Network anomaly monitoring system and method based on data analysis

Abstract

The invention discloses a network anomaly monitoring system and method based on data analysis, and belongs to the technical field of network anomaly monitoring, and the method comprises the steps: obtaining access records of a monitoring object, screening all access records of the monitoring object, and obtaining a first screening set; screening the first screening set to obtain a second screening set; analyzing a reference flow characteristic and a reference behavior characteristic of the monitoring object according to the second screening set; analyzing the abnormal flow characteristics and behavior abnormal characteristics of the monitoring object, and dividing the abnormal level of the monitoring object; according to the real-time access record of the monitored object, the real-time abnormal level of the monitored object is judged, and different protection schemes are executed; the method effectively reduces the false alarm rate and the missing report rate, improves the accuracy of network security protection, accurately recognizes potential threats, shortens the response time, solves the limitation of a traditional rule matching method, and improves the capability of the network to adapt to a complex attack mode.

Description

Technical Field

[0001] The present invention belongs to the technical field of network anomaly monitoring, and particularly relates to a network anomaly monitoring system and method based on data analysis. Background Art

[0002] The Internet has greatly changed people's work and lifestyle, changed people's concepts, and greatly promoted social development. At the same time, like the real society, the Internet as a virtual world also has behaviors that harm the interests of others, such as malicious behaviors like DDoS attacks and malware invasions, seriously affecting the availability of network services on the Internet;

[0003] The Internet has greatly changed people's work and lifestyle, changed people's concepts, and greatly promoted social development. At the same time, like the real society, the Internet as a virtual world also has behaviors that harm the interests of others, such as malicious behaviors like DDoS attacks and malware invasions, seriously affecting the availability of network services on the Internet;

[0004] Currently, the monitoring system uses traffic threshold detection technology and source and destination host credibility verification technology to set an upper limit of the traffic threshold for network anomaly prevention. However, in the case of changing attack patterns, such as attack patterns like disguising as a normal user, traditional monitoring methods are easily bypassed, making it difficult to identify threats in a timely manner and take protective measures, resulting in low accuracy of anomaly detection, false alarms and missed alarms, and reducing the practicality and security of network services;

[0005] Therefore, there is an urgent need for a network anomaly monitoring system based on data analysis to solve the above problems. Summary of the Invention

[0006] The purpose of the present invention is to provide a network anomaly monitoring system based on data analysis to solve the problems raised in the above background art.

[0007] To solve the above technical problems, the present invention provides the following technical solutions:

[0008] A network anomaly monitoring method based on data analysis, the method comprising the following steps:

[0009] S1. Obtain the access records of the monitoring object from the database, where the access records include traffic records and behavior records; according to the traffic records, screen all the access records of the monitoring object to obtain a first screening set;

[0010] S2. According to the behavior records, screen the first screening set to obtain a second screening set; according to the traffic records in the second screening set, analyze the baseline traffic characteristics of the monitoring object; according to the behavior records in the second screening set, analyze the baseline behavior characteristics of the monitoring object;

[0011] S3. Analyze the abnormal traffic characteristics of the monitored object based on the baseline traffic characteristics of the monitored object; analyze the behavioral abnormal characteristics of the monitored object based on the baseline behavioral characteristics of the monitored object; divide the abnormal level of the monitored object according to the abnormal traffic characteristics and the behavioral abnormal characteristics.

[0012] S4. Judge the real-time abnormal level of the monitored object according to the real-time access record of the monitored object, and execute different protection schemes according to the real-time abnormal level of the monitored object.

[0013] According to the above technical solution, the step S1 includes:

[0014] S1-1. Each time the monitored object accesses the server, generate an access record and store it in the database; the traffic record includes the source IP and the traffic packet data value; the behavior record includes the access path and the stay interval.

[0015] The traffic packet data value refers to the size of the data packet sent or received by the monitored object when accessing the server; the access path refers to the specific URL path requested by the monitored object when accessing the server; the stay interval refers to the length of time the monitored object stays after accessing a certain page or resource.

[0016] S1-2. Extract all the access records of the monitored object from the database. According to the source IP in the traffic record, count the number of occurrences of each source IP in all the traffic records, and obtain the source IP with the most occurrences as the baseline IP of the monitored object. Screen the access records of the monitored object according to the baseline IP, and screen out the access records with the source IP as the baseline IP in the access records to form a primary record set. According to the primary record set, calculate the average value and the standard deviation of the traffic packet data values corresponding to each traffic record in the primary record set, and set the first parameter; calculate the value obtained by multiplying the standard deviation by the first parameter, and calculate the value obtained by adding this value to the average value as the first screening value.

[0017] S1-3. Screen the primary record set according to the first screening value, and screen out the access records with the traffic packet data value less than or equal to the first screening value in the traffic record to obtain the first screening set.

[0018] Extract the access records of the monitored object from the database, and conduct a preliminary screening through the traffic data to remove irrelevant data and improve the accuracy of subsequent analysis; determine the main IP of the monitored object by calculating the number of occurrences of the source IP to improve the reliability of the screened data; screen out the access records that meet the requirements through traffic statistical analysis to reduce the interference of abnormal data.

[0019] According to the above technical solution, the step S2 includes:

[0020] S2-1. Extract the access paths of each behavior record from the first screening set, count the access path with the most occurrences as the benchmark path of the monitoring object; screen the first screening set according to the benchmark path to filter out the access records with the access path being the benchmark path, and obtain the second screening set;

[0021] S2-2. Calculate the average value of the traffic packet data values corresponding to each traffic record according to the traffic records in the second screening set as the benchmark data value of the monitoring object; extract the maximum value of the traffic packet data values corresponding to each traffic record, and calculate the ratio of the maximum value to the benchmark data value as the maximum data volume of the monitoring object; use the benchmark IP, benchmark data value, and maximum data volume as the benchmark traffic characteristics of the monitoring object;

[0022] S2-3. Calculate the average value of the residence intervals in each behavior record according to the behavior records in the second screening set in combination with the residence intervals in the behavior records as the benchmark interval of the monitoring object; extract the maximum value of the residence intervals corresponding to each behavior record, and calculate the ratio of the maximum value to the benchmark interval as the maximum interval of the monitoring object; use the benchmark path, benchmark interval, and maximum interval as the benchmark behavior characteristics of the monitoring object;

[0023] Further screen the access records and calculate the benchmark traffic characteristics and benchmark behavior characteristics of the monitoring object to provide a reference for normal access patterns; through access path analysis, screen out the path with the highest access frequency to determine the benchmark path of normal access behavior; by calculating the mean and maximum values of traffic packet data, determine the benchmark value of normal access traffic to provide a basis for abnormal traffic judgment; by calculating the mean and maximum values of residence intervals, determine the normal residence time of user behavior to provide a standard for abnormal behavior judgment.

[0024] According to the above technical solution, the step S3 includes:

[0025] S3-1. Calculate the ratio of the maximum data volume to the benchmark data value as the data parameter according to the benchmark traffic characteristics of the monitoring object; obtain the traffic packet data value in a certain access record, and calculate the ratio of the traffic packet data value in this access record to the benchmark data value as the data anomaly characteristic of the monitoring object;

[0026] If the source IP in the access record of the monitoring object is different from the benchmark IP, it is used as the IP anomaly characteristic of the monitoring object; use the data parameter, data anomaly characteristic, and IP anomaly characteristic as the abnormal traffic characteristics of the monitoring object;

[0027] S3-2. Calculate the ratio of the maximum interval to the reference interval based on the reference behavior characteristics of the monitored object as the interval parameter; obtain the stay interval in a certain access record, and calculate the ratio of the stay interval in this access record to the reference interval as the interval anomaly characteristic of the monitored object;

[0028] If the access path in the access record of the monitored object is different from the reference path, it is used as the path anomaly characteristic of the monitored object; the interval parameter, the interval anomaly characteristic, and the path anomaly characteristic are used as the abnormal traffic characteristics of the monitored object;

[0029] S3-3. Set the data weight and the interval weight according to the abnormal traffic characteristics and the behavior anomaly characteristics, calculate the value obtained by multiplying the data weight by the data parameter as the data threshold; calculate the value obtained by multiplying the interval weight by the interval parameter as the interval threshold; calculate the value obtained by adding the data judgment score and the interval judgment score as the abnormal threshold;

[0030] Calculate the value obtained by multiplying the data weight by the data anomaly characteristic as the data anomaly score; calculate the value obtained by multiplying the interval weight by the interval anomaly characteristic as the interval anomaly score; calculate the value obtained by adding the data anomaly score and the interval anomaly score as the comprehensive anomaly score;

[0031] If the comprehensive anomaly score corresponding to a certain access record of the monitored object is less than or equal to the abnormal threshold, and there are no IP anomaly characteristics and path anomaly characteristics, then the abnormal level of the monitored object is the first level;

[0032] If the comprehensive anomaly score corresponding to a certain access record of the monitored object is less than or equal to the abnormal threshold, and there are IP anomaly characteristics or path anomaly characteristics, then the abnormal level of the monitored object is the second level;

[0033] If the comprehensive anomaly score corresponding to a certain access record of the monitored object is greater than the abnormal threshold, then the abnormal level of the monitored object is the third level;

[0034] Conduct abnormal analysis on the access record, and classify the risk level of the monitored object according to the degree of abnormality; judge whether the access traffic is abnormal by calculating the traffic characteristics; identify the abnormal situation of the access behavior by calculating the behavior characteristics; set the abnormal level through the calculation of data weight and behavior weight to ensure the comprehensiveness of abnormal detection, improve the detection accuracy, and reduce the false alarm and missed alarm rates.

[0035] According to the above technical solution, the step S4 includes:

[0036] Based on the real-time access record of the monitored object, obtain the IP anomaly characteristic, the path anomaly characteristic, and the comprehensive anomaly score corresponding to the access record, and judge the real-time abnormal level of the monitored object;

[0037] If the real-time abnormal level of the monitored object is the first level, no operation is performed;

[0038] If the real-time anomaly level of the monitored object is the second level, then perform identity verification on the monitored object; if the identity verification passes, do not prohibit the access of the monitored object; if the identity verification fails, prohibit the access of the monitored object and issue an anomaly warning.

[0039] If the real-time anomaly level of the monitored object is the third level, then prohibit the access of the monitored object and issue an anomaly warning.

[0040] Execute different protection strategies according to the anomaly level of the monitored object to ensure network security; the first level allows normal access without affecting the user experience; the second level requires identity verification to improve security and avoid mis-blocking normal users; the third level directly blocks and alarms to prevent damage caused by potential attacks; through hierarchical response, improve the flexibility and effectiveness of network security protection.

[0041] A network anomaly monitoring system based on data analysis, which includes a data acquisition module, a data analysis module, an anomaly detection module, and a protection response module.

[0042] The data acquisition module is used to obtain and store the traffic data and behavior data of the monitored object's access, including the source IP, traffic packet data value, access path, and stay interval; the data analysis module is used to calculate the baseline traffic characteristics and baseline behavior characteristics of the monitored object, including the baseline IP, baseline data value, baseline path, and baseline interval; the anomaly detection module is used to analyze the anomaly traffic characteristics and behavior anomaly characteristics of the monitored object, and analyze the anomaly level of the monitored object to determine whether there is an IP anomaly or a path anomaly; the protection response module is used to perform identity verification, access restriction, or anomaly warning according to the real-time anomaly level of the monitored object to ensure the effectiveness of the network security protection strategy.

[0043] According to the above technical solution, the data acquisition module includes a traffic recording unit and a behavior recording unit.

[0044] The traffic recording unit is used to obtain and store the traffic data of the monitored object's access, including the source IP and traffic packet data value, providing basic data for traffic analysis; the behavior recording unit is used to obtain and store the access behavior data of the monitored object, including information such as the access path and stay interval, providing support for behavior analysis.

[0045] According to the above technical solution, the data analysis module includes a traffic analysis unit and a behavior analysis unit.

[0046] The flow analysis unit is used to count and calculate the benchmark flow characteristics of the monitored object, including the benchmark IP, the benchmark data value, and the maximum data volume, to judge the abnormal flow characteristics; the behavior analysis unit is used to calculate the benchmark behavior characteristics of the monitored object, including the benchmark path, the benchmark interval, and the maximum interval volume, to judge the behavior abnormal characteristics.

[0047] According to the above technical solution, the anomaly detection module includes a flow detection unit and a behavior detection unit;

[0048] The flow detection unit is used to calculate the data anomaly characteristics and the IP anomaly characteristics according to the ratio of the maximum data volume to the benchmark data value, combined with the real-time access flow data, to judge whether there is abnormal flow; the behavior detection unit is used to calculate the interval anomaly characteristics and the path anomaly characteristics according to the ratio of the maximum interval volume to the benchmark interval, combined with the real-time access behavior data, to judge whether there is behavior anomaly.

[0049] According to the above technical solution, the protection response module includes a level determination unit and a policy execution unit;

[0050] The level determination unit is used to calculate the comprehensive anomaly score and divide the anomaly level according to the abnormal flow characteristics and the behavior abnormal characteristics, so as to determine the corresponding processing strategy; the policy execution unit is used to execute different protection schemes according to the real-time anomaly level to ensure network security.

[0051] Compared with the prior art, the beneficial effects achieved by the present invention are as follows:

[0052] The present invention accurately models the network flow characteristics and user behavior patterns, and dynamically adjusts the anomaly detection threshold in combination with real-time monitoring data, realizing the intelligent identification of network anomalies, improving the accuracy and robustness of the monitoring system; at the same time, the present invention establishes standardized flow characteristics and behavior characteristics through historical access data, optimizes the anomaly detection process, effectively reduces the false alarm rate and the missed alarm rate, and improves the accuracy of network security protection; secondly, the present invention combines the flow characteristic screening, the behavior characteristic matching and the anomaly level division to accurately identify potential threats, shorten the response time, reduce the limitations of the traditional rule matching method, and improve the system's ability to adapt to complex attack patterns; in addition, the present invention combines dynamic protection strategies, and automatically executes identity verification, access restriction or alarm response according to the anomaly level, ensuring the real-time and effectiveness of network security protection, and improving the stability and practicality of the network security monitoring system. Description of the Drawings

[0053] The drawings are used to provide a further understanding of the present invention, and constitute a part of the specification, and are used to explain the present invention together with the embodiments of the present invention, and do not constitute a limitation to the present invention. In the drawings:

[0054] Figure 1 It is a schematic flowchart of a network anomaly monitoring method based on data analysis according to the present invention;

[0055] Figure 2 It is a schematic structural diagram of a network anomaly monitoring system based on data analysis according to the present invention. Specific embodiments

[0056] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0057] Please refer to Figure 1 , the present invention provides a technical solution:

[0058] A network anomaly monitoring method based on data analysis, the method includes the following steps:

[0059] S1. Obtain the access records of the monitoring object from the database, and the access records include traffic records and behavior records; according to the traffic records, screen all the access records of the monitoring object to obtain a first screening set;

[0060] According to the above technical solution, the step S1 includes:

[0061] S1-1. Each time the monitoring object accesses the server, generate an access record and store it in the database; the traffic record includes the source IP and the traffic packet data value; the behavior record includes the access path and the stay interval;

[0062] The traffic packet data value refers to the size of the data packet sent or received by the monitoring object when accessing the server; the access path refers to the specific URL path requested by the monitoring object when accessing the server; the stay interval refers to the length of time the monitoring object stays after accessing a certain page or resource;

[0063] S1-2. Extract all the access records of the monitoring object from the database, count the number of occurrences of each source IP in all the traffic records according to the source IP in the traffic records, obtain the source IP with the most occurrences as the reference IP of the monitoring object; screen the access records in which the source IP is the reference IP from all the access records of the monitoring object to form a primary record set; according to the primary record set, calculate the average value and the standard deviation of the traffic packet data values corresponding to each traffic record in the primary record set, and set a first parameter; calculate the value obtained by multiplying the standard deviation by the first parameter, and calculate the value obtained by adding this value to the average value as the first screening value;

[0064] S1-3. Screen the first set of records according to the first screening value, and screen out the access records in the traffic records where the traffic packet data value is less than or equal to the first screening value to obtain the first screening set.

[0065] Extract the access records of the monitored object from the database, and perform preliminary screening through traffic data to remove irrelevant data and improve the accuracy of subsequent analysis; determine the main IP of the monitored object by calculating the number of occurrences of the source IP to improve the reliability of the screened data; screen out the qualified access records through traffic statistical analysis to reduce the interference of abnormal data.

[0066] In specific implementation, from the access records of the monitored object, first screen through the traffic records, and find out the records with the highest traffic value and access frequency as the basic data set. This is because the concentrated data of traffic and behavior records can accurately reflect the normal access patterns and trends, and through these screening results, we can effectively eliminate abnormal data and ensure the accuracy and reliability of subsequent analysis.

[0067] S2. Screen the first screening set according to the behavior records to obtain the second screening set; analyze the baseline traffic characteristics of the monitored object according to the traffic records in the second screening set; analyze the baseline behavior characteristics of the monitored object according to the behavior records in the second screening set.

[0068] According to the above technical solution, the step S2 includes:

[0069] S2-1. Extract the access paths of each behavior record from the first screening set, count the access path with the most occurrences as the baseline path of the monitored object; screen the first screening set according to the baseline path, and screen out the access records with the access path as the baseline path to obtain the second screening set.

[0070] S2-2. According to the traffic records in the second screening set, calculate the average value of the traffic packet data values corresponding to each traffic record as the baseline data value of the monitored object; extract the maximum value of the traffic packet data values corresponding to each traffic record, and calculate the ratio of the maximum value to the baseline data value as the maximum data volume of the monitored object; use the baseline IP, baseline data value and data maximum volume as the baseline traffic characteristics of the monitored object.

[0071] S2-3. According to the behavior records in the second screening set, combined with the stay intervals in the behavior records, calculate the average value of the stay intervals in each behavior record as the baseline interval of the monitored object; extract the maximum value of the stay intervals corresponding to each behavior record, and calculate the ratio of the maximum value to the baseline interval as the maximum interval volume of the monitored object; use the baseline path, baseline interval and interval maximum volume as the baseline behavior characteristics of the monitored object.

[0072] Further screen the access records, and calculate the baseline traffic characteristics and baseline behavior characteristics of the monitored object to provide a reference for normal access patterns; through access path analysis, screen out the path with the highest access frequency to determine the baseline path of normal access behavior; by calculating the mean and maximum values of the traffic packet data, determine the baseline value of normal access traffic to provide a basis for abnormal traffic judgment; by calculating the mean and maximum values of the stay intervals, determine the normal stay time of user behavior to provide a standard for abnormal behavior judgment.

[0073] Based on the target data set, further screen out the most representative behavior characteristics such as access paths and stay intervals as baseline characteristics. This is because selecting the most common access paths and stay times can centrally reflect the access habits of normal users, provide a clear and comparable baseline reference for subsequent anomaly detection, and thus improve the ability to identify potential abnormal behaviors.

[0074] S3. Analyze the abnormal traffic characteristics of the monitored object according to the baseline traffic characteristics of the monitored object; analyze the behavioral abnormal characteristics of the monitored object according to the baseline behavior characteristics of the monitored object; divide the abnormal levels of the monitored object according to the abnormal traffic characteristics and behavioral abnormal characteristics.

[0075] According to the above technical solution, the step S3 includes:

[0076] S3-1. Calculate the ratio of the maximum amount of data to the baseline data value as a data parameter according to the baseline traffic characteristics of the monitored object; obtain the traffic packet data value in a certain access record, and calculate the ratio of the traffic packet data value in this access record to the baseline data value as the data abnormal characteristic of the monitored object.

[0077] If the source IP in the access record of the monitored object is different from the baseline IP, it is used as the IP abnormal characteristic of the monitored object; the data parameter, data abnormal characteristic, and IP abnormal characteristic are used as the abnormal traffic characteristics of the monitored object.

[0078] S3-2. Calculate the ratio of the maximum interval to the baseline interval as an interval parameter according to the baseline behavior characteristics of the monitored object; obtain the stay interval in a certain access record, and calculate the ratio of the stay interval in this access record to the baseline interval as the interval abnormal characteristic of the monitored object.

[0079] If the access path in the access record of the monitored object is different from the baseline path, it is used as the path abnormal characteristic of the monitored object; the interval parameter, interval abnormal characteristic, and path abnormal characteristic are used as the abnormal traffic characteristics of the monitored object.

[0080] S3-3. Set data weights and interval weights according to the abnormal traffic characteristics and behavioral anomaly characteristics, calculate the product of the data weight and the data parameter as the data threshold; calculate the product of the interval weight and the interval parameter as the interval threshold; calculate the sum of the data judgment score and the interval judgment score as the anomaly threshold.

[0081] Calculate the product of the data weight and the data anomaly characteristic as the data anomaly score; calculate the product of the interval weight and the interval anomaly characteristic as the interval anomaly score; calculate the sum of the data anomaly score and the interval anomaly score as the comprehensive anomaly score.

[0082] If the comprehensive anomaly score corresponding to a certain access record of the monitored object is less than or equal to the anomaly threshold, and there are no IP anomaly characteristics and path anomaly characteristics, then the anomaly level of the monitored object is the first level.

[0083] If the comprehensive anomaly score corresponding to a certain access record of the monitored object is less than or equal to the anomaly threshold, and there are IP anomaly characteristics or path anomaly characteristics, then the anomaly level of the monitored object is the second level.

[0084] If the comprehensive anomaly score corresponding to a certain access record of the monitored object is greater than the anomaly threshold, then the anomaly level of the monitored object is the third level.

[0085] Perform anomaly analysis on the access record and classify the risk level of the monitored object according to the degree of anomaly; judge whether the access traffic is abnormal by calculating the traffic characteristics; identify the abnormal situation of the access behavior by calculating the behavior characteristics; set the anomaly level through the calculation of data weights and behavior weights to ensure the comprehensiveness of anomaly detection, improve the detection accuracy, and reduce the false alarm and missed alarm rates.

[0086] S4. According to the real-time access record of the monitored object, judge the real-time anomaly level of the monitored object, and execute different protection schemes according to the real-time anomaly level of the monitored object.

[0087] According to the above technical solution, the step S4 includes:

[0088] According to the real-time access record of the monitored object, obtain the IP anomaly characteristics, path anomaly characteristics and comprehensive anomaly score of the corresponding access record, and judge the real-time anomaly level of the monitored object.

[0089] If the real-time anomaly level of the monitored object is the first level, no operation is performed.

[0090] If the real-time anomaly level of the monitored object is the second level, authenticate the monitored object; if the authentication is passed, do not prohibit the access of the monitored object; if the authentication fails, prohibit the access of the monitored object and issue an anomaly alarm.

[0091] If the real - time anomaly level of the monitored object is the third level, access to the monitored object is prohibited and an anomaly warning is issued;

[0092] According to the anomaly level of the monitored object, different protection strategies are executed to ensure network security; the first level allows normal access without affecting the user experience; the second level requires identity verification to improve security and avoid mis - blocking normal users; the third level directly blocks and alarms to prevent damage caused by potential attacks; through hierarchical response, the flexibility and effectiveness of network security protection are improved.

[0093] Please refer to Figure 2 , a network anomaly monitoring system based on data analysis, which includes a data acquisition module, a data analysis module, an anomaly detection module, and a protection response module;

[0094] The data acquisition module is used to obtain and store the traffic data and behavior data of the monitored object's access, including source IP, traffic packet data value, access path, and stay interval; the data analysis module is used to calculate the baseline traffic characteristics and baseline behavior characteristics of the monitored object, including baseline IP, baseline data value, baseline path, and baseline interval; the anomaly detection module is used to analyze the anomaly traffic characteristics and behavior anomaly characteristics of the monitored object, and analyze the anomaly level of the monitored object to determine whether there is IP anomaly or path anomaly; the protection response module is used to execute identity verification, access restriction, or anomaly warning according to the real - time anomaly level of the monitored object to ensure the effectiveness of the network security protection strategy.

[0095] According to the above - mentioned technical solution, the data acquisition module includes a traffic recording unit and a behavior recording unit;

[0096] The traffic recording unit is used to obtain and store the traffic data of the monitored object's access, including source IP and traffic packet data value, providing basic data for traffic analysis; the behavior recording unit is used to obtain and store the access behavior data of the monitored object, including information such as access path and stay interval, providing support for behavior analysis.

[0097] According to the above - mentioned technical solution, the data analysis module includes a traffic analysis unit and a behavior analysis unit;

[0098] The traffic analysis unit is used to count and calculate the baseline traffic characteristics of the monitored object, including baseline IP, baseline data value, and maximum data volume, to judge the anomaly traffic characteristics; the behavior analysis unit is used to calculate the baseline behavior characteristics of the monitored object, including baseline path, baseline interval, and maximum interval, to judge the behavior anomaly characteristics.

[0099] According to the above - mentioned technical solution, the anomaly detection module includes a traffic detection unit and a behavior detection unit;

[0100] The flow detection unit is used to calculate data anomaly features and IP anomaly features based on the ratio of the maximum data volume to the reference data value and in combination with real-time access flow data, and determine whether there is abnormal traffic; the behavior detection unit is used to calculate interval anomaly features and path anomaly features based on the ratio of the maximum interval to the reference interval and in combination with real-time access behavior data, and determine whether there is behavioral anomaly.

[0101] According to the above technical solution, the protection response module includes a level determination unit and a policy execution unit;

[0102] The level determination unit is used to calculate a comprehensive anomaly score based on the abnormal traffic features and behavioral anomaly features, and divide the anomaly level to determine the corresponding processing strategy; the policy execution unit is used to execute different protection schemes according to the real-time anomaly level to ensure network security.

[0103] It should be noted that in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the term "comprises", "comprising" or any other variation thereof is intended to cover a non-exclusive inclusion, such that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not expressly listed, or elements inherent to such process, method, article or device. Finally, it should be noted that the above are only preferred embodiments of the present invention and are not used to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some of the technical features. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims

1. A network anomaly monitoring method based on data analysis, characterized in that: The method includes the following steps: S1. Obtain the access records of the monitored object from the database, where the access records include traffic records and behavior records; according to the traffic records, screen all the access records of the monitored object to obtain a first screening set; S2. According to the behavior records, screen the first screening set to obtain a second screening set; according to the traffic records in the second screening set, analyze the baseline traffic characteristics of the monitored object; according to the behavior records in the second screening set, analyze the baseline behavior characteristics of the monitored object; S3. According to the baseline traffic characteristics of the monitored object, analyze the abnormal traffic characteristics of the monitored object; according to the baseline behavior characteristics of the monitored object, analyze the behavioral abnormal characteristics of the monitored object; according to the abnormal traffic characteristics and behavioral abnormal characteristics, divide the abnormal level of the monitored object; S4. According to the real-time access records of the monitored object, judge the real-time abnormal level of the monitored object, and execute different protection schemes according to the real-time abnormal level of the monitored object.

2. The network anomaly monitoring method based on data analysis according to claim 1, wherein: The step S1 includes: S1-1. Each time the monitored object accesses the server, generate an access record and store it in the database; the traffic record includes the source IP and the traffic packet data value; the behavior record includes the access path and the stay interval; S1-2. Extract all the access records of the monitored object from the database. According to the source IP in the traffic records, count the occurrence times of each source IP in all the traffic records, and obtain the source IP with the most occurrence times as the baseline IP of the monitored object; screen all the access records of the monitored object according to the baseline IP, and screen out the access records with the source IP as the baseline IP in the access records to form a first record set; according to the first record set, calculate the average value and the standard deviation of the traffic packet data values corresponding to each traffic record in the first record set, and set a first parameter; calculate the value obtained by multiplying the standard deviation by the first parameter, and calculate the value obtained by adding this value to the average value as the first screening value; S1-3. Screen the first record set according to the first screening value, and screen out the access records with the traffic packet data value less than or equal to the first screening value in the traffic records to obtain a first screening set.

3. The network anomaly monitoring method based on data analysis according to claim 2, characterized in that: The step S2 includes: S2-1. Extract the access paths of each behavior record from the first screening set, and count the access path with the most occurrence times as the baseline path of the monitored object; screen the first screening set according to the baseline path, and screen out the access records with the access path as the baseline path to obtain a second screening set; S2-2. According to the traffic records in the second screening set, calculate the average value of the traffic packet data values corresponding to each traffic record as the baseline data value of the monitored object; extract the maximum value of the traffic packet data values corresponding to each traffic record, and calculate the ratio of the maximum value to the baseline data value as the maximum data volume of the monitored object; regard the baseline IP, the baseline data value and the maximum data volume as the baseline traffic characteristics of the monitored object; S2-3. Based on the behavior records in the second screening set, combined with the residence intervals in the behavior records, calculate the average value of the residence intervals in each behavior record as the benchmark interval of the monitored object; extract the maximum value of the residence intervals corresponding to each behavior record, and calculate the ratio of the maximum value to the benchmark interval as the maximum interval amount of the monitored object; use the benchmark path, benchmark interval, and maximum interval amount as the benchmark behavior characteristics of the monitored object.

4. A network anomaly monitoring method based on data analysis according to claim 3, characterized in that: The step S3 includes: S3-1. According to the benchmark traffic characteristics of the monitored object, calculate the ratio of the maximum data amount to the benchmark data value as the data parameter; obtain the data packet data value in a certain access record, and calculate the ratio of the data packet data value in this access record to the benchmark data value as the data anomaly characteristic of the monitored object; If the source IP in the access record of the monitored object is different from the benchmark IP, it is used as the IP anomaly characteristic of the monitored object; use the data parameter, data anomaly characteristic, and IP anomaly characteristic as the abnormal traffic characteristics of the monitored object. S3-2. According to the benchmark behavior characteristics of the monitored object, calculate the ratio of the maximum interval amount to the benchmark interval as the interval parameter; obtain the residence interval in a certain access record, and calculate the ratio of the residence interval in this access record to the benchmark interval as the interval anomaly characteristic of the monitored object; If the access path in the access record of the monitored object is different from the benchmark path, it is used as the path anomaly characteristic of the monitored object; use the interval parameter, interval anomaly characteristic, and path anomaly characteristic as the abnormal traffic characteristics of the monitored object. S3-3. According to the abnormal traffic characteristics and behavior abnormal characteristics, set the data weight and interval weight, calculate the value obtained by multiplying the data weight by the data parameter as the data threshold; calculate the value obtained by multiplying the interval weight by the interval parameter as the interval threshold; calculate the value obtained by adding the data judgment score and the interval judgment score as the abnormal threshold; Calculate the value obtained by multiplying the data weight by the data anomaly characteristic as the data anomaly score; calculate the value obtained by multiplying the interval weight by the interval anomaly characteristic as the interval anomaly score; calculate the value obtained by adding the data anomaly score and the interval anomaly score as the comprehensive anomaly score; If the comprehensive anomaly score corresponding to a certain access record of the monitored object is less than or equal to the abnormal threshold, and there are no IP anomaly characteristics and path anomaly characteristics, then the abnormal level of the monitored object is the first level; If the comprehensive anomaly score corresponding to a certain access record of the monitored object is less than or equal to the abnormal threshold, and there are IP anomaly characteristics or path anomaly characteristics, then the abnormal level of the monitored object is the second level; If the comprehensive anomaly score corresponding to a certain access record of the monitored object is greater than the abnormal threshold, then the abnormal level of the monitored object is the third level.

5. A network anomaly monitoring method based on data analysis according to claim 4, characterized in that: The step S4 includes: According to the real-time access record of the monitored object, obtain the IP anomaly characteristic, path anomaly characteristic, and comprehensive anomaly score of the corresponding access record, and judge the real-time abnormal level of the monitored object; If the real-time abnormal level of the monitored object is the first level, no operation is performed; If the real-time abnormal level of the monitored object is the second level, authenticate the monitored object; if the authentication is passed, do not prohibit the access of the monitored object; if the authentication fails, prohibit the access of the monitored object and issue an abnormal alarm. If the real-time anomaly level of the monitored object is the third level, access to the monitored object shall be prohibited and an anomaly alarm shall be issued.

6. A network anomaly monitoring system based on data analysis, which is used to implement a network anomaly monitoring method based on data analysis according to any one of claims 1-5, and is characterized in that: The system includes a data acquisition module, a data analysis module, an anomaly detection module, and a protection response module; The data acquisition module is used to obtain and store the traffic data and behavior data of the monitored object's access, including the source IP, traffic packet data value, access path, and stay interval; The data analysis module is used to calculate the baseline traffic characteristics and baseline behavior characteristics of the monitored object, including the baseline IP, baseline data value, baseline path, and baseline interval; The anomaly detection module is used to analyze the anomaly traffic characteristics and behavior anomaly characteristics of the monitored object, and analyze the anomaly level of the monitored object to determine whether there is an IP anomaly or a path anomaly; the protection response module is used to perform authentication, access restriction, or anomaly alarm according to the real-time anomaly level of the monitored object to ensure the effectiveness of the network security protection strategy.

7. An network anomaly monitoring system based on data analysis according to claim 6, characterized in that: The data acquisition module includes a traffic recording unit and a behavior recording unit; The traffic recording unit is used to obtain and store the traffic data of the monitored object's access, including the source IP and traffic packet data value, providing basic data for traffic analysis; the behavior recording unit is used to obtain and store the access behavior data of the monitored object, including information such as the access path and stay interval, providing support for behavior analysis.

8. An online anomaly monitoring system based on data analysis according to claim 6, characterized in that: The data analysis module includes a traffic analysis unit and a behavior analysis unit; The traffic analysis unit is used to count and calculate the baseline traffic characteristics of the monitored object, including the baseline IP, baseline data value, and maximum data volume, to determine the anomaly traffic characteristics; The behavior analysis unit is used to calculate the baseline behavior characteristics of the monitored object, including the baseline path, baseline interval, and maximum interval volume, to determine the behavior anomaly characteristics.

9. An anomaly monitoring system for a network based on data analysis according to claim 6, wherein: The anomaly detection module includes a traffic detection unit and a behavior detection unit; The traffic detection unit is used to calculate the data anomaly characteristics and IP anomaly characteristics according to the ratio of the maximum data volume to the baseline data value, combined with the real-time access traffic data, to determine whether there is abnormal traffic; the behavior detection unit is used to calculate the interval anomaly characteristics and path anomaly characteristics according to the ratio of the maximum interval volume to the baseline interval, combined with the real-time access behavior data, to determine whether there is behavior anomaly.

10. The network anomaly monitoring system based on data analysis according to claim 6, characterized in that: The protection response module includes a level determination unit and a policy execution unit; The level determination unit is used to calculate the comprehensive anomaly score and divide the anomaly level according to the anomaly traffic characteristics and behavior anomaly characteristics to determine the corresponding processing strategy; the policy execution unit is used to execute different protection schemes according to the real-time anomaly level to ensure network security.

Images