormal data transmission link are compared for changes in the feature code positions, and the amount of data code loss when all gateways receive the same data packet is determined, so as to determine the data flow transmission loss ratio of each gateway and the data flow interval where the transmission loss occurs, thereby quantitatively identifying the data loss of each gateway during the data transfer transmission process. In addition, based on the data flow transmission loss feature information, the probability of occurrence of data flow transmission error time for all gateways under the abnormal data transmission link is determined. The probability of occurrence of data flow transmission error time refers to the probability of each gateway failing to completely transfer and send the data flow within the specified time range during the data flow transmission process. If the probability of occurrence of data flow transmission error time exceeds the preset probability threshold, the corresponding gateway is determined as a non-safe gateway. Based on the location of the non-secure gateway within the distributed network, the shortest data transmission link that bypasses the non-secure gateway to maintain the current normal data transmission operation is determined, so that the data transmission link of the distributed network is reset, and reliable adjustment of the data transmission link within the distributed network is achieved to maintain the normal operation of the entire network.

[0031] See also Figure 2 , is a schematic diagram of a network security detection system based on distributed gateway troubleshooting provided by an embodiment of the present invention. The network security detection system based on distributed gateway troubleshooting includes: A test message sending module, used for sending test messages to all gateways of the distributed network respectively based on the bandwidth usage status of the distributed network; A suspicious gateway identification module is used to obtain the forwarding status information of each gateway for the test message, and determine whether the gateway is a suspicious gateway based on the forwarding status information and the actual data transmission information of each gateway; A sub-network partitioning module, configured to partition the distributed network into a plurality of sub-networks based on the locations of all suspicious gateways within the distributed network; The data time-sharing sampling module is used to perform time-sharing data sampling on all sub-networks based on the gateway connection characteristics of all sub-networks, and obtain a number of data sample sets corresponding to each sub-network; A security abnormal event judgment module is used to analyze the data sample set to determine whether a security abnormal event occurs within the sub-network; The abnormal data transmission link determination module is used to trace the data transmission inside the sub-network where the abnormal security event occurs, and determine the abnormal data transmission link inside the sub-network; The non-secure gateway identification module is used to obtain the data flow transmission loss characteristic information of all gateways under the abnormal data transmission link, and based on the data flow transmission loss characteristic information, identify the non-secure gateways included in the abnormal data transmission link; The data transmission link resetting module is used to reset the data transmission link of the distributed network based on the position of the non-secure gateway inside the distributed network.

[0032] The network security detection system based on distributed gateway screening sends test messages to all gateways in the distributed network, identifies suspicious gateways based on the gateway's forwarding status of the test messages and the actual data transmission situation, and preliminarily screens gateways with security issues within the distributed network; divides the distributed network into several sub-networks based on the location of the suspicious gateways, and performs time-sharing data sampling on all sub-networks to obtain several data sample sets, providing data support for subsequent judgment on whether security anomalies occur in the sub-networks; also determines the abnormal data transmission links within the sub-networks through data transmission tracing, narrows the screening of gateways to the scope of data transmission links, and reduces the screening workload; based on the data flow transmission loss characteristic information of all gateways under the abnormal data transmission link, screens and determines non-secure gateways, thereby resetting the data transmission link of the distributed network, achieving efficient and accurate security detection of gateways and reliable adjustment of data transmission links, and maintaining the normal operation of the network as a whole.

[0033] Preferably, the test message sending module is used to send test messages to all gateways of the distributed network respectively based on the bandwidth usage status of the distributed network, including: Based on the available bandwidth of all active data transmission links within the distributed network, determine the message transmission data volume that all active data transmission links can bear; based on the message transmission data volume, construct a test message with periodic code distribution characteristics, and send the test message to all gateways of the distributed network respectively; The suspicious gateway identification module is used to obtain the forwarding status information of each gateway for the test message, and judge whether the gateway is a suspicious gateway based on the forwarding status information and the actual data transmission information of each gateway, including: Monitor the forwarding process of each gateway after receiving the test message, and obtain the forwarding status information of the test message by each gateway; wherein the forwarding status information includes the forwarding progress status information of all message subpackets after the test message is decomposed into a plurality of message subpackets with the same code content at the gateway; Based on the forwarding status information and the transmission live process information corresponding to the queue of data packets to be transmitted of each gateway, it is determined whether the gateway delays forwarding the message packet; if so, it is determined that the gateway is a suspicious gateway; if not, it is determined that the gateway is not a suspicious gateway.

[0034] In the above technical solution, a large number of gateways are arranged inside the distributed network, and each gateway can serve as a data transmission node of the corresponding data transmission link inside the distributed network, so that the data transit transmission performance of the gateway itself directly affects the overall data transmission performance of the data transmission link where it is located. In view of the huge number of gateways inside the distributed network, if all gateways are checked one by one, it will not only cost a lot of manpower and material resources and the checking efficiency will be low, but also the normal data transmission operation of the corresponding data transmission link during the checking process cannot be guaranteed. For this reason, by sending a test message to all gateways, the forwarding situation of the test message by each gateway after receiving the test message is obtained, so as to make a preliminary judgment on the data transmission performance of each gateway. Specifically, the available bandwidth of each of the active data transmission links inside the distributed network is obtained, and the active data transmission link can be but not limited to the data transmission link that continuously performs data transmission operations within a preset time interval, and the available bandwidth can be but not limited to the remaining available bandwidth value of the active data transmission link; the minimum available bandwidth of each of the available bandwidths of all active data transmission links is determined, and based on the minimum available bandwidth, the message transmission data volume that all active data transmission links can bear is determined, wherein the message transmission data volume matches the minimum available bandwidth. Based on the data volume transmitted by the message, a test message with periodic code distribution characteristics is constructed, so that the data volume of the test message is less than or equal to the data volume transmitted by the message, and the code content is periodic. This ensures that the test message is quickly transmitted to each gateway within the distributed network and facilitates identification of the test message from the code content level.

[0035] When each gateway receives the test message, it will forward the test message according to the preset transmission target address of the test message. Each gateway forwards the test message by decomposing the test message into several message packets and forming a message packet queue, so as to forward all the message packets in the message packet queue in sequence. If there is a security problem with the gateway, the gateway will delay the forwarding of all message packets under the message packet queue, and it cannot be guaranteed that all message packets can be forwarded within the specified time. Therefore, by monitoring the forwarding process of each gateway after receiving the test message, the forwarding status information of each gateway for the test message is obtained, and the forwarding status information is compared with the transmission live process information corresponding to the queue of data packets to be transmitted of each gateway to determine the time difference between the two. If the time difference is greater than the preset difference threshold, it is determined that the gateway forwards the message packet with a delay, and the gateway is determined to be a suspicious gateway; otherwise, it is determined that the gateway forwards the message packet without delay, which is convenient for further investigation of suspicious gateways in the future, and improves the efficiency of investigation and detection of gateways inside the distributed network.

[0036] Preferably, the subnetwork division module is used to divide the distributed network into a plurality of subnetworks based on the locations of all suspicious gateways within the distributed network, including: Based on the locations of all suspicious gateways in the distributed network, cluster analysis is performed on all suspicious gateways to estimate the probability of data interaction between any two suspicious gateways, so as to divide all suspicious gateways into several gateway clusters; based on the coverage of all gateway clusters in the distributed network, the distributed network is divided into several sub-networks; The data time-sharing sampling module is used to perform time-sharing data sampling on all sub-networks based on the gateway connection characteristics of all sub-networks, and obtain several data sample sets corresponding to each sub-network, including: Based on the number and bandwidth of external links of the gateways of all subnetworks, the data transmission flow rate of all subnetworks is estimated; based on the data transmission flow rate, the length of time occupied by data extraction of each subnetwork in the process of time-sharing data sampling of all subnetworks is determined, so as to obtain several data sample sets corresponding to all subnetworks one by one.

[0037] In the above technical solution, the suspicious gateway will have an adverse impact on the data transmission of other gateways within the adjacent network range centered on itself, making it possible for other gateways to be invaded or hijacked and cause security problems. In order to conduct a comprehensive gateway inspection of the distributed network, all suspicious gateways are clustered and analyzed based on their positions within the distributed network, and the probability of data interaction between any two suspicious gateways is estimated, wherein the cluster analysis can be implemented through a deep neural network model, which is not described in detail here. If the probability of data interaction between two suspicious gateways exceeds the preset probability threshold, the corresponding two suspicious gateways are divided into the same gateway cluster. Based on the coverage of all gateway clusters within the distributed network, the distributed network is divided into several subnetworks, so that each gateway cluster uniquely corresponds to a subnetwork. In addition, based on the number and bandwidth of the external links of all subnetworks, the external data transmission flow rate of all subnetworks is estimated, wherein the external data transmission flow rate refers to the total flow rate of data transmission from the gateways under the subnetwork to the gateways outside the subnetwork. The greater the rate of external data transmission of the sub-network, the longer the time taken for data extraction of the sub-network during the time-sharing data sampling of all sub-networks. This ensures balanced and equal data sampling of all sub-networks, so that the collected data sample set can accurately and comprehensively reflect the data forwarding status of the corresponding sub-network, providing a sufficient and reliable data basis for the subsequent identification of abnormal security events within the sub-network.

[0038] Preferably, the security abnormal event judgment module is used to analyze the data sample set to determine whether a security abnormal event occurs within the sub-network, including: Performing a neural network model analysis on the data sample set to determine whether there is data omission or illegal data tampering during the transmission of the data packet corresponding to the data sample set within the sub-network; if so, determining that a security anomaly has occurred within the sub-network; if not, determining that no security anomaly has occurred within the sub-network; The abnormal data transmission link determination module is used to trace the data transmission inside the sub-network where the abnormal security event occurs, and determine the abnormal data transmission link inside the sub-network, including: Obtain the transmission path label of the data packet in which data omission or illegal data tampering occurs within the subnet where the security anomaly event occurs. Based on the transmission path label, trace the data transmission of the subnet where the security anomaly event occurs to determine the abnormal data transmission link within the subnet.

[0039] In the above technical scheme, a convolutional neural network model is used to learn and analyze the data sample set to determine whether there is data omission or illegal data tampering during the transmission of the data packet corresponding to the data sample set within the sub-network, and to accurately judge the data transmission security within the sub-network. In addition, the transmission path label of the data packet with data omission or illegal data tampering within the sub-network where the security anomaly occurs is obtained. The transmission path label refers to the path address label of the data transmission link passed by the data packet with data omission or illegal data tampering within the sub-network; and based on the transmission path label, the data transmission of the sub-network where the security anomaly occurs is traced, and the abnormal data transmission link within the sub-network is determined, thereby narrowing the gateway security inspection and detection of the distributed network to the gateway security inspection of the abnormal data transmission link, greatly reducing the scope of the gateway security inspection and reducing the workload of the gateway security inspection.

[0040] Preferably, the non-secure gateway identification module is used to obtain data flow transmission loss characteristic information of all gateways under the abnormal data transmission link, and based on the data flow transmission loss characteristic information, to identify the non-secure gateways included in the abnormal data transmission link, including: Compare the changes in the characteristic code positions of the data packets received by all gateways under the abnormal data transmission link to determine the data code loss amount of all gateways when receiving the same data packet; based on the data code loss amount of all gateways, determine the data stream transmission loss characteristic information of all gateways; wherein the data stream transmission loss characteristic information includes the data stream transmission loss ratio of each gateway and the data stream interval where the transmission loss occurs; Based on the data stream transmission loss characteristic information, determine the probability of occurrence of data stream transmission error time for all gateways under the abnormal data transmission link; based on the probability of occurrence of data stream transmission error time, check and determine the non-secure gateways included in the abnormal data transmission link; The data transmission link resetting module is used to reset the data transmission link of the distributed network based on the position of the non-secure gateway inside the distributed network, including: Based on the position of the non-secure gateway inside the distributed network, the shortest data transmission link that bypasses the non-secure gateway to maintain the current normal data transmission operation is determined, thereby resetting the data transmission link of the distributed network.

[0041] In the above technical scheme, the data packets received by all gateways under the abnormal data transmission link are compared for changes in the feature code positions. If the abnormal data transmission link contains a non-safe gateway, the data packet will be partially lost after being transferred by the non-safe gateway, so the feature code position inside the data packet will also change accordingly. The greater the change in the feature code position inside the data packet, the more data code content the data packet has lost. Therefore, the data packets received by all gateways under the abnormal data transmission link are compared for changes in the feature code positions, and the amount of data code loss when all gateways receive the same data packet is determined, so as to determine the data flow transmission loss ratio of each gateway and the data flow interval where the transmission loss occurs, thereby quantitatively identifying the data loss of each gateway during the data transfer transmission process. In addition, based on the data flow transmission loss feature information, the probability of occurrence of data flow transmission error time for all gateways under the abnormal data transmission link is determined. The probability of occurrence of data flow transmission error time refers to the probability of each gateway failing to completely transfer and send the data flow within the specified time range during the data flow transmission process. If the probability of occurrence of data flow transmission error time exceeds the preset probability threshold, the corresponding gateway is determined as a non-safe gateway. Based on the location of the non-secure gateway within the distributed network, the shortest data transmission link that bypasses the non-secure gateway to maintain the current normal data transmission operation is determined, so that the data transmission link of the distributed network is reset, and reliable adjustment of the data transmission link within the distributed network is achieved to maintain the normal operation of the entire network.

[0042] It can be seen from the contents of the above embodiments that the network security detection method and system based on distributed gateway screening sends test messages to all gateways of the distributed network, identifies suspicious gateways based on the forwarding status of the test messages and the actual data transmission status of the gateways, and preliminarily screens the gateways with security problems within the distributed network; based on the location of the suspicious gateways, the distributed network is divided into several sub-networks, and time-sharing data sampling is performed on all sub-networks to obtain several data sample sets, which provide data support for the subsequent judgment of whether security abnormalities occur in the sub-networks; through data transmission tracing, the abnormal data transmission link within the sub-network is determined, and the screening of gateways is narrowed to the range of the data transmission link, reducing the workload of the screening; based on the data flow transmission loss characteristic information of all gateways under the abnormal data transmission link, the non-secure gateway is screened and determined, so as to reset the data transmission link of the distributed network, realize efficient and accurate security detection of the gateway and reliable adjustment of the data transmission link, and maintain the normal operation of the network as a whole.

[0043] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A network security detection method based on distributed gateway screening, characterized in that: It includes the following steps: Step S1, based on the bandwidth usage status of the distributed network, sending a test message to all gateways of the distributed network respectively; obtaining forwarding status information of each gateway for the test message, and judging whether the gateway is a suspicious gateway based on the forwarding status information and the real-time data transmission information of each gateway; Step S2, based on the locations of all suspicious gateways within the distributed network, the distributed network is divided into a plurality of sub-networks; based on the gateway connection characteristics of all sub-networks, time-sharing data sampling is performed on all sub-networks to obtain a plurality of data sample sets corresponding to each sub-network; Step S3, analyzing the data sample set to determine whether a security anomaly occurs within the sub-network; Tracing the data transmission inside the sub-network where the abnormal security event occurred, and determining the abnormal data transmission link inside the sub-network; Step S4, obtaining the data flow transmission loss characteristic information of all gateways under the abnormal data transmission link, and based on the data flow transmission loss characteristic information, checking and determining the non-safe gateways included in the abnormal data transmission link; based on the position of the non-safe gateway inside the distributed network, resetting the data transmission link of the distributed network.

2. The network security detection method based on distributed gateway screening as claimed in claim 1 is characterized in that: In the step S1, based on the bandwidth usage status of the distributed network, a test message is sent to all gateways of the distributed network respectively; forwarding status information of each gateway for the test message is obtained, and based on the forwarding status information and the data transmission live information of each gateway, whether the gateway is a suspicious gateway is determined, including: Determine the message transmission data volume that all active data transmission links can bear based on the available bandwidth of each of all data transmission active links within the distributed network; construct a test message with a periodic code distribution feature based on the message transmission data volume, and send the test message to all gateways of the distributed network respectively; Monitor the forwarding process of each gateway after receiving the test message, and obtain the forwarding status information of each gateway for the test message; wherein the forwarding status information includes the forwarding progress status information of all message subpackets after the test message is decomposed into a plurality of message subpackets with the same code content at the gateway; Based on the forwarding status information and the transmission live process information corresponding to the queue of data packets to be transmitted of each gateway, it is determined whether the gateway delays forwarding the message packet; if so, it is determined that the gateway is a suspicious gateway; if not, it is determined that the gateway is not a suspicious gateway.

3. The network security detection method based on distributed gateway screening as claimed in claim 1 is characterized in that: In step S2, the distributed network is divided into several sub-networks based on the positions of all suspicious gateways within the distributed network; based on the gateway connection characteristics of all sub-networks, time-sharing data sampling is performed on all sub-networks to obtain several data sample sets corresponding to each sub-network, including: Based on the locations of all suspicious gateways within the distributed network, cluster analysis is performed on all suspicious gateways to estimate the probability of data interaction between any two suspicious gateways, thereby dividing all suspicious gateways into a number of gateway clusters; and based on the coverage of all gateway clusters within the distributed network, the distributed network is divided into a number of sub-networks; Based on the number and bandwidth of gateway external links of all subnetworks, estimate the external data transmission flow rate of all subnetworks; based on the external data transmission flow rate, determine the length of time occupied by data extraction of each subnetwork during the time-sharing data sampling process of all subnetworks, so as to obtain several data sample sets corresponding to all subnetworks one by one.

4. The network security detection method based on distributed gateway screening as claimed in claim 1 is characterized in that: In the step S3, the data sample set is analyzed to determine whether a security anomaly occurs within the sub-network; Tracing the data transmission inside the sub-network where the security anomaly occurred, and determining the abnormal data transmission link inside the sub-network, including: Performing a neural network model analysis on the data sample set to determine whether data packets corresponding to the data sample set have data omissions or illegal data tampering during transmission within the subnetwork; if so, determining that a security anomaly has occurred within the subnetwork; if not, determining that no security anomaly has occurred within the subnetwork; Obtain the transmission path label of the data packet in which data omission or illegal data tampering occurs within the subnet where the security anomaly event occurs, and based on the transmission path label, trace the data transmission of the subnet where the security anomaly event occurs to determine the abnormal data transmission link within the subnet.

5. The network security detection method based on distributed gateway screening as claimed in claim 1 is characterized in that: In the step S4, the data flow transmission loss characteristic information of all gateways under the abnormal data transmission link is obtained, and based on the data flow transmission loss characteristic information, the non-secure gateways included in the abnormal data transmission link are checked and determined; Based on the location of the non-secure gateway inside the distributed network, resetting the data transmission link of the distributed network includes: Compare the changes in the feature code positions of the data packets received by all gateways under the abnormal data transmission link to determine the data code loss amount of all gateways when receiving the same data packet; based on the data code loss amount of all gateways, determine the data stream transmission loss feature information of all gateways; wherein the data stream transmission loss feature information includes the data stream transmission loss ratio of each gateway and the data stream interval where the transmission loss occurs; Based on the data stream transmission loss characteristic information, determine the probability of occurrence of data stream transmission errors for all gateways under the data transmission abnormality link; based on the probability of occurrence of data stream transmission errors, identify the non-secure gateways included in the data transmission abnormality link; based on the position of the non-secure gateway inside the distributed network, determine the shortest data transmission link that bypasses the non-secure gateway to maintain the current normal data transmission operation, thereby resetting the data transmission link of the distributed network.

6. A network security detection system based on distributed gateway inspection, characterized in that: include: A test message sending module, used for sending test messages to all gateways of the distributed network respectively based on the bandwidth usage status of the distributed network; A suspicious gateway identification module, used to obtain the forwarding status information of each gateway for the test message, and determine whether the gateway is a suspicious gateway based on the forwarding status information and the actual data transmission information of each gateway; A sub-network division module, configured to divide the distributed network into a plurality of sub-networks based on the locations of all suspicious gateways within the distributed network; The data time-sharing sampling module is used to perform time-sharing data sampling on all sub-networks based on the gateway connection characteristics of all sub-networks, and obtain a number of data sample sets corresponding to each sub-network; A security abnormal event judgment module, used to analyze the data sample set to determine whether a security abnormal event occurs within the sub-network; A data transmission abnormal link determination module is used to trace the data transmission inside the sub-network where the security abnormality event occurs, and determine the data transmission abnormal link inside the sub-network; A non-secure gateway identification module is used to obtain data flow transmission loss characteristic information of all gateways under the abnormal data transmission link, and based on the data flow transmission loss characteristic information, identify the non-secure gateways included in the abnormal data transmission link; The data transmission link resetting module is used to reset the data transmission link of the distributed network based on the position of the non-secure gateway inside the distributed network.

7. The network security detection system based on distributed gateway inspection as claimed in claim 6 is characterized in that: The test message sending module is used to send test messages to all gateways of the distributed network based on the bandwidth usage status of the distributed network, including: Determine the message transmission data volume that all active data transmission links can bear based on the available bandwidth of each of all data transmission active links within the distributed network; construct a test message with a periodic code distribution feature based on the message transmission data volume, and send the test message to all gateways of the distributed network respectively; The suspicious gateway identification module is used to obtain the forwarding status information of each gateway for the test message, and judge whether the gateway is a suspicious gateway based on the forwarding status information and the data transmission real-time information of each gateway, including: Monitor the forwarding process of each gateway after receiving the test message, and obtain the forwarding status information of each gateway for the test message; wherein the forwarding status information includes the forwarding progress status information of all message subpackets after the test message is decomposed into a plurality of message subpackets with the same code content at the gateway; Based on the forwarding status information and the transmission live process information corresponding to the queue of data packets to be transmitted of each gateway, it is determined whether the gateway delays forwarding the message packet; if so, it is determined that the gateway is a suspicious gateway; if not, it is determined that the gateway is not a suspicious gateway.

8. The network security detection system based on distributed gateway inspection as claimed in claim 6, characterized in that: The sub-network division module is used to divide the distributed network into a plurality of sub-networks based on the locations of all suspicious gateways within the distributed network, including: Based on the locations of all suspicious gateways within the distributed network, cluster analysis is performed on all suspicious gateways to estimate the probability of data interaction between any two suspicious gateways, thereby dividing all suspicious gateways into a number of gateway clusters; and based on the coverage of all gateway clusters within the distributed network, the distributed network is divided into a number of sub-networks; The data time-sharing sampling module is used to perform time-sharing data sampling on all sub-networks based on the gateway connection characteristics of all sub-networks to obtain a number of data sample sets corresponding to each sub-network, including: Based on the number and bandwidth of gateway external links of all subnetworks, estimate the external data transmission flow rate of all subnetworks; based on the external data transmission flow rate, determine the length of time occupied by data extraction of each subnetwork during the time-sharing data sampling process of all subnetworks, so as to obtain several data sample sets corresponding to all subnetworks one by one.

9. The network security detection system based on distributed gateway inspection as claimed in claim 6, characterized in that: The security abnormal event judgment module is used to analyze the data sample set to determine whether a security abnormal event occurs inside the sub-network, including: Performing a neural network model analysis on the data sample set to determine whether data packets corresponding to the data sample set have data omissions or illegal data tampering during transmission within the subnetwork; if so, determining that a security anomaly has occurred within the subnetwork; if not, determining that no security anomaly has occurred within the subnetwork; The abnormal data transmission link determination module is used to trace the data transmission inside the sub-network where the abnormal security event occurs, and determine the abnormal data transmission link inside the sub-network, including: Obtain the transmission path label of the data packet in which data omission or illegal data tampering occurs within the subnet where the security anomaly event occurs, and based on the transmission path label, trace the data transmission of the subnet where the security anomaly event occurs to determine the abnormal data transmission link within the subnet.

10. The network security detection system based on distributed gateway inspection as claimed in claim 6, characterized in that: The non-secure gateway identification module is used to obtain data flow transmission loss characteristic information of all gateways under the abnormal data transmission link, and based on the data flow transmission loss characteristic information, to identify the non-secure gateways included in the abnormal data transmission link, including: Compare the changes in the feature code positions of the data packets received by all gateways under the abnormal data transmission link to determine the data code loss amount of all gateways when receiving the same data packet; based on the data code loss amount of all gateways, determine the data stream transmission loss feature information of all gateways; wherein the data stream transmission loss feature information includes the data stream transmission loss ratio of each gateway and the data stream interval where the transmission loss occurs; Based on the data stream transmission loss characteristic information, determine the probability of occurrence of data stream transmission error time for all gateways under the abnormal data transmission link; based on the probability of occurrence of data stream transmission error time, check and determine the non-secure gateways included in the abnormal data transmission link; The data transmission link resetting module is used to reset the data transmission link of the distributed network based on the position of the non-secure gateway inside the distributed network, including: Based on the position of the non-secure gateway inside the distributed network, the shortest data transmission link that bypasses the non-secure gateway to maintain the current normal data transmission operation is determined, thereby resetting the data transmission link of the distributed network.

Images