A security event early warning and response method based on an operator-level network

Abstract

The application provides a security event early warning and response method based on an operator-level network, comprising: collecting login failure frequencies and verification timeout times of each authentication node of the operator-level network, obtaining time characteristics of abnormal authentication requests according to time interval statistical distribution of user password error retries, judging whether a certificate expiration trigger threshold is within a preset range to obtain preliminary authentication anomaly distribution data; according to an identification result of the potential threat, dynamically adjusting authentication security policy parameters of the certificate expiration trigger threshold and a token refresh failure ratio, reducing a biometric identification false rejection rate through session hijacking detection delay time optimization, and obtaining system overall security protection effect evaluation data after optimization of an authority verification response time.

Description

Technical Field

[0001] This invention relates to the field of information technology, and in particular to a method for early warning and response to security incidents based on carrier-grade networks. Background Technology

[0002] As a core pillar of modern communication network security, identity authentication systems bear the important mission of protecting user privacy and system resources. Their stability and reliability directly affect user trust and the continuity of network services. In the business environment of telecom operators, identity authentication is not only the first line of defense for users accessing services but also a key barrier against illegal intrusion and data leakage. However, with the continuous evolution of network attack methods, the security challenges of authentication systems are becoming increasingly severe, making research on how to deal with abnormal behavior and ensure system security particularly urgent. Currently, although many identity authentication systems have deployed various protective measures, these methods often reveal shortcomings when facing complex and ever-changing attack scenarios. Especially in the case of large-scale abnormal user behavior, existing solutions struggle to quickly identify and respond to regional problems, lacking the ability to dynamically perceive the overall system operating status, leading to the rapid spread of potential risks in a short period. Furthermore, existing methods often ignore the differentiated characteristics of different regions or devices when handling anomalies, making precise responses difficult. Against this backdrop, the core challenges facing identity authentication systems are increasingly focusing on changes in authentication request patterns and their impact on system security. When the user authentication failure rate suddenly surges in certain areas, the load on the authentication server quickly becomes unbalanced. This imbalance further exacerbates the uneven distribution of system resources and can even trigger a chain reaction of mass account locking. In other words, a large number of legitimate users are locked out due to misjudgments by the system's protection mechanisms, hindering normal business access and further worsening the system load. This problem can be mitigated by dynamically monitoring the distribution of authentication anomalies, intelligently adjusting resource allocation strategies, and implementing differentiated account unlocking verification mechanisms. This transmission process from local anomalies to global impact makes it difficult for the system to maintain a good access experience for legitimate users while also failing to effectively contain potential security threats. Therefore, how to dynamically adjust the authentication strategy of the identity authentication system when authentication request patterns change drastically, in order to balance the access convenience for legitimate users and the system's security protection capabilities, has become a critical issue that urgently needs to be addressed. Summary of the Invention

[0003] This invention provides a security incident early warning and response method based on carrier-grade networks, mainly including:

[0004] Collect login failure frequency and verification timeout number of each authentication node in the carrier-grade network to generate authentication anomaly distribution data;

[0005] Based on the statistical analysis of the authentication anomaly distribution data, the token refresh failure ratio is used to generate the permission verification response time distribution characteristics of the high-risk authentication area.

[0006] Based on the permission verification response time distribution characteristics, collect the memory pool fragmentation degree and thread pool saturation index of the corresponding server node, determine the abnormal resource allocation location, and identify server nodes whose cache hit rate drops beyond the preset standard.

[0007] Based on the peak network bandwidth usage data of the server node, a backup server node is identified whose processing load and network bandwidth utilization are both lower than a preset threshold.

[0008] Memory optimization is performed on the backup server node to adjust server processing capacity, fix database connection anomalies, and generate identity verification results based on the user's historical authentication success rate and session status.

[0009] Based on the identity legitimacy verification results, statistical data on the changes in authentication failure frequency of affected users is collected, the correlation between multi-factor authentication timeout and access interruption is analyzed, and potential attack threats such as abnormal password error retry intervals and a surge in verification failure frequency are identified.

[0010] Based on the potential attack threats, optimize the session hijacking detection latency and generate security protection data with optimized permission verification response time.

[0011] Furthermore, the collection of login failure frequency and verification timeout counts for each authentication node in the carrier-grade network generates authentication anomaly distribution data, including:

[0012] Login failure events and verification timeout events from each authentication node are collected to generate authentication event records containing node identifiers and timestamps. Based on the time difference between adjacent password error retry requests in the authentication event records, time interval distribution data is generated. Anomaly detection is performed on the time interval distribution data, marking authentication requests with time intervals below a preset threshold, and extracting the occurrence time and frequency characteristics of these authentication requests. Based on the frequency characteristics and certificate validity data, the correlation between the remaining certificate validity time and the frequency of abnormal requests is calculated to generate a certificate expiration trigger threshold. The certificate expiration trigger threshold is compared with a preset range, and node data meeting the criteria is retained to generate authentication anomaly distribution data.

[0013] Furthermore, the step of generating the permission verification response time distribution characteristics of the high-risk authentication area based on the statistical token refresh failure ratio of the authentication anomaly distribution data includes:

[0014] Based on the authentication anomaly distribution data, the total number of token refresh requests and the number of failures are counted to generate the token refresh failure ratio. When the failure ratio exceeds a preset benchmark value, the session verification interval is adjusted, and the frequency and source data of session requests are collected to generate an abnormal session behavior pattern. Based on the abnormal session behavior pattern, biometric authentication records are extracted to generate a false rejection rate change sequence. Based on the false rejection rate change sequence and the total number of business access requests, the access volume density and authentication failure rate deviation are calculated to identify high-risk authentication areas. For the permission verification requests in the high-risk authentication areas, the response time distribution is statistically analyzed to generate the permission verification response time distribution characteristics of the high-risk authentication areas.

[0015] Furthermore, based on the permission verification response time distribution characteristics, the step of collecting the memory pool fragmentation level and thread pool saturation index of the corresponding server node to determine the location of abnormal resource allocation includes:

[0016] Based on the distribution characteristics of the permission verification response time, the identifiers of server nodes whose response times exceed the standard are extracted; the memory pool usage data of the server nodes is collected to generate the memory pool fragmentation degree; the thread pool operation data of the server nodes is statistically analyzed to generate the thread pool saturation index; based on the memory pool fragmentation degree and the thread pool saturation index, the changes in the number of active connections in the database connection pool are detected to determine the location of abnormal resource allocation.

[0017] Furthermore, determining standby server nodes whose processing load and network bandwidth utilization are both below a preset threshold based on the peak network bandwidth usage data of the server nodes includes:

[0018] Based on the peak network bandwidth usage data of the server nodes, bandwidth usage values ​​during peak business hours are collected; when the bandwidth usage value exceeds the capacity threshold, the business request processing order is analyzed to generate response latency data; based on the response latency data and the load balancer weight configuration, a weight offset value is generated; combining the weight offset value and business traffic data, nodes with uneven traffic distribution are identified; the load and bandwidth data of standby server nodes are scanned to determine standby server nodes whose processing load and network bandwidth utilization are both lower than a preset threshold.

[0019] Furthermore, the step of performing memory defragmentation on the backup server node, adjusting server processing capacity, and repairing database connection anomalies includes:

[0020] The system performs a scan on the memory usage data of the standby server node to generate memory fragmentation region data; based on the memory fragmentation region data, it merges memory blocks to generate total available memory data; based on the total available memory data, it allocates memory resources to service processes; it adjusts the thread pool parameters of the standby server node to generate standard processing capacity data; it detects the database connection pool of the standby server node, closes abnormal connections and rebuilds new connections, and generates repaired connection pool usage data.

[0021] Furthermore, based on the identity validity verification results, the method of statistically analyzing the changes in authentication failure frequency of affected users, analyzing the correlation between multi-factor authentication timeouts and access interruptions, and identifying potential attack threats such as abnormal password error retry intervals and a surge in verification failure frequency includes:

[0022] Based on the identity verification results, the number of authentication failure events is counted to generate failure frequency change data; based on the failure frequency change data, the number of timeouts for SMS verification codes and dynamic passwords is counted to generate access interruption correlation data; based on the access interruption correlation data, the correlation between timeout and interruption is calculated; when the correlation and failure frequency growth rate exceed a preset threshold, the password error retry interval sequence is analyzed to generate potential attack threat data.

[0023] Furthermore, the step of optimizing the session hijacking detection latency based on the potential attack threats and generating security protection data with optimized permission verification response time includes:

[0024] Based on the potential attack threats, attack frequency and source data are generated; based on the attack frequency data, the certificate expiration trigger threshold and token refresh failure rate are adjusted to generate a set of security parameters; based on the set of security parameters, the session hijacking detection scan interval is adjusted to generate optimized false rejection rate data; based on the false rejection rate data, the distribution of permission verification response time is statistically analyzed to generate security protection data including success rate and availability indicators.

[0025] The technical solutions provided by the embodiments of the present invention may include the following beneficial effects:

[0026] This invention discloses a security incident early warning and response method based on carrier-grade networks, addressing comprehensive business issues such as abnormally high authentication failure frequency, response delays, and potential brute-force attacks. By monitoring login failure and timeout data of authentication nodes, this invention analyzes the temporal characteristics of abnormal authentication requests, determines the certificate expiration trigger threshold, and identifies high-risk authentication areas. For the permission verification response time distribution in high-risk areas, this invention combines server node memory pool fragmentation, thread pool saturation, and database connection pool leakage detection to locate key nodes with abnormal resource allocation. Through load balancer weight offset and traffic analysis, low-load backup nodes are identified for resource reallocation, optimizing memory usage and repairing database connection anomalies. If caching performance is still insufficient, this invention initiates a batch account unlocking verification mechanism, verifies identity legitimacy based on the user's historical authentication success rate, dynamically adjusts authentication security policy parameters, optimizes session hijacking detection delay, and reduces biometric false rejection rates. This invention significantly improves the overall system security protection effect, reduces the risk of authentication failures and access interruptions, effectively resists brute-force and credential stuffing attacks, and achieves efficient and stable network authentication services. Attached Figure Description

[0027] Figure 1 This is a flowchart of a security incident early warning and response method based on a carrier-grade network according to the present invention. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0029] like Figure 1 This embodiment of a security event early warning and response method based on carrier-grade networks may specifically include:

[0030] Step S101: Collect the login failure frequency and verification timeout number of each authentication node in the carrier-grade network, obtain the time characteristics of abnormal authentication requests based on the statistical distribution of the time interval of user password error retries, determine whether the certificate expiration trigger threshold is within the preset range, and obtain preliminary authentication anomaly distribution data.

[0031] The login failure frequency of each authentication node in the carrier-grade network is collected in real time, recording the number of failure events for each node within a fixed time window. Simultaneously, verification timeout data is collected, and an authentication event record table containing node identifier, timestamp, and failure type is established. The retry interval is calculated based on the time difference between two consecutive password error retry requests, and grouped and statistically analyzed according to the interval duration to form a time interval distribution histogram. Anomaly detection is performed on the time interval distribution histogram, calculating the mean and standard deviation of the interval distribution. If the retry interval within a certain time period is less than the mean minus twice the standard deviation, the authentication request within that time period is marked as an abnormal request. The occurrence time, duration, and request frequency data corresponding to the abnormal request are extracted from the authentication event record table to construct an abnormal authentication request time feature containing these three dimensions. Based on the request frequency data in the abnormal authentication request time feature, combined with the certificate validity information of each authentication node, the linear correlation between the remaining certificate validity time and the abnormal request frequency is calculated using the Pearson correlation coefficient formula. When the correlation coefficient exceeds a first preset threshold and the remaining certificate validity time is lower than a second preset threshold, the current abnormal request frequency value of that node is determined as the certificate expiration trigger threshold. By comparing the certificate expiration trigger threshold with the upper and lower limits of the preset range, if the trigger threshold is within the preset range, the abnormal authentication data of the node and the time characteristics of the abnormal authentication request are retained. All node data that meet the conditions are summarized and classified and statistically analyzed according to the authentication type of the node and the time characteristics of the abnormal request, so as to obtain preliminary authentication abnormality distribution data containing the abnormal frequency ratio and time distribution pattern of various types of authentication nodes.

[0032] For example, the authentication system of a carrier-grade network handles a massive number of user access requests. When a user enters an incorrect password, it automatically retryes, and these retry behaviors exhibit a specific time distribution pattern. Under normal circumstances, after discovering a password error, a user typically needs several seconds to tens of seconds to re-enter the password. However, malicious attacks or automated programs often have extremely short retry intervals, potentially initiating multiple requests within one second. Real-time collection of this data enables the establishment of a complete authentication event log table, providing a data foundation for subsequent anomaly detection.

[0033] In one possible implementation, constructing the time interval distribution histogram involves statistical analysis of a large number of retry events. Suppose an authentication node records 1000 password error retries in one hour. By calculating the time difference between adjacent retries, it is found that 800 intervals are between 5 and 30 seconds, 150 are between 1 and 5 seconds, and only 50 are less than 1 second. This distribution exhibits a clear normality, with a mean of approximately 12 seconds and a standard deviation of 8 seconds. When a large number of retry requests with intervals less than the mean minus twice the standard deviation are detected within a certain time period (i.e., intervals less than -4 seconds do not actually exist), but when there is a surge in requests with intervals less than 1 second, the system marks it as an anomaly.

[0034] It's important to note that the Pearson correlation coefficient in this scenario is used to quantify the strength of the association between certificate expiration and the frequency of abnormal requests. When a certificate is about to expire, some automated programs or services may frequently initiate authentication requests due to certificate verification failures, leading to a significant increase in the frequency of abnormal requests. The correlation coefficient is calculated based on the ratio of the product of the covariance and standard deviation of the two variables, ranging from -1 to 1. A positive correlation indicates that the shorter the remaining certificate time, the higher the frequency of abnormal requests; this association helps the system predict the risk of certificate expiration.

[0035] Specifically, determining the certificate expiration trigger threshold is a dynamic process. When a node's certificate has 25 days remaining validity, and the abnormal request frequency reaches 200 times per minute, with a correlation coefficient of 0.8, the system sets the current 200 requests / minute as the trigger threshold for that node. This threshold reflects the abnormal behavior pattern of that specific node when its certificate is about to expire, providing a quantitative basis for subsequent early warning and handling.

[0036] Preferably, the generation of preliminary authentication anomaly distribution data integrates multi-dimensional statistical information. By aggregating node data that meets the criteria, the system can identify the anomaly characteristics of different types of authentication nodes. For example, anomalies in Web service authentication nodes are mostly concentrated during peak business hours, while anomalies in API interface authentication nodes show a 24 / 7 distribution. This categorized statistical analysis reveals the patterns of authentication anomalies under different business scenarios, providing data support for operators to formulate targeted security strategies.

[0037] Step S102: Analyze the token refresh failure ratio based on the authentication anomaly distribution data. When the failure ratio exceeds the benchmark value, extend the session verification interval to identify abnormal session behavior patterns. At the same time, determine the high-risk authentication area with concentrated business access volume and high authentication failure rate by predicting the trend of biometric false rejection rate changes, and obtain the permission verification response time distribution characteristics of the high-risk authentication area.

[0038] Based on the authentication anomaly distribution data, the total number of token refresh requests and the number of refresh failures within each time period are statistically analyzed. The token refresh failure ratio is calculated. If the failure ratio exceeds a preset benchmark value, the current session verification interval parameter is multiplied by a preset multiple to obtain an extended verification interval. The request time, request frequency, and request source address data of all session request events occurring during the extended interval are recorded. Abnormal session behavior patterns are identified based on the abnormal peak values ​​of request frequency and the degree of clustering of request time. Based on the peak request frequency periods in the abnormal session behavior patterns, the biometric authentication history records for the corresponding periods are extracted. An autoregressive moving average model is used to calculate the ratio of the number of false biometric rejections to the total number of authentications as the false rejection rate. The false rejection rate sequence within a preset future time period is predicted. When the difference between the false rejection rates of adjacent time periods is consistently positive and the cumulative difference exceeds a preset threshold, the total number of business access requests and the number of authentication failures for the corresponding time period are recorded. The access density is obtained by dividing the total number of service access requests by the node coverage area. The ratio of authentication failures to the total number of access requests is calculated as the failure rate. The absolute value of the difference between this failure rate and the historical average failure rate is calculated as the failure rate deviation value. When more than a preset number of nodes in a certain area simultaneously meet the conditions that the access density is greater than a preset multiple of the network average density and the failure rate deviation value exceeds a preset deviation threshold, the area is determined to be a high-risk authentication area. For all authentication requests in the high-risk authentication area, the time difference from the initiation of each request to the completion of permission verification is extracted as the response time. The response times are grouped and statistically analyzed according to preset time interval boundary values. The proportion of the number of requests in each interval to the total number of requests is calculated. At the same time, the arithmetic mean, variance, and time interval with the most requests are calculated for all response times to obtain the permission verification response time distribution characteristics of the high-risk authentication area.

[0039] For example, the token refresh mechanism plays a key role in carrier-grade network authentication systems. When a user's access token is about to expire, the system will automatically initiate a refresh request to maintain session continuity.

[0040] In one possible implementation, suppose a carrier's network detects a sharp increase in the token refresh failure rate from the usual 5% to 30% during the morning peak hours. This anomaly often indicates a performance bottleneck or attack on the authentication service. By extending the session verification interval from the original 10 minutes to 30 minutes, the system can reduce the frequency of verification requests, providing a larger time window for identifying genuine users and abnormal behavior.

[0041] It should be noted that identifying abnormal session behavior patterns relies on precise analysis of request characteristics. Normal user session requests typically exhibit a regular distribution, while abnormal behavior manifests as a surge in requests within a short period of time.

[0042] For example, if an IP address initiates 50 authentication requests in a row within an extended authentication interval, with each request only 2 seconds apart, this high-frequency request pattern clearly deviates from normal user behavior, and the system will mark it as an abnormal session.

[0043] Specifically, the autoregressive moving average model plays a crucial role in predicting trends in biometric false rejection rates. By analyzing the autocorrelation and moving average characteristics of historical false rejection rate data, this model can capture the time dependence of the data. When the fingerprint recognition system experiences a decline in recognition accuracy due to equipment aging, the false rejection rate will show a gradual upward trend. Assuming the false rejection rates for three consecutive days are 2%, 3.5%, and 5%, the model predicts that it may reach 6.8% on the fourth day. This continuously rising trend suggests that the system needs to focus on improving the authentication quality in the relevant areas.

[0044] In one embodiment, the access density calculation reflects the authentication pressure within a unit area. A central area covers 2 square kilometers, and during weekday lunch breaks, access requests reach 100,000 per hour, resulting in an access density of 50,000 accesses per square kilometer per hour, far exceeding the 5,000 accesses per square kilometer per hour of residential areas. When the authentication failure rate in this area rises from the historical average of 1% to 8%, a deviation of 7 percentage points, the system classifies it as a high-risk authentication area.

[0045] Preferably, obtaining the distribution characteristics of the authorization verification response time provides operators with key performance indicators. In high-risk authentication areas, the response time exhibits a clear bimodal distribution: 60% of requests are completed within 100-300 milliseconds, which is considered a normal response; while the response time for the other 30% of requests is concentrated in the 2-5 second range, indicating that the system encounters a bottleneck when processing these requests. Calculations show an average response time of 850 milliseconds, a variance of 1.2 seconds, and peak times concentrated between 12:00 and 13:00.

[0046] Step S103: Based on the distribution characteristics of the permission verification response time in the high-risk authentication area, obtain the memory pool fragmentation degree and thread pool saturation index of the corresponding server node, determine the specific location of the abnormal allocation of carrier-grade network resources based on the detection results of database connection pool leakage, and identify the key server node whose cache hit rate drops beyond the warning standard.

[0047] Based on the distribution characteristics of permission verification response times in the high-risk authentication areas, server node identifiers with response times exceeding the average plus twice the standard deviation are extracted. The memory pool usage of these server nodes is obtained, and the difference between the total allocated memory block size and the actual used memory size is divided by the total allocated memory block size to obtain the memory pool fragmentation level. Simultaneously, the ratio of the number of threads executing tasks in the thread pool to the maximum number of threads in the thread pool is used as a thread pool saturation indicator. Based on the memory pool fragmentation level and thread pool saturation indicator, for server nodes with fragmentation exceeding a first preset threshold or saturation exceeding a second preset threshold, the changes in the number of active connections in their database connection pool are monitored. When the number of active connections continues to increase and new connection requests are still being made even after reaching the connection pool's upper limit, a connection pool leak is determined. The address of the server node with the leak and its network region are recorded to pinpoint the specific location of the abnormal allocation of carrier-grade network resources. Based on the specific location information of the resource allocation anomaly, the total number of cache requests and the number of cache hits of each abnormal server node within a preset time window are counted. The cache hit rate and its difference from the historical average hit rate are calculated as the decrease rate. If the decrease rate exceeds the warning standard and the server node simultaneously meets the conditions of carrying the core authentication service function and the processor utilization rate or memory utilization rate exceeding the preset utilization threshold, then the server node is determined to be a critical server node.

[0048] For example, the degree of memory pool fragmentation is an important indicator for measuring the efficiency of server memory management.

[0049] In one possible implementation, after a server has been running for a long time, frequent memory allocation and deallocation operations can lead to a discontinuous distribution of memory space. Suppose an authentication server's memory pool is allocated a total of 8GB, but due to fragmentation, only 5GB of contiguous memory is actually usable, with the remaining 3GB scattered across various smaller blocks and unable to be effectively utilized. Calculating 3GB divided by 8GB yields a fragmentation level of 37.5%. This high fragmentation prevents new authentication requests from obtaining sufficient contiguous memory space, thus impacting response time.

[0050] It's important to note that thread pool saturation directly reflects a server's concurrent processing capacity. Carrier-grade network authentication servers typically have a fixed-size thread pool, such as supporting a maximum of 1000 concurrent threads. When a large number of users simultaneously initiate authentication requests, the number of active threads may reach 950, a saturation level of 95%. At this point, new requests have to queue and wait, causing response delays. This saturation state, coupled with memory fragmentation issues, creates a vicious cycle of performance bottlenecks.

[0051] Specifically, the database connection pool leak detection mechanism is based on dynamic monitoring of the number of connections. Normally, after an application finishes using a database connection, it returns it to the connection pool for reuse by other requests. However, in certain abnormal scenarios, such as abnormal program exit or network interruption, connections may not be released correctly, leading to a continuous increase in the number of active connections.

[0052] For example, a server node's connection pool has a limit of 200. During normal operation, the number of active connections fluctuates between 50 and 100. However, when a leak occurs, the number of active connections will gradually climb to 190, 195, and eventually reach the limit of 200. At this point, new authentication requests will fail because they cannot obtain a database connection.

[0053] In one embodiment, calculating the cache hit rate involves a deep analysis of authentication data access patterns. Authentication systems typically cache user authentication information and permission data in memory to improve access speed. Assume a critical server node, under normal conditions, processes 100,000 authentication requests per hour, with 85,000 directly retrieving data from the cache, resulting in a cache hit rate of 85%. However, when memory fragmentation is severe or the thread pool is saturated, the cache space is compressed, forcing some frequently accessed data to be evicted, causing the hit rate to drop to 60%, a decrease of 25 percentage points, far exceeding the 10% warning threshold.

[0054] Preferably, the determination of critical server nodes requires comprehensive consideration of multiple dimensions of indicators. Nodes carrying core authentication services not only handle user login verification but are also responsible for critical functions such as token generation and permission verification. A node is considered a critical server node when its processor utilization consistently remains above 90%, its memory utilization exceeds 85%, and it is accompanied by issues such as a significant drop in cache hit rate and connection pool leaks.

[0055] Step S104: Based on the peak network bandwidth usage data of the key server nodes, when the bandwidth usage exceeds the capacity threshold, analyze the increased response latency caused by the disorder of the carrier-grade network processing priority, identify nodes with uneven traffic distribution, and determine the target node range for resource reallocation as standby server nodes whose processing load is lower than a preset threshold and whose network bandwidth utilization is lower than a preset threshold.

[0056] Based on the peak network bandwidth usage data of the key server nodes, the real-time bandwidth usage of each node during peak business hours is collected. If the bandwidth usage exceeds the node capacity threshold, the processing order records of different service types of requests within that period are extracted. The difference between the waiting time of high-priority requests and the waiting time of low-priority requests is calculated. When the difference is less than a preset threshold, priority confusion is determined, and the increase in average response latency caused by priority confusion is statistically analyzed. Based on the increase in average response latency, the weight configuration parameters of each server node in the load balancer are obtained. The deviation between the actual traffic allocation ratio and the weight configuration ratio is calculated as the weight offset value. At the same time, the types and quantities of service traffic received by each node are statistically analyzed. When the weight offset value of a node exceeds a preset offset threshold and the traffic carried by the node exceeds its processing capacity, the node is identified as a node with uneven traffic distribution. Based on the identification results of the nodes with uneven traffic distribution, the real-time status of all backup server nodes in the network is scanned to obtain the processor utilization rate, memory utilization rate, and the number of requests currently carried by each backup node. The comprehensive processing load value is calculated by weighted summation, where the processor utilization rate has a weight of 0.5, the memory utilization rate has a weight of 0.3, and the normalized value of the number of requests has a weight of 0.2. At the same time, the network bandwidth usage of each backup node is monitored. When the comprehensive processing load value of a backup node is lower than a first preset threshold and the network bandwidth utilization rate is lower than a second preset threshold, the backup server node is determined to be the target node for resource reallocation.

[0057] For example, peak network bandwidth usage is a key indicator for carrier-grade network performance monitoring.

[0058] In one possible implementation, a critical server node is configured with a 10Gbps network interface. During the morning peak, when authentication requests surge, real-time monitoring shows that bandwidth usage reaches 9.5Gbps, exceeding 90% of the capacity threshold. Under this high load, processing of service requests with different priorities becomes chaotic. Authentication requests for enterprise VIP users, which should have been prioritized, experience a wait time of 3 seconds, while ordinary user requests receive a response within 2.5 seconds. The difference of only 0.5 seconds is far below the normal 2-second difference, indicating that the priority scheduling mechanism has failed.

[0059] It's important to note that the load balancer's weight offset calculation directly reflects the rationality of traffic distribution. Load balancers typically preset weight values ​​based on the processing capacity of each node; for example, a high-performance node A might have a weight of 5, while a normal node B might have a weight of 3, theoretically resulting in a 5:3 traffic distribution ratio. However, in actual operation, due to changes in network routing or configuration deviations, node A might only receive 40% of the total traffic, while node B might handle 35%, a significant deviation from the expected 62.5% and 37.5%. By calculating the difference between the actual and theoretical ratios, the weight offset for node A is found to be -22.5%. This negative offset indicates that high-performance resources are not being fully utilized.

[0060] Specifically, the weighted summation method used to calculate the overall processing load value is scientifically sound. Processor utilization directly affects request processing speed, so it is given the highest weight of 0.5; memory utilization affects concurrent processing capability, and its weight is set to 0.3; the number of requests currently being handled needs to be normalized, that is, the current number of requests is divided by the node's maximum processing capacity, and then multiplied by a weight of 0.2.

[0061] For example, if a standby node has a processor utilization of 30%, a memory utilization of 40%, and is currently processing 200 requests while its maximum capacity is 1000, then the overall load value is...

[0062] 30% × 0.5 + 40% × 0.3 + 20% × 0.2 = 31%, which is significantly lower than the threshold of 60%.

[0063] In one embodiment, statistics on service traffic types provide an important basis for identifying uneven traffic distribution. Authentication traffic in operator networks typically includes various types such as user login verification, token refresh, and permission queries, with significant differences in resource consumption among different types. When a node receives a large number of permission verification requests requiring database queries, even if the total traffic is not high, it may still cause a processing bottleneck. Analysis reveals that nodes with uneven traffic distribution often concentrate on carrying a specific type of high-consumption request.

[0064] Preferably, the selection of backup server nodes needs to meet multiple conditions simultaneously. Monitoring network bandwidth utilization includes not only current usage but also the capacity to handle sudden traffic surges. For example, assuming a backup node is configured with 5Gbps bandwidth, currently using only 500Mbps (10% utilization), far below the 30% threshold, and its overall processing load is only 31%, it has sufficient resources to receive authentication requests for resource reallocation. This multi-dimensional screening ensures that the target node for resource reallocation has both sufficient processing power and ample network bandwidth, effectively alleviating the pressure on critical nodes.

[0065] Step S105: By reorganizing the memory usage within the target node range of resource reallocation and adjusting the server processing capacity to a normal level, if the cache performance degradation still exceeds the preset standard after the database connection anomaly is repaired, a batch account unlocking verification mechanism is launched in conjunction with the abnormal session behavior pattern. This mechanism verifies the legitimacy of the user's identity based on the user's historical authentication success rate and the current session status.

[0066] By scanning the memory usage within the target node range of resource reallocation, fragmented memory regions are identified and memory defragmentation is performed. Small, scattered memory blocks are merged into large, contiguous blocks, releasing occupied but unused memory space. The total available memory after defragmentation is obtained, and memory resources are reallocated to various service processes based on current business load requirements. The percentage improvement in memory allocation efficiency is recorded. Based on this percentage improvement, the server's thread pool size and process priority parameters are adjusted to restore processing capacity to standard configuration levels. Simultaneously, abnormal connections in the database connection pool are detected, timed-out connections are closed, and new connections are re-established. The database query response time and connection pool utilization rate after repair are monitored, and the difference between the repaired cache hit rate and the historical average is calculated as the performance degradation rate. If the performance degradation still exceeds the preset standard, the abnormal session behavior pattern feature data recorded in the high-risk authentication area is extracted to obtain the abnormal request frequency value, request time distribution pattern and source address information. The batch account unlocking verification mechanism is then activated. This mechanism obtains the historical authentication records of the account to be unlocked, calculates the ratio of the number of successful authentications in the past preset time period to the total number of authentications as the historical authentication success rate, and checks whether the duration of the current session is within the normal range and whether the request source address is consistent with the historical records. When the historical authentication success rate is higher than the preset success rate threshold and the current session status parameters are within the normal range, the identity legality verification is passed.

[0067] For example, memory defragmentation plays a key role in optimizing carrier-grade network servers.

[0068] In one possible implementation, after a server has been running for a period of time, frequent memory allocation and deallocation can lead to memory fragmentation. Suppose an authentication server is configured with 32GB of physical memory. After a long period of operation, although it shows 10GB of available memory, this memory is scattered across thousands of small blocks, with the largest contiguous block being only 200MB. When a new authentication service needs to request 1GB of contiguous memory, it will fail. By using memory defragmentation methods to merge these fragments, multiple contiguous memory blocks of over 1GB can be formed, improving memory allocation efficiency from 60% to 85%. This 25% improvement lays the foundation for subsequent performance optimization.

[0069] It's important to note that adjusting server processing capacity involves optimizing several key parameters. The thread pool size directly impacts concurrency; too small a pool leads to request queuing, while too large a pool increases context switching overhead. Based on a 25% improvement in memory allocation efficiency, the thread pool can be increased from 500 threads to 625. Simultaneously, process priorities are adjusted to allocate higher CPU time slices to the authentication core process. Repairing the database connection pool is equally crucial; abnormal connections not only consume resources but also prevent new requests from acquiring connections. Monitoring revealed that 15 out of 50 connections on a certain node were in a dead state. After cleaning up and rebuilding these connections, the database response time decreased from an average of 300 milliseconds to 150 milliseconds.

[0070] Specifically, the calculation of the performance degradation of the cache reflects the overall optimization effect of the system. After fixing the database connection, the caching system gains more stable data source support, but if the underlying problems are severe, the cache hit rate may still be unsatisfactory.

[0071] For example, the historical average cache hit rate was 80%, but after the fix, it only recovered to 65%, a drop of 15%, exceeding the preset standard of 10%. This situation indicates that there is a deeper problem in the system, requiring further remedial measures.

[0072] In one embodiment, the batch account unlocking verification mechanism is designed to balance security and efficiency. The mechanism first extracts abnormal session behavior characteristics from monitoring data in high-risk authentication areas, including certain accounts initiating more than 10 authentication requests per second between 2 AM and 4 AM, which clearly deviates from normal user behavior. For these locked accounts, the system queries their historical authentication records and calculates the success rate over the past 30 days. If an account's past success rate reaches 95%, it indicates that this is a normal account that may have encountered a temporary anomaly.

[0073] Preferably, identity verification employs a multi-dimensional approach. In addition to historical success rates, the characteristics of the current session are checked for reasonableness. Normal user sessions typically last between 5 minutes and 2 hours; if a session has lasted 8 hours and remains active, it may indicate an anomaly. Consistency checks of the request source address are also crucial. If an account has historically logged in from Beijing and suddenly receives requests from overseas, even with a high historical success rate, caution is advised. Only when the historical success rate exceeds 90%, the current session duration is within a reasonable range, and the request source is largely consistent with historical records, is the user deemed legitimate and the unlocking operation executed. This rigorous verification mechanism not only quickly restores access permissions to legitimate users but also effectively prevents malicious accounts from being unlocked in bulk, maintaining the security and availability of the entire authentication system.

[0074] Step S106: Based on the execution result of the account batch unlocking verification mechanism, obtain the change data of the unified identity authentication failure frequency of affected users in the carrier-grade network, analyze the correlation between the number of authentication timeouts and user access interruptions, and when it is found that the authentication failure frequency has increased abnormally and has a strong correlation with access interruptions, further identify potential brute-force attacks and credential stuffing attacks on the carrier-grade network.

[0075] Based on the execution results of the batch account unlocking verification mechanism, the number of accounts that successfully unlocked and failed verification were counted. Unified identity authentication failure event records for affected users before and after unlocking were extracted. The ratio of authentication failures to the total number of users in each time period was calculated to obtain the failure frequency. The difference in failure frequencies before and after unlocking was compared to form a change data sequence. Based on the failure frequency change data sequence, the number of timeouts after sending SMS verification codes and the number of timeouts for dynamic password input were counted. The user access status corresponding to each timeout event was recorded, and the probability of user access interruption within a preset time window after a timeout event was calculated. The Pearson correlation coefficient was used to calculate the correlation between the number of timeouts and the number of access interruptions. When the correlation value exceeds a preset correlation threshold and the authentication failure frequency growth rate exceeds a preset multiple of the historical average growth rate, the timestamp sequence of password error events was extracted. The time interval between two adjacent password errors was calculated. If the interval shows a decreasing trend and the minimum interval is lower than a preset security threshold, and the verification failure frequency surges from a normal level to a preset multiple within a short period, then a potential brute-force attack and credential stuffing attack threat to the carrier-grade network is identified.

[0076] For example, the execution results of the batch account unlocking verification mechanism provide an important data foundation for subsequent security analysis.

[0077] In one possible implementation, suppose a carrier network performs a batch unlocking operation involving 100,000 accounts after a large-scale authentication anomaly. Of these, 80,000 are successfully unlocked, while 20,000 fail verification due to ineligibility. Tracking the subsequent behavior of these users reveals that 5% of the successfully unlocked accounts experience authentication failure again within 24 hours, while the authentication requests from unlocked accounts remain frequently and abnormally high. This differential behavior provides crucial clues for identifying legitimate users and malicious accounts.

[0078] It should be noted that constructing the failure frequency change data sequence requires precise time window division. Authentication failure events include various types such as incorrect passwords, expired tokens, and failed certificate verification. The occurrence frequency of each type of failure event is counted hourly.

[0079] For example, if there are 1,000 active users during a certain period and 50 authentication failures occur, the failure frequency is 5%. By comparing the data for the same period before and after unlocking, it was found that the failure frequency decreased from 15% before unlocking to 5%, forming a clear downward trend sequence. This sequence reflects the actual effect of the unlocking operation.

[0080] Specifically, timeout issues in multi-factor authentication mechanisms directly impact user experience. SMS verification codes typically have a 60-second validity period, but during network congestion or SMS gateway failures, users may not receive their codes before they expire. Dynamic passwords have even stricter timeout limits, usually only allowing a 30-second input window. When the system detects that the SMS verification code timeout rate reaches 20% and the dynamic password timeout rate reaches 30% within a certain timeframe, and 80% of these timeout users experience access interruption within the following 5 minutes, the Pearson correlation coefficient reaches 0.85, indicating a strong correlation between timeout and interruption.

[0081] In one embodiment, the calculation of the Pearson correlation coefficient involves a covariance analysis of two variable sequences. The coefficient ranges from -1 to 1, with a value closer to 1 indicating a stronger correlation. By collecting data for seven consecutive days, with 24 time points per day and a total of 168 data pairs, the correlation between the timeout frequency sequence and the access interruption frequency sequence is calculated. When the correlation coefficient exceeds a preset threshold of 0.7, and the authentication failure frequency surges from the normal 2% to 10%, the system determines that an anomaly exists.

[0082] Preferably, the identification of brute-force attacks and credential stuffing attacks relies on precise analysis of password error patterns. When a normal user enters an incorrect password, they typically pause to think, retrying for more than 10 seconds. Automated attack tools, however, exhibit highly regular retry intervals, potentially attempting every 0.5 seconds. When an account's password error retry interval is detected to gradually decrease from an initial 5 seconds to 0.5 seconds, forming a clear decreasing trend, and simultaneously, the number of failed verifications for that account surges from the normal 2-3 times to over 200 times within 10 minutes, this abnormal pattern strongly suggests a brute-force attack attempt. Credential stuffing attacks, on the other hand, manifest as a large number of different accounts attempting the same or similar password combinations within a short period. By correlating and analyzing the password characteristics of these failed attempts, such threats can be effectively identified, providing early warnings for network security protection for operators.

[0083] Step S107: Based on the identification results of the potential threats, dynamically adjust the authentication security policy parameters of the certificate expiration trigger threshold and the token refresh failure ratio, reduce the biometric false rejection rate by optimizing the session hijacking detection delay time, and obtain the overall system security protection effect evaluation data after the permission verification response time optimization.

[0084] Based on the identification results of the potential threats, the frequency value of brute-force attacks and the number of source addresses of credential stuffing attacks are extracted. The time period distribution pattern of attack occurrences is analyzed. The threat level coefficient is determined according to the ratio of the attack frequency to the preset baseline frequency. The original certificate expiration trigger threshold is multiplied by this threat level coefficient to obtain the adjusted threshold. At the same time, the judgment criteria for the token refresh failure ratio are adjusted according to the attack intensity. The account lock-up time after authentication failure, the maximum number of password retries, and the session validity duration are combined to form a security parameter set. Using the session validity duration parameter in the security parameter set, the scanning interval for session hijacking detection is set to one-tenth of this duration. The detection delay time is adjusted from once per minute to once every six seconds. The number of false rejection events of biometric devices under the new detection frequency is recorded. The ratio of the optimized number of false rejections to the total number of recognitions is calculated to obtain the new biometric false rejection rate. Based on the new biometric false rejection rate data, the time distribution from the initiation to the completion of permission verification requests is statistically analyzed, the optimized average response time and response time variance are calculated, the ratio of the number of successful authentications to the total number of authentications is obtained as the success rate, the proportion of the system's normal operating time to the total time is recorded as an availability indicator, and the number of security incidents is statistically analyzed. These multi-dimensional indicators are summarized to form the overall security protection effect evaluation data of the system.

[0085] In one possible implementation, the system sets the baseline attack frequency under normal conditions to 10 times per hour. When a brute-force attack frequency of 500 times per hour is detected, the ratio of the attack frequency to the baseline frequency is 50. This ratio, after logarithmic transformation, yields a threat level coefficient of 3.9. The original certificate expiration trigger threshold is assumed to be 30 days, which is adjusted to 117 days after multiplying by the threat level coefficient. This means that in a high-threat environment, the system will issue a warning about certificate expiration risks much earlier, giving administrators ample time to respond.

[0086] It's important to note that the set of security parameters requires comprehensive consideration of multiple protection needs. Extending the account lockout time after authentication failure from the normal 5 minutes to 30 minutes effectively reduces the frequency of attacker attempts. Reducing the number of password retries from the default 5 to 3 decreases the window of opportunity for brute-force attacks. Shortening the session validity period from 2 hours to 30 minutes reduces the time of harm after a session is hijacked. These three parameters work together to form a comprehensive security protection system.

[0087] Specifically, optimizing session hijacking detection involves balancing detection frequency and response speed. Traditional detection mechanisms scan active sessions once per minute, meaning that in the worst case, a hijacked session might go undetected for up to 59 seconds. By using one-tenth of the 30-minute effective session duration as the detection interval, i.e., detecting every 3 minutes, the potential exposure window is significantly shortened. However, considering system performance, an actual detection frequency of once every 6 seconds is adopted, ensuring security while avoiding excessive resource consumption.

[0088] In one embodiment, changes in the biometric false rejection rate directly reflect the effectiveness of detection optimization. Frequent session checks may interrupt legitimate users during the biometric process, resulting in false rejections. Assuming that before optimization, there were 50 false rejections per 1000 fingerprint scans, a false rejection rate of 5%. After optimization, by precisely controlling the timing of detection and avoiding critical moments in biometric data collection, the number of false rejections decreased to 30, with a new false rejection rate of 3%. This improvement not only enhances the user experience but also reduces duplicate authentication requests caused by false rejections, lowering the system load.

[0089] Preferably, the overall security protection effect evaluation of the system requires comprehensive analysis of multi-dimensional indicators. The average response time for permission verification decreased from 800 milliseconds to 500 milliseconds before optimization, and the variance decreased from 200 to 100, indicating faster and more stable response. The authentication success rate increased from 92% to 96%, indicating smoother access for legitimate users. System availability increased from 99.5% to 99.8%, equivalent to a reduction in monthly downtime from 3.6 hours to 1.4 hours. The number of security incidents decreased from an average of 15 per day to 3, fully demonstrating the effectiveness of the dynamic parameter adjustment strategy.

[0090] Specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art can make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. Unless otherwise specified, the embodiments and features described in this application can be arbitrarily combined with each other.

Claims

1. A security incident early warning and response method based on carrier-grade networks, characterized in that, The method includes: collecting login failure frequency and verification timeout number of each authentication node in the carrier-grade network to generate authentication anomaly distribution data; based on the authentication anomaly distribution data, calculating the total number of token refresh requests and the number of failures to generate a token refresh failure ratio; when the failure ratio exceeds a preset benchmark value, adjusting the session verification interval, collecting session request frequency and source data to generate an abnormal session behavior pattern; based on the abnormal session behavior pattern, extracting biometric authentication records to generate a false rejection rate change sequence; based on the false rejection rate change sequence and the total number of service access requests, calculating the access density and authentication failure rate deviation value to identify high-risk authentication areas; for the permission verification requests in the high-risk authentication areas, statistically analyzing the response time distribution to generate permission verification response time distribution characteristics for the high-risk authentication areas; and based on the permission verification response time distribution characteristics, collecting data from the corresponding server nodes. The system uses memory pool fragmentation and thread pool saturation metrics to identify abnormal resource allocation locations and server nodes whose cache hit rate drops beyond a preset standard. Based on the peak network bandwidth usage of these server nodes, it identifies backup server nodes where both processing load and network bandwidth utilization are below a preset threshold. It then performs memory defragmentation on these backup server nodes, adjusting server processing capacity and fixing database connection anomalies. Based on historical user authentication success rates and session states, it generates identity verification results. Based on these results, it statistically analyzes changes in authentication failure frequency for affected users, identifies the correlation between multi-factor authentication timeouts and access interruptions, and identifies potential attack threats such as abnormal password retry intervals and a surge in verification failure frequency. Finally, it optimizes session hijacking detection latency based on these potential attack threats and generates security protection data with optimized permission verification response times.

2. The security incident early warning and response method based on carrier-grade networks according to claim 1, characterized in that, The process of collecting login failure frequencies and verification timeout counts from each authentication node in the carrier-grade network to generate authentication anomaly distribution data includes: collecting login failure events and verification timeout events from each authentication node to generate authentication event records containing node identifiers and timestamps; generating time interval distribution data based on the time difference between adjacent password error retry requests in the authentication event records; performing anomaly detection on the time interval distribution data, marking authentication requests with time intervals below a preset threshold, and extracting the occurrence time and frequency characteristics of the authentication requests; calculating the correlation between the remaining validity time of the certificate and the frequency of abnormal requests based on the frequency characteristics and certificate validity data to generate a certificate expiration trigger threshold; comparing the certificate expiration trigger threshold with a preset range, retaining node data that meets the conditions, and generating authentication anomaly distribution data.

3. The security incident early warning and response method based on carrier-grade networks according to claim 1, characterized in that, The step of determining the location of abnormal resource allocation by collecting the memory pool fragmentation degree and thread pool saturation index of the corresponding server node based on the permission verification response time distribution characteristics includes: extracting the server node identifier that exceeds the response time limit based on the permission verification response time distribution characteristics; collecting the memory pool usage data of the server node to generate the memory pool fragmentation degree; statistically analyzing the thread pool operation data of the server node to generate the thread pool saturation index; and detecting changes in the number of active connections in the database connection pool based on the memory pool fragmentation degree and thread pool saturation index to determine the location of abnormal resource allocation.

4. The security incident early warning and response method based on carrier-grade networks according to claim 1, characterized in that, The step of determining standby server nodes whose processing load and network bandwidth utilization are both below a preset threshold based on the peak network bandwidth usage data of the server nodes includes: collecting bandwidth usage values ​​during peak business hours based on the peak network bandwidth usage data of the server nodes; analyzing the business request processing order and generating response latency data when the bandwidth usage value exceeds the capacity threshold; generating weight offset values ​​based on the response latency data and load balancer weight configuration; identifying nodes with uneven traffic distribution by combining the weight offset values ​​and business traffic data; and scanning the load and bandwidth data of standby server nodes to determine standby server nodes whose processing load and network bandwidth utilization are both below a preset threshold.

5. A security incident early warning and response method based on carrier-grade networks according to claim 1, characterized in that, The process of performing memory defragmentation on the backup server node, adjusting server processing capacity, and repairing database connection anomalies includes: scanning the memory usage data of the backup server node to generate memory fragmentation region data; merging memory blocks based on the memory fragmentation region data to generate total available memory data; allocating memory resources to service processes based on the total available memory data; adjusting the thread pool parameters of the backup server node to generate standard processing capacity data; and detecting the database connection pool of the backup server node, closing abnormal connections and reconstructing new connections to generate repaired connection pool usage data.

6. The security incident early warning and response method based on carrier-grade networks according to claim 1, characterized in that, The process of statistically analyzing the changes in authentication failure frequency of affected users based on the identity legitimacy verification results, and identifying the correlation between multi-factor authentication timeouts and access interruptions to identify potential attack threats such as abnormal password error retry intervals and a surge in verification failure frequency includes: statistically analyzing the number of authentication failure events based on the identity legitimacy verification results to generate failure frequency change data; statistically analyzing the timeout counts of SMS verification codes and dynamic passwords based on the failure frequency change data to generate access interruption correlation data; calculating the correlation degree between timeouts and interruptions based on the access interruption correlation data; and analyzing the password error retry interval sequence to generate potential attack threat data when the correlation degree and the failure frequency growth rate exceed a preset threshold.

7. A security incident early warning and response method based on carrier-grade networks according to claim 1, characterized in that, The step of optimizing session hijacking detection latency based on the potential attack threats and generating security protection data with optimized permission verification response time includes: generating attack frequency and source data based on the potential attack threats; adjusting the certificate expiration trigger threshold and token refresh failure ratio based on the attack frequency data to generate a set of security parameters; adjusting the session hijacking detection scanning interval based on the set of security parameters to generate optimized false rejection rate data; and statistically analyzing the permission verification response time distribution based on the false rejection rate data to generate security protection data including success rate and availability metrics.

Images