Local area network exit abnormal flow detection method and device

Abstract

The invention belongs to the technical field of network abnormal traffic detection, and particularly provides a local area network exit abnormal traffic detection method and device, which utilizes the port mirroring function of the existing core network switching equipment to losslessly copy exit traffic to an independent mirroring port in a bypass mode, thereby improving the detection efficiency. And real-time deep analysis is carried out on the mirror image traffic by means of general computing equipment provided with traffic analysis software, abnormal traffic is accurately identified based on a threat feature rule base, and an infected terminal in a local area network is rapidly positioned according to source address information of the abnormal traffic. By means of the arrangement, monitoring of the outlet flow of the local area network is achieved, the cost is low, the blind area problem caused by the fact that professional safety equipment cannot be deployed in scenes such as county-level branches due to cost limitation is solved, and the high-standard requirement of industries such as insurance for network safety can be met.

Description

Technical Field

[0001] This application belongs to the field of network abnormal traffic detection technology, specifically a method and device for detecting abnormal traffic at the local area network exit. Background Technology

[0002] Insurance company headquarters and provincial branches typically have well-developed network architectures, often equipped with professional security equipment (such as firewalls, internet behavior management systems, and intrusion detection systems) for protection. However, due to cost constraints, numerous county-level branches often struggle to deploy the same level of professional security hardware. Currently, many county-level branches primarily rely on policies and manual outreach to require employees to install designated endpoint security software. However, the lack of effective technical enforcement measures and network-level monitoring capabilities leaves security blind spots in the local networks of county-level branches.

[0003] Therefore, there is an urgent need for a technical solution that can effectively detect, analyze, and quickly trace the source of threats to abnormal traffic at the local area network exit point in scenarios with limited network resources, such as county-level branch offices, at a lower cost. Summary of the Invention

[0004] Based on the above-mentioned technical problems, this application provides a method and device for detecting abnormal traffic at the local area network egress point, in order to solve the problem in the prior art that abnormal traffic at the egress point cannot be effectively monitored and threats are difficult to trace quickly in scenarios such as county-level branch offices due to the lack of professional security equipment.

[0005] To achieve the above objectives, the technical solution adopted in this application is as follows: Firstly, this application provides a method for detecting abnormal traffic at the local area network (LAN) egress point, including: Configure port mirroring on the core network switching equipment of the local area network to mirror all or specified traffic flowing to the egress gateway to a separate mirror port. Connect an analysis terminal equipped with traffic analysis software to the mirror port to receive and capture the outgoing traffic of the mirror. The traffic analysis software, based on a threat feature rule base, performs real-time analysis on captured mirrored traffic, identifies abnormal network traffic that matches threat features, and determines the nature of the threat. Based on the source address information of the abnormal network traffic, locate the source terminal device within the local area network that generated the abnormal traffic.

[0006] In one possible implementation, the threat signature rule base includes a list of known or suspected high-risk domain names, a list of malicious IP addresses, and abnormal network behavior characteristics.

[0007] In one possible implementation, the traffic analysis software analyzes abnormal network traffic by parsing the five-tuple information, session sequence, and payload characteristics of data packets, and matching them with a threat feature rule base to determine the nature of the threat.

[0008] In one possible implementation, the method for detecting abnormal traffic at the local area network egress point further includes: when the traffic analysis software determines that a threat exists, performing network access control operations on the source terminal device through the core network switching device or the egress gateway.

[0009] Compared with existing technologies, the beneficial effects of the local area network (LAN) egress abnormal traffic detection method provided by this invention are: The local area network (LAN) egress abnormal traffic detection method provided by this invention utilizes the port mirroring function of existing core network switching equipment to losslessly copy egress traffic to an independent mirror port in a bypass manner. Real-time in-depth analysis of the mirrored traffic is then performed on a general-purpose computing device equipped with traffic analysis software. Based on a pre-set or dynamically deployed threat characteristic rule base, abnormal traffic is accurately identified, and the source address information of the abnormal traffic is used to quickly locate infected terminals within the LAN. This setup not only achieves monitoring of LAN egress traffic but also has a low cost, solving the blind spot problem caused by cost constraints preventing the deployment of professional security equipment in scenarios such as county-level branch offices. It can meet the high network security standards required by industries such as insurance.

[0010] Secondly, this application provides a local area network (LAN) egress abnormal traffic detection device, used to implement a LAN egress abnormal traffic detection method provided by any of the above implementation methods, including: The core network switching equipment, deployed within the local area network, is equipped with a port mirroring module to mirror outgoing traffic to a mirror port. The traffic analysis terminal is a general-purpose computing device whose network interface is connected to the mirror port of the core network switching device. Traffic analysis software is installed and running on it to capture and analyze mirror traffic. A threat signature rule base is stored in the traffic analysis terminal or a server accessible by it, and is used to provide a basis for feature matching for traffic analysis; The source tracing and response module, either integrated into the traffic analysis software or as a separate module, is used to locate the abnormal source terminal based on the analysis results and generate handling suggestions.

[0011] The local area network (LAN) egress abnormal traffic detection device provided by this invention includes a traffic analysis terminal, a threat feature rule base, and a source tracing and response module. It is used to implement a LAN egress abnormal traffic detection method provided by any of the above implementation methods and has the same technical effect, which will not be described in detail here. Attached Figure Description

[0012] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 A flowchart illustrating a method for detecting abnormal traffic at the local area network egress point, as provided in this application. Detailed Implementation

[0014] To make the technical problems, technical solutions, and beneficial effects to be solved by this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and are not intended to limit the scope of this application.

[0015] It should be noted that when a component is referred to as being "fixed to" or "set on" another component, it can be directly on or indirectly on that other component. When a component is referred to as being "connected to" another component, it can be directly connected to or indirectly connected to that other component.

[0016] It should be understood that the terms "length", "width", "upper", "lower", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this application.

[0017] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, "multiple" or "several" means two or more, unless otherwise explicitly specified.

[0018] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0019] Please refer to the following: Figure 1 The following describes a method and apparatus for detecting abnormal traffic at the local area network exit point provided in the embodiments of this application.

[0020] In a first aspect, embodiments of this application provide a method for detecting abnormal traffic at the local area network (LAN) egress point, comprising the following steps: Configure port mirroring on the core network switching equipment of the local area network (LAN) to mirror all or a specified traffic flowing to the egress gateway to a dedicated mirror port. Specifically, enable port mirroring on the core Layer 3 switch of the LAN to perform lossless copying of all traffic connected to the egress gateway and send the mirrored traffic to a pre-configured, dedicated mirror port on the switch. This process does not change the original network topology and does not affect the forwarding path or performance of normal traffic.

[0021] An analysis terminal equipped with traffic analysis software is connected to the mirror port. This analysis terminal receives and captures all mirror outgoing traffic. The traffic analysis software is capable of performing in-depth analysis of the captured data packets.

[0022] The traffic analysis software, based on a threat signature rule base, performs real-time analysis on captured mirrored traffic, identifies abnormal network traffic matching threat signatures, and determines the nature of the threat. The software has a built-in threat signature rule base containing known malicious IP addresses, high-risk domain names, and specific attack payload characteristics. The software matches the parsed traffic features (such as destination IP, domain name, URL, and protocol behavior patterns) with the rule base in real time to identify suspicious or malicious abnormal outbound traffic.

[0023] Based on the source address information of the abnormal network traffic, the source terminal device generating the abnormal traffic within the local area network can be located. Based on the source tracing report, network administrators can manually or through preset automated scripts implement temporary network isolation policies for infected terminals on core switches or egress gateways.

[0024] When traffic analysis software determines that a threat exists, it performs network access control operations on the source terminal device through the core network switching device or egress gateway, such as blocking its IP address's internet access, to prevent the threat from spreading further.

[0025] In some possible embodiments, the threat signature rule base includes a list of known or suspected high-risk domain names, a list of malicious IP addresses, and abnormal network behavior characteristics.

[0026] In some possible embodiments, the traffic analysis software analyzes abnormal network traffic by parsing the five-tuple information, session timing, and payload characteristics of data packets, and matching them with a threat feature rule base to determine the nature of the threat.

[0027] Secondly, a local area network (LAN) egress abnormal traffic detection device is provided to implement a LAN egress abnormal traffic detection method provided in any of the above embodiments, including a core network switching device, a traffic analysis terminal, a threat feature rule base, and a source tracing and response module.

[0028] The core network switching equipment is deployed within the local area network and is equipped with a port mirroring module to mirror outgoing traffic to a mirror port. The traffic analysis terminal is a general-purpose computing device whose network interface is connected to the mirror port of the core network switching equipment. Traffic analysis software is installed and runs on it to capture and analyze mirrored traffic. The threat signature rule base is stored in the traffic analysis terminal or a server accessible by it, providing a basis for feature matching for traffic analysis. The source tracing and response module is integrated into the traffic analysis software or exists as a separate module. Upon detecting virus traffic, the source tracing and response module automatically associates the source IP, MAC address, and switch port to locate the abnormal source terminal and generate handling instructions or suggestions.

[0029] It is understood that the parts in the above embodiments can be freely combined or deleted to form different combined embodiments. The specific contents of each combined embodiment will not be repeated here. After this description, it can be considered that the present invention specification has recorded each combined embodiment and can support different combined embodiments.

[0030] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for detecting abnormal traffic at the exit point of a local area network (LAN), characterized in that, Includes the following steps: Configure port mirroring on the core network switching equipment of the local area network to mirror all or specified traffic flowing to the egress gateway to a separate mirror port. Connect an analysis terminal equipped with traffic analysis software to the mirror port to receive and capture the outgoing traffic of the mirror. The traffic analysis software, based on a threat feature rule base, performs real-time analysis on captured mirrored traffic, identifies abnormal network traffic that matches threat features, and determines the nature of the threat. Based on the source address information of the abnormal network traffic, locate the source terminal device within the local area network that generated the abnormal traffic.

2. The method for detecting abnormal traffic at the local area network egress point according to claim 1, characterized in that, The threat signature rule base includes a list of known or suspicious high-risk domain names, a list of malicious IP addresses, and abnormal network behavior characteristics.

3. The method for detecting abnormal traffic at the local area network egress point according to claim 1, characterized in that, The traffic analysis software analyzes abnormal network traffic by parsing the five-tuple information, session sequence, and payload characteristics of data packets, and matching them with a threat feature rule base to determine the nature of the threat.

4. The method for detecting abnormal traffic at the local area network egress point according to claim 1, characterized in that, The method for detecting abnormal traffic at the local area network egress point further includes: when the traffic analysis software determines that a threat exists, performing network access control operations on the source terminal device through the core network switching device or the egress gateway.

5. A local area network (LAN) egress abnormal traffic detection device, used to implement the LAN egress abnormal traffic detection method according to any one of claims 1-5, characterized in that, include: The core network switching equipment, deployed within the local area network, is equipped with a port mirroring module to mirror outgoing traffic to a mirror port. The traffic analysis terminal is a general-purpose computing device whose network interface is connected to the mirror port of the core network switching device. Traffic analysis software is installed and running on it to capture and analyze mirror traffic. A threat signature rule base is stored in the traffic analysis terminal or a server accessible by it, and is used to provide a basis for feature matching for traffic analysis; The source tracing and response module, either integrated into the traffic analysis software or as a separate module, is used to locate the abnormal source terminal based on the analysis results and generate handling suggestions.

Images