A distribution network terminal safety behavior monitoring system and method based on artificial intelligence

Abstract

The present invention belongs to the technical field of distribution network terminal security behavior monitoring system, and in particular, relates to a distribution network terminal security behavior monitoring system and method based on artificial intelligence. The system of the present invention includes a system installation configuration module, a distribution network equipment asset account module, a distribution network equipment unified management module, a distribution network equipment operation status monitoring module, a distribution network equipment network behavior analysis module and a terminal portrait module. The present invention has the characteristics of an end-to-end in-depth defense system, integrated management and control of massive terminals, examining network traffic from a business perspective, analyzing network behavior with intelligent means, excellent insight into unknown new attacks, and flexible architecture support for rapid deployment. Thereby helping power companies solve the problem of distribution network terminal equipment security and significantly reducing distribution network security risks.

Description

Technical Field

[0001] The present invention belongs to the technical field of distribution network terminal safety behavior monitoring systems, and in particular, relates to a distribution network terminal safety behavior monitoring system and method based on artificial intelligence. Background Art

[0002] The power distribution network faces many security risks. First of all, embedded systems are prone to risks: on the one hand, the existence of complex factors such as system tailoring, application customization, difficulty in online upgrades and proprietary communication protocols makes most distribution network equipment have a large number of security risks and security vulnerabilities; on the other hand, due to limited software and hardware computing resources, in order to ensure real-time and availability, distribution network equipment often fails to consider information security needs too much in the early stages of design, which makes most of the current and on-sale distribution network terminals in an unguarded state, and the terminal equipment has problems such as counterfeit replacement, illegal access, illegal access, and intrusion attacks.

[0003] Secondly, the security level of distribution network terminal equipment is not high: terminal equipment manufacturers are less aware of the risks, and many terminal equipment manufacturers lack security awareness and security capabilities, which leads to insufficient consideration of security during the design and development of terminal hardware and software. As a result, some terminals have no message authentication and integrity identification mechanisms, which makes it impossible for terminal devices to determine whether business instructions are forged or maliciously tampered with. Therefore, attackers may cause equipment to malfunction through illegal instructions, and attackers may illegally use or destroy smart terminals without authorization, thereby reducing the security level of the distribution network.

[0004] Third, there are risks in the physical environment of the distribution network: distribution network equipment is usually deployed in unattended or unsafe environments, which makes it easy for attackers to directly access the equipment and carry out physical damage, or forge the equipment by cloning it, or carry out information theft, software tampering and remote control through various means such as short-range or long-range attacks, thereby reducing the security of the distribution network. Summary of the invention

[0005] In view of the shortcomings of the above-mentioned prior art, the present invention provides a distribution network terminal safety behavior monitoring system and method based on artificial intelligence. Its purpose is to analyze and monitor distribution network terminal anomalies, timely discover and eliminate abnormal activities of terminal equipment, and reduce the safety risks of distribution networks.

[0006] The technical solution adopted by the present invention to achieve the above-mentioned purpose is:

[0007] An artificial intelligence-based distribution network terminal security behavior monitoring system includes a system installation and configuration module, a distribution network equipment asset account module, a distribution network equipment unified management module, a distribution network equipment operation status monitoring module, a distribution network equipment network behavior analysis module and a terminal portrait module.

[0008] Furthermore, the system installation configuration includes the collection and analysis engine connection configuration; the system installation configuration module includes: device IP address configuration, device hardware clock setting, detection engine reporting IP address configuration, detection engine self-start configuration, detection engine service IP address configuration, detection engine detection IP address range configuration, detection engine detection cycle configuration, detection engine performance configuration, analysis engine performance configuration, and analysis engine function switch configuration.

[0009] Furthermore, the distribution network equipment asset ledger module includes the function of generating a comprehensive and accurate asset ledger for the distribution automation network; through active detection technology, passive detection technology and fingerprint recognition technology, it discovers and identifies various terminal devices in the distribution automation network to form a comprehensive and accurate asset ledger for the distribution automation network; it forms a detailed asset ledger of various types of equipment including terminal devices unique to the distribution automation network, including: distribution collection terminals, ONU / OLT, smart meters, operation terminals, cameras, hosts, network equipment, and servers.

[0010] Furthermore, the unified management module of distribution network equipment includes a unified management function for distribution automation network terminal equipment; all valuable information of the equipment is listed in detail in the asset list, TOP chart, and trend chart, and the asset data ranking and asset view display are displayed: among which, the asset data ranking includes top 5 equipment types, top 5 blacklists, top 5 high-risk ports, and top 5 brands; the asset view display includes weak password device trends, department equipment statistics, and newly connected equipment; the system also supports multi-dimensional and multi-level grouping of terminals.

[0011] Furthermore, the distribution network equipment operation status monitoring module includes a function of completing the monitoring of the operation status of the terminal equipment of the distribution automation network. Through detection and perception, the operation status of the terminal equipment is monitored in real time from aspects such as network accessibility and equipment health status. Once a terminal equipment in the network fails or an abnormal offline event occurs, the system immediately generates an alarm, completes the operation status monitoring of the terminal equipment in the network, and displays the risk status in the current network.

[0012] The distribution network equipment operation status monitoring module can also display the total number of devices, the maximum number of devices, the number and trend of newly added devices on the day, the total number of IPs in the entire network, the number of available IPs, the departments with the highest IP utilization rate, the top 5 department IP utilization rate rankings, IP utilization rate trend view, the total number of open ports, the device with the most open ports and its trend, and view offline devices by category.

[0013] Furthermore, the network behavior analysis module of the distribution network equipment includes the functions of completing the abnormal behavior analysis and early warning of the distribution automation network; through the behavior analysis function, the network traffic is divided into three types of traffic: black, white, and gray; the illegal network behavior of the network is discovered through the blacklist; the suspicious network behavior of the network is discovered through the graylist; the analysis and early warning of abnormal network behaviors such as illegal external connection behaviors, use of unsafe protocols, high-risk port behaviors, use of illegal software behaviors, illegal access to databases, illegal access to security domains, and illegal access to application systems are completed through the intelligent analysis model; the behavior of accessing high-risk ports and blacklisted ports within the network is discovered through the built-in "National Grid Port and Service Black and White List";

[0014] The network behavior analysis module of the distribution network equipment includes the following steps:

[0015] Step 1. View illegal network data:

[0016] Step 2. View the details of illegal network information:

[0017] Step 3. Export illegal network devices:

[0018] Step 4. Display of suspicious network data.

[0019] Furthermore, the terminal portrait module includes the functions of completing the discovery and early warning of unknown attack behaviors in the distribution automation network; through the access relationship model of the terminal portrait based on artificial intelligence, a white model of the access relationship between the same type of network equipment and security domains is established, and the network access behavior beyond the scope of the white model is warned, and the discovery of unknown attack behaviors in the network is completed, and an early warning is issued; through the statistical data model of the terminal portrait based on artificial intelligence, a security baseline of the access traffic, access relationship, and access port of the terminal equipment in the network is established, and the network access behavior beyond the security baseline threshold is warned, and the discovery of unknown attack behaviors in the network is completed, and an early warning is issued; the total number of models, the total number of illegal network connections, the top 5 analysis model hits, the top 5 statistical model hits, the top ranking of illegal behaviors of important assets, the top 5 analysis model hits, and the top 5 statistical model hits information are displayed. The analysis model and the statistical model in the list need to be switched;

[0020] The terminal portrait module includes the following steps:

[0021] Step 1. Whitelist information management and query:

[0022] Step 2. Intelligent analysis data display:

[0023] Step 3. Enable the important asset data comparison and blocking functions.

[0024] Furthermore, the detection system is divided into two stages, including: a learning stage and an operation stage;

[0025] The learning phase includes collecting distribution network traffic, establishing terminal network device fingerprints, and terminal behavior modeling;

[0026] Distribution network traffic collection includes: traffic collection based on port mirroring and traffic collection based on optical splitting; the traffic collection based on optical splitting is implemented through an optical splitter; the traffic collection based on port mirroring is to copy the traffic data of one or more ports of a switch or router and other network devices to one or more ports, and the copied ports and the copied ports are respectively called mirror source ports and mirror ports. Port mirroring is mainly deployed at the network aggregation layer or core layer to mirror the traffic to the collection device. This traffic collection method can monitor the traffic transmission status of each port without affecting the normal use of network users, thereby monitoring the network in real time;

[0027] Establishing terminal network device fingerprints is to analyze historical network traffic, use matching algorithms to identify network device features contained in the traffic, and form device network fingerprints;

[0028] Terminal behavior modeling is based on historically collected network traffic information through manual or automatic analysis;

[0029] The operation phase includes real-time collection of distribution network traffic, automatic discovery and identification of distribution network equipment, terminal network behavior analysis, and terminal profiling and monitoring;

[0030] Real-time collection of distribution network traffic is to collect the real-time full traffic of the distribution network operation through the mirror port;

[0031] Automatic discovery and identification of distribution network equipment is to analyze the real-time traffic of the distribution network, use the device identification technology based on network fingerprint to detect and identify the distribution network equipment, and use the device information database to use the network scanning technology to detect and identify the equipment in real time;

[0032] Terminal network behavior analysis is to analyze the real-time traffic of the distribution network, and obtain the abnormal network traffic and abnormal network access behavior of the terminal device based on the pre-generated network traffic feature model and network access behavior feature model; through the built-in behavior white model, it is determined whether the proprietary system of the terminal device has been maliciously exploited by attackers, and high-risk scanning and worm virus abnormal behaviors are identified;

[0033] Terminal profiling and monitoring is based on the automatic discovery and identification results of the equipment during the operation phase and the network behavior analysis results of the terminal equipment. It extracts static attributes such as IP, MAC address, brand, model, and dynamic attributes such as traffic data and application protocol, and then uses the equipment as the analysis object to perform static and dynamic profiling of the equipment.

[0034] A method for monitoring the safety behavior of distribution network terminals based on artificial intelligence comprises the following steps:

[0035] Step 1. Install and configure the traffic collection module;

[0036] Step 2. Administrator, user and network configuration;

[0037] Step 3. Log in to the monitoring system;

[0038] Step 4. Log in to the monitoring system: device detection and control, risk vulnerability management, whitelist and data model management, dynamic status monitoring, risk status monitoring and terminal profiling;

[0039] Step 5. Exit the system.

[0040] A computer storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the steps of a method for monitoring the safe behavior of distribution network terminals based on artificial intelligence are implemented.

[0041] The present invention has the following beneficial effects and advantages:

[0042] The present invention is based on artificial intelligence distribution network terminal security behavior monitoring system, which adopts machine learning and big data analysis technology, and integrates rapid equipment discovery, precise control of network access, comprehensive asset management, comprehensive control of vulnerabilities, in-depth behavior analysis, automatic blocking of violations, clear grasp of operating status, and precise control of boundary access. The system captures network data flow information in real time, adopts artificial intelligence technology, automatically aggregates and abstracts massive network access relationships, and establishes a white model of network access relationships with mathematical models to achieve accurate portraits of terminal behaviors. Combined with the detected device information, it automatically determines whether the network behavior of the device is illegal or harmful, so as to achieve visual monitoring of network behavior at any time and any place, and timely discover various abnormal behaviors.

[0043] The artificial intelligence-based distribution network terminal security behavior monitoring system of the present invention forms a closed loop of IoT security management and control from six aspects: clarifying soft and hard assets, building security boundaries, managing terminal access, monitoring security status, discovering and handling abnormal behaviors, and displaying security trends. While strengthening safe operation management, it enhances ease of use and user experience, freeing users from heavy daily affairs, and comprehensively solving the problem of safe operation of distribution automation network.

[0044] By deploying an AI-based distribution network terminal security behavior monitoring system, it is possible to discover, manage, securely access and monitor the IoT terminals, network devices, terminals and servers of the distribution network. At the same time, it can detect abnormal activities, block abnormal devices, calculate the security risk indicators of the distribution network, and control security risks.

[0045] Compared with the existing technology, the present invention has the characteristics of an end-to-end in-depth defense system, integrated management and control of massive terminals, examining network traffic from a business perspective, analyzing network behavior with intelligent means, excellent insight into unknown new attacks, and rapid deployment supported by a flexible architecture.

[0046] The end-to-end defense-in-depth system establishes a security defense-in-depth system with terminal devices as the core, which runs through the perception layer, network layer, application layer, and data layer, fully ensuring terminal security, application security, data security, system and network security, and operational compliance. At the same time, the system is deployed in a bypass mode, without changing the network structure or adding failure points.

[0047] The integrated management and control of massive terminals involves a great variety of network terminals in terms of number, types, status, problems, attack surfaces, and security protection levels. The system presents the number and distribution of terminals, threats faced, and alarm situations in a visual and real-time manner. On the basis of decentralization and domain division, distribution maps, trend maps, GIS maps, and other methods are used to help users clearly understand the overall security situation, perceive threats in a timely manner, and unify protection and disposal strategies.

[0048] The above-mentioned network traffic is examined from the business perspective. All infrastructure, application services and related security measures ultimately serve the business, so all network traffic is directly or indirectly derived from business needs. On the basis of automatically identifying the application system in the network, the system takes the equipment, business applications and service software as the analysis subjects, abstracts and converges the rigid and boring network traffic into network behavior, and analyzes and displays the network traffic from the business perspective;

[0049] The said intelligent means are used to analyze network behavior, and the technology of artificial intelligence, big data and other technologies are comprehensively used to construct a behavior analysis model. While conducting intelligent analysis of network behavior, the behavior model actively learns and actively iterates and optimizes;

[0050] The excellent insight into unknown new attacks mentioned above is different from traditional feature detection products. The system uses new technologies such as machine learning, behavior profiling, model baselines, and distributed computing to perform behavior analysis and monitoring, and has an excellent ability to discover unknown attack behaviors;

[0051] The described flexible architecture supports rapid deployment. The system is built on microservices and distributed big data architecture, and adopts a deployment method that combines an active detection engine with a collection and analysis center. This flexible architecture does not require changing the network architecture or installing any agents, and can achieve rapid deployment. In addition, the detection engine has a simple interface and is lightweight, so it can be easily deployed to the required location. The analysis center is powerful and can serve as a security brain. While doing behavioral analysis, it can command and dispatch all detection engines within its jurisdiction to work together.

[0052] In addition, due to the problems of system tailoring, application customization, difficulty in online upgrading and proprietary and complex communication protocols in distribution network terminals, most distribution network equipment has a large number of security risks and security loopholes. At the same time, due to its limited computing resources, in order to ensure real-time performance and availability, the system often cannot consider the needs of information security too much during design. Most of the distribution network terminals currently in service and on sale are in an unguarded state, and the terminal equipment has problems such as counterfeit replacement, illegal access, illegal access, and intrusion attacks. The monitoring system of the present invention can automatically detect equipment and analyze the network access behavior of equipment, forming a closed loop of distribution network terminal behavior security analysis, monitoring and early warning, and illegal disposal, thereby helping power companies solve the above-mentioned distribution network terminal equipment security issues. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] The above and / or additional aspects and advantages of the present invention will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0054] Figure 1 It is a flow chart of the system simulation of the present invention;

[0055] Figure 2 This is a functional module diagram of the platform of the present invention;

[0056] Figure 3 It is a schematic diagram of the platform structure of the present invention;

[0057] Figure 4 This is a flow chart of the operation of the platform of the present invention;

[0058] Figure 5 This is a logical structure diagram of the system principle of the present invention. DETAILED DESCRIPTION

[0059] In order to more clearly understand the above-mentioned objectives, features and advantages of the present invention, the present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be noted that the embodiments of the present application and the features in the embodiments can be combined with each other without conflict.

[0060] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Therefore, the protection scope of the present invention is not limited to the specific embodiments disclosed below.

[0061] Refer to the following Figure 1-Figure 5 The technical solutions of some embodiments of the present invention are described.

[0062] Example 1

[0063] The present invention provides an embodiment, which is a distribution network terminal safety behavior monitoring system based on artificial intelligence, such as Figure 2 As shown, Figure 2 The monitoring system of the present invention includes a system installation and configuration module, a distribution network equipment asset account module, a distribution network equipment unified management module, a distribution network equipment operation status monitoring module, a distribution network equipment network behavior analysis module and a terminal portrait module.

[0064] The system installation configuration module includes: device IP address configuration, device hardware clock setting, detection engine reporting IP address configuration, detection engine self-start configuration, detection engine service IP address configuration, detection engine detection IP address range configuration, detection engine detection cycle configuration, detection engine performance configuration, analysis engine performance configuration, and analysis engine function switch configuration.

[0065] The distribution network equipment asset ledger module discovers and identifies various types of terminal equipment in the distribution automation network through active detection technology, passive detection technology and fingerprint recognition technology, and forms a comprehensive and accurate asset ledger for the distribution automation network.

[0066] The unified management module for distribution network equipment lists all valuable information of the equipment in detail, making it convenient for users to understand the status of assets in real time.

[0067] The distribution network equipment operation status monitoring module monitors the operation status of the terminal equipment in real time from aspects such as network accessibility and equipment health status through detection and perception, completes the operation status monitoring of the terminal equipment in the network, and displays the risk status in the existing network.

[0068] The network behavior analysis module of the distribution network equipment divides network traffic into three types of traffic: black, white and gray through a behavior analysis function.

[0069] The terminal portrait module establishes a white model of the access relationship between the same type of network devices and security domains through an access relationship model of the terminal portrait based on artificial intelligence, issues early warnings for network access behaviors that exceed the scope of the white model, completes the discovery of unknown attack behaviors on the network, and issues early warnings; through a statistical data model of the terminal portrait based on artificial intelligence, a security baseline of the access traffic, access relationships, and access ports of terminal devices in the network is established, and issues early warnings for network access behaviors that exceed the security baseline threshold range, completes the discovery of unknown attack behaviors on the network, and issues early warnings.

[0070] Furthermore, the system installation configuration includes the following steps:

[0071] Collection and analysis engine connection configuration: First, plug the collection device into the power cord and turn on the power switch. The power indicator (POWER light) on the front panel will be on, and the hard disk status light (HDD light) will flash. After about 1-2 minutes, the status light will flash normally, indicating that the device is working normally. Further, use a standard RJ-45 Ethernet cable to connect the management port (eth0 port) to the network port of the IoT terminal switch, and use a standard RJ-45 Ethernet cable to connect the mirror port (range eth1-eth5 ports) to the mirror port of the IoT terminal switch. The traffic mirror port description requires all traffic in the mirror network, including the detection engine network port traffic;

[0072] Log in to the collection and analysis engine Web terminal: Use a browser to log in to the system, web terminal login link:

[0073] Network configuration: First log in to the engine web terminal, enter the [Modify Address] page, further select the interface to be modified, enter the corresponding IP address, mask and gateway address, and click Submit;

[0074] System configuration: First, configure the device detection: you can set the device serial number, detection mode detection interval (minutes), detection timeout (minutes), connection timeout (seconds), receiving timeout (seconds), offline detection time (milliseconds), image reporting time (seconds), stream URL upload speed (n, times), detection range, and further configure the reporting method: support reporting through the mirror port and https protocol to the management center. The detection modes include layer 2 mode and layer 3 mode.

[0075] Management Center Configuration: Use a browser to log in to the system, Management Center login link:

[0076] Log in to the management center page, go to System Configuration->Engine List, and add the collection and analysis engine address; log in to the management center page, go to System Configuration->Address Group Management, and add an address group.

[0077] Furthermore, the distribution network equipment asset account module includes a function of generating a comprehensive and accurate asset account of the distribution automation network. Through active detection technology, passive detection technology and fingerprint recognition technology, various types of terminal equipment in the distribution automation network are discovered and identified to form a comprehensive and accurate asset account of the distribution automation network. A detailed asset account of various types of equipment including terminal equipment unique to the distribution automation network, including: distribution acquisition terminals, ONU / OLT, smart meters, operation terminals, cameras, hosts, network equipment, servers, etc. is formed.

[0078] The specific implementation steps of the distribution network equipment asset ledger module are as follows:

[0079] Step 1. Log in to the management center;

[0080] Query asset data: You can query the total number of devices, the number of open ports, the number of devices with blacklist ports, the number of available IP addresses, the top 5 device types, the top 5 blacklists, the top 5 high-risk ports, the top 5 brands, department equipment statistics, and newly connected devices;

[0081] Step 2. Query device information:

[0082] First, enter keywords in the search box and press the [Enter] key to filter out devices that respond to the search criteria. Then click the department name. The devices displayed in the list on the right are all devices under the selected department.

[0083] Furthermore, the unified management module of distribution network equipment includes the unified management function of terminal equipment of distribution automation network. All valuable information of the equipment is listed in detail in the asset list, TOP chart, and trend chart, including unique identification, equipment type, model, manufacturer, IP, MAC, physical location, network access status, open ports, equipment risk, real-time traffic, total number of displayed equipment, number of open ports, number of blacklist port equipment, number of available IPs, etc., so that users can understand the status of assets in real time; asset data ranking and asset view display can also be displayed: the asset data ranking includes top 5 equipment types, top 5 blacklists, top 5 high-risk ports, and top 5 brands; the asset view display includes weak password equipment trends, department equipment statistics, and newly connected equipment; the system also supports multi-dimensional and multi-level grouping of terminals, such as grouping based on management departments, equipment types, geographic locations, etc.

[0084] The specific implementation steps of the unified management module for distribution network equipment include:

[0085] Step 1. Log in to the management center;

[0086] Step 2. Add a new device: Click the [Add] button to enter the editing interface to edit the device information, click the [OK] button to save the device information, and the newly added device is valid; or click the [Add] button, enter the IP, click the [One Device One File] button in the editing interface, edit the device information, and click the [OK] button to save the device information details, and the newly added device is valid;

[0087] Step 3. Modify device information: Check the device form that needs to be modified, click the [Modify] button, modify the device information, and click the [OK] button to save the information;

[0088] Step 4. Delete device information: Check the device information, click the [Delete] button, and click the [Delete] confirmation button in the confirmation box to delete the device information; device information can be deleted in batches;

[0089] Step 5. Export device information: Check the device information (or uncheck the device information), click the [Export] button, select [All Data], and click the [OK] button to export all device information; or check the filtered device information (or uncheck the filtered device information), click the [Export] button, select [Current Query], and click the [OK] button to export the currently queried device information; or check the device information, click the [Export] button, select [Currently Selected], and click the [OK] button to export the currently selected device information;

[0090] Furthermore, the distribution network equipment operation status monitoring module includes the function of completing the monitoring of the operation status of the terminal equipment of the distribution automation network. Through detection and perception, the operation status of the terminal equipment is monitored in real time from aspects such as network accessibility and equipment health status. Once an abnormal event such as equipment failure or offline occurs in the terminal equipment within the network, the system will immediately generate an alarm to complete the operation status monitoring of the terminal equipment within the network.

[0091] The specific implementation steps of the distribution network equipment operation status monitoring module include:

[0092] Step 1. Port information display: display the total number of open ports, the device with the most open ports and their trends, and display the port classification rankings including the top 5 destination ports, top 5 blacklist ports, top 5 high-risk ports, and top 5 department blacklist ports;

[0093] Step 2. IP address information display: Display the total number of IP addresses in the entire network, the number of available IP addresses, the department with the highest IP usage rate, the top 5 ranking of department IP usage rate, IP usage rate trend view, and IP detail query, including clicking the drop-down box button, selecting the IP segment to be viewed, and clicking the non-available IP in the list to enter the IP query information details interface;

[0094] Step 3. View offline devices by category: Click the drop-down box button on the right side of the operation status monitoring navigation bar, as marked by the red box in the figure above, and select an option in the drop-down menu to filter out the corresponding offline devices;

[0095] Step 4. Terminal image:

[0096] This step is applied to the terminal portrait module using some of its sub-modules, including terminal portrait-access relationship model: select the [Access Relationship] navigation menu, select the monitoring model generated by intelligent learning, click the [Generate Monitoring Model] button, and the selected form is added to the analysis model in the intelligent analysis model; Terminal portrait-threshold model: select the [Statistical Data] navigation menu, check the threshold setting option, enter the deviation value directly below the option, click the [Confirm] button to save the threshold setting, click the [Generate Policy] button, and the set threshold will automatically generate an effective policy; Terminal portrait-statistical model: select the [Statistical Data] navigation menu, check the model form generated by the threshold step, click the [Generate Statistical Model] button, and the generated statistical model will be displayed in the statistical model under the intelligent analysis model; Terminal portrait-static portrait of terminal equipment: display department information, equipment interconnection view and equipment information; Terminal portrait-dynamic portrait (radar chart): click the equipment view connection point to view the equipment data comparison information.

[0097] The distribution network equipment operation status monitoring module can also display the total number of devices, the maximum number of devices, the number of newly added devices on the day and the trend, the total number of IPs in the entire network, the number of available IPs, the departments with the highest IP utilization rate, the top 5 ranking of department IP utilization rate, IP utilization trend view, the total number of open ports, the number of devices with the most open ports and their trends, and classify and view offline devices. Detailed information on devices includes: device type, operating system, department, mac address, brand, model, weak passwords, vulnerabilities, discovery time, online time, and open services; port classification rankings include: top 5 destination ports, top 5 blacklist ports, top 5 high-risk ports, and top 5 department blacklist ports; risk status monitoring includes: displaying the vulnerabilities, weak passwords, high-risk ports, and blacklist ports scanned by the device to show the risk status in the existing network.

[0098] Furthermore, the network behavior analysis module of the distribution network equipment includes the functions of completing the abnormal behavior analysis and early warning of the distribution automation network. Through the behavior analysis function, the network traffic is divided into three types of traffic: black, white, and gray. Through the blacklist, the illegal network behavior of the network is discovered; through the gray list, the suspicious network behavior of the network is discovered; through the intelligent analysis model, the network's illegal external connection behavior, the use of unsafe protocols, high-risk port behavior, the use of illegal software, illegal access to databases, illegal access to security domains, illegal access to application systems and other abnormal network behaviors are analyzed and warned; through the built-in "National Grid Port and Service Black and White List", the behavior of accessing high-risk ports and blacklisted ports within the network is discovered.

[0099] The specific implementation steps of the network behavior analysis module of the distribution network equipment include:

[0100] Step 1. View illegal network data:

[0101] Displays the total number of illegal network devices, the total number and trend of risk events, the top 5 illegal behavior source addresses, the top 5 related business applications, the top 5 illegal behavior types, illegal network behavior trends, and illegal network information;

[0102] Step 2. View the details of illegal network information:

[0103] Click on the illegal network information [quantity link] (the quantity link is blue) to open the illegal network information details interface;

[0104] Step 3. Export illegal network devices:

[0105] Check the device information (or uncheck the device information), click the [Export] button, select [All Data], enter the file name, click the [OK] button, and the export file will be generated in the file download list. Click the generated file to download the illegal network device information; or check the filtered device information or uncheck the filtered device information, click the [Export] button, select [Current Query], enter the file name, click the [OK] button, and the export file will be generated in the file download list. Click the generated file to download the illegal network device information; check the device information, click the [Export] button, select [Currently Selected], enter the file name, click the [OK] button, and the export file will be generated in the file download list. Click the generated file to download the illegal network device information;

[0106] Step 4. Display of suspicious network data:

[0107] Displays the total number and trend of suspicious devices, top 5 suspicious behavior source addresses, top 5 suspicious behavior destination addresses, suspicious network behavior trends, address perspective, and destination port perspective;

[0108] The network behavior analysis module of the distribution network equipment can also display the total number of devices, the number of online devices, the online rate of devices, the number of blocked devices, the number of weak passwords, the top 5 device types, the top 5 brands, the device access statistics, the top 5 destination ports, the top 5 high-risk ports, the top 5 blacklist ports, the top 5 illegal behavior devices, the top 5 illegal behavior types, the top 5 suspicious behavior source IPs, the top 5 suspicious behavior destination IPs, network behavior trends, the total number of illegal behavior devices, the total number of suspicious behavior devices, the total number of whitelist policies, the total number of whitelists, the total number of filtered normal network connections, the information of newly connected devices, the alarm device information, the blocked device information, etc. Data information, total number of illegal network devices, total number and trend of risk events, top 5 illegal behavior source addresses, top 5 related business applications, top 5 illegal behavior types, illegal network behavior trends, illegal network information, total number and trend of suspicious devices, top 5 suspicious behavior source addresses, top 5 possible behavior destination addresses, possible network behavior trends, address perspective, destination port perspective, total number of whitelist policies, number of whitelist items, total number of network connections, top 5 whitelist policy hits, top 5 whitelist hits, whitelist policies and whitelist list information; the functions of the whitelist policy module are consistent with the operations in the whitelist policy configuration under the Security Configuration Center.

[0109] Furthermore, the terminal portrait module includes the function of completing the discovery and early warning of unknown attack behaviors in the distribution automation network. Through the access relationship model of the terminal portrait based on artificial intelligence, a white model of the access relationship between the same type of network devices and security domains is established, and the network access behavior beyond the scope of the white model is warned, and the discovery of unknown attack behaviors in the network is completed, and an early warning is issued; through the statistical data model of the terminal portrait based on artificial intelligence, a security baseline of the access traffic, access relationship, and access port of the terminal equipment in the network is established, and the network access behavior beyond the security baseline threshold range is warned, and the discovery of unknown attack behaviors in the network is completed, and an early warning is issued; the total number of models, the total number of illegal network connections, the top 5 analysis model hits, the top 5 statistical model hits, the top ranking of illegal behaviors of important assets, the top 5 analysis model hits, and the top 5 statistical model hits information are displayed. The analysis model and statistical model in the list need to be switched.

[0110] The specific implementation steps of the terminal portrait module include:

[0111] Step 1. Whitelist information management and query:

[0112] Displays the total number of whitelist policies, the number of whitelist items, the total number of network connections, the top 5 whitelist policy hits, the top 5 whitelist hits, whitelist policies, and whitelist list information; the functions of the whitelist policy module are consistent with the operations in the whitelist policy configuration under the Security Configuration Center;

[0113] Step 2. Intelligent analysis data display:

[0114] Display the total number of models, the total number of illegal network connections, the top 5 analytical model hits, the top 5 statistical model hits, the top ranking of illegal behaviors of important assets, the top 5 analytical model hits, and the top 5 statistical model hits. To view this information, you need to switch between analytical models and statistical models in the list.

[0115] Step 3. Enable the important asset data comparison and blocking functions:

[0116] Add important assets and check the [Compare with Myself] function. After intelligent learning, the system will compare the data and give an alarm on the [Illegal Network Behavior] interface; or add important assets and check the [Compare with Myself] function and the blocking function. After intelligent learning, the system will compare the data and give an alarm on the [Illegal Network Behavior] interface. The device is blocked and can be viewed in the [Blocking List].

[0117] like Figure 3 As shown, Figure 3 The schematic diagram of the platform structure of the present invention is shown in Figure 1. The system principle logic is as follows: Figure 5 shown.

[0118] The system traffic collection device collects the network traffic of the entire distribution network through the mirror port of the distribution network core switch, and uses a distributed storage server to store the collected network data. Users use and operate the monitoring system through the WEB-based application services provided by the system.

[0119] The IoT terminal behavior monitoring system integrates multiple security functions such as automatic discovery of network-wide devices, real-time alarm of device failures, automatic identification of security access, automatic analysis of network behaviors, and automatic blocking of illegal behaviors. The system is deployed in a bypass deployment mode, without changing the original network architecture or installing a proxy client. It can be used for network-wide device management, access management, and illegal detection, forming an in-depth defense system for the IoT.

[0120] Example 2

[0121] The present invention further provides an embodiment, which is a method for monitoring the safety behavior of distribution network terminals based on artificial intelligence, such as Figure 4 As shown, the specific steps include:

[0122] Step 1. Install and configure the traffic collection module;

[0123] Step 2. Administrator, user and network configuration;

[0124] Step 3. Log in to the monitoring system;

[0125] Step 4. Log in to the monitoring system: device detection and control, risk vulnerability management, whitelist and data model management, dynamic status monitoring, risk status monitoring and terminal profiling;

[0126] Step 5. Exit the system.

[0127] Example 3

[0128] The present invention also provides an embodiment, which is an artificial intelligence-based distribution network terminal security behavior monitoring system, including a system installation and configuration module, a distribution network equipment asset ledger module, a distribution network equipment unified management module, a distribution network equipment operation status monitoring module, a distribution network equipment network behavior analysis module and a terminal portrait module.

[0129] like Figure 1 As shown, Figure 1 The detection system of the present invention can be divided into two stages, including a learning stage and an operation stage.

[0130] The learning phase includes collecting distribution network traffic, establishing terminal network device fingerprints, and terminal behavior modeling.

[0131] The distribution network traffic collection mainly includes: traffic collection based on port mirroring and traffic collection based on optical splitting.

[0132] The traffic collection based on the optical splitting method is realized through an optical splitter. The optical splitter is a passive device, and its principle is to copy the input light at the physical layer to obtain traffic, that is, the original traffic passes normally, and the optical splitting is used for equipment analysis. The traffic collection based on the optical splitting method is essentially a form of bypass monitoring, so it does not affect the normal communication of the entire network. For high-speed optical fiber links, the optical splitter obtains traffic data from the high-speed optical fiber and transmits it to the diversion device, and then the various traffic data packets are diverted by the diversion device and handed over to various types of traffic servers for analysis and processing. Finally, the results of the analysis of all servers are summarized to realize real-time collection and analysis of traffic.

[0133] The traffic collection based on port mirroring is to copy the traffic data of one or more ports of other network devices such as switches or routers to one or more ports. The copied port and the copied port are respectively called the mirror source port and the mirror port. Port mirroring is mainly deployed in the network aggregation layer or core layer to mirror the traffic to the collection device. This traffic collection method can monitor the traffic transmission status of each port without affecting the normal use of network users, thereby monitoring the network in real time.

[0134] The establishment of the terminal network device fingerprint is to analyze the historical network traffic, use the matching algorithm to identify the network device features contained in the traffic, and form the device network fingerprint. These device fingerprints will be used for automatic detection and identification of devices in the distribution network during the operation phase. The device fingerprint is pre-extracted from the device's historical traffic feature information. Specifically, the historical feature information can be extracted from the historically collected network traffic information, and the device fingerprint is generated based on the various data recorded in the historical feature information. The device fingerprint is unique and can be used to identify the corresponding device in the distribution network. The feature information includes the protocol type, IP address, MAC address, port, and identification information of the traffic device. The identification information is also called Banner information, which can include OS (Operating System) version, software and hardware version, device manufacturer information, device type, device model and other information;

[0135] The terminal behavior modeling is based on the historically collected network traffic information, through manual or automatic analysis methods, such as statistical analysis, signal analysis, correlation analysis or one or more of them, to analyze and obtain network traffic feature models of different types and different terminal devices. The model can be a traffic threshold model, a network link feature parameter model, a sequence feature model, etc. These traffic analysis feature models can be stored in a traffic analysis model library. Based on the models in the traffic analysis model library, abnormal analysis of network traffic in the distribution network can be achieved.

[0136] According to the historically collected network traffic information, the network access behavior feature models of different types of devices and different terminal devices are analyzed and established through machine learning algorithms. The learning algorithm adopts decision tree learning, Bayesian network learning or clustering learning. Through the learning of a large amount of normal access behavior traffic, the network access behavior feature models of different types of devices accessing different business types are automatically established, or the network access behavior white models of different business types are established through manual analysis. These models can simplify the huge and complex network traffic into a limited number of network access behavior models, and are used to realize the analysis of abnormal network access behavior in the operation stage. The model content of the behavior white model includes network behavior name, network behavior protocol type, network behavior port range feature, network behavior address range feature and network behavior traffic sequence feature.

[0137] Furthermore, the operation phase includes real-time collection of distribution network traffic, automatic discovery and identification of distribution network equipment, terminal network behavior analysis, and terminal profiling and monitoring.

[0138] The real-time collection of distribution network traffic is to collect the real-time full traffic of the distribution network operation through the mirror port;

[0139] The automatic discovery and identification of distribution network equipment is to analyze the real-time traffic of the distribution network, use the device identification technology based on network fingerprint to detect and identify the distribution network equipment, and use the device information library to use the network scanning technology to detect and identify the equipment in real time;

[0140] The terminal network behavior analysis is to analyze the real-time traffic of the distribution network, and obtain the abnormal network traffic and abnormal network access behavior of the terminal device based on the pre-generated network traffic feature model and network access behavior feature model. The real-time traffic of the distribution network is analyzed, specifically, the built-in behavior white model is used to determine whether the proprietary system such as the terminal device has been maliciously exploited by the attacker, and to identify abnormal behaviors such as high-risk scanning and worm viruses.

[0141] The terminal profiling and monitoring is based on the automatic discovery and identification results of the equipment during the operation phase and the network behavior analysis results of the terminal equipment, extracting static attributes including IP, MAC address, brand, model, and dynamic attributes such as traffic data and application protocol, and then taking the equipment as the analysis object to perform static and dynamic profiling of the equipment.

[0142] In the description of this specification, the description of the terms "one embodiment", "some embodiments", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0143] Example 4

[0144] Based on the same inventive concept, an embodiment of the present invention also provides a computer storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of a distribution network terminal safety behavior monitoring method based on artificial intelligence described in Examples 1-2 are implemented.

[0145] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0146] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0147] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0148] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0149] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A distribution network terminal security behavior monitoring system based on artificial intelligence, Its characteristics are: It includes system installation and configuration module, distribution network equipment asset account module, distribution network equipment unified management module, distribution network equipment operation status monitoring module, distribution network equipment network behavior analysis module and terminal profiling module; The system installation configuration includes the collection and analysis engine connection configuration; the system installation configuration module includes: device IP address configuration, device hardware clock setting, detection engine reporting IP address configuration, detection engine self-start configuration, detection engine service IP address configuration, detection engine detection IP address range configuration, detection engine detection cycle configuration, detection engine performance configuration, analysis engine performance configuration, analysis engine function switch configuration; the distribution network equipment asset account module includes the function of generating a comprehensive and accurate distribution automation network asset account; through active detection technology, passive detection technology and fingerprint recognition technology, various types of terminal equipment in the distribution automation network are discovered and identified to form a comprehensive and accurate distribution automation network asset account; the asset account includes the distribution automation network-specific Terminal equipment, including: distribution collection terminals, ONU / OLT, smart meters, operation terminals, cameras, hosts, network equipment, servers and various types of equipment asset detailed accounts; the distribution network equipment unified management module includes the unified management function of distribution automation network terminal equipment; all valuable information of the equipment is listed in detail in the asset list, TOP chart, trend chart, display asset data ranking, asset view display: among them, asset data ranking includes top 5 equipment types, top 5 blacklists, top 5 high-risk ports, top 5 brands; the asset view display includes weak password equipment trends, department equipment statistics, and newly connected equipment; the system also supports multi-dimensional and multi-level grouping of terminals; the distribution network equipment operation status monitoring module It includes the monitoring function of the operating status of the terminal equipment in the distribution automation network. Through detection and perception, the operating status of the terminal equipment is monitored in real time from the aspects of network accessibility and equipment health status. Once a terminal device in the network fails or an abnormal offline event occurs, the system immediately generates an alarm to complete the operating status monitoring of the terminal equipment in the network and display the risk status of the existing network; the distribution network equipment operating status monitoring module can also display the total number of devices, the maximum number of devices, the number and trend of newly added devices on the day, the total number of IPs in the entire network, the number of available IPs, the departments with the highest IP usage rate, the top 5 ranking of department IP usage rate, IP usage rate trend view, the total number of open ports, the device with the most open ports and its trend, and the classification of offline devices; the network behavior of the distribution network equipment The analysis module includes the functions of completing the analysis and early warning of abnormal behaviors of the distribution automation network; through the behavior analysis function, the network traffic is divided into three types of traffic: black, white, and gray; the illegal network behaviors of the network are discovered through the blacklist; the suspicious network behaviors of the network are discovered through the graylist; the analysis and early warning of the network's illegal external connection behaviors, the use of unsafe protocols, high-risk port behaviors, the use of illegal software behaviors, illegal access to databases, illegal access to security domains, and illegal access to application system network abnormal behaviors are completed through the intelligent analysis model; the behavior of accessing high-risk ports and blacklist ports in the network is discovered through the built-in "National Grid Port and Service Black and White List"; the terminal portrait module includes the functions of completing the discovery and early warning of unknown attack behaviors of the distribution automation network;Through the access relationship model of terminal portraits based on artificial intelligence, a white model of the access relationship between the same type of network devices and security domains is established, and network access behaviors beyond the scope of the white model are warned, and unknown network attack behaviors are discovered and warned; through the statistical data model of terminal portraits based on artificial intelligence, a security baseline of the access traffic, access relationship, and access port of terminal devices in the network is established, and network access behaviors beyond the threshold range of the security baseline are warned, and unknown network attack behaviors are discovered and warned; the total number of models, the total number of illegal network connections, the top 5 analysis model hits, the top 5 statistical model hits, the top ranking of illegal behaviors of important assets, the top 5 analysis model hits, and the top 5 statistical model hits are displayed. To view the information, you need to switch the analysis model and statistical model in the list. ; 2. According to claim 1, a distribution network terminal safety behavior monitoring system based on artificial intelligence, Its characteristics are: The network behavior analysis module of the distribution network equipment includes the following steps: Step 1. View illegal network data: Step 2. View the details of illegal network information: Step 3. Export illegal network devices: Step 4. Display of suspicious network data.

3. According to claim 1, a distribution network terminal safety behavior monitoring system based on artificial intelligence, Its characteristics are: The terminal portrait module includes the following steps: Step 1. Whitelist information management and query: Step 2. Intelligent analysis data display: Step 3. Enable the important asset data comparison and blocking functions.

4. According to claim 1, a distribution network terminal safety behavior monitoring system based on artificial intelligence, Its characteristics are: The monitoring system is divided into two stages, including: a learning stage and an operation stage; the learning stage includes distribution network traffic collection, establishment of terminal network equipment fingerprints, and terminal behavior modeling; the operation stage includes real-time collection of distribution network traffic, automatic discovery and identification of distribution network equipment, terminal network behavior analysis, and terminal profiling and monitoring.

5. According to claim 4, a distribution network terminal safety behavior monitoring system based on artificial intelligence, Its characteristics are: The distribution network traffic collection includes: traffic collection based on port mirroring and traffic collection based on optical splitting; the traffic collection based on optical splitting is implemented through an optical splitter; the traffic collection based on port mirroring is to copy the traffic data of one or more ports of a switch or router and other network devices to one or more ports, the copied ports and the copied ports are respectively called mirror source ports and mirror ports, and port mirroring is mainly deployed at the network aggregation layer or core layer to mirror the traffic to the collection device. This traffic collection method can monitor the traffic transmission status of each port without affecting the normal use of network users, thereby monitoring the network in real time; Establishing terminal network device fingerprints is to analyze historical network traffic, use matching algorithms to identify network device features contained in the traffic, and form device network fingerprints; Terminal behavior modeling is a method of manual or automatic analysis based on historically collected network traffic information.

6. According to claim 4, a distribution network terminal safety behavior monitoring system based on artificial intelligence, Its characteristics are: The real-time collection of distribution network traffic is to collect the real-time full traffic of the distribution network operation through the mirror port; Automatic discovery and identification of distribution network equipment is to analyze the real-time traffic of the distribution network, use the device identification technology based on network fingerprint to detect and identify the distribution network equipment, and use the device information database to use the network scanning technology to detect and identify the equipment in real time; Terminal network behavior analysis is to analyze the real-time traffic of the distribution network, and obtain the abnormal network traffic and abnormal network access behavior of the terminal device based on the pre-generated network traffic feature model and network access behavior feature model; through the built-in behavior white model, it is determined whether the proprietary system of the terminal device has been maliciously exploited by attackers, and high-risk scanning and worm virus abnormal behaviors are identified; Terminal profiling and monitoring is based on the automatic discovery and identification results of the equipment during the operation phase and the network behavior analysis results of the terminal equipment. It extracts static attributes including IP, MAC address, brand, and model, as well as dynamic attributes of traffic data and application protocols, and then uses the equipment as the analysis object to perform static and dynamic profiling of the equipment.

7. According to claim 1, a monitoring method for a distribution network terminal safety behavior monitoring system based on artificial intelligence, Its characteristics are: The following steps are involved: Step 1. Install and configure the traffic collection module; Step 2. Administrator, user and network configuration; Step 3. Log in to the monitoring system; Step 4. Log in to the monitoring system: device detection and control, risk vulnerability management, whitelist and data model management, dynamic status monitoring, risk status monitoring and terminal profiling; Step 5. Exit the system.

8. A computer storage medium, Its characteristics are: The computer storage medium stores a computer program, and when the computer program is executed by the processor, the steps of the monitoring method of the distribution network terminal safety behavior monitoring system based on artificial intelligence described in claim 7 are implemented.

Images