Network traffic backtracing and analysis method and system

Abstract

The present invention provides a network traffic backtracing and analysis method and system. The method collects the traffic of network devices in real time, associates it from the time and space dimensions, splits it into data segments, searches for possible anomalies, and then determines the anomalies through identity authentication to obtain possible attack trajectories. The source of the attack is traced back, and a source point relationship model is established to achieve model-based continuous monitoring of the source point. This overcomes the shortcomings of existing traffic backtracing, such as low detection rate, inaccurate security event monitoring, and difficulty in handling large traffic flows.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network traffic backtracing and analysis method and system. Background Art

[0002] The existing network security traffic analysis market faces challenges in traffic backtracking, such as low detection rates and inaccurate security incident monitoring. Furthermore, existing network traffic volumes are generally high, making existing detection and analysis systems inadequate for comprehensive detection of traffic anomalies.

[0003] Therefore, there is an urgent need for a targeted network traffic backtracking and analysis method and system. Summary of the Invention

[0004] The purpose of the present invention is to provide a network traffic backtracking and analysis method and system to solve the problems of low detection rate of existing traffic backtracking, inaccurate security event monitoring, and difficulty in handling large traffic.

[0005] In a first aspect, the present application provides a network traffic backtracking and analysis method, the method comprising:

[0006] Collect traffic from various network devices in real time, and perform in-depth data correlation on the collected traffic from two dimensions: time series and spatial connection;

[0007] Splitting the data-associated traffic into a plurality of data segments, storing the data segments on a server, analyzing the data segments using a logical analysis model, finding possible abnormal data segments therein, marking network devices to which the abnormal data segments belong as abnormal points, and analyzing whether there is a logical association between the abnormal data segments;

[0008] Initiate an identity authentication request to the abnormal point, wherein the identity authentication request carries the public key, user identity information and device identification of the server and the adjacent network device respectively;

[0009] The outlier receives the identity authentication request and queries the database based on the device identification to determine whether the server and the adjacent network device are legitimate. If the judgment result is legitimate, the outlier returns the plaintext message and the encryption certificate of the plaintext message using the outlier's private key to the server to verify itself. If the verification is successful, the outlier removes the abnormal mark, otherwise it retains the abnormal mark.

[0010] Connect the abnormal points with logical associations to obtain possible attack trajectories;

[0011] According to the possible attack trajectory, the attack source information and the corresponding recorded network behavior are obtained, characteristic attributes are extracted therefrom, and a source point relationship model is established;

[0012] The source point relationship model includes the business, users and corresponding weight values involved in the source point, regularly collects the business information, user identity and operation of the source point, and trains the source point relationship model according to the set weight values;

[0013] Acquire new businesses or new users logging into the source point, continuously monitor the business trends or user operations of the source point, input the source point relationship model, and determine whether the business trends or user operations will trigger an exception;

[0014] Upload the above judgment results to the server.

[0015] In a second aspect, the present application provides a network traffic backtracking and analysis system, the system comprising:

[0016] The collection unit is used to collect the traffic of various network devices in real time and perform in-depth data correlation on the collected traffic from the two dimensions of time series and spatial connection;

[0017] an analysis unit, configured to split the traffic after data association into a plurality of data segments, store the data segments on a server, analyze the data segments using a logical analysis model, find possible abnormal data segments therein, mark the network devices to which the abnormal data segments belong as abnormal points, and analyze whether there is a logical association between the abnormal data segments;

[0018] a verification unit, configured to initiate an identity authentication request to the abnormal point, wherein the identity authentication request carries the public key, user identity information, and device identification of each of the server and the adjacent network device; upon receiving the identity authentication request, the abnormal point queries a database based on the device identification to determine whether the server and the adjacent network device are legitimate; if the judgment result is legitimate, the abnormal point returns a plaintext message and a certificate for encrypting the plaintext message using the abnormal point's private key to the server to verify itself; if the verification is successful, the abnormal point removes the abnormal mark; otherwise, the abnormal mark is retained;

[0019] A model building unit is used to connect logically related anomaly points to obtain possible attack trajectories; based on the possible attack trajectories, obtain the source point information of the attack and the corresponding recorded network behavior, extract characteristic attributes from them, and establish a source point relationship model;

[0020] The source point relationship model includes the business, users and corresponding weight values involved in the source point, regularly collects the business information, user identity and operation of the source point, and trains the source point relationship model according to the set weight values;

[0021] The monitoring unit is used to obtain new businesses or new users logging into the source point, continuously monitor the business trends or user operations of the source point, input the source point relationship model, and determine whether the business trends or user operations will trigger an exception; and upload the results of the above judgment to the server.

[0022] In a third aspect, the present application provides a network traffic backtracking and analysis system, the system comprising a processor and a memory:

[0023] The memory is used to store program code and transmit the program code to the processor;

[0024] The processor is configured to execute any one of the four possible methods of the first aspect according to instructions in the program code.

[0025] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store program code, and the program code is used to execute any one of the four possible methods in the first aspect.

[0026] Beneficial effects

[0027] The present invention provides a network traffic backtracing and analysis method and system. The method collects the traffic of network devices in real time, associates it from the time and space dimensions, splits it into data segments, searches for possible anomalies, and then determines the anomalies through identity authentication to obtain possible attack trajectories. The source of the attack is traced back, and a source point relationship model is established to achieve model-based continuous monitoring of the source point. This overcomes the shortcomings of existing traffic backtracing, such as low detection rate, inaccurate security event monitoring, and difficulty in handling large traffic flows. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0029] Figure 1 A general flow chart of the network traffic backtracking and analysis method of the present invention;

[0030] Figure 2 This is an architectural diagram of the network traffic backtracing and analysis system of the present invention. DETAILED DESCRIPTION

[0031] The preferred embodiments of the present invention are described in detail below with reference to the accompanying drawings so that the advantages and features of the present invention can be more easily understood by those skilled in the art, thereby making a clearer and more precise definition of the protection scope of the present invention.

[0032] Figure 1 This is a general flow chart of the network traffic backtracking and analysis method provided in this application, which includes:

[0033] Collect traffic from various network devices in real time, and perform in-depth data correlation on the collected traffic from two dimensions: time series and spatial connection;

[0034] Splitting the data-associated traffic into a plurality of data segments, storing the data segments on a server, analyzing the data segments using a logical analysis model, finding possible abnormal data segments therein, marking network devices to which the abnormal data segments belong as abnormal points, and analyzing whether there is a logical association between the abnormal data segments;

[0035] Initiate an identity authentication request to the abnormal point, wherein the identity authentication request carries the public key, user identity information and device identification of the server and the adjacent network device respectively;

[0036] The outlier receives the identity authentication request and queries the database based on the device identification to determine whether the server and the adjacent network device are legitimate. If the judgment result is legitimate, the outlier returns the plaintext message and the encryption certificate of the plaintext message using the outlier's private key to the server to verify itself. If the verification is successful, the outlier removes the abnormal mark, otherwise it retains the abnormal mark.

[0037] The encryption algorithm includes any one of DES, MD5, and AES.

[0038] The certificate is hashed.

[0039] Connect logically related anomaly points to obtain possible attack trajectories;

[0040] According to the possible attack trajectory, the attack source information and the corresponding recorded network behavior are obtained, characteristic attributes are extracted therefrom, and a source point relationship model is established;

[0041] The source point relationship model includes the business, users and corresponding weight values involved in the source point, regularly collects the business information, user identity and operation of the source point, and trains the source point relationship model according to the set weight values;

[0042] Acquire new businesses or new users logging into the source point, continuously monitor the business trends or user operations of the source point, input the source point relationship model, and determine whether the business trends or user operations will trigger an exception;

[0043] Upload the above judgment results to the server.

[0044] In some preferred embodiments, when it is determined that the business trend or user operation will trigger an exception, the business or user is marked and all access behaviors of the business or user are denied.

[0045] In some preferred embodiments, before initiating an identity authentication request to the abnormal point, the process includes: filtering network devices corresponding to the abnormal point based on a whitelist constructed based on popularity and security personnel tag data, and excluding obviously trustworthy network devices.

[0046] In some preferred embodiments, the deep data association includes: performing deep data association on the collected traffic from two dimensions: time series and spatial connection, establishing a rule base, comparing the source point information of the suspected attack with the information in the rule base, and constructing a traceability graph through propagation query and tracing query.

[0047] Figure 2 This is an architectural diagram of the network traffic backtracking and analysis system provided in this application, which includes:

[0048] The collection unit is used to collect the traffic of various network devices in real time and perform in-depth data correlation on the collected traffic from the two dimensions of time series and spatial connection;

[0049] an analysis unit, configured to split the traffic after data association into a plurality of data segments, store the data segments on a server, analyze the data segments using a logical analysis model, find possible abnormal data segments therein, mark the network devices to which the abnormal data segments belong as abnormal points, and analyze whether there is a logical association between the abnormal data segments;

[0050] a verification unit, configured to initiate an identity authentication request to the abnormal point, wherein the identity authentication request carries the public key, user identity information, and device identification of each of the server and the adjacent network device; upon receiving the identity authentication request, the abnormal point queries a database based on the device identification to determine whether the server and the adjacent network device are legitimate; if the judgment result is legitimate, the abnormal point returns a plaintext message and a certificate for encrypting the plaintext message using the abnormal point's private key to the server to verify itself; if the verification is successful, the abnormal point removes the abnormal mark; otherwise, the abnormal mark is retained;

[0051] A model building unit is used to connect logically related anomaly points to obtain possible attack trajectories; based on the possible attack trajectories, obtain the source point information of the attack and the corresponding recorded network behavior, extract characteristic attributes from them, and establish a source point relationship model;

[0052] The source point relationship model includes the business, users and corresponding weight values involved in the source point, regularly collects the business information, user identity and operation of the source point, and trains the source point relationship model according to the set weight values;

[0053] The monitoring unit is used to obtain new businesses or new users logging into the source point, continuously monitor the business trends or user operations of the source point, input the source point relationship model, and determine whether the business trends or user operations will trigger an exception; and upload the results of the above judgment to the server.

[0054] The present application provides a network traffic backtracking and analysis system, the system comprising: the system comprising a processor and a memory:

[0055] The memory is used to store program code and transmit the program code to the processor;

[0056] The processor is configured to execute the method described in any one of all embodiments of the first aspect according to instructions in the program code.

[0057] The present application provides a computer-readable storage medium, which is used to store program code, and the program code is used to execute the method described in any one of the embodiments of the first aspect.

[0058] In a specific implementation, the present invention further provides a computer storage medium, wherein the computer storage medium may store a program that, when executed, may include some or all of the steps of various embodiments of the present invention. The storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0059] Those skilled in the art will clearly understand that the technology in the embodiments of the present invention can be implemented by means of software plus the necessary general-purpose hardware platform. Based on this understanding, the technical solutions in the embodiments of the present invention, or the portion that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a storage medium such as ROM / RAM, a magnetic disk, or an optical disk, and includes a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments of the present invention or certain portions of the embodiments.

[0060] In particular, for the embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the description in the method embodiments.

[0061] The above-described embodiments of the present invention do not limit the protection scope of the present invention.

Claims

1. A network traffic backtracking and analysis method, characterized in that: The method comprises: Collect traffic from various network devices in real time, and perform in-depth data correlation on the collected traffic from two dimensions: time series and spatial connection; Splitting the data-associated traffic into a plurality of data segments, storing the data segments on a server, analyzing the data segments using a logical analysis model, finding possible abnormal data segments therein, marking network devices to which the abnormal data segments belong as abnormal points, and analyzing whether there is a logical association between the abnormal data segments; Initiate an identity authentication request to the abnormal point, wherein the identity authentication request carries the public key, user identity information and device identification of the server and the adjacent network device respectively; The outlier receives the identity authentication request and queries the database based on the device identification to determine whether the server and the adjacent network device are legitimate. If the judgment result is legitimate, the outlier returns the plaintext message and the encryption certificate of the plaintext message using the outlier's private key to the server to verify itself. If the verification is successful, the outlier removes the abnormal mark, otherwise it retains the abnormal mark. Connect logically related anomaly points to obtain possible attack trajectories; According to the possible attack trajectory, the attack source information and the corresponding recorded network behavior are obtained, characteristic attributes are extracted therefrom, and a source point relationship model is established; The source point relationship model includes the business, users and corresponding weight values involved in the source point, regularly collects the business information, user identity and operation of the source point, and trains the source point relationship model according to the set weight values; Acquire new businesses or new users logging into the source point, continuously monitor the business trends or user operations of the source point, input the source point relationship model, and determine whether the business trends or user operations will trigger an exception; Upload the above judgment results to the server.

2. The method according to claim 1, wherein: When it is determined that the business trend or user operation will trigger an exception, the business or user is marked and all access behaviors of the business or user are denied.

3. The method according to claim 1, wherein: Before initiating the identity authentication request to the abnormal point, the method includes: filtering the network devices corresponding to the abnormal point based on the white list constructed based on popularity and security personnel marking data, and excluding obviously trustworthy network devices.

4. The method according to any one of claims 2 or 3, characterized in that: The deep data association includes: performing deep data association on the collected traffic from two dimensions: time series and spatial connection, establishing a rule base, comparing the source point information of the suspected attack with the information in the rule base, and constructing a traceability graph through propagation query and tracing query.

5. A network traffic backtracking and analysis system, characterized in that: The system comprises: The collection unit is used to collect the traffic of various network devices in real time and perform in-depth data correlation on the collected traffic from the two dimensions of time series and spatial connection; an analysis unit, configured to split the traffic after data association into a plurality of data segments, store the data segments on a server, analyze the data segments using a logical analysis model, find possible abnormal data segments therein, mark the network devices to which the abnormal data segments belong as abnormal points, and analyze whether there is a logical association between the abnormal data segments; a verification unit, configured to initiate an identity authentication request to the abnormal point, wherein the identity authentication request carries the public key, user identity information, and device identification of each of the server and the adjacent network device; upon receiving the identity authentication request, the abnormal point queries a database based on the device identification to determine whether the server and the adjacent network device are legitimate; if the judgment result is legitimate, the abnormal point returns a plaintext message and a certificate for encrypting the plaintext message using the abnormal point's private key to the server to verify itself; if the verification is successful, the abnormal point removes the abnormal mark; otherwise, the abnormal mark is retained; A model building unit is used to connect logically related anomaly points to obtain possible attack trajectories; based on the possible attack trajectories, obtain the source point information of the attack and the corresponding recorded network behavior, extract characteristic attributes from them, and establish a source point relationship model; The source point relationship model includes the business, users and corresponding weight values involved in the source point, regularly collects the business information, user identity and operation of the source point, and trains the source point relationship model according to the set weight values; The monitoring unit is used to obtain new businesses or new users logging into the source point, continuously monitor the business trends or user operations of the source point, input the source point relationship model, and determine whether the business trends or user operations will trigger an exception; and upload the results of the above judgment to the server.

6. A network traffic backtracking and analysis system, characterized in that: The system includes a processor and a memory: The memory is used to store program code and transmit the program code to the processor; The processor is configured to implement the method according to any one of claims 1 to 4 according to the instructions in the program code.

7. A computer-readable storage medium, characterized in that The computer-readable storage medium is used to store program code, and the program code is used to execute the method according to any one of claims 1 to 4.

Images