Network detection method, device, electronic device and storage medium

Abstract

The embodiment of the present invention provides a network detection method, device, electronic device and storage medium, the method comprising: obtaining real-time traffic data corresponding to a network node device; extracting IPV4 class messages belonging to the TCP / IP protocol family from the real-time traffic data as target data messages, and removing the message headers of each target data message to obtain a number of valid data messages corresponding to the real-time traffic data; performing vector extraction on the valid data message to generate a vector matrix corresponding to the valid data message, and converting the vector matrix corresponding to the valid data message into a grayscale image, and calculating the image entropy corresponding to the grayscale image; performing network analysis on the network node device according to the image entropy corresponding to each valid data message, and generating a detection result corresponding to the network node device.

Description

Technical Field

[0001] The present invention relates to the field of network communication technology, and in particular to a network detection method, a network detection device, an electronic device and a computer-readable storage medium. Background Art

[0002] With the development and application of Internet technology, "Internet +" has become an essential means for various industries to improve productivity, utilize information and communication technology and Internet platforms, and create a new development ecology. This trend of deep integration has brought revolutionary changes to the dissemination of information. As network coverage continues to increase, various network applications have also benefited all aspects of people's lives.

[0003] However, due to its openness, freedom, sharing and loopholes in security protocols, information may be stolen, tampered with, destroyed, etc. during transmission, causing huge economic losses, so network security issues are becoming increasingly serious. Denial of service (DoS) and distributed denial of service (DistributeDoS) attacks are favored by hackers because they can cause the attacked network to lose its normal service function at a relatively low cost within a certain period of time, causing huge damage to the attacked network. Attackers use multiple attack sources to send a large number of data packets to the victim, consuming network terminal computing resources and network resources, making it unable to serve normal requests. This is one of the most common methods of network destruction. Summary of the invention

[0004] The embodiments of the present invention provide a network detection method, device, electronic device and computer-readable storage medium to solve or partially solve the problem of low network security caused by inaccurate network detection.

[0005] The embodiment of the present invention discloses a network detection method, comprising:

[0006] Obtain real-time traffic data corresponding to network node devices;

[0007] Extracting IPV4-class messages belonging to the TCP / IP protocol family from the real-time traffic data as target data messages, and removing message headers of each of the target data messages to obtain a plurality of valid data messages corresponding to the real-time traffic data;

[0008] Performing vector extraction on the valid data message, generating a vector matrix corresponding to the valid data message, converting the vector matrix corresponding to the valid data message into a grayscale image, and calculating the image entropy corresponding to the grayscale image;

[0009] The network node device is subjected to network analysis according to the image entropy corresponding to each of the valid data messages, and a detection result corresponding to the network node device is generated, wherein the detection result includes one of network abnormality information, network warning information, network normal information and device abnormality information.

[0010] Optionally, the real-time traffic data includes a plurality of data packets, and extracting a packet belonging to the TCP / IP protocol family of IPv4 from the real-time traffic data as a target data packet includes:

[0011] Obtaining the message type of each of the data messages;

[0012] Eliminate data packets whose message type is a routing function type, and when eliminating the data packets of the routing function type, eliminate data packets whose message type is an IPV6 type, to obtain data packets of the IPV4 type in the real-time traffic data;

[0013] The data packets belonging to the TCP / IP protocol family among the IPV4 class data packets are used as target data packets.

[0014] Optionally, the message header includes at least an Ethernet header and an IP header, and removing the message headers of each of the target data messages to obtain a plurality of valid data messages corresponding to the real-time traffic data includes:

[0015] The Ethernet header and the IP header of each of the target data messages are removed to obtain a plurality of valid data messages corresponding to the real-time traffic data.

[0016] Optionally, the target data message includes an HTTP protocol message, a TCP protocol message, a UDP protocol message, and an ICMP protocol message, and removing an Ethernet header and an IP header of each of the target data messages to obtain a plurality of valid data messages corresponding to the real-time traffic data includes:

[0017] After removing the Ethernet header and the IP header of the HTTP protocol message, if the HTTP protocol message is a request type or a post request type, the data content of the HTTP protocol message is used as a valid data message;

[0018] After removing the Ethernet header and the IP header of the TCP protocol message, if the length of the remaining message content is not equal to 0, the remaining message is used as a valid data message;

[0019] After removing the Ethernet header and the IP header of the UDP protocol message, the remaining message is used as a valid data message;

[0020] After removing the Ethernet header and the IP header of the ICMP protocol message, the data content of the ICMP protocol message is used as a valid data message.

[0021] Optionally, the performing vector extraction on the valid data message to generate a vector matrix corresponding to the valid data message includes:

[0022] Convert the valid data message into a column vector in a binary manner;

[0023] Transposing the column vector to obtain a row vector corresponding to the valid data message;

[0024] The column vector is multiplied by the row vector to generate a vector matrix corresponding to the valid data message.

[0025] Optionally, converting the vector matrix corresponding to the valid data message into a grayscale image, and calculating the image entropy corresponding to the grayscale image includes:

[0026] Normalizing the vector matrix, setting the values ​​in the vector matrix between 0 and 1, and obtaining a normalized matrix;

[0027] Obtaining a grayscale image corresponding to the valid data message based on the normalized matrix, wherein a value of 1 in the normalized matrix represents black, a value of 0 represents white, and a value between 0 and 1 represents gray;

[0028] An information entropy formula is obtained, and the image entropy corresponding to the grayscale graphic is calculated according to the information entropy formula.

[0029] Optionally, performing network analysis on the network node device according to the image entropy corresponding to each of the valid data messages to generate a detection result corresponding to the network node device includes:

[0030] Counting the image entropy corresponding to each of the valid data packets in the real-time traffic data to obtain a total entropy value corresponding to the real-time traffic data;

[0031] The total entropy value and the preset collection time are used to calculate the entropy value per unit time corresponding to the network traffic per unit time corresponding to the real-time traffic data;

[0032] The entropy value per unit time is calculated by the following formula to generate a network traffic determination value corresponding to the real-time traffic data:

[0033]

[0034] If the network traffic determination value is greater than 1, network anomaly information for the network node device is generated;

[0035] If the network traffic determination value is greater than 0 and less than 1, the network normal information for the network node device is generated;

[0036] If the network traffic determination value is equal to 1, a network warning message for the network node device is generated;

[0037] If the network traffic determination value is equal to 0, device abnormality information for the network node device is generated;

[0038] Wherein, HH is the entropy value per unit time, t is the preset acquisition time, and ψ u is the upper limit of the entropy value per unit time, the ψ l is the lower limit of the entropy value per unit time, and θ is the network traffic judgment value.

[0039] The embodiment of the present invention further discloses a network detection device, comprising:

[0040] A flow data acquisition module is used to acquire real-time flow data corresponding to network node devices;

[0041] A valid data message determination module is used to extract the messages of the IPv4 class and belonging to the TCP / IP protocol family from the real-time traffic data as target data messages, and remove the message headers of each of the target data messages to obtain a number of valid data messages corresponding to the real-time traffic data;

[0042] An image entropy calculation module, used to extract vectors from the valid data message, generate a vector matrix corresponding to the valid data message, convert the vector matrix corresponding to the valid data message into a grayscale image, and calculate the image entropy corresponding to the grayscale image;

[0043] The network analysis module is used to perform network analysis on the network node device according to the image entropy corresponding to each of the valid data messages, and generate a detection result corresponding to the network node device, wherein the detection result includes one of network abnormality information, network warning information, network normal information and device abnormality information.

[0044] Optionally, the real-time traffic data includes a plurality of data packets, and the valid data packet determination module is specifically used to:

[0045] Obtaining the message type of each of the data messages;

[0046] Eliminate data packets whose message type is a routing function type, and when eliminating the data packets of the routing function type, eliminate data packets whose message type is an IPV6 type, to obtain data packets of the IPV4 type in the real-time traffic data;

[0047] The data packets belonging to the TCP / IP protocol family among the IPV4 class data packets are used as target data packets.

[0048] Optionally, the message header includes at least an Ethernet header and an IP header, and the valid data message determination module is specifically used to:

[0049] The Ethernet header and the IP header of each of the target data messages are removed to obtain a plurality of valid data messages corresponding to the real-time traffic data.

[0050] Optionally, the target data message includes an HTTP protocol message, a TCP protocol message, a UDP protocol message, and an ICMP protocol message, and the valid data message determination module is specifically used to:

[0051] After removing the Ethernet header and the IP header of the HTTP protocol message, if the HTTP protocol message is a request type or a post request type, the data content of the HTTP protocol message is used as a valid data message;

[0052] After removing the Ethernet header and the IP header of the TCP protocol message, if the length of the remaining message content is not equal to 0, the remaining message is used as a valid data message;

[0053] After removing the Ethernet header and the IP header of the UDP protocol message, the remaining message is used as a valid data message;

[0054] After removing the Ethernet header and the IP header of the ICMP protocol message, the data content of the ICMP protocol message is used as a valid data message.

[0055] Optionally, the image entropy calculation module is specifically used for:

[0056] Convert the valid data message into a column vector in a binary manner;

[0057] Transposing the column vector to obtain a row vector corresponding to the valid data message;

[0058] The column vector is multiplied by the row vector to generate a vector matrix corresponding to the valid data message.

[0059] Optionally, the image entropy calculation module is specifically used for:

[0060] Normalizing the vector matrix, setting the values ​​in the vector matrix between 0 and 1, and obtaining a normalized matrix;

[0061] Obtaining a grayscale image corresponding to the valid data message based on the normalized matrix, wherein a value of 1 in the normalized matrix represents black, a value of 0 represents white, and a value between 0 and 1 represents gray;

[0062] An information entropy formula is obtained, and the image entropy corresponding to the grayscale graphic is calculated according to the information entropy formula.

[0063] Optionally, the network analysis module is specifically used for:

[0064] Counting the image entropy corresponding to each of the valid data packets in the real-time traffic data to obtain a total entropy value corresponding to the real-time traffic data;

[0065] The total entropy value and the preset collection time are used to calculate the entropy value per unit time corresponding to the network traffic per unit time corresponding to the real-time traffic data;

[0066] The entropy value per unit time is calculated by the following formula to generate a network traffic determination value corresponding to the real-time traffic data:

[0067]

[0068] If the network traffic determination value is greater than 1, network anomaly information for the network node device is generated;

[0069] If the network traffic determination value is greater than 0 and less than 1, the network normal information for the network node device is generated;

[0070] If the network traffic determination value is equal to 1, a network warning message for the network node device is generated;

[0071] If the network traffic determination value is equal to 0, device abnormality information for the network node device is generated;

[0072] Wherein, HH is the entropy value per unit time, t is the preset acquisition time, and ψ u is the upper limit of the entropy value per unit time, the ψ l is the lower limit of the entropy value per unit time, and θ is the network traffic judgment value.

[0073] The embodiment of the present invention further discloses an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0074] The memory is used to store computer programs;

[0075] The processor is used to implement the method described in the embodiment of the present invention when executing the program stored in the memory.

[0076] The embodiment of the present invention further discloses a computer-readable storage medium having instructions stored thereon, which, when executed by one or more processors, enables the processors to execute the method described in the embodiment of the present invention.

[0077] The embodiments of the present invention include the following advantages:

[0078] In an embodiment of the present invention, real-time traffic data corresponding to a network node device is obtained, and then packets of the IPV4 class and belonging to the TCP / IP protocol family are extracted from the real-time traffic data as target data packets, and the packet headers of each target data packet are removed to obtain a number of valid data packets corresponding to the real-time traffic data, and vector extraction is performed on the valid data packets to generate a vector matrix corresponding to the valid data packets, and the vector matrix corresponding to the valid data packets is converted into a grayscale image, and the image entropy corresponding to the grayscale image is calculated, and then network analysis can be performed on the real-time traffic data according to the image entropy corresponding to each valid data packet to generate a detection result corresponding to the network node device, and the detection result can be detected. The detection results include one of network anomaly information, network warning information, network normal information and device anomaly information. Therefore, in the process of detecting network security, by obtaining the real-time traffic data of network node devices, effective data collection is guaranteed, and effective data packets are extracted from the traffic data. The image entropy of the packet is calculated by converting the data packet into a grayscale image to realize the detection of the network status. This not only simplifies the detection process, but also can effectively reduce computing resources. At the same time, network analysis of network device nodes is performed based on image entropy to obtain corresponding analysis results. When network security detection of network node communications is realized, the accuracy and versatility of detection are improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0079] Figure 1 is a flowchart of a method for detecting a network provided in an embodiment of the present invention;

[0080] Figure 2 is a schematic diagram of generating a vector matrix provided in an embodiment of the present invention;

[0081] Figure 3 is a schematic diagram of grayscale image conversion provided in an embodiment of the present invention;

[0082] Figure 4 is a flow chart of network traffic monitoring and detection provided in an embodiment of the present invention;

[0083] Figure 5 is a structural block diagram of a network detection device provided in an embodiment of the present invention;

[0084] Figure 6 It is a block diagram of an electronic device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0085] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0086] As an example, due to the openness, freedom, sharing and other characteristics of the Internet and the loopholes in security protocols, information may be stolen, tampered with, destroyed, etc. during transmission, causing huge economic losses, so network security issues are becoming increasingly serious. Denial of service (DoS) and distributed denial of service (Distribute DoS) attacks are favored by hackers because they can cause the attacked network to lose its normal service function at a relatively low cost within a certain period of time, causing huge damage to the attacked. Attackers use multiple attack sources to send a large number of data packets to the victim, consuming network terminal computing resources and network resources, making it unable to serve normal requests. This is one of the most common methods of network destruction.

[0087] In this regard, one of the core invention points of the present invention is to obtain the real-time traffic data corresponding to the network node device, then extract the IPV4 class and the TCP / IP protocol family class messages from the real-time traffic data as the target data messages, and remove the message headers of each target data message to obtain a number of valid data messages corresponding to the real-time traffic data, perform vector extraction on the valid data message, generate a vector matrix corresponding to the valid data message, convert the vector matrix corresponding to the valid data message into a grayscale image, and calculate the image entropy corresponding to the grayscale image, and then perform network analysis on the real-time traffic data according to the image entropy corresponding to each valid data message to generate a detection result corresponding to the network node device. As a result, the detection results include one of network anomaly information, network warning information, network normal information and device anomaly information. Therefore, in the process of detecting network security, by obtaining the real-time traffic data of the network node equipment, effective data collection is guaranteed, and valid data packets are extracted from the traffic data. The image entropy of the packet is calculated by converting the data packet into a grayscale image to realize the detection of the network status. This not only simplifies the detection process, but also can effectively reduce computing resources. At the same time, based on the image entropy, the network device nodes are analyzed to obtain the corresponding analysis results. When the network security detection of the network node communication is realized, the accuracy and versatility of the detection are improved.

[0088] Reference Figure 1 , shows a flow chart of the steps of a network detection method provided in an embodiment of the present invention, which may specifically include the following steps:

[0089] Step 101, obtaining real-time traffic data corresponding to the network node device;

[0090] In an embodiment of the present invention, a network node device may be a communication device in a network topology. The network topology may include a star structure, a ring structure, a bus structure, a tree structure, a mesh structure, a honeycomb structure, and a hybrid structure, etc. In the process of detecting the network, a corresponding node device may be selected from the network topology as a key node device for network detection. For example, in a star structure, a central node device may be selected as a key node device for network detection; in a ring structure, each node device may be used as a key node device for network detection; in a bus structure, some or all of the node devices may be selected as key node devices for network detection; in a tree structure, a parent node device may be selected as a key node device for network detection, etc. It can be understood that for a network topology with a transit (center) node device / parent node device, the transit (center) node device / parent node device may be used as a key node device. If there is no such node device, some or all of the node devices may be selected as key node devices for network detection. The present invention does not impose any limitation on this.

[0091] In a specific implementation, for a network node device that needs to be tested on a network, a corresponding collection duration t can be set for it, and then the real-time flow data of the network node device in the network communication state can be collected according to the collection duration t. Among them, the real-time flow data can be data transmitted when the network node device communicates with other node devices. For example, the collection duration t can be 1 minute, 30 seconds, etc., then when triggering data collection on the network node device, the real-time flow data transmitted by the network node device within the collection duration t can be collected to perform corresponding network analysis and determine whether there is an abnormality in the network of the network node device.

[0092] Step 102, extracting IPV4-class messages belonging to the TCP / IP protocol family from the real-time traffic data as target data messages, and removing message headers of each of the target data messages to obtain a plurality of valid data messages corresponding to the real-time traffic data;

[0093] In addition to valid data packets, real-time traffic data may also include information used to characterize data attributes (such as destination MAC address, source MAC address, type, destination IP, destination port, source address, source port, and data length, etc.). This type of information will affect the effectiveness of data analysis during network detection. In this regard, after obtaining the real-time traffic data corresponding to the network node device, on the one hand, it can be stored, and on the other hand, it can be cleaned to remove some redirected data packets and obtain valid data packets.

[0094] In a specific implementation, the real-time traffic data may include several data packets, and the packet type of each data packet may be obtained first, and then the data packets with the packet type of routing function type are eliminated, and when the data packets with the routing function type are eliminated, the data packets with the packet type of IPV6 class are eliminated, and the data packets of the IPV4 class in the real-time traffic data are obtained, and then the data packets belonging to the TCP / IP protocol family class in the IPV4 class data packets are used as the target data packets. For each data packet, it may include an Ethernet header, an IP header, and data content, and for the target data packet, several valid data packets corresponding to the real-time traffic data may be obtained by removing the Ethernet header and the IP header of each target data packet.

[0095] Optionally, the target data message may include HTTP protocol messages, TCP protocol messages, UDP protocol messages, and ICMP protocol messages. For target data messages of different message categories, they may be processed in different ways to obtain valid data messages. Specifically, for HTTP protocol messages, after removing the Ethernet header and IP header of the HTTP protocol message, if the HTTP protocol message is of the request type or the post type, the data content of the HTTP protocol message is used as a valid data message; for TCP protocol messages, after removing the Ethernet header and IP header of the TCP protocol message, if the length of the remaining message content is not equal to 0, the remaining message is used as a valid data message; for UDP protocol messages, after removing the Ethernet header and IP header of the UDP protocol message, the remaining message is used as a valid data message; for ICMP protocol messages, after removing the Ethernet header and IP header of the ICMP protocol message, the data content of the ICMP protocol message is used as a valid data message.

[0096] In one example, the process of extracting a valid data message includes:

[0097] 1) Determine the source of the message;

[0098] A. According to the message type, the broadcast messages, multicast messages, ARP, RARP and other routing function data messages in the message are removed;

[0099] B. Remove the IPV6 and other message data processed in step A, leaving only the IPV4 data messages;

[0100] C. After the IPV4 data packets processed in step B, only the TCP / IP protocol family packets are kept and the rest are discarded.

[0101] 2) Determine the type of message;

[0102] D. Reprocess the TCP / IP protocol family messages processed in step C to separate HTTP, TCP, UDP, ICMP and other messages.

[0103] 3) Extract the data packets with data payload (data) such as HTTP, TCP, UDP, ICMP, etc. from the IPV4 type data packets obtained in B.

[0104] E. Reprocess the separated HTTP, TCP, UDP, ICMP and other messages and directly remove their data payload (data):

[0105] a) For HTTP protocol: after removing Ethernet header information, IP header information and other information, if it is a request message, take the data part; if it is a get message, the data content is 0; if it is a post message, take the data part.

[0106] b) For the TCP protocol: after removing the Ethernet header information, IP header information and other information, if len≠0, take out the TCP Payload part (the part that actually transmits data); if len=0, the content is 0.

[0107] c) For UDP protocol: remove the Ethernet header information, IP header information and other information and then take the UDP data part.

[0108] d) For ICMP protocol: remove the Ethernet header information, IP header information and other information, and then take out the data part of the ICMP message.

[0109] After processing steps 1) and 2), m valid data message contents (including content 0) are obtained.

[0110] Through the above-mentioned extraction of valid data from real-time traffic data, several valid data packets corresponding to the real-time traffic data can be obtained. In the process of network detection, these valid data packets are processed by means of image entropy, which can effectively monitor and detect the network of network node devices to determine whether there are security anomalies in the network of network node devices.

[0111] Step 103, extracting vectors from the valid data message, generating a vector matrix corresponding to the valid data message, converting the vector matrix corresponding to the valid data message into a grayscale image, and calculating the image entropy corresponding to the grayscale image;

[0112] In an embodiment of the present invention, after obtaining valid data packets corresponding to real-time traffic data through data cleaning, vector extraction can be further performed on each valid data packet to obtain a vector matrix corresponding to each valid data packet, and then the vector matrix can be converted into a corresponding grayscale image, and the image entropy corresponding to each grayscale image can be calculated, so as to determine whether the network of the network node device is abnormal through the image entropy, thereby realizing the detection of the network status by calculating the image entropy of the packet, which not only simplifies the detection process but also can effectively reduce computing resources.

[0113] In a specific implementation, for each valid data message, the valid data message can be converted into a column vector in a binary manner, and then the column vector is transposed to obtain the row vector corresponding to the valid data message, and then the column vector is multiplied by the row vector to generate a vector matrix corresponding to the valid data message. After obtaining the vector matrix, each vector matrix can be normalized, and the values ​​in the vector matrix are set between 0 and 1 to obtain a normalized matrix, and a grayscale image corresponding to the valid data message is obtained based on the normalized matrix. The value of 1 in the normalized matrix represents black, the value of 0 represents white, and the value between 0 and 1 represents gray. Then, the information entropy formula can be obtained, and the image entropy corresponding to the grayscale graphic can be calculated according to the information entropy formula.

[0114] For example, for the i-th data message, it is arranged in 0 / 1 bit binary format to form a 1-row n i The column elements are 0 or 1 column vectors, and then the obtained column vectors can be transposed to obtain an n i A row vector whose row 1 and column elements are 0 or 1. Then we can further multiply the row vector and the column vector to get an n i Row, n i The vector matrix whose column elements are 0 or 1 is converted into a grayscale image (e.g. 0 is white and 1 is black). The grayscale image entropy algorithm is then used to obtain the image entropy H of each valid data packet. i, so that the network status can be detected according to the image entropy corresponding to the real-time traffic data, which not only simplifies the detection process but also effectively reduces the computing resources.

[0115] Optionally, the column vector corresponding to the valid data message obtained in the above process may be:

[0116] a=(a1,a2,…,a n )

[0117] The lateral quantity obtained by transposing the column vector can be:

[0118]

[0119] By multiplying the column vector corresponding to the above valid data message with the horizontal quantity, the corresponding vector matrix can be obtained, which can be:

[0120]

[0121] Among them, α is the row vector formed by the arrangement of message payloads, β is the transpose of α, and A is the square matrix obtained by multiplying the two.

[0122] In one example, referring to Figure 2 , which shows a schematic diagram of generating a vector matrix provided in an embodiment of the present invention, referring to Figure 3 , shows a conversion schematic diagram of a grayscale image provided in an embodiment of the present invention. Specifically, if the value in the vector matrix is ​​0, it can be converted into a white pixel; if the value in the vector matrix is ​​1, it can be converted into a black pixel, thereby realizing the conversion of the vector matrix into the corresponding grayscale image, so as to further calculate the image entropy corresponding to the grayscale image, and perform network analysis based on the image entropy.

[0123] In addition, image entropy is a statistical form of features, which reflects the average amount of information in the image. The one-dimensional entropy of an image represents the amount of information contained in the aggregated features of the grayscale distribution in the image. By mathematically counting the grayscale values ​​of the image, the number and probability of occurrence of each grayscale value can be obtained. The one-dimensional grayscale entropy of a grayscale image is defined as:

[0124]

[0125] The information entropy of an image can be calculated using the information entropy calculation formula to find the entropy (average self-information) of any discrete source. Self-information is a random variable, which refers to the amount of information contained in a message sent by a source. Different messages contain different amounts of information. The self-information of any message cannot represent the average self-information contained in the source.

[0126] The meaning of information entropy: The information entropy of a source is considered from the statistical characteristics of the entire source. It characterizes the overall characteristics of the source in an average sense. For a specific source, there is only one information entropy. Different sources have different entropies due to different statistical characteristics.

[0127] The one-dimensional entropy of an image can represent the clustering characteristics of the grayscale distribution of an image, but it cannot reflect the spatial characteristics of the grayscale distribution of an image. In order to characterize this spatial characteristic, a feature quantity that can reflect the spatial characteristics of the grayscale distribution can be introduced on the basis of the one-dimensional entropy to form the two-dimensional entropy of the image. The neighborhood grayscale mean of the image is selected as the spatial feature quantity of the grayscale distribution, and it is combined with the grayscale of the image pixel to form a feature binary, recorded as (, j), where i represents the grayscale value of the pixel and j represents the neighborhood grayscale:

[0128] P ij =f(,j) / 2

[0129] Where f(i,j) is the frequency of occurrence of the feature binary (,j), N is the scale of the image, and the discrete two-dimensional entropy of the image is defined as:

[0130]

[0131] The constructed two-dimensional entropy of the image can highlight the comprehensive characteristics of the grayscale information of the pixel position in the image and the grayscale distribution in the pixel neighborhood, based on the amount of information contained in the image.

[0132] Step 104, performing network analysis on the network node device according to the image entropy corresponding to each of the valid data messages, and generating a detection result corresponding to the network node device, wherein the detection result includes one of network abnormality information, network warning information, network normal information and device abnormality information.

[0133] In an embodiment of the present invention, after obtaining the image entropy corresponding to each valid data message corresponding to the real-time traffic data, the total entropy value corresponding to these image entropies can be calculated, and then a network analysis is performed on the network node device based on the total entropy value to determine whether there is an abnormality (including equipment abnormality, network abnormality, etc.), and then generate the corresponding detection result. Among them, the detection results include one of network anomaly information, network warning information, network normal information and device anomaly information. For network anomaly information, it can be used to indicate that the current network is under attack and needs to be investigated by the network security administrator; for network warning information, it can be used to indicate that the current traffic of the network node device is large and needs attention; for network normal information, it can be used to indicate that the current network of the network node device is normal; for device anomaly information, it can be used to indicate that the network node device is currently in a faulty state. Therefore, in the process of detecting network security, by obtaining real-time traffic data of the network node device, effective data collection is guaranteed, and valid data packets are extracted from the traffic data. The image entropy of the packet is calculated by converting the data packet into a grayscale image to realize the detection of the network status. This not only simplifies the detection process, but also can effectively reduce computing resources. At the same time, network analysis of network device nodes is performed based on image entropy to obtain corresponding analysis results. When network security detection of network node communications is realized, the accuracy and versatility of detection are improved.

[0134] In a specific implementation, the total entropy value corresponding to the real-time traffic data can be obtained by counting the image entropy corresponding to each valid data message in the real-time traffic data, and then the total entropy value and the preset collection time (different network node devices may correspond to different collection time) are used to calculate the unit time entropy value corresponding to the unit time network traffic corresponding to the real-time traffic data, and then the unit time entropy value can be calculated by the following formula to generate the network traffic judgment value corresponding to the real-time traffic data:

[0135]

[0136] If the network traffic judgment value is greater than 1, network abnormality information for the network node device is generated; if the network traffic judgment value is greater than 0 and less than 1, network normal information for the network node device is generated; if the network traffic judgment value is equal to 1, network warning information for the network node device is generated; if the network traffic judgment value is equal to 0, device abnormality information for the network node device is generated, where HH is the entropy value per unit time, t is the preset collection time, ψ u is the upper limit of entropy value per unit time, ψ l is the lower limit of the entropy value per unit time, and θ is the network traffic judgment value.

[0137] It should be noted that in the actual process of network detection of network node devices, ψu The actual setting value of can also be greater than the upper limit of the entropy value of the network traffic per unit time. l The actual set value may also be smaller than the lower limit of the entropy value of the network traffic per unit time.

[0138] It should be noted that the embodiments of the present invention include but are not limited to the above examples. It is understandable that those skilled in the art can also make settings according to actual needs under the guidance of the ideas of the embodiments of the present invention, and the present invention is not limited to this.

[0139] In an embodiment of the present invention, real-time traffic data corresponding to a network node device is obtained, and then packets of the IPV4 class and belonging to the TCP / IP protocol family are extracted from the real-time traffic data as target data packets, and the packet headers of each target data packet are removed to obtain a number of valid data packets corresponding to the real-time traffic data, and vector extraction is performed on the valid data packets to generate a vector matrix corresponding to the valid data packets, and the vector matrix corresponding to the valid data packets is converted into a grayscale image, and the image entropy corresponding to the grayscale image is calculated, and then network analysis can be performed on the real-time traffic data according to the image entropy corresponding to each valid data packet to generate a detection result corresponding to the network node device, and the detection result can be detected. The detection results include one of network anomaly information, network warning information, network normal information and device anomaly information. Therefore, in the process of detecting network security, by obtaining the real-time traffic data of network node devices, effective data collection is guaranteed, and effective data packets are extracted from the traffic data. The image entropy of the packet is calculated by converting the data packet into a grayscale image to realize the detection of the network status. This not only simplifies the detection process, but also can effectively reduce computing resources. At the same time, network analysis of network device nodes is performed based on image entropy to obtain corresponding analysis results. When network security detection of network node communications is realized, the accuracy and versatility of detection are improved.

[0140] In order to enable those skilled in the art to better understand the technical solution in the embodiments of the present invention, an example is given below for illustrative explanation:

[0141] Assuming that a central node device is selected as a node device for network detection in a star network topology, after obtaining the real-time traffic data of the central node device, the IPV4 class and the TCP / IP protocol family messages can be extracted as target data messages, and the message headers of each target data message can be removed to obtain a number of valid data messages corresponding to the real-time traffic data. Vectors are extracted from the valid data messages to generate a vector matrix corresponding to the valid data messages, and the vector matrix corresponding to the valid data messages is converted into a grayscale image, and the image entropy corresponding to the grayscale image is calculated. Then, network analysis can be performed on the real-time traffic data according to the image entropy corresponding to each valid data message to generate a detection result corresponding to the central node device. For example, when the generated When the detection result is network anomaly information, it indicates that the central node device is under attack at this time. The network security administrator needs to conduct timely inspections to ensure the security of the central node device. Therefore, in the process of detecting network security, the real-time traffic data of the central node device is obtained to ensure the collection of effective data, and valid data packets are extracted from the traffic data. The image entropy of the packet is calculated by converting the data packet into a grayscale image to realize the detection of the network status. This not only simplifies the detection process, but also can effectively reduce computing resources. At the same time, network analysis of network device nodes is performed based on image entropy to obtain corresponding analysis results. When network security detection of network node communications is realized, the accuracy and versatility of detection are improved.

[0142] Specifically, refer to Figure 4, showing a flow chart of network traffic monitoring and detection provided in an embodiment of the present invention. For node devices that require network monitoring and detection, the corresponding network raw data can be obtained through mirroring. After storing the network raw data, the network data can be cleaned to extract the effective message payload, and then the effective message payload is vectorized to obtain the corresponding single message column vector. The message column vector is then transposed to obtain the corresponding message row vector, and the message column vector is multiplied by the message row vector to obtain a message matrix. The message matrix corresponding to each valid message load can be converted into a corresponding grayscale image, and the image entropy value of the grayscale image can be calculated. At the same time, the entropy value per unit time is calculated in combination with the corresponding acquisition time, and the obtained entropy value per unit time is compared with the upper limit and lower limit of the network traffic. If the entropy value per unit time is less than the lower limit or greater than the upper limit, a network warning is issued; if it is greater than the lower limit and less than the upper limit, the network is normal and no processing is required. The real-time traffic data is analyzed based on the image entropy method, and whether the network is under attack is determined based on the analysis results, thereby realizing the detection of the network status. This not only simplifies the detection process, but also can effectively reduce computing resources. At the same time, network analysis of network device nodes is performed based on image entropy to obtain corresponding analysis results. When network security detection of network node communications is realized, the accuracy and versatility of detection are improved. This is not only applicable to large-scale networks, but also to small-scale networks.

[0143] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0144] Reference Figure 5 , shows a structural block diagram of a network detection device provided in an embodiment of the present invention, which may specifically include the following modules:

[0145] The flow data acquisition module 501 is used to acquire the real-time flow data corresponding to the network node device;

[0146] The valid data message determination module 502 is used to extract the messages of the IPv4 class and belonging to the TCP / IP protocol family from the real-time traffic data as target data messages, and remove the message headers of each of the target data messages to obtain a plurality of valid data messages corresponding to the real-time traffic data;

[0147] An image entropy calculation module 503 is used to extract vectors from the valid data message, generate a vector matrix corresponding to the valid data message, convert the vector matrix corresponding to the valid data message into a grayscale image, and calculate the image entropy corresponding to the grayscale image;

[0148] The network analysis module 504 is used to perform network analysis on the network node device according to the image entropy corresponding to each of the valid data messages, and generate a detection result corresponding to the network node device, wherein the detection result includes one of network abnormality information, network warning information, network normal information and device abnormality information.

[0149] In an optional embodiment, the real-time traffic data includes a plurality of data packets, and the valid data packet determination module 502 is specifically used to:

[0150] Obtaining the message type of each of the data messages;

[0151] Eliminate data packets whose message type is a routing function type, and when eliminating the data packets of the routing function type, eliminate data packets whose message type is an IPV6 type, to obtain data packets of the IPV4 type in the real-time traffic data;

[0152] The data packets belonging to the TCP / IP protocol family among the IPV4 class data packets are used as target data packets.

[0153] In an optional embodiment, the message header includes at least an Ethernet header and an IP header, and the valid data message determination module 502 is specifically used to:

[0154] The Ethernet header and the IP header of each of the target data messages are removed to obtain a plurality of valid data messages corresponding to the real-time traffic data.

[0155] In an optional embodiment, the target data message includes an HTTP protocol message, a TCP protocol message, a UDP protocol message, and an ICMP protocol message, and the valid data message determination module 502 is specifically used to:

[0156] After removing the Ethernet header and the IP header of the HTTP protocol message, if the HTTP protocol message is a request type or a post request type, the data content of the HTTP protocol message is used as a valid data message;

[0157] After removing the Ethernet header and the IP header of the TCP protocol message, if the length of the remaining message content is not equal to 0, the remaining message is used as a valid data message;

[0158] After removing the Ethernet header and the IP header of the UDP protocol message, the remaining message is used as a valid data message;

[0159] After removing the Ethernet header and the IP header of the ICMP protocol message, the data content of the ICMP protocol message is used as a valid data message.

[0160] In an optional embodiment, the image entropy calculation module 503 is specifically used for:

[0161] Convert the valid data message into a column vector in a binary manner;

[0162] Transposing the column vector to obtain a row vector corresponding to the valid data message;

[0163] The column vector is multiplied by the row vector to generate a vector matrix corresponding to the valid data message.

[0164] In an optional embodiment, the image entropy calculation module 503 is specifically used for:

[0165] Normalizing the vector matrix, setting the values ​​in the vector matrix between 0 and 1, and obtaining a normalized matrix;

[0166] Obtaining a grayscale image corresponding to the valid data message based on the normalized matrix, wherein a value of 1 in the normalized matrix represents black, a value of 0 represents white, and a value between 0 and 1 represents gray;

[0167] An information entropy formula is obtained, and the image entropy corresponding to the grayscale graphic is calculated according to the information entropy formula.

[0168] In an optional embodiment, the network analysis module 504 is specifically used to:

[0169] Counting the image entropy corresponding to each of the valid data packets in the real-time traffic data to obtain a total entropy value corresponding to the real-time traffic data;

[0170] The total entropy value and the preset collection time are used to calculate the entropy value per unit time corresponding to the network traffic per unit time corresponding to the real-time traffic data;

[0171] The entropy value per unit time is calculated by the following formula to generate a network traffic determination value corresponding to the real-time traffic data:

[0172]

[0173] If the network traffic determination value is greater than 1, network anomaly information for the network node device is generated;

[0174] If the network traffic determination value is greater than 0 and less than 1, the network normal information for the network node device is generated;

[0175] If the network traffic determination value is equal to 1, a network warning message for the network node device is generated;

[0176] If the network traffic determination value is equal to 0, device abnormality information for the network node device is generated;

[0177] Wherein, HH is the entropy value per unit time, t is the preset acquisition time, and ψ u is the upper limit of the entropy value per unit time, the ψ l is the lower limit of the entropy value per unit time, and θ is the network traffic judgment value.

[0178] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0179] In addition, an embodiment of the present invention further provides an electronic device, including: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the various processes of the above-mentioned network detection method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0180] The embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, each process of the above-mentioned network detection method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0181] Figure 6 A schematic diagram of the hardware structure of an electronic device for implementing various embodiments of the present invention.

[0182] The electronic device 600 includes but is not limited to: a radio frequency unit 601, a network module 602, an audio output unit 603, an input unit 604, a sensor 605, a display unit 606, a user input unit 607, an interface unit 608, a memory 609, a processor 610, and a power supply 611. Those skilled in the art will appreciate that the electronic device structure involved in the embodiments of the present invention does not constitute a limitation on the electronic device, and the electronic device may include more or fewer components than shown in the figure, or combine certain components, or arrange components differently. In the embodiments of the present invention, the electronic device includes but is not limited to a mobile phone, a tablet computer, a laptop computer, a PDA, a vehicle-mounted terminal, a wearable device, and a pedometer.

[0183] It should be understood that in the embodiment of the present invention, the radio frequency unit 601 can be used for receiving and sending signals during information transmission or communication. Specifically, after receiving downlink data from the base station, it is sent to the processor 610 for processing; in addition, uplink data is sent to the base station. Generally, the radio frequency unit 601 includes but is not limited to an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier, a duplexer, etc. In addition, the radio frequency unit 601 can also communicate with the network and other devices through a wireless communication system.

[0184] The electronic device provides users with wireless broadband Internet access through the network module 602, such as helping users to send and receive emails, browse web pages, and access streaming media.

[0185] The audio output unit 603 can convert the audio data received by the RF unit 601 or the network module 602 or stored in the memory 609 into an audio signal and output it as sound. Moreover, the audio output unit 603 can also provide audio output related to a specific function performed by the electronic device 600 (for example, a call signal reception sound, a message reception sound, etc.). The audio output unit 603 includes a speaker, a buzzer, a receiver, etc.

[0186] The input unit 604 is used to receive audio or video signals. The input unit 604 may include a graphics processor (GPU) 6041 and a microphone 6042, and the graphics processor 6041 processes the image data of a static picture or video obtained by an image capture device (such as a camera) in a video capture mode or an image capture mode. The processed image frame can be displayed on the display unit 606. The image frame processed by the graphics processor 6041 can be stored in the memory 609 (or other storage medium) or sent via the radio frequency unit 601 or the network module 602. The microphone 6042 can receive sound and can process such sound into audio data. The processed audio data can be converted into a format output that can be sent to a mobile communication base station via the radio frequency unit 601 in the case of a telephone call mode.

[0187] The electronic device 600 also includes at least one sensor 605, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor includes an ambient light sensor and a proximity sensor, wherein the ambient light sensor can adjust the brightness of the display panel 6061 according to the brightness of the ambient light, and the proximity sensor can turn off the display panel 6061 and / or the backlight when the electronic device 600 is moved to the ear. As a type of motion sensor, the accelerometer sensor can detect the magnitude of acceleration in each direction (generally three axes), and can detect the magnitude and direction of gravity when stationary, which can be used to identify the posture of the electronic device (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc.; the sensor 605 can also include a fingerprint sensor, a pressure sensor, an iris sensor, a molecular sensor, a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, etc., which will not be repeated here.

[0188] The display unit 606 is used to display information input by the user or information provided to the user. The display unit 606 may include a display panel 6061, which may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), or the like.

[0189] The user input unit 607 can be used to receive input digital or character information, and to generate key signal input related to user settings and function control of the electronic device. Specifically, the user input unit 607 includes a touch panel 6071 and other input devices 6072. The touch panel 6071, also known as a touch screen, can collect the user's touch operation on or near it (such as the user's operation on the touch panel 6071 or near the touch panel 6071 using any suitable object or accessory such as a finger, stylus, etc.). The touch panel 6071 may include two parts: a touch detection device and a touch controller. Among them, the touch detection device detects the user's touch orientation, detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts it into contact coordinates, and then sends it to the processor 610, receives the command sent by the processor 610 and executes it. In addition, the touch panel 6071 can be implemented in various types such as resistive, capacitive, infrared and surface acoustic waves. In addition to the touch panel 6071, the user input unit 607 may also include other input devices 6072. Specifically, other input devices 6072 may include but are not limited to a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, and a joystick, which will not be described in detail here.

[0190] Further, the touch panel 6071 may be covered on the display panel 6061. When the touch panel 6071 detects a touch operation on or near it, it is transmitted to the processor 610 to determine the type of the touch event, and then the processor 610 provides a corresponding visual output on the display panel 6061 according to the type of the touch event. It can be understood that in one embodiment, the touch panel 6071 and the display panel 6061 are used as two independent components to implement the input and output functions of the electronic device, but in some embodiments, the touch panel 6071 and the display panel 6061 can be integrated to implement the input and output functions of the electronic device, which is not limited here.

[0191] The interface unit 608 is an interface for connecting an external device to the electronic device 600. For example, the external device may include a wired or wireless headset port, an external power supply (or battery charger) port, a wired or wireless data port, a memory card port, a port for connecting a device with an identification module, an audio input / output (I / O) port, a video I / O port, a headphone port, etc. The interface unit 608 may be used to receive input (e.g., data information, power, etc.) from an external device and transmit the received input to one or more elements within the electronic device 600 or may be used to transmit data between the electronic device 600 and an external device.

[0192] The memory 609 can be used to store software programs and various data. The memory 609 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory 609 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0193] The processor 610 is the control center of the electronic device. It uses various interfaces and lines to connect various parts of the entire electronic device. By running or executing software programs and / or modules stored in the memory 609 and calling data stored in the memory 609, it performs various functions of the electronic device and processes data, thereby monitoring the electronic device as a whole. The processor 610 may include one or more processing units; preferably, the processor 610 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 610.

[0194] The electronic device 600 may also include a power supply 611 (such as a battery) for supplying power to each component. Preferably, the power supply 611 may be logically connected to the processor 610 through a power management system, thereby implementing functions such as charging, discharging, and power consumption management through the power management system.

[0195] In addition, the electronic device 600 includes some functional modules not shown, which will not be described in detail here.

[0196] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0197] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0198] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation modes, which are merely illustrative rather than restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the present invention and the claims, all of which are within the protection of the present invention.

[0199] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in the embodiments of the present invention can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0200] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0201] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0202] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0203] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0204] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, ROM, RAM, magnetic disks, or optical disks.

[0205] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A network detection method, characterized in that: include: Obtain real-time traffic data corresponding to network node devices; Extracting IPV4-class messages belonging to the TCP / IP protocol family from the real-time traffic data as target data messages, and removing message headers of each of the target data messages to obtain a plurality of valid data messages corresponding to the real-time traffic data; Performing vector extraction on the valid data message, generating a vector matrix corresponding to the valid data message, converting the vector matrix corresponding to the valid data message into a grayscale image, and calculating the image entropy corresponding to the grayscale image; Performing network analysis on the network node device according to the image entropy corresponding to each of the valid data messages, generating a detection result corresponding to the network node device, the detection result including one of network abnormality information, network warning information, network normal information and device abnormality information; The performing of network analysis on the network node device according to the image entropy corresponding to each of the valid data messages to generate a detection result corresponding to the network node device includes: Counting the image entropy corresponding to each of the valid data packets in the real-time traffic data to obtain a total entropy value corresponding to the real-time traffic data; The total entropy value and the preset collection time are used to calculate the entropy value per unit time corresponding to the network traffic per unit time corresponding to the real-time traffic data; The entropy value per unit time is calculated by the following formula to generate a network traffic determination value corresponding to the real-time traffic data: If the network traffic determination value is greater than 1, network anomaly information for the network node device is generated; If the network traffic determination value is greater than 0 and less than 1, the network normal information for the network node device is generated; If the network traffic determination value is equal to 1, a network warning message for the network node device is generated; If the network traffic determination value is equal to 0, device abnormality information for the network node device is generated; Wherein, HH is the entropy value per unit time, t is the preset acquisition time, is the upper limit of the entropy value per unit time, is the lower limit of the entropy value per unit time, A value is determined for the network traffic.

2. The method according to claim 1, characterized in that The real-time traffic data includes a plurality of data packets, and the extracting of IPv4 packets belonging to the TCP / IP protocol family from the real-time traffic data as target data packets includes: Obtaining the message type of each of the data messages; Eliminate data packets whose message type is a routing function type, and when eliminating the data packets of the routing function type, eliminate data packets whose message type is an IPV6 type, to obtain data packets of the IPV4 type in the real-time traffic data; The data packets belonging to the TCP / IP protocol family among the IPV4 class data packets are used as target data packets.

3. The method according to claim 1 or 2, characterized in that: The message header includes at least an Ethernet header and an IP header, and the removing of the message headers of each of the target data messages to obtain a plurality of valid data messages corresponding to the real-time traffic data includes: The Ethernet header and the IP header of each of the target data messages are removed to obtain a plurality of valid data messages corresponding to the real-time traffic data.

4. The method according to claim 3, characterized in that The target data message includes an HTTP protocol message, a TCP protocol message, a UDP protocol message, and an ICMP protocol message, and the removing of the Ethernet header and the IP header of each of the target data messages to obtain a plurality of valid data messages corresponding to the real-time traffic data includes: After removing the Ethernet header and the IP header of the HTTP protocol message, if the HTTP protocol message is a request type or a post request type, the data content of the HTTP protocol message is used as a valid data message; After removing the Ethernet header and the IP header of the TCP protocol message, if the length of the remaining message content is not equal to 0, the remaining message is used as a valid data message; After removing the Ethernet header and the IP header of the UDP protocol message, the remaining message is used as a valid data message; After removing the Ethernet header and the IP header of the ICMP protocol message, the data content of the ICMP protocol message is used as a valid data message.

5. The method according to claim 1, characterized in that The step of extracting vectors from the valid data message to generate a vector matrix corresponding to the valid data message includes: Convert the valid data message into a column vector in a binary manner; Transposing the column vector to obtain a row vector corresponding to the valid data message; The column vector is multiplied by the row vector to generate a vector matrix corresponding to the valid data message.

6. The method according to claim 1, characterized in that The step of converting the vector matrix corresponding to the valid data message into a grayscale image and calculating the image entropy corresponding to the grayscale image includes: Normalizing the vector matrix, setting the values ​​in the vector matrix between 0 and 1, and obtaining a normalized matrix; Obtaining a grayscale image corresponding to the valid data message based on the normalized matrix, wherein a value of 1 in the normalized matrix represents black, a value of 0 represents white, and a value between 0 and 1 represents gray; An information entropy formula is obtained, and image entropy corresponding to the grayscale image is calculated according to the information entropy formula.

7. A network detection device, characterized in that: include: A flow data acquisition module is used to acquire real-time flow data corresponding to network node devices; A valid data message determination module is used to extract the messages of the IPv4 class and belonging to the TCP / IP protocol family from the real-time traffic data as target data messages, and remove the message headers of each of the target data messages to obtain a number of valid data messages corresponding to the real-time traffic data; An image entropy calculation module, used to extract vectors from the valid data message, generate a vector matrix corresponding to the valid data message, convert the vector matrix corresponding to the valid data message into a grayscale image, and calculate the image entropy corresponding to the grayscale image; A network analysis module, configured to perform network analysis on the network node device according to the image entropy corresponding to each of the valid data messages, and generate a detection result corresponding to the network node device, wherein the detection result includes one of network abnormality information, network warning information, network normal information, and device abnormality information; Wherein, the network analysis module is specifically used for: Counting the image entropy corresponding to each of the valid data packets in the real-time traffic data to obtain a total entropy value corresponding to the real-time traffic data; The total entropy value and the preset collection time are used to calculate the entropy value per unit time corresponding to the network traffic per unit time corresponding to the real-time traffic data; The entropy value per unit time is calculated by the following formula to generate a network traffic determination value corresponding to the real-time traffic data: If the network traffic determination value is greater than 1, network anomaly information for the network node device is generated; If the network traffic determination value is greater than 0 and less than 1, the network normal information for the network node device is generated; If the network traffic determination value is equal to 1, a network warning message for the network node device is generated; If the network traffic determination value is equal to 0, device abnormality information for the network node device is generated; Wherein, HH is the entropy value per unit time, t is the preset acquisition time, is the upper limit of the entropy value per unit time, is the lower limit of the entropy value per unit time, A value is determined for the network traffic.

8. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; The memory is used to store computer programs; The processor is used to implement the method according to any one of claims 1 to 6 when executing the program stored in the memory.

9. A computer-readable storage medium having instructions stored thereon, which, when executed by one or more processors, cause the processors to perform the method according to any one of claims 1 to 6.

Images