A network port detection system based on filing authorization

Abstract

The present invention provides a network port detection system based on record authorization, comprising: a detection module, which is used to generate a detection data packet based on the network topology information of the target network port accessing the network, and send the detection data packet to the target network port according to a preset period; a response receiving module, which is used to receive a detection response data packet corresponding to the detection data packet; and a security determination module, which is used to determine whether the target network port has a security problem according to the detection response data packet. The present invention uses multiple detections to perform security detection on the network port, determines whether the detected network port has a security problem according to the detection results, discovers security risks in time, and protects user information security.

Description

Technical Field

[0001] The present invention relates to the technical field of network port detection, and in particular to a network port detection system based on filing authorization. Background Art

[0002] With the rapid development of information technology, more and more smart networks such as smart life and smart city are being established to provide users with comprehensive, fast and efficient services. People's dependence on the network is increasing. Ensuring network security has become one of the important topics of network construction. Network ports are the hubs of network information transmission. Ensuring the security of network ports has also become a top priority of network security. Therefore, the present invention proposes a network port detection system based on filing authorization. Summary of the invention

[0003] The present invention provides a network port detection system based on record authorization, which uses multiple detections to perform security detection on network ports, determines whether the detected network ports have security problems according to the detection results, discovers security risks in time, and protects user information security.

[0004] The present invention provides a network port detection system based on filing authorization, comprising:

[0005] A detection module, used to generate a detection data packet based on the network topology information of the target network port accessing the network, and send the detection data packet to the target network port according to a preset period;

[0006] A response receiving module, used for receiving a detection response data packet corresponding to the detection data packet;

[0007] The security determination module is used to determine whether there is a security problem on the target network port based on the detection response data packet.

[0008] Preferably, the detection module in the network port detection system based on filing authorization includes:

[0009] The information acquisition submodule is used to obtain the network topology information of the target network port accessing the network;

[0010] The data generation submodule is used to obtain the data characteristics of the transmission data of the target network port based on the network topology information, and determine the task attributes of the target port according to the data characteristics, and generate a detection data packet;

[0011] The detection initiating submodule is used to send detection data packets to the target network port according to a preset period.

[0012] Preferably, the data generation submodule in the network port detection system based on filing authorization includes:

[0013] A feature acquisition unit, used to acquire network topology information of a network to which a target network port is connected, determine attributes of a device connected to the target network port, and determine data features of data transmitted by the target network port based on the device attributes;

[0014] A first generating unit is used to determine the candidate execution tasks corresponding to the target network port according to the data characteristics, classify the candidate execution tasks, and determine the detection sub-data characteristics according to the classification results;

[0015] The second generating unit is used to generate a plurality of detection sub-data based on the detection sub-data characteristics, and generate a detection data packet in combination with the communication protocol corresponding to the target network port.

[0016] Preferably, the first generating unit in the network port detection system based on record authorization includes:

[0017] A task confirmation unit, used to confirm the data type of the data transmitted by the target network port according to the data characteristics, and determine all candidate execution tasks of the target network port according to the type;

[0018] A relationship judgment unit, used to determine the execution relationship between the candidate execution tasks based on the task execution rules, calculate the task correlation between each candidate execution task, and determine the task correlation relationship;

[0019] The feature acquisition unit is used to establish a task association chain according to the task association relationship, obtain multiple task association chains, use the task data corresponding to the primary tasks and the highest-level tasks of the multiple task association chains as the target task data, and obtain the data features of the target task data as the corresponding detection sub-data features.

[0020] Preferably, the second generation unit in the network port detection system based on record authorization includes:

[0021] A primary generation unit, used to generate a plurality of detection sub-data according to the detection sub-data characteristics and detection data preset rules;

[0022] The arranging and compressing unit is used to arrange the multiple detection sub-data to generate a data sequence, and generate a detection sub-data identification code according to the order of the data sequence to obtain an identification list, and at the same time, compress the data sequence to generate a detection data packet;

[0023] The data storage unit is used to generate a data call identifier according to the target network port, add the data call identifier to the detection data packet, and then send it to the storage module for storage.

[0024] Preferably, the detection module in the network port detection system based on filing authorization further includes:

[0025] The non-periodic detection submodule is used to obtain the detection data packet corresponding to the target network port based on the data call identifier when the total transmission data flow of the target network port in the current stage is greater than the preset value and has not reached the preset detection period, and send the detection data packet to the target network port to perform non-periodic detection on the target network port.

[0026] Preferably, the detection module in the network port detection system based on filing authorization includes:

[0027] The passive detection submodule is used to obtain the fingerprint information of the regular data packets received by the target network port, and based on the fingerprint information, detect the regular data content to determine whether the regular new data is safe data;

[0028] If it is safe data, regular data is allowed to continue to execute;

[0029] Otherwise, enable the firewall to block the normal return data.

[0030] Preferably, the security determination module in the network port detection system based on record authorization includes:

[0031] A data matching submodule is used to obtain a detection sub-data identification code corresponding to each detection response sub-data in the detection response data packet, match each detection response sub-data with the detection sub-data according to the identification list, and obtain the predicted response sub-data corresponding to the detection response sub-data according to the matching result;

[0032] The detection diagnosis submodule is used to compare each detection response sub-data with its corresponding predicted response data. When it is determined that there is an abnormality in the detection response sub-data, it is determined that there is a security problem in the target network port.

[0033] Preferably, the detection diagnosis submodule in the network port detection system based on filing authorization includes:

[0034] A data cutting unit, used for obtaining the logical relationship between the codes corresponding to the prediction response sub-data, and determining the data segmentation method of the prediction response sub-data based on the logical relationship;

[0035] Segmenting the predicted response data based on the data segmentation method to obtain a plurality of first sub-data sets and a plurality of first judgment nodes;

[0036] At the same time, based on the data segmentation method, the multiple detection response sub-data are segmented respectively to obtain multiple second data fragments and second judgment nodes.

[0037] Preferably, the detection and diagnosis submodule further includes:

[0038] A first comparison unit is used to obtain a second position feature corresponding to the second judgment node and a first position feature corresponding to the first judgment node, and when the first position feature is inconsistent with the second position feature, it is determined that the detection response sub-data is abnormal and the target network port has a security problem;

[0039] The second comparison unit is used to obtain the first data segment and the second data segment for matching and comparison when the first position feature is consistent with the second position feature, to determine whether there are abnormal characters, and if there are no abnormal characters, determine that the target network port is safe; otherwise, determine that the target network port has a security problem.

[0040] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings.

[0041] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0043] Figure 1 A schematic diagram of the structure of a network port detection system based on filing authorization in an embodiment of the present invention;

[0044] Figure 2 It is a structural schematic diagram of a detection module of a network port detection system based on record authorization in an embodiment of the present invention;

[0045] Figure 3 It is a structural diagram of a security determination module of a network port detection system based on filing authorization in an embodiment of the present invention. DETAILED DESCRIPTION

[0046] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0047] Embodiment 1:

[0048] The present invention provides a network port detection system based on record authorization, such as Figure 1 As shown, including:

[0049] A detection module, used to generate a detection data packet based on the network topology information of the target network port accessing the network, and send the detection data packet to the target network port according to a preset period;

[0050] A response receiving module, used for receiving a detection response data packet corresponding to the detection data packet;

[0051] The security determination module is used to determine whether there is a security problem on the target network port based on the detection response data packet.

[0052] In this embodiment, the detection data packet is used for data sent to the target network port during the active detection process of the network port detection system, wherein the active detection includes sending the detection data packet to the target port according to a preset period and also includes non-periodic detection.

[0053] In this embodiment, the detection response data packet refers to the response result of the target network port to the data in the detection data packet after receiving the detection data packet.

[0054] The beneficial effects of the above embodiments: the present invention generates a detection data packet based on the network topology information of the target network port accessing the network through the detection module, and generates different detection data packets according to different network ports, so that the detection data packet is more in line with the data transmission characteristics of each network port, and effectively improves the accuracy of the detection result; sends a detection data packet to the target network port according to a preset period, and uses multiple detections to perform security detection on the network port, thereby realizing automatic detection of the network port and overcoming the uncertainty of manual operation. It determines whether the detected network port (target network port) has security problems based on the detection results (detection response data packet), timely discovers security risks, and protects user information security.

[0055] Embodiment 2:

[0056] On the basis of Example 1, the detection module in the network port detection system based on record authorization is as follows: Figure 2 As shown, including:

[0057] The information acquisition submodule is used to obtain the network topology information of the target network port accessing the network;

[0058] The data generation submodule is used to obtain the data characteristics of the transmission data of the target network port based on the network topology information, and determine the task attributes of the target port according to the data characteristics, and generate a detection data packet;

[0059] The detection initiating submodule is used to send detection data packets to the target network port according to a preset period.

[0060] In this embodiment, the network topology information refers to the connection relationship between the various devices in the target network port access network. Based on the connection relationship, the device connected to the target network port in the access network can be determined, and the data type and data function of the target network port to be transmitted can be determined.

[0061] In this embodiment, the data feature refers to the data type and data function of the target port transmitting data.

[0062] In this embodiment, the target port task attribute refers to the type of operation instruction to be completed by the data transmitted by the target port.

[0063] In this embodiment, directional sending means that the detection data packet value will be sent to the corresponding target network port, and different target network ports correspond to different detection data packets.

[0064] The beneficial effects of the above embodiments are as follows: the present invention obtains the data transmission characteristics of the target network port based on the network topology information, and determines the target port task attributes according to the data transmission characteristics, generates a detection data packet, and ensures the comprehensiveness of the detection data; sends the detection data packet to the target network port in a targeted manner according to a preset period, realizes autonomous detection of the network port, and improves the port security.

[0065] Embodiment 3:

[0066] On the basis of Example 2, the data generation submodule in the network port detection system based on filing authorization includes:

[0067] A feature acquisition unit, used to acquire network topology information of a network to which a target network port is connected, determine attributes of a device connected to the target network port, and determine data features of data transmitted by the target network port based on the device attributes;

[0068] A first generating unit is used to determine the candidate execution tasks corresponding to the target network port according to the data characteristics, classify the candidate execution tasks, and determine the detection sub-data characteristics according to the classification results;

[0069] The second generating unit is used to generate a plurality of detection sub-data based on the detection sub-data characteristics, and generate a detection data packet in combination with the communication protocol corresponding to the target network port.

[0070] In this embodiment, the device attribute refers to the type of terminal device connected to the target network port access network.

[0071] In this embodiment, the candidate execution task refers to an operation completed by a terminal device connected to the target network port access network through the target network port.

[0072] In this embodiment, detecting sub-data features refers to detecting data features of sub-data in a data packet.

[0073] In this embodiment, the detection sub-data refers to a detection data packet containing multiple types of data, and any complete data is a sub-data.

[0074] The beneficial effects of the above embodiments are as follows: the present invention determines the data characteristics of multiple detection sub-data respectively for the candidate execution task types of the terminal device connected to the target network port access network, generates detection sub-data according to the corresponding data characteristics of each detection sub-data, ensures that the detection sub-data meets the detection data standard and has the data characteristics of the target network port itself, and provides a basis for comprehensive detection of the target network port.

[0075] Embodiment 4:

[0076] On the basis of Example 3, the first generating unit in the network port detection system based on record authorization includes:

[0077] A task confirmation unit, used to confirm the data type of the data transmitted by the target network port according to the data characteristics, and determine all candidate execution tasks of the target network port according to the type;

[0078] A relationship judgment unit, used to determine the execution relationship between the candidate execution tasks based on the task execution rules, calculate the task correlation between each candidate execution task, and determine the task correlation relationship;

[0079] The feature acquisition unit is used to establish a task association chain according to the task association relationship, obtain multiple task association chains, use the task data corresponding to the primary tasks and the highest-level tasks of the multiple task association chains as the target task data, and obtain the data features of the target task data as the corresponding detection sub-data features.

[0080] In this embodiment, the task execution relationship refers to the execution relationship between the candidate tasks during the execution process.

[0081] In this embodiment, the task execution rules refer to the steps to be completed for each candidate execution task. For example, the candidate task can only be executed after certain prerequisite tasks are completed. For example, when clock timing is used, clock initialization must be completed before timing can be performed. Clock initialization is a prerequisite task.

[0082] In this embodiment, the task correlation refers to the degree of dependence between candidate execution tasks.

[0083] In this embodiment, the task association chain refers to a task completion relationship chain constructed by multiple candidate execution tasks, that is, the same high-level task contains multiple candidate execution tasks, and the same candidate execution task can be in multiple task relationship chains.

[0084] In this embodiment, the primary task refers to the first preceding task in the process of completing the candidate execution task, and the highest-level task refers to the final task in the process of completing the candidate task.

[0085] In this embodiment, task data refers to data that needs to be sent to the target network port to complete a candidate execution task.

[0086] In this embodiment, the target task data refers to the task data corresponding to the primary task and the highest-level task in the task association chain.

[0087] The beneficial effects of the above embodiments: the present invention determines the correlation between each candidate execution task by the task correlation between all candidate execution tasks corresponding to the target network port, thereby obtaining multiple task correlation chains, thereby determining the data characteristics of multiple detection sub-data, while ensuring that the data in the detection data packet can cover all types of transmission data of the target network port, redundant data is deleted based on the task relationship chain, and the data in the detection data packet is streamlined in advance to avoid the detection data packet being too large to bring operating pressure to the system.

[0088] Embodiment 5:

[0089] Based on Embodiment 4, the relationship determination unit includes:

[0090] A computing unit, used to determine the subtasks included in each candidate execution task according to the task execution rule, and obtain a task decomposition set;

[0091] Based on the task decomposition set, calculate the dependency between candidate execution tasks:

[0092]

[0093] Among them, ρ x,y Indicates the degree of dependency between the xth candidate execution task and the yth candidate execution task; a x,y Indicates the number of repeated subtasks between the xth candidate execution task and the yth candidate execution task; a x Indicates the number of subtasks contained in the xth candidate execution task; a y A represents the number of subtasks contained in the yth candidate execution task; x A represents the task decomposition set corresponding to the xth candidate execution task; y A represents the task decomposition set corresponding to the yth candidate execution task; x ∩A y represents the intersection of the task decomposition set corresponding to the xth candidate execution task and the task decomposition set corresponding to the yth candidate execution task; represents the empty set;

[0094] According to the dependency degree between the candidate execution tasks, the task correlation between the candidate execution tasks is calculated:

[0095]

[0096] Among them, ω x,y represents the task correlation between the xth candidate execution task and the yth candidate execution task; β x represents the execution probability of the xth candidate execution task among all candidate execution tasks; β y represents the execution probability of the yth candidate execution task among all candidate execution tasks;

[0097] an association confirmation unit, configured to determine that two candidate execution tasks are associated when the task association degree is greater than a preset value;

[0098] Otherwise, it is determined that the two candidate execution tasks are unrelated.

[0099] The beneficial effects of the above embodiments are as follows: the present invention determines the correlation between each candidate execution task by the task correlation between all candidate execution tasks corresponding to the target network port, while ensuring that the data in the detection data packet can cover all types of transmission data of the target network port, and at the same time, deletes redundant data based on the task relationship chain, thereby pre-simplifying the data in the detection data packet.

[0100] Embodiment 6:

[0101] On the basis of Example 3, the second generation unit in the network port detection system based on record authorization includes:

[0102] A primary generation unit, used to generate a plurality of detection sub-data according to the detection sub-data characteristics and detection data preset rules;

[0103] The arranging and compressing unit is used to arrange the multiple detection sub-data to generate a data sequence, and generate a detection sub-data identification code according to the order of the data sequence to obtain an identification list, and at the same time, compress the data sequence to generate a detection data packet;

[0104] The data storage unit is used to generate a data call identifier according to the target network port, add the data call identifier to the detection data packet, and then send it to the storage module for storage.

[0105] In this embodiment, the preset rule for detection data refers to a detection data generation rule set in advance to ensure that the detection data complies with the communication rule of the target network port.

[0106] In this embodiment, the data sequence refers to numbering and sorting a plurality of detection data according to the execution order of the detection sub-data, so as to ensure that after the detection data packet is placed at the target network port, the corresponding detection response sub-data can be executed in order.

[0107] In this embodiment, the detection sub-data identification code refers to the identification mark carried on the detection sub-data, which is used for matching with the security judgment module data.

[0108] In this embodiment, the identification list refers to a list used to store data identifiers corresponding to various detection sub-data.

[0109] In this embodiment, the data call identifier refers to an identification identifier including the identity of the target network port, which facilitates the data call of the candidate non-periodic detection.

[0110] The beneficial effects of the above embodiments are as follows: the present invention generates multiple detection sub-data according to the detection sub-data characteristics and the detection data preset rules, ensures that the detection sub-data conforms to the communication rules of the target network port, and ensures the validity of the detection sub-data; organizes the multiple detection sub-data to generate a data sequence, and generates a detection sub-data identification code according to the data sequence order to obtain an identification list, which is convenient for processing the data of the security judgment module, compresses the data sequence to generate a detection data packet, generates a data call identifier according to the target network port, adds the data call identifier to the detection data packet, and sends it to the storage module for storage, thereby providing a data basis for non-periodic detection of the target network port.

[0111] Embodiment 7:

[0112] On the basis of Example 6, the detection module in the network port detection system based on record authorization further includes:

[0113] The non-periodic detection submodule is used to obtain the detection data packet corresponding to the target network port based on the data call identifier when the total transmission data flow of the target network port in the current stage is greater than the preset value and has not reached the preset detection period, and send the detection data packet to the target network port to perform non-periodic detection on the target network port.

[0114] The beneficial effects of the above embodiments are as follows: when the total transmission data flow of the target network port at the current stage is greater than a preset value and has not reached a preset detection period, the present invention obtains a detection data packet corresponding to the target network port based on a data call identifier, and sends the detection data packet to the target network port, performs non-periodic detection on the target network port, ensures port security during frequent use of the target network port, effectively improves the degree of user information protection, and improves network security.

[0115] Embodiment 8:

[0116] On the basis of Example 1, the detection module in the network port detection system based on filing authorization further includes:

[0117] The passive detection submodule is used to obtain the fingerprint information of the regular data packets received by the target network port, and based on the fingerprint information, detect the regular data content to determine whether the regular new data is safe data;

[0118] If it is safe data, regular data is allowed to continue to execute;

[0119] Otherwise, enable the firewall to block the normal return data.

[0120] In this embodiment, regular data refers to all data that can be received by the target network port.

[0121] In this embodiment, the safe data refers to regular data received by the target network port in which no abnormality is detected.

[0122] The beneficial effects of the above embodiments are as follows: the present invention performs real-time monitoring on the data received by the target network port to ensure the security of the data transmitted by the target network port.

[0123] Embodiment 9:

[0124] On the basis of Example 1, the security determination module in the network port detection system based on record authorization is as follows: Figure 3 As shown, including:

[0125] A data matching submodule is used to obtain a data identification code corresponding to each detection response sub-data in the detection response data packet, match each detection response sub-data with the detection sub-data according to the identification list, and obtain the predicted response sub-data corresponding to the detection response sub-data according to the matching result;

[0126] The detection diagnosis submodule is used to compare each detection response sub-data with its corresponding predicted response data. When it is determined that there is an abnormality in the detection response sub-data, it is determined that there is a security problem in the target network port.

[0127] In this embodiment, the data identification code corresponding to the detection response sub-data refers to the data identification code of the detection response sub-data that is generated according to the data identification code on the corresponding detection sub-data and is the same as the data identification code of the detection sub-data.

[0128] In this embodiment, the predicted response sub-data refers to the detection response sub-data of each detection sub-data predicted by the system according to the detection data packet after the detection data packet is sent.

[0129] The beneficial effects of the above embodiments: the present invention obtains the data identification code corresponding to each detection response sub-data in the detection response data packet, matches each detection response sub-data with the detection sub-data according to the identification list, and obtains the predicted response sub-data corresponding to the detection response sub-data according to the matching result, which facilitates the detection diagnosis sub-module to compare the data, and is conducive to quickly determining whether there is abnormal data in the detection response packet, thereby judging whether there is a security problem or network security risk on the target port.

[0130] Embodiment 10:

[0131] On the basis of Example 9, the detection diagnosis submodule in the network port detection system based on record authorization includes:

[0132] A data cutting unit, used for obtaining the logical relationship between the codes corresponding to the prediction response sub-data, and determining the data segmentation method of the prediction response sub-data based on the logical relationship;

[0133] Segmenting the predicted response data based on the data segmentation method to obtain a plurality of first sub-data sets and a plurality of first judgment nodes;

[0134] At the same time, based on the data segmentation method, the multiple detection response sub-data are segmented respectively to obtain multiple second data fragments and second judgment nodes.

[0135] In this embodiment, the logical relationship refers to the internal logical relationship of the prediction response sub-data.

[0136] In this embodiment, the first sub-data set refers to a set constructed by dividing the same prediction response sub-data into multiple data segments and used to store these data segments, and one prediction response sub-data corresponds to one first sub-data set; the second sub-data set refers to a set constructed by dividing the same detection response sub-data into multiple data segments and used to store these data segments, and one detection response sub-data corresponds to one first sub-data set.

[0137] In this embodiment, the first judgment node refers to the data segmentation point when the prediction response sub-data is divided into multiple data segments; the second judgment node refers to the data segmentation point when the detection response sub-data is divided into multiple data segments.

[0138] The beneficial effects of the above embodiments are as follows: the present invention obtains the logical relationship between the corresponding codes of the prediction response sub-data, and determines the data segmentation method of the prediction response sub-data based on the logical relationship; the prediction response data is segmented based on the data segmentation method to obtain multiple first sub-data sets and multiple first judgment nodes; at the same time, based on the data segmentation method, the multiple detection response sub-data are segmented respectively to obtain multiple second data fragments and second judgment nodes, which provides two different comparison data for subsequent data comparison, which is beneficial to improving the accuracy of the detection results.

[0139] Embodiment 11:

[0140] Based on Example 9, the detection and diagnosis submodule further includes:

[0141] A first comparison unit is used to obtain a second position feature corresponding to the second judgment node and a first position feature corresponding to the first judgment node, and when the first position feature is inconsistent with the second position feature, it is determined that the detection response sub-data is abnormal and the target network port has a security problem;

[0142] The second comparison unit is used to obtain the first data segment and the second data segment for matching and comparison when the first position feature is consistent with the second position feature, to determine whether there are abnormal characters, and if there are no abnormal characters, determine that the target network port is safe; otherwise, determine that the target network port has a security problem.

[0143] In this embodiment, the first position feature refers to the data code properties of the first judgment node before and after the position of the corresponding predicted response sub-data and its segmentation position.

[0144] In this embodiment, the second position feature refers to the data code properties of the second judgment node before and after the position of the corresponding detection response sub-data and its segmentation position.

[0145] In this embodiment, the first data segment refers to a data segment obtained by segmenting the predicted response sub-data.

[0146] In this embodiment, the second data segment refers to a data segment obtained by segmenting the detection response sub-data.

[0147] In this embodiment, the abnormal character refers to a data code in the second data segment that is different from that in the first data segment.

[0148] The beneficial effects of the above embodiments: The present invention compares and determines whether the detection data response data packet of the target network port contains abnormal data from two aspects: the judgment node and the code content in the data segment, so as to determine whether there is a security problem with the target port, improves the accuracy of the detection result, avoids the data omission problem that may occur in unilateral judgment, and effectively improves the system fault tolerance.

[0149] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A network port detection system based on filing authorization, characterized in that: include: A detection module, used to generate a detection data packet based on the network topology information of the target network port accessing the network, and send the detection data packet to the target network port according to a preset period; A response receiving module, used for receiving a detection response data packet corresponding to the detection data packet; A security determination module is used to determine whether there is a security problem on the target network port based on the detection response data packet; The detection module includes: The information acquisition submodule is used to obtain the network topology information of the target network port accessing the network; The data generation submodule is used to obtain the data characteristics of the transmission data of the target network port based on the network topology information, and determine the task attributes of the target network port according to the data characteristics, and generate a detection data packet; The detection initiating submodule is used to send detection data packets to the target network port according to a preset period; Among them, the data generation submodule includes: A feature acquisition unit, used to acquire network topology information of a network to which a target network port is connected, determine attributes of a device connected to the target network port, and determine data features of data transmitted by the target network port based on the device attributes; A first generating unit is used to determine the candidate execution tasks corresponding to the target network port according to the data characteristics, classify the candidate execution tasks, and determine the detection sub-data characteristics according to the classification results; A second generating unit is used to generate a plurality of detection sub-data based on the detection sub-data characteristics, and generate a detection data packet in combination with the communication protocol corresponding to the target network port; The first generation unit includes A task confirmation unit, used to confirm the data type of the data transmitted by the target network port according to the data characteristics, and determine all candidate execution tasks of the target network port according to the type; A relationship judgment unit, used to determine the execution relationship between the candidate execution tasks based on the task execution rules, calculate the task correlation between each candidate execution task, and determine the task correlation relationship; A feature acquisition unit is used to establish a task association chain according to the task association relationship, obtain multiple task association chains, use the task data corresponding to the primary tasks and the highest-level tasks of the multiple task association chains as target task data, and obtain data features of the target task data as corresponding detection sub-data features; The relationship judgment unit includes: A computing unit, used to determine the subtasks included in each candidate execution task according to the task execution rule, and obtain a task decomposition set; Based on the task decomposition set, calculate the dependency between candidate execution tasks: in, Indicates the degree of dependency between the xth candidate execution task and the yth candidate execution task; Indicates the number of repeated subtasks between the xth candidate execution task and the yth candidate execution task; Indicates the number of subtasks contained in the xth candidate execution task; Indicates the number of subtasks contained in the yth candidate execution task; represents the task decomposition set corresponding to the xth candidate execution task; represents the task decomposition set corresponding to the yth candidate execution task; represents the intersection of the task decomposition set corresponding to the xth candidate execution task and the task decomposition set corresponding to the yth candidate execution task; ∅ represents an empty set; According to the dependency degree between the candidate execution tasks, the task correlation between the candidate execution tasks is calculated: in, represents the task correlation between the xth candidate execution task and the yth candidate execution task; represents the execution probability of the xth candidate execution task among all candidate execution tasks; represents the execution probability of the yth candidate execution task among all candidate execution tasks; an association confirmation unit, configured to determine that two candidate execution tasks are associated when the task association degree is greater than a preset value; Otherwise, it is determined that the two candidate execution tasks are not related; Wherein, the second generation unit includes: A primary generation unit, used to generate a plurality of detection sub-data according to the detection sub-data characteristics and detection data preset rules; The arranging and compressing unit is used to arrange the multiple detection sub-data to generate a data sequence, and generate a detection sub-data identification code according to the order of the data sequence to obtain an identification list, and at the same time, compress the data sequence to generate a detection data packet; The data storage unit is used to generate a data call identifier according to the target network port, add the data call identifier to the detection data packet, and then send it to the storage module for storage.

2. A network port detection system based on filing authorization according to claim 1, characterized in that: The detection module also includes: The non-periodic detection submodule is used to obtain the detection data packet corresponding to the target network port based on the data call identifier when the total transmission data flow of the target network port in the current stage is greater than the preset value and has not reached the preset detection period, and send the detection data packet to the target network port to perform non-periodic detection on the target network port.

3. A network port detection system based on filing authorization according to claim 1, characterized in that: Detection module, including: The passive detection submodule is used to obtain the fingerprint information of the regular data packets received by the target network port, and based on the fingerprint information, detect the regular data content to determine whether the regular new data is safe data; If it is safe data, regular data is allowed to continue to execute; Otherwise, open the firewall to block regular data.

4. A network port detection system based on filing authorization according to claim 1, characterized in that: The safety determination module includes: A data matching submodule is used to obtain a detection sub-data identification code corresponding to each detection response sub-data in the detection response data packet, match each detection response sub-data with the detection sub-data according to the identification list, and obtain the predicted response sub-data corresponding to the detection response sub-data according to the matching result; The detection diagnosis submodule is used to compare each detection response sub-data with its corresponding prediction response sub-data, and when it is determined that there is an abnormality in the detection response sub-data, it is determined that there is a security problem in the target network port.

5. A network port detection system based on filing authorization according to claim 4, characterized in that: Detection and diagnosis submodule, including: A data cutting unit, used for obtaining the logical relationship between the codes corresponding to the prediction response sub-data, and determining the data segmentation method of the prediction response sub-data based on the logical relationship; Segmenting the predicted response sub-data based on the data segmentation method to obtain a plurality of first sub-data sets and a plurality of first judgment nodes; At the same time, based on the data segmentation method, the multiple detection response sub-data are segmented respectively to obtain multiple second data fragments and second judgment nodes.

6. A network port detection system based on filing authorization according to claim 5, characterized in that: The detection and diagnosis submodule also includes: A first comparison unit is used to obtain a second position feature corresponding to the second judgment node and a first position feature corresponding to the first judgment node, and when the first position feature is inconsistent with the second position feature, it is determined that the detection response sub-data is abnormal and the target network port has a security problem; A second comparison unit is used for obtaining and comparing the first data segment with the second data segment when the first position feature is consistent with the second position feature, and determining whether there are abnormal characters. If there are no abnormal characters, it is determined that the target network port is safe; otherwise, it is determined that there is a security problem with the target network port; The first data segment refers to the data segment obtained by segmenting the predicted response sub-data.

Images