A method, device and storage medium for determining data pollution degree

Abstract

The present invention discloses a method, device and storage medium for determining the degree of data pollution, including: determining the flow of each node in the network; when it is determined that there is polluted data, determining the nodes that have transmitted polluted data during the pollution time period; determining the degree of data pollution according to the flow of the nodes that have transmitted polluted data during the pollution time period, and the proportion of polluted data. The present invention solves the problem that there is currently no solution for evaluating the scope and degree of pollution caused by data pollution events, and realizes the evaluation of the scope and degree of data pollution. For networks with more nodes, it is not necessary to consume a lot of resources to normally calculate node-related attribute data.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a method, device and storage medium for determining the degree of data contamination. Background Art

[0002] In the Internet age, various systems and applications generate massive amounts of data every day. Many data quality management systems or security protection systems are not complete, which may cause a lot of contaminated data to be stored and used in normal data, resulting in data contamination incidents. Data contamination refers to a damage to the integrity and authenticity of original data caused by intentional or accidental behavior, that is, tampering or forging of original data.

[0003] The direct consequence of data pollution is the distortion of original data. If the polluted data is used, it may affect the analysis and decision-making of a series of related links through dissemination, leading to wrong data analysis results and even causing serious economic losses.

[0004] The deficiency of the existing technology is that there is no solution to evaluate the scope and degree of pollution caused by data pollution events. Summary of the invention

[0005] The present invention provides a method, device and storage medium for determining the degree of data pollution, so as to solve the problem that there is no solution for evaluating the scope and degree of pollution caused by data pollution events.

[0006] The present invention provides the following technical solutions:

[0007] A method for determining a data pollution degree comprises:

[0008] Determine the traffic flow of each node in the network;

[0009] When it is determined that there is contaminated data, determine the nodes that have transmitted the contaminated data during the contamination period;

[0010] The degree of data pollution is determined based on the traffic of the nodes that transmitted the polluted data during the pollution period and the proportion of the polluted data.

[0011] During implementation, determine the traffic of each node, including:

[0012] Obtain data transmitted by each node in the network;

[0013] Get the key fields in the data;

[0014] Extract operation object data based on key fields;

[0015] The traffic of each node is determined according to the object data being transmitted.

[0016] In implementation, the key fields include one or a combination of the following fields:

[0017] The unique identifier of the starting node, the unique identifier of the arrival node, the unique identifier corresponding to the business on the node, the occurrence time of the data, the operation request of the data, and the operation status of the data.

[0018] During implementation, it further includes:

[0019] After determining the traffic of each node in the network, classify each node according to the traffic size;

[0020] When determining the degree of data pollution according to the flow of the node that has transmitted the polluted data during the pollution time period and the proportion of the polluted data, the degree of data pollution is determined according to the classification of the node and the proportion of the polluted data.

[0021] In implementation, the node that has transmitted polluted data during the pollution period is determined according to one or a combination of the following information:

[0022] Information about nodes that discover data pollution;

[0023] The time frame in which the data contamination incident occurred;

[0024] Tainted data objects.

[0025] During implementation, nodes that have transmitted polluted data during the pollution period are determined, including:

[0026] According to the data pollution source attributes, determine the data pollution object set {A1, A2, ..., A n};

[0027] A i As the data outflow object, the arrival node is limited to the pollution discovery node N0, and the data object is equal to the set {A1, A2, ..., A n}, search in the data outflow object field of the operation information table and the data object table corresponding to the operation information table, and obtain the key-value pair set of polluted nodes and polluted data objects {{A1, N11}, {A1, N12}, ..., {A n ,N1 m}}, the first layer of contaminated node set {N11,N12,……,N1 j};

[0028] A i As the data outflow object, search in the data outflow object field of the data association table, and de-reorganize the objects corresponding to the data inflow object field obtained from the search into the associated polluted data object set {Ai1, Ai2, ..., Ai n};

[0029] Limit the reachable nodes to the first-layer contaminated node set {N11, N12, ..., N1 j}, the operation data object is limited to the associated pollution data object set {Ai1, Ai2, ..., Ai n}, and search for relevant operation records. If so, the retrieved start node field content is used to form a set of polluted nodes and polluted data object key-value pairs {{Ai1, N21}, {Ai1, N22}, ..., {Ai n ,N2 n}}, and reassemble the second layer of polluted node set {N2 i ,N2 i+1 ,……,N2 j};

[0030] And so on, we get the third layer, ..., nth layer of polluted nodes, and determine all the polluted nodes.

[0031] In implementation, the degree of data pollution is determined based on the traffic of the node that transmitted the polluted data during the pollution period and the proportion of the polluted data, including:

[0032] Determine the set of polluted nodes {N1, N2, ..., N n}The proportion of pollution source data of each node;

[0033] Determine the retrieval time range as the time after the data pollution event occurs, and obtain {N1, N2, ..., N n Each node N in n The total number of requested operations;

[0034] Get {N1, N2, ..., N n Each node N in n The total number of requested operations on pollution-affected data objects;

[0035] Determine {N1, N2, ..., N n Each node N in n The proportion of pollution source data;

[0036] Determine {N1, N2, ..., N n}, wherein the propagation attribute value is a value determined according to the flow of the node;

[0037] Determine the pollution degree score of the data pollution event based on the transmission power value and the proportion of pollution source data.

[0038] A device for determining a data pollution degree, comprising:

[0039] The processor reads the program in the memory and performs the following processes:

[0040] Determine the traffic flow of each node in the network;

[0041] When it is determined that there is contaminated data, determine the nodes that have transmitted the contaminated data during the contamination period;

[0042] The degree of data pollution is determined based on the traffic of the nodes that transmitted the polluted data during the pollution period and the proportion of the polluted data;

[0043] A transceiver is used to receive and send data under the control of the processor.

[0044] During implementation, determine the traffic of each node, including:

[0045] Obtain data transmitted by each node in the network;

[0046] Get the key fields in the data;

[0047] Extract operation object data based on key fields;

[0048] The traffic of each node is determined according to the object data being transmitted.

[0049] In implementation, the key fields include one or a combination of the following fields:

[0050] The unique identifier of the starting node, the unique identifier of the arrival node, the unique identifier corresponding to the business on the node, the occurrence time of the data, the operation request of the data, and the operation status of the data.

[0051] During implementation, it further includes:

[0052] After determining the traffic of each node in the network, classify each node according to the traffic size;

[0053] When determining the degree of data pollution according to the flow of the node that has transmitted the polluted data during the pollution time period and the proportion of the polluted data, the degree of data pollution is determined according to the classification of the node and the proportion of the polluted data.

[0054] In implementation, the node that has transmitted polluted data during the pollution period is determined according to one or a combination of the following information:

[0055] Information about nodes that discover data pollution;

[0056] The time frame in which the data contamination incident occurred;

[0057] Tainted data objects.

[0058] During implementation, nodes that have transmitted polluted data during the pollution period are determined, including:

[0059] According to the data pollution source attributes, determine the data pollution object set {A1, A2, ..., A n};

[0060] A i As the data outflow object, the arrival node is limited to the pollution discovery node N0, and the data object is equal to the set {A1, A2, ..., A n}, search in the data outflow object field of the operation information table and the data object table corresponding to the operation information table, and obtain the key-value pair set of polluted nodes and polluted data objects {{A1, N11}, {A1, N12}, ..., {A n ,N1 m}}, the first layer of contaminated node set {N11,N12,……,N1 j};

[0061] A i As the data outflow object, search in the data outflow object field of the data association table, and de-reorganize the objects corresponding to the data inflow object field obtained from the search into the associated polluted data object set {Ai1, Ai2, ..., Ai n};

[0062] Limit the reachable nodes to the first-layer contaminated node set {N11, N12, ..., N1 j}, the operation data object is limited to the associated pollution data object set {Ai1, Ai2, ..., Ai n}, and search for relevant operation records. If so, the retrieved start node field content is used to form a set of polluted nodes and polluted data object key-value pairs {{Ai1, N21}, {Ai1, N22}, ..., {Ai n ,N2 n}}, and reassemble the second layer of polluted node set {N2 i ,N2 i+1 ,……,N2 j};

[0063] And so on, we get the third layer, ..., nth layer of polluted nodes, and determine all the polluted nodes.

[0064] In implementation, the degree of data pollution is determined based on the traffic of the node that transmitted the polluted data during the pollution period and the proportion of the polluted data, including:

[0065] Determine the set of polluted nodes {N1, N2, ..., N n}The proportion of pollution source data of each node;

[0066] Determine the retrieval time range as the time after the data pollution event occurs, and obtain {N1, N2, ..., N n Each node N in n The total number of requested operations;

[0067] Get {N1, N2, ..., N n Each node N in n The total number of requested operations on pollution-affected data objects;

[0068] Determine {N1, N2, ..., N n Each node N in n The proportion of pollution source data;

[0069] Determine {N1, N2, ..., N n}, wherein the propagation attribute value is a value determined according to the flow of the node;

[0070] Determine the pollution degree score of the data pollution event based on the transmission power value and the proportion of pollution source data.

[0071] A device for determining a data pollution degree, comprising:

[0072] A flow determination module, used to determine the flow of each node in the network;

[0073] A pollution determination module, for determining, when it is determined that there is polluted data, the nodes that have transmitted the polluted data within the pollution time period;

[0074] The degree determination module is used to determine the data pollution degree according to the flow of the node that has transmitted the polluted data during the pollution time period and the proportion of the polluted data.

[0075] In implementation, the traffic determination module is further used to determine the traffic of each node, including:

[0076] Obtain data transmitted by each node in the network;

[0077] Get the key fields in the data;

[0078] Extract operation object data based on key fields;

[0079] The traffic of each node is determined according to the object data being transmitted.

[0080] In implementation, the traffic determination module is further used to obtain key fields including one of the following fields or a combination thereof:

[0081] The unique identifier of the starting node, the unique identifier of the arrival node, the unique identifier corresponding to the business on the node, the occurrence time of the data, the operation request of the data, and the operation status of the data.

[0082] In implementation, the traffic determination module is further used to determine the traffic of each node in the network and then classify each node according to the traffic size;

[0083] The degree determination module is further used to determine the data pollution degree according to the node classification and the proportion of polluted data when determining the data pollution degree according to the traffic of the node that has transmitted the polluted data during the pollution time period and the proportion of the polluted data.

[0084] In implementation, the pollution determination module is further used to determine the nodes that have transmitted polluted data during the pollution time period according to one or a combination of the following information:

[0085] Information about nodes that discover data pollution;

[0086] The time frame in which the data contamination incident occurred;

[0087] Tainted data objects.

[0088] In implementation, the pollution determination module is further used to determine the nodes that have transmitted polluted data within the pollution time period, including:

[0089] According to the data pollution source attributes, determine the data pollution object set {A1, A2, ..., A n};

[0090] A i As the data outflow object, the arrival node is limited to the pollution discovery node N0, and the data object is equal to the set {A1, A2, ..., A n}, search in the data outflow object field of the operation information table and the data object table corresponding to the operation information table, and obtain the key-value pair set of polluted nodes and polluted data objects {{A1, N11}, {A1, N12}, ..., {A n ,N1 m}}, the first layer of contaminated node set {N11,N12,……,N1 j};

[0091] A i As the data outflow object, search in the data outflow object field of the data association table, and de-reorganize the objects corresponding to the data inflow object field obtained from the search into the associated polluted data object set {Ai1, Ai2, ..., Ai n};

[0092] Limit the reachable nodes to the first-layer contaminated node set {N11, N12, ..., N1j}, the operation data object is limited to the associated pollution data object set {Ai1, Ai2, ..., Ai n}, and search for relevant operation records. If so, the retrieved start node field content is used to form a set of polluted nodes and polluted data object key-value pairs {{Ai1, N21}, {Ai1, N22}, ..., {Ai n ,N2 n}}, and reassemble the second layer of polluted node set {N2 i ,N2 i+1 ,……,N2 j};

[0093] And so on, we get the third layer, ..., nth layer of polluted nodes, and determine all the polluted nodes.

[0094] In implementation, the degree determination module is further used to determine the degree of data pollution according to the traffic of the node that has transmitted the polluted data during the pollution time period and the proportion of the polluted data, including:

[0095] Determine the set of polluted nodes {N1, N2, ..., N n}The proportion of pollution source data of each node;

[0096] Determine the retrieval time range as the time after the data pollution event occurs, and obtain {N1, N2, ..., N n Each node N in n The total number of requested operations;

[0097] Get {N1, N2, ..., N n Each node N in n The total number of requested operations on pollution-affected data objects;

[0098] Determine {N1, N2, ..., N n Each node N in n The proportion of pollution source data;

[0099] Determine {N1, N2, ..., N n}, wherein the propagation attribute value is a value determined according to the flow of the node;

[0100] Determine the pollution degree score of the data pollution event based on the transmission power value and the proportion of pollution source data.

[0101] A computer-readable storage medium stores a computer program for executing the above-mentioned method for determining the degree of data contamination.

[0102] The beneficial effects of the present invention are as follows:

[0103] In the technical solution provided by the embodiment of the present invention, the flow of each node in the network is determined in advance, so that the data transmission power of each node can be determined; in this way, when it is determined that there is polluted data, after determining the nodes that have transmitted polluted data during the pollution time period, the degree of data pollution can be determined according to the flow of the nodes that have transmitted polluted data during the pollution time period, and the proportion of polluted data. This solution solves the problem that there is currently no solution to evaluate the scope and degree of pollution caused by data pollution events, and realizes the evaluation of the scope and degree of data pollution.

[0104] Furthermore, the calculation method of this solution is simple, and for a network with a large number of nodes, it does not need to consume a large amount of resources to normalize the calculation of node-related attribute data. BRIEF DESCRIPTION OF THE DRAWINGS

[0105] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0106] Figure 1 This is a schematic diagram of an implementation flow of a method for determining the degree of data contamination in an embodiment of the present invention;

[0107] Figure 2 This is a schematic diagram of the data pollution degree analysis step architecture in an embodiment of the present invention;

[0108] Figure 3 A schematic diagram of an implementation flow of determining the flow of each node in a network in an embodiment of the present invention;

[0109] Figure 4 A schematic diagram of an implementation flow of determining a node that has transmitted polluted data within a polluted time period in an embodiment of the present invention;

[0110] Figure 5 Schematic diagram of the structure of a device for determining the degree of data pollution according to an embodiment of the present invention;

[0111] Figure 6 Schematic diagram of the second structure of the device for determining the degree of data pollution in an embodiment of the present invention;

[0112] Figure 7 FIG. 3 is a schematic diagram of the structure of the device for determining the degree of data pollution in an embodiment of the present invention. DETAILED DESCRIPTION

[0113] The inventors noticed during the invention process that:

[0114] After a data pollution incident occurs in the internal data of an enterprise, how to evaluate the scope and degree of pollution caused by the group of data, so as to help data managers judge the severity of the incident and take corresponding disposal measures. One direction of data pollution research that has been more extensive is the P2P (node ​​to node, peer to peer) network data pollution problem. There are fewer discussions on the data pollution problem of enterprise data. In addition, existing technical research focuses more on studying how to prevent data from being polluted through data quality management systems, and there are even fewer discussions on the disposal of data pollution incidents. Two aspects that may be related to the existing solutions are node propagation capabilities and security risk assessment, both of which have algorithm models for related research.

[0115] Based on this, the technical solution provided by the embodiment of the present invention is based on the approximate impact caused by the current analysis based on known data, and therefore does not require an overly complex algorithm model for calculation to reduce resource consumption, which will not be elaborated in detail here.

[0116] The specific implementation modes of the present invention are described below in conjunction with the accompanying drawings. During the description, English database terms are involved. Since each English term is clear to those skilled in the art, Chinese terms are not provided to avoid ambiguity.

[0117] Figure 1 A flowchart for implementing a method for determining the degree of data contamination is shown in the figure, which may include:

[0118] Step 101: Determine the flow of each node in the network;

[0119] Step 102: When it is determined that there is polluted data, determine the nodes that have transmitted the polluted data during the polluted time period;

[0120] Step 103: Determine the degree of data pollution according to the traffic of the node that has transmitted the polluted data during the pollution time period and the proportion of the polluted data.

[0121] To facilitate understanding and expression, several terms will be introduced in the embodiments. Since the purpose of determining the traffic of each node in the network is to determine the propagation capacity of the node, obviously, this capacity can be quantified, and therefore, it is referred to as the node's propagation power in the embodiments; since it is necessary to determine various attributes of the data when determining the nodes that have transmitted polluted data during the pollution time period in order to determine the possible nodes that transmit polluted data, these related attributes are referred to as data source attributes, and examples will be given in the following embodiments. Obviously, all attributes that meet this purpose can be analyzed as data source attributes; since the traffic of the nodes that have transmitted polluted data during the pollution time period and the proportion of polluted data can be quantified and used to judge the size of the propagation power, there will be attribute values ​​that can be examined to quantify the propagation power, and therefore, in the embodiments, it is referred to as the node's propagation power attribute value.

[0122] Specifically, this solution can solve the problem of how to evaluate the scope and degree of pollution caused by a group of data after a data pollution incident occurs within the enterprise, thereby helping data managers to determine the severity of the incident and take corresponding disposal measures. A specific solution for evaluating the scope and degree of data pollution is proposed. First, the relevant network data traffic of all server nodes in the monitoring network is analyzed to obtain the propagation power values ​​of all monitoring nodes. When a data pollution incident occurs, the propagation scope of the polluted data is obtained based on the traffic data after the pollution incident, according to the attributes of the polluted data source, combined with the data association table. Finally, the pollution degree score of this data pollution incident is obtained through the propagation power of the polluted node and the proportion of pollution source data, which serves as the decision-making basis for the event handling method.

[0123] In the scheme, the field contents in the traffic data can be extracted, mainly database SQL statements and interface call requests, to calculate the node's propagation power, whether it is polluted, and the degree of pollution, and evaluate the impact of pollution. By analyzing the data propagation node information, the nodes that may be polluted and the degree of pollution can be obtained, and the risk assessment information of the incident that has occurred can be directly generated.

[0124] The following will explain with examples.

[0125] Figure 2 This is a schematic diagram of the data pollution degree analysis step architecture. As shown in the figure, by monitoring all network traffic data of the network, the propagation power of all nodes is analyzed. When a data pollution event occurs, the impact range and degree of the pollution event are analyzed through the traffic data within a certain period of time. The main steps can be as follows:

[0126] Step A: Determine the traffic of each node in the network, including:

[0127] Based on the network traffic data, store, calculate and monitor the relevant information of all nodes and operations between nodes in the network, and maintain the node information table and operation information table.

[0128] Specifically, the network traffic data of all nodes in the monitoring network can be obtained by means of optical traffic or traffic collection agent module, the required data in the network traffic can be filtered and parsed, and the key fields in the traffic can be extracted and stored. Based on the key field information, the operation object data can be extracted and the operation information can be stored; the traffic data of each node can be counted, the node's propagation power value can be calculated, and the node information table can be updated.

[0129] Step B, when it is determined that there is polluted data, determining the nodes that have transmitted the polluted data during the polluted time period, including:

[0130] When a data pollution event occurs, the nodes through which the polluted data may flow are found based on the pollution attributes and the node operation data of the traffic analysis.

[0131] Specifically, when a data pollution event occurs, the time range of the pollution event is determined based on the possible time of the data pollution event. Based on the pollution source attributes, combined with the node operation data of the traffic analysis, find the nodes through which the polluted data may flow. Since how to discover data pollution events is not the focus of this solution, it will not be described in detail. In specific practice, it can be discovered by system in-process detection or post-audit, personnel confession, notification of data source pollution, etc. During implementation, when the event occurs, the pollution source attributes are used as known content, including data pollution discovery node information, event time range and polluted data objects (tables and field attributes involved in the database, interface call request url attributes, etc.). Based on the pollution source attributes, the first layer of polluted nodes is discovered. Combined with the data association table, through recursive retrieval, the set of all possible polluted nodes {N1, N2,..., N n}, this collection is represented by the node's unique identifier, which can be the node's IP.

[0132] Step C: determining the degree of data pollution according to the traffic of the node that has transmitted the polluted data during the pollution period and the proportion of the polluted data, including:

[0133] The pollution degree score of this data pollution incident is calculated based on the propagation attribute value of the polluted node and the proportion of pollution source data.

[0134] Specifically, the pollution degree score of this data pollution event is calculated based on the propagation attribute value of the polluted node and the proportion of pollution source data. First, the possible polluted node set {N1, N2, ..., N n The pollution source data proportion data p of each node in n. Combined with the node attribute table, obtain the polluted node set {N1, N2, ..., N n} The transmission attribute value tn of each node in}. Combining these data, calculate the pollution degree score of this data pollution event.

[0135] Figure 3 To determine the flow of each node in the network, the detailed workflow of step A analyzing and calculating the relevant information of all nodes and inter-node operations in the monitoring network is shown in the figure, which mainly includes:

[0136] A1. Obtain the data transmitted by each node in the network and obtain the key fields in the data, including:

[0137] Obtain network traffic data of all nodes in the monitoring network and filter and parse the key field content required.

[0138] In implementation, the key fields include one or a combination of the following fields:

[0139] The unique identifier of the starting node, the unique identifier of the arrival node, the unique identifier corresponding to the business on the node, the occurrence time of the data, the operation request of the data, and the operation status of the data.

[0140] Specifically, the network traffic data of all nodes in the monitoring network can be obtained by means of optical traffic or traffic collection agent module, where the monitoring network refers to the interconnected network composed of all server nodes or terminal nodes that need to monitor data pollution. Filter and parse the required data in the network traffic, where the filtered traffic includes but is not limited to database operation traffic, interface call request traffic, etc.

[0141] Database operation traffic can include traffic of all types of databases deployed in the monitoring network, such as oracle database-related traffic data, which is filtered through server port 1521; mysql database-related traffic data, which is filtered through port 3306. Interface call request traffic can filter http protocol traffic. The traffic type involved in data operations can be changed accordingly according to the actual situation in the monitoring network.

[0142] Extract key fields from the filtered traffic. The key fields may include but are not limited to: unique identifiers of the starting node and the arrival node (can be in multiple forms, IP is used as an example below), unique identifiers of the application services on the node (can be in multiple forms, port is used as an example below), occurrence time, operation request, operation status, etc.

[0143] The traffic parsing process can be as follows:

[0144] 1. Identify the protocol information of the traffic data packet and parse it according to different protocols. Protocol types include http, oracle, mysql, etc.

[0145] 2. Combine the data packets to form a request and response data packet pair. The node that sends the request data packet is the start node, and the node that responds to the response data packet is the destination node. Extract the IP and port data of the start node and the destination node respectively. The occurrence time of the request data packet is the occurrence time of the operation.

[0146] 3. Extract the operation request from the request data packet. For example, for database operation, it is to extract the SQL statement information; for interface call operation, it is to extract the URL information.

[0147] 4. Extract the operation status from the response data packet. This field is not always available. For example, the select operation of the mysql database will return the corresponding data if successful, and a response code of 0xff if failed; the get request of the http interface call will return a status code of 200 if successful, and a status code starting with 4 or 5 if failed.

[0148] 5. Based on the above fields, generate a set of key field information.

[0149] A2. Extract operation object data based on key fields, including:

[0150] Based on the key field information, the operation object data is extracted and the node information and operation information are stored.

[0151] Specifically, the operation object data can be extracted based on the key field information, and the node information and operation information can be stored. The specific parsing process for each set of key field information can be as follows:

[0152] Search the IP addresses of the starting node and the destination node in the node information table. If they do not exist, add a new node information item to the node information table. The node information table content example is as follows:

[0153] Table 1 Example of node information table

[0154]

[0155] The unique identifier of the Key node in the table.

[0156] When adding node information here, you only need to use the ip to fill in the key field, the id is automatically accumulated, the create_time is the time when the information is added, and the other fields are updated in step A3.

[0157] Extract the operation object data from the operation request field. First, determine the traffic protocol type. If it is a database protocol, further parse the operation request field, that is, the SQL statement, to extract the operation method (such as select, insert) and the operation object (including database, data table, and data table field information). For example, the SQL statement is as follows:

[0158] select f1,f2 from db1.table1 where f3=3

[0159] The extraction result is that the operation method is select, the database operated is db1, the data table operated is db1.table1, and the data table field information operated is db1.table1.f1, db1.table1.f2, db1.table1.f3. The corresponding stored operation information table (split into two tables for storage in actual operation) is as follows:

[0160] Table 2 Operation information example 1

[0161]

[0162] The start_node field stores the identifier of the operation request node, the end_node field stores the identifier of the operation response node, the time field stores the operation time, the type field stores the protocol type, the method field stores the operation method, and the status field stores the operation status.

[0163] Table 3 Operation information table corresponding to data object table storage example 1

[0164] id op_id op_object 1 1 db1 2 1 db1.table1 3 1 db1.table1.f1 4 1 db1.table1.f2 5 1 db1.table1.f3

[0165] The op_id field stores the operation identifier in the operation information table, which is the id number in this example, and the op_object field stores the data object of the operation.

[0166] If it is an http protocol, extract the operation method from the protocol header, such as GET, POST, etc. And further parse the operation request field, that is, the url statement, and remove the http header and parameter content, such as the following url:

[0167] http: / / web.test.com / suggest?le=en&num=5

[0168] The operation object is parsed as web.test.com / suggest. The storage example is as follows:

[0169] Table 4 Operation information example 2

[0170]

[0171] Table 5 Operation information table corresponding to data object table storage example 2

[0172] id op_id op_object 6 2 web.test.com / suggest

[0173] A3. Determine the traffic of each node according to the transmitted object data, including:

[0174] Based on the node operation data, calculate the node's propagation force value and update the node information table.

[0175] In practice, considering that the influence of pollution can be easily determined after quantification, the transmission power can also be graded, that is, it can further include:

[0176] After determining the traffic of each node in the network, classify each node according to the traffic size;

[0177] When determining the degree of data pollution according to the flow of the node that has transmitted the polluted data during the pollution time period and the proportion of the polluted data, the degree of data pollution is determined according to the classification of the node and the proportion of the polluted data.

[0178] Specifically, the traffic data of each node is counted, the propagation power value of the node is calculated, and the node information table is updated. Here, the node information is recalculated and updated every period of time (for example, one week) based on the data in the operation information table.

[0179] As shown in Table 1, the statistical data of each node is the statistical value field request_count of the number of all requested operations, that is, the total number of operations. The definition of the requested operation is that for database operations, the node acts as the server that receives the select statement operation request; for interface call operations, the node acts as the interface server and is called by the client for interface requests.

[0180] The node propagation power value ranges from 0 to 100. The propagation power value is determined by dividing the number of requested operations of all nodes in the entire monitoring network into intervals. The value is determined by the quantity level value set {C1,...,C 100} to determine, the quantity level value set calculation method can be as follows, in the specific implementation, all calculations can be rounded off:

[0181] 1. Get the requested operation counts of all nodes in the node information table and sort them in ascending order to obtain the node requested operation count set {RC1, RC2, ..., RC n}.

[0182] 2. Get the set {RC1, RC2, ..., RC n}The smallest non-zero value RC i , assign C1 = RC i , C 100 =RC n .

[0183] 3. Compute the average number of requested operations on nodes Assign C(1+100) / 2=RA, that is, C 51 =RA.

[0184] 4. Set {RC1,RC2,…,RC n}, greater than C1 and less than or equal to C 51 The data composition interval is the requested operand set 1 {RC p ,RC p+1 ,……,RC p+n}, greater than C 51 and less than or equal to C 100 The data composition interval is the requested operand set 2 {RC q ,RC q+1 ,……,RC q+m}. Calculate step c for requested operand set 1 and requested operand set 2 respectively, and get C 26 and C 76 The value of, and so on, the value set of quantity level {C1, ..., C 100}All values.

[0185] The calculation method of the transmission power value can be as follows:

[0186] 1. Get the requested operation number rc of the node from the node information table.

[0187] 2. If rc=0, the propagation force of the node is 0.

[0188] 3. If rc≠0, replace rc with the set of numerical level values ​​{C1,...,C 100}, if rc<=C1, the propagation force takes the value of 1; otherwise, start from C1 and compare in order until C i-1 <rc<=C i When , the propagation force of the node takes the value i.

[0189] In implementation, determining the nodes that have transmitted polluted data during the polluted time period may include:

[0190] According to the data pollution source attributes, determine the data pollution object set {A1, A2, ..., A n};

[0191] A i As the data outflow object, the arrival node is limited to the pollution discovery node N0, and the data object is equal to the set {A1, A2, ..., A n}, search in the data outflow object field of the operation information table and the data object table corresponding to the operation information table, and obtain the key-value pair set of polluted nodes and polluted data objects {{A1, N11}, {A1, N12}, ..., {A n ,N1 m}}, the first layer of contaminated node set {N11,N12,……,N1 j};

[0192] A i As the data outflow object, search in the data outflow object field of the data association table, and de-reorganize the objects corresponding to the data inflow object field obtained from the search into the associated polluted data object set {Ai1, Ai2, ..., Ai n};

[0193] Limit the reachable nodes to the first-layer contaminated node set {N11, N12, ..., N1 j}, the operation data object is limited to the associated pollution data object set {Ai1, Ai2, ..., Ai n}, and search for relevant operation records. If so, the retrieved start node field content is used to form a set of polluted nodes and polluted data object key-value pairs {{Ai1, N21}, {Ai1, N22}, ..., {Ai n ,N2 n}}, and reassemble the second layer of polluted node set {N2 i ,N2 i+1 ,……,N2 j};

[0194] And so on, we get the third layer, ..., nth layer of polluted nodes, and determine all the polluted nodes.

[0195] Specifically, the first-level polluted nodes do not need the content in the data association table to be determined, because the first-level polluted nodes can directly derive the nodes of the subsequent levels through operation information. Since there may be conversion processing inside the nodes (for example, database data is transmitted through http interface calls), the information in the data association table is needed to determine the association relationship.

[0196] This is equivalent to having N0 nodes. According to the operation information table and the data object table corresponding to the operation information table, the first-layer contaminated node set {N 11 ,N 12 ,……,N 1j}.

[0197] Then, based on the data association table, combined with the operation information and the object, the contaminated nodes that propagate to the next layer are determined. And so on.

[0198] It can also be understood vertically, similar to a tree diagram, spreading from one node to N nodes, and each child node spreads to N grandchild nodes. Since there may be many overlaps in child nodes, each layer of the solution can be deduplicated and then the nodes of the child generations can be retrieved uniformly.

[0199] The start node field content is jointly searched in the operation information table (such as the example in Table 2) and the data object table corresponding to the operation information table (such as the example in Table 3), and the limiting conditions are: the value of the arrival node is equal to the pollution discovery node N0, and the data object is equal to the set {A1, A2, ..., A n}. The retrieved start node field content is formed into a set of polluted nodes and polluted data object key-value pairs {{A1,N 11},{A1,N 12},……,{A n ,N 1m}}.

[0200] Figure 4 In order to determine the implementation process of the nodes that have transmitted the polluted data during the pollution period, the detailed workflow of step B of the technical solution to find the nodes through which the polluted data may flow can be as follows: Figure 4 As shown below:

[0201] Step B1: Find the first-layer polluted nodes based on the pollution source attributes.

[0202] Specifically, the first-layer polluted nodes are found based on the data pollution source attributes. The pollution source attributes are known contents, including the data pollution discovery node information, the event start time and the polluted data object (the table and field attributes involved in the database, the interface call request url attributes, etc.). That is, in implementation, the nodes that have transmitted polluted data during the pollution period can be determined based on one or a combination of the following information:

[0203] Information about nodes that discover data pollution;

[0204] The time frame in which the data contamination incident occurred;

[0205] The polluted data object, for example, includes one or a combination of the following information: the table and field attributes involved in the data in the database, and the URL attribute of the interface call request.

[0206] In this example, the data pollution object set is represented by {A1, A2, ..., A n It should be noted that the content of all the retrieved operation information tables in step B can be limited to a time range after the event start time.

[0207] The start node field content is jointly searched in the operation information table (such as the example in Table 2) and the data object table corresponding to the operation information table (such as the example in Table 3). The limiting conditions can be: the value of the arrival node is equal to the pollution discovery node N0, and the data object is equal to the set {A1, A2, ..., A n}. The retrieved start node field content is formed into a set of polluted nodes and polluted data object key-value pairs {{A1,N 11},{A1,N 12},……,{A n ,N 1m}}(In the implementation, the node paired with the polluted data object A1 is not necessarily the node N 11 or N 12 , or it could be node N 13 or N 14 , similarly to the polluted data object A n The paired node is not necessarily node N 1m , which is given here just for the convenience of expression. The subsequent polluted node and polluted data object key-value pair sets are also the same, so I will not repeat them here), and reassemble the first layer of polluted node set {N 11 ,N 12 ,……,N 1n}.

[0208] Step B2: Based on the first-layer polluted nodes and in combination with the data association table, the next-layer polluted nodes and the corresponding polluted data objects are found.

[0209] Specifically, based on the first-layer polluted nodes, combined with the data association table, the next-layer polluted nodes and the corresponding polluted data objects are found. The data association table stores the flow relationship of the data. The content in the association table can be generated by the data flow detection method, or it can be added and maintained manually. The data association table includes two fields: data outflow object and data inflow object. The outflow and inflow objects can be database tables, database table fields, interfaces, etc. The examples are as follows:

[0210] Table 6 Data association table example

[0211] out_object in_object db1.table1 db2.table1 db1.table1.f1 db3.table1.f1 db1.table1 test1.com / api1 test1.com / api1 test2.com / api2

[0212] For the polluted data object set {A1, A2, ..., A n Each data object in} performs the following processing:

[0213] A) Will A i As the data outflow object, search in the data outflow object field of the data association table, and reorganize the objects corresponding to the data inflow object field obtained from the search into the associated polluted data object set {Ai1, Ai2, ..., Ai n}.

[0214] B) In the set of polluted nodes and polluted data object key-value pairs {{A1, N11}, {A1, N12}, ..., {A n ,N1 m}}, find A i The corresponding set of polluted nodes is expressed as the set {N11, N12, ..., N1 j}.

[0215] C) In the operation information table, limit the arrival node to A i The corresponding polluted node set {N11, N12, ..., N1 j}, the operation data object is limited to the associated pollution data object set {Ai1,Ai2,……,Ai n}, and search for relevant operation records. If so, the retrieved start node field content is used to form a set of polluted nodes and polluted data object key-value pairs {{Ai1, N21}, {Ai1, N22}, ..., {Ai n ,N2 n}}, and reassemble the second layer of polluted node set {N2 i ,N2 i+1 ,……,N2 j}(Because it is polluted data object A i The nodes found by association are not included in the nodes found by association with other polluted data objects).

[0216] The polluted data object set {A1, A2, ..., A n After all objects in} have completed the above steps a to c, all the retrieved second-layer polluted nodes are deduplicated to form the second-layer polluted node set {N21, N22, ..., N2 n}.

[0217] B3. Through recursive retrieval, the third, ..., and nth layer of polluted nodes are obtained, thereby obtaining the set of all possible polluted nodes. The second layer polluted node set {N11, N12, ..., N1 n} as the pollution start node, and combine the second pollution node and the pollution data object key-value pair set {{A11, N21}, {A11, N22}, ..., {A21, N23}, {A22, N24}, ..., {A1 n ,N2 m}}, repeat steps B1 and B2 to get the third layer of polluted node set {N31, N32, ..., N3 n}. And so on, until there is no related data object, or until the network boundary node is reached. Merge all polluted data objects to form a pollution-affected data object set {B1, B2, ..., B n Merge all polluted nodes to form a polluted node set {N1, N2, ..., N n}, giving the pollution range.

[0218] That is, in the implementation, the degree of data pollution is determined according to the traffic of the node that has transmitted the polluted data during the pollution period and the proportion of the polluted data, including:

[0219] Determine the set of polluted nodes {N1, N2, ..., N n}The proportion of pollution source data of each node;

[0220] Determine the retrieval time range as the time after the data pollution event occurs, and obtain {N1, N2, ..., N n Each node N in n The total number of requested operations;

[0221] Get {N1, N2, ..., N n Each node N in n The total number of requested operations on pollution-affected data objects;

[0222] Determine {N1, N2, ..., N n Each node N in n The proportion of pollution source data;

[0223] Determine {N1, N2, ..., N n}, wherein the propagation attribute value is a value determined according to the flow of the node;

[0224] Determine the pollution degree score of the data pollution event based on the transmission power value and the proportion of pollution source data.

[0225] For example, it can be implemented as follows. It should be noted that the pollution degree score S of the data pollution event can be determined by adjusting the relationship between the transmission power value and the pollution source data ratio data as needed, and is not limited to the formula relationship in the example.

[0226] The degree of data pollution is determined based on the traffic of the node that transmitted the polluted data during the pollution period and the proportion of the polluted data, including:

[0227] Determine the set of polluted nodes {N1, N2, ..., N n The pollution source data proportion data p of each node in n ;

[0228] Determine the retrieval time range as the time after the data pollution event occurs, and obtain {N1, N2, ..., N n Each node N in n The total number of requested operations C n ;

[0229] Get {N1, N2, ..., N n Each node N in n The total number of requested operations cn whose operation objects are pollution-affected data objects;

[0230] Determine {N1, N2, ..., N n Each node N in n The proportion of pollution source data n =c n / C n ;

[0231] Determine {N1, N2, ..., N n The propagation attribute value t of each node in n , wherein the propagation attribute value is a value determined according to the flow of the node;

[0232] According to the transmission power value and the proportion of pollution source data, the pollution degree score S of the data pollution event is determined, where:

[0233] The detailed workflow of step C for calculating the pollution degree of the data pollution event may specifically include the following:

[0234] C1. Combine the polluted data object and the data in the operation information table to calculate the possible polluted node set {N1, N2, ..., N n The pollution source data proportion data p of each node in n The calculation process is described as follows, taking the proportion of pollution source data p1 of computing node N1 as an example:

[0235] 1. Combined with the operation information table, limit the search time range to the time after the data pollution event occurs. Obtain the total number of requested operations C1 of node N1.

[0236] 2. Obtain the total number c1 of requested operations whose operation objects are pollution-affected data objects.

[0237] 3. The proportion of pollution source data of node N1 is p1=c1 / C1.

[0238] C2. Combine the node information table to obtain the polluted node set {N1, N2, ..., N n The propagation attribute value t of each node in n . Combined with the transmission power value and the proportion of pollution source data, calculate the pollution degree score S of this data pollution event.

[0239] Based on the same inventive concept, an embodiment of the present invention also provides a device for determining the degree of data contamination and a computer-readable storage medium. Since the principles of solving the problem by these devices are similar to those of the method for determining the degree of data contamination, the implementation of these devices can refer to the implementation of the method, and the repeated parts will not be repeated.

[0240] When implementing the technical solution provided by the embodiment of the present invention, it can be implemented as follows.

[0241] Figure 5 A schematic diagram of a device structure for determining the degree of data contamination is shown in the figure. The device includes:

[0242] The processor 500 is used to read the program in the memory 520 and execute the following process:

[0243] Determine the traffic flow of each node in the network;

[0244] When it is determined that there is contaminated data, determine the nodes that have transmitted the contaminated data during the contamination period;

[0245] The degree of data pollution is determined based on the traffic of the nodes that transmitted the polluted data during the pollution period and the proportion of the polluted data;

[0246] The transceiver 510 is configured to receive and send data under the control of the processor 500 .

[0247] During implementation, determine the traffic of each node, including:

[0248] Obtain data transmitted by each node in the network;

[0249] Get the key fields in the data;

[0250] Extract operation object data based on key fields;

[0251] The traffic of each node is determined according to the object data being transmitted.

[0252] In implementation, the key fields include one or a combination of the following fields:

[0253] The unique identifier of the starting node, the unique identifier of the arrival node, the unique identifier corresponding to the business on the node, the occurrence time of the data, the operation request of the data, and the operation status of the data.

[0254] During implementation, it further includes:

[0255] After determining the traffic of each node in the network, classify each node according to the traffic size;

[0256] When determining the degree of data pollution according to the flow of the node that has transmitted the polluted data during the pollution time period and the proportion of the polluted data, the degree of data pollution is determined according to the classification of the node and the proportion of the polluted data.

[0257] In implementation, the node that has transmitted polluted data during the pollution period is determined according to one or a combination of the following information:

[0258] Information about nodes that discover data pollution;

[0259] The time frame in which the data contamination incident occurred;

[0260] Tainted data objects.

[0261] During implementation, nodes that have transmitted polluted data during the pollution period are determined, including:

[0262] According to the data pollution source attributes, determine the data pollution object set {A1, A2, ..., A n};

[0263] A i As the data outflow object, the arrival node is limited to the pollution discovery node N0, and the data object is equal to the set {A1, A2, ..., A n}, search in the data outflow object field of the operation information table and the data object table corresponding to the operation information table, and obtain the key-value pair set of polluted nodes and polluted data objects {{A1, N11}, {A1, N12}, ..., {A n ,N1 m}}, the first layer of contaminated node set {N11,N12,……,N1 j};

[0264] A i As the data outflow object, search in the data outflow object field of the data association table, and de-reorganize the objects corresponding to the data inflow object field obtained from the search into the associated polluted data object set {Ai1, Ai2, ..., Ai n};

[0265] Limit the reachable nodes to the first-layer contaminated node set {N11, N12, ..., N1 j}, the operation data object is limited to the associated pollution data object set {Ai1, Ai2, ..., Ai n}, and search for relevant operation records. If so, the retrieved start node field content is used to form a set of polluted nodes and polluted data object key-value pairs {{Ai1, N21}, {Ai1, N22}, ..., {Ai n ,N2 n}}, and reassemble the second layer of polluted node set {N2 i ,N2 i+1 ,……,N2 j};

[0266] And so on, we get the third layer, ..., nth layer of polluted nodes, and determine all the polluted nodes.

[0267] In implementation, the degree of data pollution is determined based on the traffic of the node that transmitted the polluted data during the pollution period and the proportion of the polluted data, including:

[0268] Determine the set of polluted nodes {N1, N2, ..., N n}The proportion of pollution source data of each node;

[0269] Determine the retrieval time range as the time after the data pollution event occurs, and obtain {N1, N2, ..., N n Each node N in n The total number of requested operations;

[0270] Get {N1, N2, ..., N n Each node N in n The total number of requested operations on pollution-affected data objects;

[0271] Determine {N1, N2, ..., N n Each node N in n The proportion of pollution source data;

[0272] Determine {N1, N2, ..., N n}, wherein the propagation attribute value is a value determined according to the flow of the node;

[0273] Determine the pollution degree score of the data pollution event based on the transmission power value and the proportion of pollution source data.

[0274] Among them, Figure 5In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically linking together various circuits of one or more processors represented by processor 500 and memory represented by memory 520. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 510 may be a plurality of components, namely, a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium. The processor 500 is responsible for managing the bus architecture and general processing, and the memory 520 may store data used by the processor 500 when performing operations.

[0275] Figure 6 The second schematic diagram of the data pollution degree determination device structure is shown in the figure. As shown in the figure, the device includes:

[0276] The flow determination module 601 is used to determine the flow of each node in the network;

[0277] A pollution determination module 602, for determining, when it is determined that there is polluted data, a node that has transmitted polluted data within a pollution time period;

[0278] The degree determination module 603 is used to determine the data pollution degree according to the traffic of the node that has transmitted the polluted data during the pollution time period and the proportion of the polluted data.

[0279] In implementation, the traffic determination module is further used to determine the traffic of each node, including:

[0280] Obtain data transmitted by each node in the network;

[0281] Get the key fields in the data;

[0282] Extract operation object data based on key fields;

[0283] The traffic of each node is determined according to the object data being transmitted.

[0284] In implementation, the traffic determination module is further used to obtain key fields including one of the following fields or a combination thereof:

[0285] The unique identifier of the starting node, the unique identifier of the arrival node, the unique identifier corresponding to the business on the node, the occurrence time of the data, the operation request of the data, and the operation status of the data.

[0286] In implementation, the traffic determination module is further used to determine the traffic of each node in the network and then classify each node according to the traffic size;

[0287] The degree determination module is further used to determine the data pollution degree according to the node classification and the proportion of polluted data when determining the data pollution degree according to the traffic of the node that has transmitted the polluted data during the pollution time period and the proportion of the polluted data.

[0288] In implementation, the pollution determination module is further used to determine the nodes that have transmitted polluted data during the pollution time period according to one or a combination of the following information:

[0289] Information about nodes that discover data pollution;

[0290] The time frame in which the data contamination incident occurred;

[0291] Tainted data objects.

[0292] In implementation, the pollution determination module is further used to determine the nodes that have transmitted polluted data within the pollution time period, including:

[0293] According to the data pollution source attributes, determine the data pollution object set {A1, A2, ..., A n};

[0294] A i As the data outflow object, the arrival node is limited to the pollution discovery node N0, and the data object is equal to the set {A1, A2, ..., A n}, search in the data outflow object field of the operation information table and the data object table corresponding to the operation information table, and obtain the key-value pair set of polluted nodes and polluted data objects {{A1, N11}, {A1, N12}, ..., {A n ,N1 m}}, the first layer of contaminated node set {N11,N12,……,N1 j};

[0295] A i As the data outflow object, search in the data outflow object field of the data association table, and de-reorganize the objects corresponding to the data inflow object field obtained from the search into the associated polluted data object set {Ai1, Ai2, ..., Ai n};

[0296] Limit the reachable nodes to the first-layer contaminated node set {N11, N12, ..., N1 j}, the operation data object is limited to the associated pollution data object set {Ai1, Ai2, ..., Ai n}, and search for relevant operation records. If so, the retrieved start node field content is used to form a set of polluted nodes and polluted data object key-value pairs {{Ai1, N21}, {Ai1, N22}, ..., {Ain ,N2 n}}, and reassemble the second layer of polluted node set {N2 i ,N2 i+1 ,……,N2 j};

[0297] And so on, we get the third layer, ..., nth layer of polluted nodes, and determine all the polluted nodes.

[0298] In implementation, the degree determination module is further used to determine the degree of data pollution according to the traffic of the node that has transmitted the polluted data during the pollution time period and the proportion of the polluted data, including:

[0299] Determine the set of polluted nodes {N1, N2, ..., N n}The proportion of pollution source data of each node;

[0300] Determine the retrieval time range as the time after the data pollution event occurs, and obtain {N1, N2, ..., N n Each node N in n The total number of requested operations;

[0301] Get {N1, N2, ..., N n Each node N in n The total number of requested operations on pollution-affected data objects;

[0302] Determine {N1, N2, ..., N n Each node N in n The proportion of pollution source data;

[0303] Determine {N1, N2, ..., N n}, wherein the propagation attribute value is a value determined according to the flow of the node;

[0304] Determine the pollution degree score of the data pollution event based on the transmission power value and the proportion of pollution source data.

[0305] For the convenience of description, the various parts of the above-mentioned device are divided into various modules or units according to their functions and described separately. Of course, when implementing the present invention, the functions of each module or unit can be implemented in the same or multiple software or hardware.

[0306] In specific implementation, it is not limited to Figure 5 , Figure 6 The limited structure, for example, can also be Figure 7 As shown, as long as the degree of data pollution can be determined, an appropriate functional structure can be adopted as needed.

[0307] Figure 7 The third schematic diagram of the structure of the device for determining the degree of data pollution is shown in the figure. As shown in the figure, the device includes: a traffic analysis module 100, a basic information maintenance module 200, a data pollution range and degree calculation module 300 and a network status display module 400.

[0308] The main function of the traffic analysis module 100 is to analyze all traffic data of the monitoring network, filter out traffic data packets of specified protocol types, combine the data packets, extract key fields in each group of operation data packets, and pass the key field combination to the basic information maintenance module.

[0309] The function of the basic information maintenance module 200 is mainly to maintain the data in the node information table and the operation information table. Each set of key field combinations passed in by the traffic analysis module is further analyzed, including node information maintenance (if the node related information does not exist in the node information table, the node is added to the node information table), operation information table maintenance (storing the operation information in the key field combination, extracting the operation object for the request operation and storing it together). Regularly recalculate the requested operation number and propagation power data of all nodes, and update the node information table.

[0310] The data pollution range and degree calculation module 300 mainly collects and obtains the pollution event time range data and pollution source attribute data when a data pollution event is discovered, and retrieves all nodes through which the pollution data of this event may flow in combination with the data in the node information table, operation information table, and data association table. Calculate the proportion of pollution data object operations that may pollute nodes, and calculate the pollution degree score of the data pollution event in combination with the propagation power data.

[0311] The function of the monitoring network status display module 400 is mainly to display the current network status data and the data related to the scope and degree of the impact of the data pollution event. The current network status data mainly includes: the current number of nodes in the network, the node information of the top 10 nodes with the highest transmission power, the node information of the top 10 nodes with the highest number of requested operations, the node information of the top 10 nodes with the highest number of total operations, etc. The data related to the scope and degree of the impact of the data pollution event include: the possible start time of the data pollution event, the data objects involved in the data pollution source, the data related to the nodes through which the polluted data may flow (total number of nodes, percentage of the number of nodes, the node information of the top 10 nodes with the highest transmission power, the node information of the top 10 nodes with the highest number of requested operations, and the detailed data of each node), the flow diagram of the nodes through which the polluted data may flow, and the pollution degree assessment score of the pollution event.

[0312] A computer-readable storage medium is also provided in an embodiment of the present invention. The computer-readable storage medium stores a computer program for executing the above-mentioned method for determining the degree of data contamination.

[0313] In the specific implementation, please refer to the implementation of the method for determining the degree of data pollution.

[0314] In summary, in the technical solution provided in the embodiment of the present invention, a solution for the scope and degree of data pollution in the monitoring network is provided, and a data pollution impact degree score is comprehensively obtained based on the node propagation power data, the set of nodes that may be polluted, and the proportion of polluted data object operations in the nodes. Among them, the evaluation scheme for the propagation power of each node is to filter and parse the entire monitoring network traffic, extract the key field content of each operation, obtain the requested operation statistics of all nodes, divide all the data values ​​into intervals, and obtain the propagation power value of each node; the evaluation scheme for the node that may be polluted is to filter and parse the entire monitoring network traffic, extract the key field content of each operation, and obtain all operation information in the entire monitoring network. According to the pollution source data object, combined with the data association table and the operation information table, the first layer, the second layer, ..., the nth layer of possible pollution nodes are progressively retrieved, and finally all possible polluted node sets are obtained.

[0315] This solution can evaluate the scope and degree of data pollution. Compared with node-based attribute information collection, this solution analyzes node data by copying network traffic packet data, which does not affect the actual business operation of the monitoring network, and the data is more accurate. Compared with complex algorithms such as calculating propagation path models, this solution has a simple calculation method. For networks with many nodes, it does not need to consume a lot of resources to normalize the calculation of node-related attribute data.

[0316] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) containing computer-usable program code.

[0317] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0318] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0319] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0320] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A method for determining the degree of data contamination, characterized in that: include: Determine the traffic flow of each node in the network; When it is determined that there is contaminated data, determine the nodes that have transmitted the contaminated data during the contamination period; The degree of data pollution is determined based on the traffic of the nodes that transmitted the polluted data during the pollution period and the proportion of the polluted data; The degree of data pollution is determined based on the traffic of the node that has transmitted the polluted data during the pollution period and the proportion of the polluted data, including: Determine the set of polluted nodes {N1, N2, ..., N n }; Determine the retrieval time range as the time after the data pollution event occurs, and obtain {N1, N2, ..., N n The total number of requested operations for each node in}; Get {N1, N2, ..., N n The operation object of each node in} is the total number of requested operations on the pollution-affected data object; According to {N1,N2,……,N n }, and {N1,N2,……,N n The operation object of each node in {N1, N2, ..., N n }The proportion of pollution data of each node; Determine {N1, N2, ..., N n }, wherein the propagation attribute value is a value determined according to the flow of the node; Determine the pollution degree score of the data pollution event based on the transmission attribute value and the proportion of polluted data.

2. The method according to claim 1, characterized in that Determine the traffic flow of each node, including: Obtain data transmitted by each node in the network; Get the key fields in the data; Extract operation object data based on key fields; The traffic of each node is determined according to the object data being transmitted.

3. The method according to claim 2, characterized in that Key fields include one or a combination of the following fields: The unique identifier of the starting node, the unique identifier of the arrival node, the unique identifier corresponding to the business on the node, the occurrence time of the data, the operation request of the data, and the operation status of the data.

4. The method according to claim 1, characterized in that Further including: After determining the traffic of each node in the network, classify each node according to the traffic size; When determining the degree of data pollution according to the flow of the node that has transmitted the polluted data during the pollution time period and the proportion of the polluted data, the degree of data pollution is determined according to the classification of the node and the proportion of the polluted data.

5. The method according to claim 1, characterized in that Determine the nodes that have transmitted polluted data during the pollution period based on one or a combination of the following information: Information about nodes that discover data pollution; The time frame in which the data contamination incident occurred; Tainted data objects.

6. The method according to claim 5, characterized in that Determine the nodes that have transmitted polluted data during the pollution period, including: According to the pollution source attributes, the first layer of polluted nodes is found; Based on the first-layer polluted nodes and the data association table, the next-layer polluted nodes and corresponding polluted data objects are found; Through recursive retrieval, the set of all possible polluted nodes that the flow may pass through is obtained.

7. A device for determining the degree of data pollution, characterized in that: include: The processor reads the program in the memory and performs the following processes: Determine the traffic flow of each node in the network; When it is determined that there is contaminated data, determine the nodes that have transmitted the contaminated data during the contamination period; The degree of data pollution is determined based on the traffic of the nodes that transmitted the polluted data during the pollution period and the proportion of the polluted data; a transceiver for receiving and transmitting data under the control of the processor; The degree of data pollution is determined based on the traffic of the node that has transmitted the polluted data during the pollution period and the proportion of the polluted data, including: Determine the set of polluted nodes {N1, N2, ..., N n }; Determine the retrieval time range as the time after the data pollution event occurs, and obtain {N1, N2, ..., N n The total number of requested operations for each node in}; Get {N1, N2, ..., N n The operation object of each node in} is the total number of requested operations on the pollution-affected data object; According to {N1,N2,……,N n }, and {N1,N2,……,N n The operation object of each node in {N1, N2, ..., N n }The proportion of pollution data of each node; Determine {N1, N2, ..., N n }, wherein the propagation attribute value is a value determined according to the flow of the node; Determine the pollution degree score of the data pollution event based on the transmission attribute value and the proportion of polluted data.

8. A device for determining the degree of data pollution, characterized in that: include: A flow determination module, used to determine the flow of each node in the network; A pollution determination module, for determining, when it is determined that there is polluted data, the nodes that have transmitted the polluted data within the pollution time period; A degree determination module is used to determine the degree of data pollution according to the flow of the node that has transmitted the polluted data during the pollution period and the proportion of the polluted data; The degree of data pollution is determined based on the traffic of the node that has transmitted the polluted data during the pollution period and the proportion of the polluted data, including: Determine the set of polluted nodes {N1, N2, ..., N n }; Determine the retrieval time range as the time after the data pollution event occurs, and obtain {N1, N2, ..., N n The total number of requested operations for each node in}; Get {N1, N2, ..., N n The operation object of each node in} is the total number of requested operations on the pollution-affected data object; According to {N1,N2,……,N n }, and {N1,N2,……,N n The operation object of each node in {N1, N2, ..., N n }The proportion of pollution data of each node; Determine {N1, N2, ..., N n }, wherein the propagation attribute value is a value determined according to the flow of the node; Determine the pollution degree score of the data pollution event based on the transmission attribute value and the proportion of polluted data.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program for executing the method according to any one of claims 1 to 6.

Images