An Internet data fault safety monitoring system

Abstract

The present invention discloses an Internet data fault safety monitoring system, which relates to the field of network security technology and includes a network monitoring module, a network processor, and an early warning module. The network monitoring module is used to monitor the data network and transmit a signal to the network processor after monitoring. The network processor determines whether the data is faulty and performs security protection on the data. The network processor then transmits the information to the early warning module, which is used to issue an early warning signal to alert the user. The Internet data fault safety monitoring system, by establishing a detailed rule base, constantly analyzes and compares the network data status with the established rule base, thereby being able to determine whether the network has a fault, achieving accurate monitoring work, and when a network fault occurs, being able to promptly issue an early warning signal so that the user is aware of it immediately. At the same time, the system can also protect the network data, prevent data loss, and reduce economic losses.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to an Internet data fault safety monitoring system. Background Art

[0002] With the advent of the digital information age, using the internet to communicate has become an integral part of our lives. The internet's inherent openness, interactivity, and decentralization satisfy people's needs for information sharing, openness, flexibility, and speed.

[0003] As a result, with the rapid development and widespread application of network technology, the scale of the network continues to expand, and the network will often face the problem of network failure. When a network failure occurs, it will cause certain losses. Although the network currently has fault safety monitoring devices, there are still some loopholes in its monitoring, and some special faults cannot be detected. Summary of the Invention

[0004] In view of the shortcomings of the existing technology, the present invention provides an Internet data fault safety monitoring system, which solves the problem that traditional network fault monitoring devices still have certain loopholes and are not perfect in monitoring.

[0005] To achieve the above objectives, the present invention is implemented through the following technical solutions: an Internet data fault safety monitoring system, comprising a network monitoring module, a network processor, and an early warning module. The network monitoring module is used to monitor the data network and transmit the signal to the network processor after monitoring. The network processor determines whether there is a fault in the data and protects the data. The information is then transmitted to the early warning module, which is used to issue an early warning signal to alert the user.

[0006] As a further solution of the present invention: when the network monitoring module monitors, the user first sets the system to start the monitoring system, and the startup method is divided into the following four steps:

[0007] S1. Obtain a network device, turn it on, set the network card to promiscuous mode, and start a capture thread to continuously receive and analyze data packets.

[0008] S2. Determine the data packets of the monitoring protocol by entering the filter string in the combo box of the dialog bar;

[0009] S3. Control the start and end of the listening thread through the menu or toolbar button;

[0010] S4. Create a separate thread for receiving data packets to improve the responsiveness of the interface.

[0011] As a further solution of the present invention: the data packets of the monitoring protocol include TCP data packets, UDP data packets and ICMP data packets;

[0012] As a further solution of the present invention, the network processor includes a rule establishment module, an analysis and comparison module, and a data processing module. The rule establishment module is used to create a fault rule base. When the network monitoring module monitors network information, the analysis and comparison module compares the information with the rule base to determine whether there is fault information in the network data. After the determination is made, the data processing module backs up and repairs the network data to ensure the security of the network data.

[0013] As a further solution of the present invention, the rule establishment module includes the following steps when establishing the rule base:

[0014] S1. Determine the domain and scope of the ontology;

[0015] S2, examine the possibility of reusing existing ontologies;

[0016] S3. List the set of important concepts in the ontology;

[0017] S4. Define classes and class hierarchies;

[0018] S5. Define the attribute set of the class;

[0019] S6. Define the value type and range of the attribute;

[0020] S7. Create an instance of the corresponding type;

[0021] As a further solution of the present invention, the analysis and comparison module includes the following steps when analyzing the comparison library:

[0022] S1. First, define an initial feature template, then extract the corresponding features in the feature template from the rule base, then train the named entity recognition model, use the trained model to recognize the data in the test set, and obtain the three indicators of recognition accuracy, recall rate and F value;

[0023] S2. Add new features to the initial template, and then train and test based on the divided training and test datasets to obtain recognition indicators, namely accuracy, recall, and F-value.

[0024] S3. Compare the F value before adding the new feature with the F value after adding the new feature. If the F value is improved after adding the new feature, the new feature is retained in the feature template; otherwise, the new feature is deleted from the feature template.

[0025] As a further solution of the present invention: when the data processing module repairs the data, it automatically deletes the intruded and useless data, automatically retrieves and sorts the lost and messy data, corrects the erroneous data, and then backs up and stores the data.

[0026] As a further solution of the present invention: the early warning module includes an information acquisition module, an information editing module and an information transmission module. The information acquisition module is used to obtain information data of monitored network faults, and then the network editing module automatically edits the early warning type signal according to the information type of the fault, and then issues a early warning signal.

[0027] As a further solution of the present invention: when the early warning module sends out an early warning signal, it is sent to the user's mobile phone terminal in the form of a text message, so that the user can realize the early warning work.

[0028] As a further solution of the present invention: the information editing module includes a modification function for the user to edit and modify the type of warning information.

[0029] Obtain a network device, open it, set the network card to promiscuous mode, and start a capture thread to continuously receive and analyze data packets. Enter a filter string in the combo box in the dialog bar to determine the data packets of the monitoring protocol. Use the menu or toolbar button to control the start and end of the monitoring thread. Create a separate thread for receiving data packets to improve the responsiveness of the interface.

[0030] The rule establishment module creates a fault rule base, determines the domain and scope of the ontology; examines the possibility of reusing the existing ontology; lists the set of important concepts in the ontology; defines classes and class hierarchies; defines the attribute set of the class; defines the value type and range of the attribute; creates instances corresponding to the corresponding types. When the network monitoring module monitors network information, the analysis and comparison module compares and analyzes the information with the rule base. First, an initial feature template is defined, and then the corresponding features in the feature template are extracted from the rule base. Then the named entity recognition model is trained, and the trained model is used to identify the data of the test set to obtain the three indicators of recognition accuracy, recall rate and F value; new features are added on the basis of the initial template, and then training and testing are performed based on the divided training data set and test data set to obtain the recognition indicators, namely accuracy, recall rate and F value Three indicator data; compare the F value before adding the new feature and the F value after adding the new feature. If the F value is improved after adding the new feature, the new feature will be retained in the feature template, otherwise the new feature will be deleted from the feature template. It is judged whether there is fault information in the network data. After the judgment, the data processing module backs up and repairs the network data to ensure the security of the network data. When the data processing module repairs the data, it automatically deletes the intrusion and useless data, automatically retrieves and sorts the lost and messy data, and corrects the erroneous data. After that, the data is backed up and stored. The information acquisition module obtains the information data of the monitored network fault, and then the network editing module automatically edits the warning type signal according to the fault information type, and then sends it to the user's mobile terminal via SMS to realize the warning work.

[0031] The present invention provides an Internet data fault safety monitoring system, which has the following advantages compared with the prior art:

[0032] The Internet data fault safety monitoring system establishes a detailed rule base and analyzes and compares the network data status with the established rule base at all times, so as to determine whether the network has a fault and realize accurate monitoring. When a network fault occurs, it can send out early warning signals in time so that users can know it at the first time. At the same time, it can also protect network data, prevent data loss, and reduce economic losses. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 It is a principle system diagram of the present invention;

[0034] Figure 2 This is a principle system diagram of the network processor of the present invention;

[0035] Figure 3 This is a principle system diagram of the early warning module of the present invention;

[0036] Figure 4 This is a schematic diagram of the principle flow of the rule establishment module of the present invention.

[0037] In the figure: 1. Network monitoring module; 2. Network processor; 3. Early warning module. DETAILED DESCRIPTION

[0038] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0039] See also Figure 1 The present invention provides a technical solution: an Internet data fault safety monitoring system, including a network monitoring module 1, a network processor 2 and an early warning module 3. The network monitoring module 1 is used to monitor the data network and transmit the signal to the network processor 2 after monitoring. The network processor 2 determines whether there is a fault in the data and protects the data at the same time. Then, the information is transmitted to the early warning module 3. The early warning module 3 is used to send an early warning signal to remind the user.

[0040] See also Figure 1 In the embodiment of the present invention, when the network monitoring module 1 monitors, the user first sets the system to start the monitoring system. The startup method is divided into the following four steps:

[0041] S1. Obtain a network device, turn it on, set the network card to promiscuous mode, and start a capture thread to continuously receive and analyze data packets.

[0042] S2. Determine the data packets of the monitoring protocol by entering the filter string in the combo box of the dialog bar;

[0043] S3. Control the start and end of the listening thread through the menu or toolbar button;

[0044] S4. Create a separate thread for receiving data packets to improve the responsiveness of the interface.

[0045] See also Figure 1 In the embodiment of the present invention, the data packets of the monitoring protocol include TCP data packets, UDP data packets and ICMP data packets.

[0046] See also Figure 2In the embodiment of the present invention, the network processor 2 includes a rule establishment module, an analysis and comparison module, and a data processing module. The rule establishment module is used to create a fault rule base. When the network monitoring module 1 monitors network information, the analysis and comparison module compares the information with the rule base to determine whether there is fault information in the network data. After the determination is made, the data processing module backs up and repairs the network data to ensure the security of the network data.

[0047] See also Figure 4 In the embodiment of the present invention, when the rule building module builds the rule base, the following steps are included:

[0048] S1. Determine the domain and scope of the ontology;

[0049] S2, examine the possibility of reusing existing ontologies;

[0050] S3. List the set of important concepts in the ontology;

[0051] S4. Define classes and class hierarchies;

[0052] S5. Define the attribute set of the class;

[0053] S6. Define the value type and range of the attribute;

[0054] S7. Create an instance of the corresponding type.

[0055] See also Figure 2 In the embodiment of the present invention, when analyzing the comparison library, the analysis and comparison module includes the following steps:

[0056] S1. First, define an initial feature template, then extract the corresponding features in the feature template from the rule base, then train the named entity recognition model, use the trained model to recognize the data in the test set, and obtain the three indicators of recognition accuracy, recall rate and F value;

[0057] S2. Add new features to the initial template, and then train and test based on the divided training and test datasets to obtain recognition indicators, namely accuracy, recall, and F-value.

[0058] S3. Compare the F value before adding the new feature with the F value after adding the new feature. If the F value is improved after adding the new feature, the new feature is retained in the feature template; otherwise, the new feature is deleted from the feature template.

[0059] See also Figure 2In the embodiment of the present invention, when the data processing module repairs the data, it automatically deletes the intruded and useless data, automatically retrieves and sorts the lost and messy data, corrects the erroneous data, and then backs up and stores the data.

[0060] See also Figure 3 In an embodiment of the present invention, the early warning module 3 includes an information acquisition module, an information editing module and an information transmission module. The information acquisition module is used to obtain information data of the monitored network fault, and then the network editing module automatically edits the early warning type signal according to the information type of the fault, and then issues a early warning signal.

[0061] See also Figure 3 In the embodiment of the present invention, when the early warning module 3 issues an early warning signal, it is sent to the user's mobile phone terminal via a text message, so that the early warning work can be realized.

[0062] See also Figure 3 In an embodiment of the present invention, the information editing module includes a modification function for users to edit and modify the type of warning information.

[0063] Working Principle: Get the network device, turn it on, set the network card to promiscuous mode, and start the capture thread to continuously receive and analyze data packets; enter the filter string in the combo box in the dialog bar to determine the data packets of the monitoring protocol; control the start and end of the monitoring thread through the menu or toolbar button; create a separate thread for receiving data packets to improve the responsiveness of the interface;

[0064] The rule establishment module creates a fault rule base, determines the domain and scope of the ontology; examines the possibility of reusing the existing ontology; lists the set of important concepts in the ontology; defines the class and class hierarchy; defines the attribute set of the class; defines the value type and range of the attribute; creates instances corresponding to the corresponding types. When the network monitoring module 1 monitors the network information, the analysis and comparison module compares and analyzes the information with the rule base. First, an initial feature template is defined, and then the corresponding features in the feature template are extracted from the rule base. Then, the named entity recognition model is trained and the trained model is used to identify the data of the test set to obtain the three indicators of recognition accuracy, recall rate and F value. New features are added on the basis of the initial template, and then training and testing are performed based on the divided training data set and test data set to obtain the recognition indicators, namely accuracy, recall rate and F value. The three indicator data are compared; the F value before adding the new feature is compared with the F value after adding the new feature. If the F value is improved after adding the new feature, the new feature will be retained in the feature template, otherwise the new feature will be deleted from the feature template. It is judged whether there is fault information in the network data. After the judgment, the data processing module backs up and repairs the network data to ensure the security of the network data. When the data processing module repairs the data, it automatically deletes the intrusion and useless data, automatically retrieves and sorts the lost and messy data, and corrects the wrong data. After that, the data is backed up and stored. The information acquisition module obtains the information data of the monitored network fault, and then the network editing module automatically edits the warning type signal according to the information type of the fault, and then sends it to the user's mobile terminal via SMS to realize the warning work.

[0065] Meanwhile, the contents not described in detail in this specification belong to the prior art known to those skilled in the art.

Claims

1. An Internet data fault safety monitoring system, comprising a network monitoring module (1), a network processor (2), and an early warning module (3), characterized in that: The network monitoring module (1) is used to monitor the data network, and after monitoring, transmits a signal to the network processor (2). The network processor (2) determines whether there is a fault in the data and performs security protection on the data. The information is then transmitted to the early warning module (3). The early warning module (3) is used to issue an early warning signal to remind the user. The network processor (2) includes a rule establishment module, an analysis and comparison module, and a data processing module. The rule establishment module is used to create a fault rule base. When the network monitoring module (1) monitors network information, the analysis and comparison module compares the information with the rule base to determine whether the network data contains fault information. After the determination is made, the data processing module backs up and repairs the network data to ensure the security of the network data. When establishing a rule base, the rule establishment module includes the following steps: S1. Determine the domain and scope of the ontology; S2, examine the possibility of reusing existing ontologies; S3. List the set of important concepts in the ontology; S4. Define classes and class hierarchies; S5. Define the attribute set of the class; S6. Define the value type and range of the attribute; S7. Create an instance of the corresponding type; When analyzing the comparison library, the analysis and comparison module includes the following steps: S1. First, define an initial feature template, then extract the corresponding features in the feature template from the rule base, then train the named entity recognition model, use the trained model to recognize the data in the test set, and obtain the three indicators of recognition accuracy, recall rate and F value; S2. Add new features to the initial template, and then train and test based on the divided training and test datasets to obtain recognition indicators, namely accuracy, recall, and F-value. S3. Compare the F value before adding the new feature with the F value after adding the new feature. If the F value is improved after adding the new feature, the new feature is retained in the feature template; otherwise, the new feature is deleted from the feature template. When the data processing module repairs the data, it automatically deletes the intruded and useless data, automatically retrieves and sorts the lost and messy data, corrects the erroneous data, and then backs up and stores the data; The early warning module (3) includes an information acquisition module, an information editing module and an information transmission module. The information acquisition module is used to acquire information data of the monitored network fault, and then the network editing module automatically edits the early warning type signal according to the information type of the fault, and then issues the early warning signal. When the early warning module (3) issues an early warning signal, it is sent to the user's mobile phone terminal via a text message, enabling the user to implement the early warning function.

2. The Internet data failure safety monitoring system according to claim 1, characterized in that: The information editing module includes a modification function for users to edit and modify the type of warning information.

3. The Internet data failure safety monitoring system according to claim 1, characterized in that: When the network monitoring module (1) monitors, the user first sets the system to start the monitoring system. The startup method is divided into the following four steps: S1. Obtain a network device, turn it on, set the network card to promiscuous mode, and start a capture thread to continuously receive and analyze data packets. S2. Determine the data packets of the monitoring protocol by entering the filter string in the combo box of the dialog bar; S3. Control the start and end of the listening thread through the menu or toolbar button; S4. Create a separate thread for receiving data packets to improve the responsiveness of the interface.

4. The Internet data failure safety monitoring system according to claim 3, characterized in that: The data packets of the monitoring protocol include TCP data packets, UDP data packets and ICMP data packets.

Images