DPU-based enterprise intranet illegal external connection detection system

Abstract

The invention relates to the technical field of network information security monitoring, in particular to a DPU-based enterprise intranet illegal external connection detection system, which comprises an access control unit, a host monitoring unit, an identity authentication unit, a security management unit, an intranet resource information management unit, a database unit, an automatic detection unit, an alarm unit and a blocking unit. In the invention, the network access examination and approval module registers and examines the physical address of a network card for each host newly accessed into the intranet of an enterprise, the illegal access detection module performs illegal detection on host equipment subjected to network access registration, and the illegal access blocking module can block the communication between the host and other hosts in the intranet. And meanwhile, the automatic detection unit realizes automatic detection of system illegal external connection information through an illegal external connection information automatic detection model, and judges whether the illegal external connection information exists or not, so that illegal external connection of an enterprise intranet of unknown equipment and leakage of sensitive information in an enterprise intranet database system are avoided, and the overall network security of the enterprise intranet is effectively improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network information security monitoring, and in particular to a DPU-based enterprise intranet illegal external connection detection system. Background Art

[0002] An intranet, also known as an enterprise internal network or intranet, is a computer network that uses the same technology as the Internet. It is usually built within a company or organization and is mainly used for information sharing and communication. The functions and services provided by an intranet include but are not limited to World Wide Web browsing, file transfer, email communication, etc.

[0003] Since a large amount of information flow interaction will be generated in the enterprise intranet system, the environment of the enterprise intranet is becoming more and more complex, the identity of enterprise users and visitors cannot be confirmed, and there are many ways for information leakage, which leads to a large number of potential threats to the enterprise intranet system. As the number of front-end devices in the enterprise intranet increases, and when the scale of the enterprise intranet is large, there are problems such as a large number of devices and difficulty in manual supervision, which leads to illegal external connection of the enterprise intranet by unknown devices, and the risk of leakage of sensitive information in the enterprise intranet database system. Therefore, it is necessary to design an enterprise intranet illegal external connection detection solution to perform security detection on the access devices of the enterprise intranet, allow trusted and compliant devices to enter the network, and block devices that do not comply with the policy, so as to improve the overall network security of the enterprise intranet.

[0004] In view of this, the present application proposes a DPU-based enterprise intranet illegal external connection detection system. Summary of the invention

[0005] The purpose of the present invention is to provide a DPU-based enterprise intranet illegal external connection detection system to solve the above problems.

[0006] To achieve the above object, the present invention provides the following technical solutions:

[0007] A DPU-based enterprise intranet illegal external connection detection system, including an access control unit, a host monitoring unit, an identity authentication unit, a security management unit, an intranet resource information management unit, a database unit, an automatic detection unit, an alarm unit and a blocking unit;

[0008] The access control unit identifies the asset information of the enterprise intranet through a variety of asset identification technologies. When a host accesses the enterprise intranet, it detects the host's illegal access behavior through network scanning, and blocks the host with illegal access. At the same time, the access control unit transmits the host access signal to the host monitoring unit and the identity authentication unit;

[0009] After receiving the host access signal, the host monitoring unit implements the functions of monitoring the host's illegal external connections, host process monitoring, host resource monitoring, and host network traffic monitoring by formulating, allocating, and issuing security policies and forcibly installing the client program of the intranet information security management;

[0010] After receiving the host access signal, the identity authentication unit uses the public key infrastructure PKI technology to implement the identity authentication function of the enterprise intranet user, and realizes the user digital certificate application and the user identity authentication function based on the digital certificate;

[0011] The security management unit implements encryption protection of important files on the enterprise intranet and refined management of access rights through file encryption and permission setting, encrypted file access, real-time control of document permissions, and document access log management functions;

[0012] The intranet resource information management unit supports the system administrator to register and manage the intranet resources through the management platform configured by the system, and updates the terminal information according to the changes found and reported by the client program;

[0013] The database unit is used to store all data in the access control unit, the host monitoring unit, the identity authentication unit, the security management unit and the intranet resource information management unit in the server-side database;

[0014] The automatic detection unit obtains a standard data set by collecting system data from the database unit and performing data processing through the DPU, reduces the dimension of the data set using a dimensionality reduction model, extracts data sparse features in the system and introduces them into the constructed automatic detection model for illegal external connection information, distinguishes illegal external connection information, and realizes automatic detection of illegal external connection information in the system. When illegal external connection information that does not match any network access conditions is detected, the illegal external connection signal is transmitted to the alarm unit and the blocking unit;

[0015] After receiving the illegal external connection signal, the alarm unit generates an illegal access alarm event;

[0016] After receiving the illegal external connection signal, the blocking unit calls the automation program through the remote control protocol, transmits the blocking signal to the access control unit, and issues a blocking instruction to the network port directly connected to the illegal device through the access control unit, thereby blocking the illegal external connection of the enterprise intranet.

[0017] Further, the access control unit includes a simple network management protocol SNMP detection module, an address resolution protocol ARP monitoring module, a port mirroring module, a fingerprint recognition module, a network access approval module, an illegal access detection module and an illegal access blocking module;

[0018] The Simple Network Management Protocol (SNMP) detection module detects all online assets or private network assets connected to the switching network through SNMP;

[0019] The address resolution protocol ARP monitoring module monitors all layer 2 network data packets through ARP to promptly discover hidden networks;

[0020] The port mirroring module uses the port mirroring technology to perform application-level monitoring and analysis on the data transmitted in the system to distinguish service traffic and user traffic;

[0021] The fingerprint recognition module realizes the recognition of fingerprint features, running services, and operating system functions of online assets in the enterprise intranet through the enterprise intranet fingerprint recognition library;

[0022] The network access approval module registers and examines the physical address of the network card for each new host in the enterprise intranet, binds the physical address MAC of the network card, and transmits the host device signal that has been registered to the illegal access detection module;

[0023] The illegal access detection module detects illegal access to the host device that has been registered with the network, and when it detects that the host has illegally accessed, it generates an alarm signal and transmits the illegal access host signal to the illegal access blocking module;

[0024] After receiving the illegal access host signal, the illegal access blocking module blocks the host from communicating with other hosts in the intranet by forging an ARP response data packet.

[0025] Furthermore, the intranet resource information management unit includes a traffic management module, an IP management module, a front-end access management module and a terminal access management module;

[0026] The traffic management module automatically identifies the manufacturer and model of the enterprise intranet access device by learning the network topology in real time, realizes the network device panel view management and port list management, and realizes the real-time monitoring of the network device CPU and memory and the real-time statistics of port traffic;

[0027] The IP management module supports the discovery and management of IP addresses in the enterprise intranet, timely discovers the IP addresses in use, long-term offline, illegally invaded and unused in each network segment, and can add valid remarks information, and supports the display of the actual use of IP resources in the form of charts;

[0028] The front-end access management module establishes weak password scanning, high-risk port scanning, and whitelist access strategies through active scanning and passive monitoring to identify, warn, and block illegal and malicious behaviors in the network;

[0029] The terminal access management module automatically blocks all network communication capabilities of the terminal by determining whether the terminal is accessing the network for the first time, performs terminal registration and authentication, confirms the legitimacy of the terminal, and performs compliance and security checks on the access client.

[0030] Furthermore, the automatic detection unit includes an acquisition module, a data processing module, a model control module, a data set dimension reduction module, a reconstruction error calculation module and an external information discrimination module;

[0031] The acquisition module is used to collect system data from the database unit and transmit the system data to the data processing module;

[0032] The data processing module is used to format, digitize and standardize the system data to obtain a standard data set, and transmit the data set to the data set dimensionality reduction module;

[0033] The model control module is used to control the dimensionality reduction model and the illegal external connection information automatic detection model;

[0034] The data set dimension reduction module reduces the dimension of the data set using a dimension reduction model and extracts data sparse features in the system, and introduces the data sparse features into the constructed illegal external connection information automatic detection model;

[0035] The reconstruction error calculation module calculates the reconstruction error through the illegal external connection information automatic detection model, and transmits the reconstruction error value to the external connection information discrimination module;

[0036] The external connection information identification module automatically identifies the illegal external connection information according to the reconstruction error value through the illegal external connection information automatic detection model, and when the illegal external connection information that does not match any network access conditions is detected, the illegal external connection signal is transmitted to the alarm unit and the blocking unit.

[0037] Furthermore, the data processing module performs data processing, including the following steps:

[0038] A1. Format the system data. The formatting formula is as follows:

[0039]

[0040] Where: d is the collected system data, α is the format conversion parameter;

[0041] A2. Convert the non-numeric data in the data packet of the system data into numeric data. The conversion formula is as follows:

[0042]

[0043] Where: χ is the numerical conversion parameter;

[0044] A3. Standardize the system data. The standardization formula is as follows:

[0045]

[0046] Where: f is the standardized processing parameter.

[0047] Furthermore, the data set dimension reduction module uses a dimension reduction model to reduce the dimension of the data set and extract the data sparse features in the system, including the following steps:

[0048] B1. The solution function of the dimensionality reduction model is expressed as follows:

[0049]

[0050] Where: H is the sparse feature of the system data, Y is the linear combination of the system data, G is the dictionary of the system data, and F is the F-norm of the convex function;

[0051] B2. Add the characteristic function Z to transform the above solution function into:

[0052]

[0053] Then the Lagrange multiplier method is:

[0054]

[0055] Where: λ is the Lagrange multiplier, β is the penalty factor, λ T is the orthogonal matrix of Lagrange multipliers;

[0056] B3. The sparse feature solution equations based on the alternating direction multiplier method are:

[0057]

[0058] B4. Similarly, the sparse features obtained are used as known parameters to solve the dictionary G.

[0059] Furthermore, the reconstruction error calculation module calculates the reconstruction error through the illegal external connection information automatic detection model, including the following steps:

[0060] C1. Automatically detect the model through illegal external connection information, and build the normal class and illegal external connection class sub-dictionary P according to the sparse characteristics of the system data obtained above 1 With P 2 ;

[0061] C2, use the alternating direction multiplication method in step B3 to multiply d in the sub-dictionary P 1 With P 2 The sparse representation below is calculated;

[0062] C3. According to P 1 and P 2 Reconstruct d and calculate the reconstruction error to get the reconstruction error u i for:

[0063]

[0064] Where: G i H i It is the reconstruction result of sub-dictionary and sparse features.

[0065] Furthermore, the external information identification module includes the following steps:

[0066] D1. Construct normal class sub-dictionary P 1 With P 2 , and calculate the sparse features H of the input system data d 1 and H 2 ;

[0067] D2. Calculate the reconstruction error u 1 and u 2 ;

[0068] D3. Determine the reconstruction error u 1 and u 2 The size relationship, if u 1 >u 2 , the input system data d is normal, otherwise the input system data d is abnormal.

[0069] Beneficial effects of the present invention:

[0070] 1. In the present invention, the access control unit identifies the asset information of the enterprise intranet, discovers the hidden network in time, and performs application-level monitoring and analysis on the data transmitted in the system. At the same time, the network access approval module registers and examines the physical address of the network card for each new host entering the enterprise intranet, and performs MAC binding of the physical address of the network card, and transmits the signal of the host device that has been registered for network access to the illegal access detection module. The illegal access detection module performs illegal detection on the host device that has been registered for network access. When it is detected that the host has illegally accessed, an alarm signal is generated. The illegal access blocking module can block the host from communicating with other hosts in the intranet.

[0071] 2. In the present invention, the automatic detection unit processes a large amount of data in the enterprise intranet system through the DPU, extracts information features and matches them, and realizes automatic detection of the system's illegal external connection information through the automatic detection model of illegal external connection information, thereby judging whether there is illegal external connection information, improving the detection rate and reducing the false alarm rate, greatly improving the detection accuracy of the automatic detection method of illegal external connection information, providing a strong guarantee for the stable operation of the enterprise intranet system, avoiding the problems of numerous devices and difficulty in manual supervision due to the large scale of the enterprise intranet, and performing security detection on the access devices of the enterprise intranet, allowing trusted and compliant devices to access the network, and blocking devices that do not comply with the policy, avoiding illegal external connection of the enterprise intranet by unknown devices and leakage of sensitive information in the enterprise intranet database system, effectively improving the overall network security of the enterprise intranet. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] Figure 1 This is a system principle diagram of a DPU-based enterprise intranet illegal external connection detection system of the present invention;

[0073] Figure 2 This is a flow chart of an automatic detection model of illegal external connection information of a DPU-based enterprise intranet illegal external connection detection system of the present invention.

[0074] In the figure: 1. Access control unit; 2. Host monitoring unit; 3. Identity authentication unit; 4. Security management unit; 5. Intranet resource information management unit; 6. Database unit; 7. Automatic detection unit; 8. Alarm unit; 9. Blocking unit; 11. Simple Network Management Protocol SNMP detection module; 12. Address Resolution Protocol ARP monitoring module; 13. Port mirroring module; 14. Fingerprint recognition module; 15. Network access approval module; 16. Illegal access detection module; 17. Illegal access blocking module; 51. Traffic management module; 52. IP management module; 53. Front-end access management module; 54. Terminal access management module; 71. Collection module; 72. Data processing module; 73. Model control module; 74. Data set dimensionality reduction module; 75. Reconstruction error calculation module; 76. External information discrimination module. DETAILED DESCRIPTION

[0075] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0076] Embodiment 1

[0077] See also Figure 1,This design proposes an implementation method, a DPU-based enterprise intranet illegal external connection detection system, including an access control unit 1, a host monitoring unit 2, an identity authentication unit 3, a security management unit 4, an intranet resource information management unit 5, a database unit 6, an automatic detection unit 7, an alarm unit 8 and a blocking unit 9;

[0078] The access control unit 1 identifies the asset information of the enterprise intranet through a variety of asset identification technologies. When a host accesses the enterprise intranet, it detects the host's illegal access behavior through network scanning and blocks the host that has been found to have illegally accessed. At the same time, the access control unit 1 transmits the host access signal to the host monitoring unit 2 and the identity authentication unit 3;

[0079] After receiving the host access signal, the host monitoring unit 2 implements the host illegal external connection monitoring, host process monitoring, host resource monitoring, and host network traffic monitoring functions by formulating, allocating, and issuing security policies and forcibly installing the client program of intranet information security management;

[0080] After receiving the host access signal, the identity authentication unit 3 uses the public key infrastructure PKI technology to implement the identity authentication function of the enterprise intranet user, and realizes the user digital certificate application and the user identity authentication function based on the digital certificate;

[0081] The security management unit 4 implements encryption protection of important files on the enterprise intranet and refined management of access rights through file encryption and permission setting, encrypted file access, real-time control of document permissions, and document access log management functions;

[0082] The intranet resource information management unit 5 supports the system administrator to register and manage the intranet resources through the management platform configured by the system, and updates the terminal information changes reported by the client program;

[0083] The database unit 6 is used to store all data of the access control unit 1, the host monitoring unit 2, the identity authentication unit 3, the security management unit 4 and the intranet resource information management unit 5 in the server-side database;

[0084] The automatic detection unit 7 obtains a standard data set by collecting system data from the database unit 6 and performing data processing through the DPU, reduces the dimension of the data set using the dimensionality reduction model, extracts the data sparse features in the system and introduces them into the constructed automatic detection model of illegal external connection information, distinguishes the illegal external connection information, and realizes automatic detection of illegal external connection information in the system. When illegal external connection information that does not match any network access conditions is detected, the illegal external connection signal is transmitted to the alarm unit 8 and the blocking unit 9;

[0085] After receiving the illegal external connection signal, the alarm unit 8 generates an illegal access alarm event;

[0086] After receiving the illegal external connection signal, the blocking unit 9 calls the automation program through the remote control protocol, transmits the blocking signal to the access control unit 1, and issues a blocking instruction to the network port directly connected to the illegal device through the access control unit 1, thereby blocking the illegal external connection of the enterprise intranet.

[0087] Embodiment 2

[0088] See also Figure 1 , this design proposes an implementation method, a DPU-based enterprise intranet illegal external connection detection system. In this embodiment, preferably, the access control unit 1 includes a simple network management protocol SNMP detection module 11, an address resolution protocol ARP monitoring module 12, a port mirroring module 13, a fingerprint recognition module 14, a network access approval module 15, an illegal access detection module 16 and an illegal access blocking module 17; the simple network management protocol SNMP detection module 11 detects all online assets or private network assets connected to the switching network through SNMP; the address resolution protocol ARP monitoring module 12 monitors all Layer 2 network data packets through ARP to promptly discover hidden networks; the port mirroring module 13 performs application-level monitoring and analysis on the data transmitted in the system through port mirroring technology to determine the service service flow and user flow; the fingerprint recognition module 14 realizes the recognition of the fingerprint characteristics, running services and operating system functions of the online assets of the enterprise intranet through the enterprise intranet fingerprint recognition library; the network access approval module 15 registers and examines the physical address of the network card for each new host entering the enterprise intranet, binds the physical address MAC of the network card, and transmits the host device signal that has been registered for network access to the illegal access detection module 16; the illegal access detection module 16 performs illegal detection on the host device that has been registered for network access, and when it detects that the host has illegally accessed, it generates an alarm signal and transmits the illegal access host signal to the illegal access blocking module 17; after receiving the illegal access host signal, the illegal access blocking module 17 blocks the communication between the host and other hosts in the intranet by forging an ARP response data packet.

[0089] In this embodiment, preferably, the intranet resource information management unit 5 includes a traffic management module 51, an IP management module 52, a front-end access management module 53 and a terminal access management module 54; the traffic management module 51 automatically identifies the manufacturer and model of the enterprise intranet access device by learning the network topology in real time, realizes the network device panel view management and port list management, and realizes the network device CPU, memory real-time monitoring, and port traffic real-time statistics; the IP management module 52 supports the discovery and management of the IP address of the enterprise intranet, timely discovers the IPs that are in use, long-term offline, illegally invaded and unused in each network segment, and can add effective remarks information, and supports the display of the actual use of IP resources in the form of charts; the front-end access management module 53 establishes weak password scanning, high-risk port scanning, and whitelist access strategies through active scanning and passive monitoring, identifies, warns and blocks illegal and malicious behaviors in the network; the terminal access management module 54 automatically blocks all its network communication capabilities by judging whether the terminal is accessing the network for the first time, performs terminal registration and authentication, confirms the legitimacy of the terminal, and performs compliance checks and security checks on the access client.

[0090] Embodiment 3

[0091] See also Figure 1 and Figure 2 , this design proposes an implementation method, a DPU-based enterprise intranet illegal external connection detection system. In this embodiment, preferably, the automatic detection unit 7 includes an acquisition module 71, a data processing module 72, a model control module 73, a data set dimensionality reduction module 74, a reconstruction error calculation module 75 and an external connection information discrimination module 76; the acquisition module 71 is used to collect system data from the database unit 6 and transmit the system data to the data processing module 72; the data processing module 72 is used to format, digitize and standardize the system data to obtain a standard data set, and transmit the data set to the data set dimensionality reduction module 74; the model control module 73 is used to control the dimensionality reduction model type and illegal external connection information automatic detection model; the data set dimensionality reduction module 74 uses the dimensionality reduction model to reduce the dimensionality of the data set and extract the data sparse features in the system, and introduces the data sparse features into the constructed illegal external connection information automatic detection model; the reconstruction error calculation module 75 calculates the reconstruction error through the illegal external connection information automatic detection model, and transmits the reconstruction error value to the external connection information discrimination module 76; the external connection information discrimination module 76 automatically discriminates the illegal external connection information according to the reconstruction error value through the illegal external connection information automatic detection model, and when the illegal external connection information that does not match any network access condition is detected, the illegal external connection signal is transmitted to the alarm unit 8 and the blocking unit 9.

[0092] In this embodiment, preferably, the data processing module 72 performs data processing, which specifically includes the following steps:

[0093] A1. Format the system data. The formatting formula is as follows:

[0094]

[0095] Where: d is the collected system data, α is the format conversion parameter;

[0096] A2. Convert the non-numeric data in the data packet of the system data into numeric data. The conversion formula is as follows:

[0097]

[0098] Where: χ is the numerical conversion parameter;

[0099] A3. Standardize the system data. The standardization formula is as follows:

[0100]

[0101] Where: f is the standardized processing parameter.

[0102] In this embodiment, preferably, the data set dimension reduction module 74 uses a dimension reduction model to reduce the dimension of the data set and extract the data sparse features in the system, which specifically includes the following steps:

[0103] B1. The solution function of the dimensionality reduction model is expressed as follows:

[0104]

[0105] Where: H is the sparse feature of the system data, Y is the linear combination of the system data, G is the dictionary of the system data, and F is the F-norm of the convex function;

[0106] B2. Add the characteristic function Z to transform the above solution function into:

[0107]

[0108] Then the Lagrange multiplier method is:

[0109]

[0110] Where: λ is the Lagrange multiplier, β is the penalty factor, λ T is the orthogonal matrix of Lagrange multipliers;

[0111] B3. The sparse feature solution equations based on the alternating direction multiplier method are:

[0112]

[0113] B4. Similarly, the sparse features obtained are used as known parameters to solve the dictionary G.

[0114] In this embodiment, preferably, the reconstruction error calculation module 75 calculates the reconstruction error by using the illegal external connection information automatic detection model, which specifically includes the following steps:

[0115] C1. Automatically detect the model through illegal external connection information, and build the normal class and illegal external connection class sub-dictionary P according to the sparse characteristics of the system data obtained above 1 With P 2 ;

[0116] C2, use the alternating direction multiplication method in step B3 to multiply d in the sub-dictionary P 1 With P 2 The sparse representation below is calculated;

[0117] C3. According to P 1 and P 2 Reconstruct d and calculate the reconstruction error to get the reconstruction error u i for:

[0118]

[0119] Where: G i H i It is the reconstruction result of sub-dictionary and sparse features.

[0120] In this embodiment, preferably, the external information identification module 76 specifically includes the following steps:

[0121] D1. Construct normal class sub-dictionary P 1 With P 2 , and calculate the sparse features H of the input system data d 1 and H 2 ;

[0122] D2. Calculate the reconstruction error u 1 and u 2 ;

[0123] D3. Determine the reconstruction error u 1 and u 2 The size relationship, if u 1 >u 2 , the input system data d is normal, otherwise the input system data d is abnormal.

[0124] In the present invention, when the DPU-based enterprise intranet illegal external connection detection system is in use, first, the access control unit 1 identifies the asset information of the enterprise intranet, timely discovers the hidden network, and performs application-level monitoring and analysis on the data transmitted in the system through the simple network management protocol SNMP detection module 11, the address resolution protocol ARP monitoring module 12, the port mirroring module 13 and the fingerprint recognition module 14. At the same time, when a host accesses the enterprise intranet, the network access approval module 15 registers and examines the physical address of the network card for each host newly entering the enterprise intranet, and performs MAC binding of the physical address of the network card, and transmits the host device signal that has been registered for network access to the illegal access detection module 16; the illegal access detection module 16 performs illegal detection on the host device that has been registered for network access, and when it is detected that the host has illegally accessed, an alarm signal is generated and the illegal access host signal is transmitted to the illegal access blocking module 17; after receiving the illegal access host signal, the illegal access blocking module 17 blocks the communication between the host and other hosts in the intranet by forging an ARP response data packet, and at the same time, the access control unit 1 transmits the host access signal to the host monitoring unit 2 and the identity authentication unit 3;

[0125] After receiving the host access signal, the host monitoring unit 2 implements the host illegal external connection monitoring, host process monitoring, host resource monitoring, and host network traffic monitoring functions by formulating, allocating, and issuing security policies and forcibly installing the client program of intranet information security management; after receiving the host access signal, the identity authentication unit 3 adopts the public key infrastructure PKI technology to implement the identity authentication function of the enterprise intranet user, and implements the user digital certificate application and the user identity authentication function based on the digital certificate; the security management unit 4 implements the encryption protection of important files in the enterprise intranet and the refined management of their access rights through file encryption and permission setting, encrypted file access, real-time control of document permissions, and document access log management functions; the intranet resource information management unit 5 supports the system administrator to realize the network registration and information management of intranet resources through the management platform configured by the system, and updates according to the terminal information changes reported by the client program;

[0126] At the same time, the automatic detection unit 7 collects system data from the database unit 6, obtains a standard data set after data processing through the DPU, and reduces the dimension of the data set using the dimensionality reduction model. The data processing module 72 formats, digitizes and standardizes the system data to obtain a standard data set, standardizes the format and value of the power industrial control system data, and makes full preparations for the subsequent extraction of sparse features of system data. It also has an excellent effect on improving the accuracy of sparse feature extraction, and transmits the data set to the data set dimensionality reduction module 74. The data set dimensionality reduction module 74 uses the dimensionality reduction model to reduce the dimension of the data set and extract the data sparse features in the system, and introduces the data sparse features into the constructed illegal external connection information automatic detection model. The reconstruction error calculation module 75 calculates the reconstruction error through the illegal external connection information automatic detection model, and transmits the reconstruction error value to the external connection information judgment module 76. The external connection information judgment module 76 automatically judges the illegal external connection information according to the reconstruction error value through the illegal external connection information automatic detection model (the process is as follows). Figure 2 As shown), when illegal external connection information that does not match any network access conditions is detected, the illegal external connection signal is transmitted to the alarm unit 8 and the blocking unit 9 to realize automatic detection of illegal external connection information in the system. After the alarm unit 8 receives the illegal external connection signal, an illegal access alarm event is generated. After the blocking unit 9 receives the illegal external connection signal, it calls the automation program through the remote control protocol to transmit the blocking signal to the access control unit 1, and the access control unit 1 issues a blocking instruction to the network port directly connected to the illegal device to realize the blocking processing of the illegal external connection of the enterprise intranet; a large amount of data in the enterprise intranet system is processed by the DPU, information features are extracted and matched, and illegal external connections are detected by the DPU. The automatic detection model for external information realizes automatic detection of illegal external information of the system, so as to determine whether there is illegal external information, improves the detection rate and reduces the false alarm rate, greatly improves the detection accuracy of the automatic detection method of illegal external information, and provides a strong guarantee for the stable operation of the enterprise intranet system, avoiding the problems of large number of devices and difficulty in manual supervision due to the large scale of the enterprise intranet. By performing security detection on the access devices of the enterprise intranet, it allows trusted and compliant devices to access the network, and blocks devices that do not comply with the policy, avoiding illegal external connection of unknown devices to the enterprise intranet and leakage of sensitive information in the enterprise intranet database system, effectively improving the overall network security of the enterprise intranet.

[0127] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A DPU-based enterprise intranet illegal external connection detection system, characterized in that: It comprises an access control unit (1), a host monitoring unit (2), an identity authentication unit (3), a security management unit (4), an intranet resource information management unit (5), a database unit (6), an automatic detection unit (7), an alarm unit (8) and a blocking unit (9); The access control unit (1) identifies the asset information of the enterprise intranet through a variety of asset identification technologies. When a host accesses the enterprise intranet, the access control unit (1) detects the host's illegal access behavior through network scanning, and blocks the host that has been found to have illegally accessed. At the same time, the access control unit (1) transmits the host access signal to the host monitoring unit (2) and the identity authentication unit (3); After receiving the host access signal, the host monitoring unit (2) implements the functions of monitoring the host's illegal external connections, monitoring the host's processes, monitoring the host's resources, and monitoring the host's network traffic by formulating, allocating, and issuing security policies and forcibly installing a client program for intranet information security management; After receiving the host access signal, the identity authentication unit (3) uses the public key infrastructure (PKI) technology to implement the identity authentication function of the enterprise intranet user, and implements the user digital certificate application and the user identity authentication function based on the digital certificate; The security management unit (4) implements encryption protection of important files on the enterprise intranet and refined management of access rights through file encryption and permission setting, encrypted file access, real-time control of document rights, and document access log management functions; The intranet resource information management unit (5) supports the system administrator to register and manage the intranet resources through the management platform configured by the system, and updates the terminal information according to the changes found and reported by the client program; The database unit (6) is used to store all data in the access control unit (1), the host monitoring unit (2), the identity authentication unit (3), the security management unit (4) and the intranet resource information management unit (5) in a server-side database; The automatic detection unit (7) collects system data from the database unit (6) and processes the data through the DPU to obtain a standard data set, reduces the dimension of the data set using a dimensionality reduction model, extracts data sparse features in the system and introduces them into the constructed automatic detection model for illegal external connection information, distinguishes illegal external connection information, and realizes automatic detection of illegal external connection information in the system. When illegal external connection information that does not match any network access condition is detected, an illegal external connection signal is transmitted to the alarm unit (8) and the blocking unit (9); After receiving the illegal external connection signal, the alarm unit (8) generates an illegal access alarm event; After receiving the illegal external connection signal, the blocking unit (9) calls the automation program through the remote control protocol, transmits the blocking signal to the access control unit (1), and issues a blocking instruction to the network port directly connected to the illegal device through the access control unit (1), thereby blocking the illegal external connection of the enterprise intranet.

2. According to the DPU-based enterprise intranet illegal external connection detection system according to claim 1, it is characterized in that: The access control unit (1) comprises a simple network management protocol (SNMP) detection module (11), an address resolution protocol (ARP) monitoring module (12), a port mirroring module (13), a fingerprint recognition module (14), a network access approval module (15), an illegal access detection module (16) and an illegal access blocking module (17); The Simple Network Management Protocol (SNMP) detection module (11) detects all online assets or private network assets connected to the switching network through SNMP; The address resolution protocol ARP monitoring module (12) monitors all layer 2 network data packets through ARP to timely discover hidden networks; The port mirroring module (13) performs application-level monitoring analysis on the data transmitted in the system through the port mirroring technology to distinguish service traffic and user traffic; The fingerprint recognition module (14) realizes the recognition of fingerprint features, running services and operating system functions of online assets in the enterprise intranet through the enterprise intranet fingerprint recognition library; The network access approval module (15) registers and examines the network card physical address of each host newly entering the enterprise intranet, performs MAC binding of the network card physical address, and transmits the host device signal that has passed the network access registration to the illegal access detection module (16); The illegal access detection module (16) performs illegal detection on the host device that has been registered on the network, and when it detects that the host has been illegally accessed, it generates an alarm signal and transmits the illegal access host signal to the illegal access blocking module (17); After receiving the signal of the illegally accessed host, the illegal access blocking module (17) blocks the communication between the host and other hosts in the intranet by forging an ARP response data packet.

3. According to the DPU-based enterprise intranet illegal external connection detection system of claim 1, it is characterized in that: The intranet resource information management unit (5) comprises a traffic management module (51), an IP management module (52), a front-end access management module (53) and a terminal access management module (54); The traffic management module (51) automatically identifies the manufacturer and model of the enterprise intranet access device by learning the network topology in real time, realizes the network device panel view management and port list management, and realizes the real-time monitoring of the network device CPU and memory and the real-time statistics of port traffic; The IP management module (52) supports the discovery and management of IP addresses in the enterprise intranet, timely discovers the IP addresses in use, long-term offline, illegally invaded and unused in each network segment, and can add valid remarks information, and supports the display of the actual use of IP resources in the form of charts; The front-end access management module (53) establishes weak password scanning, high-risk port scanning, and whitelist access policies through active scanning and passive monitoring, and identifies, warns, and blocks illegal and malicious behaviors in the network; The terminal access management module (54) automatically blocks all network communication capabilities of the terminal by determining whether the terminal is accessing the network for the first time, performs terminal registration and authentication, confirms the legitimacy of the terminal, and performs compliance and security checks on the access client.

4. According to the DPU-based enterprise intranet illegal external connection detection system according to claim 1, it is characterized in that: The automatic detection unit (7) comprises a collection module (71), a data processing module (72), a model control module (73), a data set dimension reduction module (74), a reconstruction error calculation module (75) and an external information identification module (76); The acquisition module (71) is used to acquire system data from the database unit (6) and transmit the system data to the data processing module (72); The data processing module (72) is used to format, digitize and standardize the system data to obtain a standard data set, and transmit the data set to the data set dimension reduction module (74); The model control module (73) is used to control the dimension reduction model and the illegal external connection information automatic detection model; The data set dimension reduction module (74) uses a dimension reduction model to reduce the dimension of the data set and extract data sparse features in the system, and introduces the data sparse features into the constructed illegal external connection information automatic detection model; The reconstruction error calculation module (75) calculates the reconstruction error through the illegal external connection information automatic detection model, and transmits the reconstruction error value to the external connection information judgment module (76); The external connection information identification module (76) automatically identifies the illegal external connection information according to the reconstruction error value through the illegal external connection information automatic detection model, and when the illegal external connection information that does not match any network access condition is detected, the illegal external connection signal is transmitted to the alarm unit (8) and the blocking unit (9).

5. According to the DPU-based enterprise intranet illegal external connection detection system according to claim 4, it is characterized in that: The data processing module (72) performs data processing, including the following steps: A1. Format the system data. The formatting formula is as follows: Where: d is the collected system data, α is the format conversion parameter; A2. Convert the non-numeric data in the data packet of the system data into numeric data. The conversion formula is as follows: Where: χ is the numerical conversion parameter; A3. Standardize the system data. The standardization formula is as follows: Where: f is the standardized processing parameter.

6. According to the DPU-based enterprise intranet illegal external connection detection system according to claim 5, it is characterized in that: The data set dimension reduction module (74) uses a dimension reduction model to reduce the dimension of the data set and extract the data sparse features in the system, including the following steps: B1. The solution function of the dimensionality reduction model is expressed as follows: Where: H is the sparse feature of the system data, Y is the linear combination of the system data, G is the dictionary of the system data, and F is the F-norm of the convex function; B2. Add the characteristic function Z to transform the above solution function into: Then the Lagrange multiplier method is: Where: λ is the Lagrange multiplier, β is the penalty factor, λ T is the orthogonal matrix of Lagrange multipliers; B3. The sparse feature solution equations based on the alternating direction multiplier method are: B4. Similarly, the sparse features obtained are used as known parameters to solve the dictionary G.

7. According to claim 6, a DPU-based enterprise intranet illegal external connection detection system is characterized in that: The reconstruction error calculation module (75) calculates the reconstruction error by using the illegal external connection information automatic detection model, including the following steps: C1. Automatically detect the model through illegal external connection information, and build the normal class and illegal external connection class sub-dictionary P according to the sparse characteristics of the system data obtained above 1 With P 2 ; C2, use the alternating direction multiplication method in step B3 to multiply d in the sub-dictionary P 1 With P 2 The sparse representation below is calculated; C3. According to P 1 and P 2 Reconstruct d and calculate the reconstruction error to get the reconstruction error u i for: Where: G i H i It is the reconstruction result of sub-dictionary and sparse features.

8. According to the DPU-based enterprise intranet illegal external connection detection system of claim 7, it is characterized in that: The external information identification module (76) includes the following steps: D1. Construct normal class sub-dictionary P 1 With P 2 , and calculate the sparse features H1 and H2 of the input system data d; D2, calculate the reconstruction errors u1 and u2; D3. Determine the magnitude relationship between the reconstruction errors u1 and u2. If u1>u2, the input system data d is normal; otherwise, the input system data d is abnormal.

Images