Intranet domain-specific target monitoring method based on task construction
By constructing a thematic monitoring method for specific targets within the intranet domain, the problem of monitoring difficulties in enterprise internal networks has been solved, enabling real-time risk detection of specific targets and improving the timeliness and accuracy of monitoring.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- SHENSI TECH CO LTD
- Filing Date
- 2023-07-06
- Publication Date
- 2026-06-02
AI Technical Summary
In enterprise internal network environments, there are problems such as difficulty in monitoring specific targets, limited monitoring methods, unfocused monitoring content, and low monitoring timeliness.
By using a task-based intranet domain-specific target-themed monitoring method, alarm and traffic data are acquired and preprocessed to identify abnormal data, monitoring targets and rules are configured, and scheduled tasks are set for monitoring. Application-type and combined-type topics are monitored and analyzed to obtain monitoring results.
It enables diversified thematic monitoring of specific targets within the intranet domain, and can detect risks of specific targets in real time, improving the timeliness and accuracy of monitoring.
Smart Images
Figure CN116781562B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security monitoring, and in particular to a task-based method for thematic monitoring of specific targets within an intranet domain. Background Technology
[0002] With the development of new-generation information technology and the advancement of informatization, more and more enterprises are establishing their own local area network (LAN) systems. However, the current internal network environment of enterprises is usually quite complex, involving a large number of personnel, and the awareness of computer host security is weak, leading to abnormal behavior in the internal network environment due to the influence of zombies, viruses, targeted attacks, worms, etc. Therefore, it is possible to conduct specialized monitoring on certain specific targets. Problems that still exist in internal networks, especially large LANs, include difficulty in monitoring specific targets, limited monitoring methods, unfocused monitoring content, and low monitoring timeliness. Summary of the Invention
[0003] The purpose of this invention is to design a task-based intranet domain-specific target-themed monitoring method to solve the above problems.
[0004] The present invention achieves the above objectives through the following technical solutions:
[0005] Task-based thematic monitoring methods for specific targets within an intranet domain include:
[0006] S1. Obtain intranet domain alarm data, preprocess the alarm data, and store it in the search server after preprocessing.
[0007] S2. Acquire traffic data in real time and preprocess it;
[0008] S3. Identify abnormal data after traffic data preprocessing and save the abnormal data in database table f;
[0009] S4. Configure the target topics, monitoring tasks, and monitoring rules for the tasks. The monitoring tasks include the topic update frequency and topic status. The topic update frequency and topic status are stored in topic table a. The target topics include application-type topics and combined topics. The monitoring rules for application-type topics are stored in task table b, and the monitoring rules for combined topics are stored in task table c.
[0010] S5. Set up scheduled tasks to monitor target topics. Through the monitoring rules configured in the topics, monitor the tasks in each topic according to the corresponding rules.
[0011] S6. Monitoring and analysis were conducted on application-type and combined-type topics respectively to obtain monitoring results;
[0012] Monitoring and analysis of application-related topics: Using task table b, retrieve all tasks for the application-related topics, perform application device statistics, and, based on the monitoring rules for each task, calculate the total number of connections and the number of connections today for the corresponding port in data table d; Application device statistics: Using task table b, retrieve a specified task, and, based on the specified task, calculate the IP address of the task port and the total number of times these IP addresses were accessed / the number of new accesses today in data table d; Application task details: Using a provided specified IP address and time range, query the asset database through the search server to obtain details of assets available in the asset database for the specified IP address within the specified task;
[0013] For combined thematic monitoring and analysis: according to the monitoring rules in task table c, query the alarm database through the search server to obtain specific alarm information data for the task, and then query the database table f for specific abnormal information data for the task according to the search server.
[0014] The beneficial effects of this invention are as follows: by constructing special tasks to perform diversified special monitoring of specific targets in the intranet domain based on IP and port, it is possible to obtain alarms, anomalies, sessions and other information of specific targets in real time, thereby quickly discovering the risks existing in specific targets. Attached Figure Description
[0015] Figure 1 This is a flowchart of the present invention. Detailed Implementation
[0016] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.
[0017] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.
[0018] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.
[0019] In the description of this invention, it should be understood that the terms "upper," "lower," "inner," "outer," "left," "right," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, or the orientation or positional relationship commonly used when the product of this invention is in use, or the orientation or positional relationship commonly understood by those skilled in the art. They are only used to facilitate the description of this invention and to simplify the description, and are not intended to indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.
[0020] Furthermore, the terms "first," "second," etc., are used only to distinguish descriptions and should not be interpreted as indicating or implying relative importance.
[0021] In the description of this invention, it should also be noted that, unless otherwise explicitly specified and limited, terms such as "set" and "connection" should be interpreted broadly. For example, "connection" can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium; it can be a connection within two components. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.
[0022] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings.
[0023] like Figure 1 As shown, the task-based intranet domain-specific target thematic monitoring method includes:
[0024] S1. Obtain intranet domain alarm data, import it through Kafka, preprocess the alarm data, and store it in the search server after preprocessing.
[0025] S2. Real-time acquisition of traffic data, import via Kafka, and preprocessing of the data;
[0026] Preprocessing is a standardization process. Since alarm network probes and traffic network probes may come in different models and specifications, their data may be inconsistent. Therefore, standardization is necessary to transform the data into the required format. This helps in better data management and analysis, and facilitates better data integration. It can better eliminate data inconsistencies, unify fields, units, and types, and improve data quality.
[0027] S3. Identify abnormal data after traffic data preprocessing and store the abnormal data in database table f. Specifically, the preprocessed abnormal data is placed into the following models: high-frequency connection anomaly model, network behavior anomaly model, remote access anomaly model, one-way invalid access model, data aggregation anomaly model, unknown scan detection model, network segment scan model, specific IP scan model, and specific port scan model. The high-frequency connection anomaly model is used to monitor whether there are high-frequency abnormal connections in the network. The network behavior anomaly model is used to monitor whether there are abnormal network behaviors in the network. The remote access anomaly model is used to monitor whether there are abnormal remote access behaviors in the network. The one-way invalid access model is used to monitor whether there are one-way invalid access behaviors in the network. The data aggregation anomaly model is used to monitor whether there are abnormal data aggregation behaviors in the network. The unknown scan detection model is used to monitor whether there are unknown scan detection behaviors or vulnerability scan behaviors in the network. The network segment scan model based on session scan detection is used to monitor whether there are network segment scan behaviors in the network. The specific IP scan model based on session scan detection is used to monitor whether there are specific IP scan behaviors in the network. The specific port scan model based on session scan detection is used to monitor whether there are specific port scan behaviors in the network.
[0028] S4. Configure the target topics, monitoring tasks, and monitoring rules for the tasks. The monitoring tasks include the topic update frequency and topic status. The topic update frequency and topic status are stored in topic table a. The target topics include application-type topics and combined topics. The monitoring rules for application-type topics are stored in task table b, and the monitoring rules for combined topics are stored in task table c.
[0029] S5. Set up scheduled tasks to monitor target topics. Monitor tasks in each topic according to the monitoring rules configured in the topic. When monitoring target topics, monitor combined topics by monitoring IP address and application topics by monitoring port.
[0030] S6. Monitoring and analysis were conducted on application-type and combined-type topics respectively to obtain monitoring results;
[0031] Monitoring and analysis of application-related topics: Using task table b, retrieve all tasks for the application-related topics, perform application device statistics, and, based on the monitoring rules for each task, calculate the total number of connections and the number of connections today for the corresponding port in data table d; Application device statistics: Using task table b, retrieve a specified task, and, based on the specified task, calculate the IP address of the task port and the total number of times these IP addresses were accessed / the number of new accesses today in data table d; Application task details: Using a provided specified IP address and time range, query the asset database through the search server to obtain details of assets available in the asset database for the specified IP address within the specified task;
[0032] For combined thematic monitoring and analysis: according to the monitoring rules in task table c, query the alarm database through the search server to obtain specific alarm information data for the task, and then query the database table f for specific abnormal information data for the task according to the search server.
[0033] Monitoring and analysis of application-oriented topics specifically includes:
[0034] 1) Determine if the task is completed. If not, place the task in the same scheduler and proceed to 2); otherwise, place the task in another scheduler and proceed to 4).
[0035] 2) Retrieve relevant information about incomplete tasks from the asset library of the search server, batch insert the relevant information into the application task baseline data table d, modify the status of the task in the task table b, and proceed to 5).
[0036] 3) Execute the scheduling of completed tasks, obtain the asset whitelist IP list from the asset table, and delete the data in the task table b whose corresponding IP list is not empty;
[0037] 4) When querying the asset database of the search server, add asset type filtering to obtain relevant information of completed tasks, and then insert the relevant information into data table d in batches;
[0038] 5) Extract the number of baseline data for each task from data table d;
[0039] 6) Modify the task status of each task in each topic of Task Table b and the number of new tasks added.
[0040] 7) Update the status of application-type topics in topic table a. If any tasks in a topic have been completed, change the topic status to completed.
[0041] Monitoring and analyzing combined thematic projects specifically includes:
[0042] ① Determine if the task is completed. If not, place the task in the same scheduler and proceed to ②; otherwise, place the task in another scheduler and proceed to ④.
[0043] ② Classify tasks by topic; for existing topics, perform alarm and anomaly queries for each task, and conduct data statistics.
[0044] Alarm queries for tasks are categorized into IP range and single IP monitoring based on monitoring rules. For IP range monitoring: the IP range is broken down into individual IPs for querying. The start and end times of the topic are obtained from topic table a. Then, the alarm data is retrieved from the alarm database on the search server according to the monitoring rules for each task. The alarm count is then tallied and the data is placed into the corresponding task. For single IP monitoring: the start and end times of the topic are obtained from topic table a. Then, the alarm data is retrieved from the alarm database on the search server according to the monitoring rules for each task. The alarm count is then tallied and the data is placed into the corresponding task.
[0045] For anomaly queries of tasks: Set the start and end times, as well as IP and port conditions for anomaly queries of each task in topic table a. Filter from the anomaly cache based on the conditions and then count the anomaly data.
[0046] ③ Modify the status of the statistical data in task table c to "completed", and update the status of combined topics in topic table a. If there are completed tasks in each topic, change the status of that topic to "completed".
[0047] ④ Obtain the exception list from table f based on different abnormal behaviors, put it into the exception cache, and then update the task again. Obtain the topic update frequency through task table c. The topic update frequency is added to the task's end time and subtracted from the current time. If it is less than 0, classify the tasks by topic. For existing topics, perform alarm and exception queries for each task and perform data statistics.
[0048] The working principle of the task-based intranet domain specific target thematic monitoring method of this invention is as follows:
[0049] Step 1: Prepare the environment for the specific target monitoring topic and obtain intranet domain alarm data through alarm network probes (single or multiple).
[0050] Step 2: Initialize the runtime environment and import the intranet domain alarm data collected by the probe through Kafka, because Kafka has the characteristics of high performance, low latency, high availability, mature toolchain, and mature ecosystem.
[0051] Step 3: Perform alarm data preprocessing, specifically as follows:
[0052] Probes may come in different models and specifications, leading to inconsistent data. Therefore, standardization is necessary to transform the data into the required format. This helps in better data management and analysis, as well as improved data integration. It effectively eliminates data inconsistencies, standardizes fields, units, and types, thereby improving data quality. The pre-processed alert data is then stored on the Elasticsearch search server.
[0053] Step 4: Obtain intranet domain session data through traffic network probes (single or multiple).
[0054] Step 5: Import the intranet domain session data collected by the probe into Kafka.
[0055] Step 6: Perform session data preprocessing as follows:
[0056] Similarly, network traffic probes may come in different models and specifications, resulting in inconsistent data. Therefore, standardization is necessary to convert the data into the required format. This mainly involves unifying the fields, units, and types.
[0057] Step 7: The preprocessed session data is put into the anomaly model for anomaly data identification; the anomaly model includes nine models, as follows:
[0058] 1. High-frequency connection anomaly model
[0059] The high-frequency connection anomaly model has the ability to monitor whether there are high-frequency abnormal connections in the network and generate alarms for high-frequency connection anomalies.
[0060] 2. Network Behavior Anomaly Model
[0061] The network behavior anomaly model has the ability to monitor for abnormal network behavior and issue alerts for such behavior.
[0062] 3. Remote Access Anomaly Model
[0063] The remote access anomaly model has the ability to monitor for abnormal remote access behavior in the network and generate alerts for such behavior.
[0064] 4. One-way invalid access model
[0065] The one-way invalid access model has the ability to monitor whether there is one-way invalid access behavior in the network and to issue alerts for abnormal one-way invalid access behavior.
[0066] 5. Data Aggregation Anomaly Model
[0067] The data aggregation anomaly model has the ability to monitor whether there are abnormal data aggregation behaviors in the network and to generate alarms for abnormal data aggregation behaviors.
[0068] 6. Unknown scanning detection model
[0069] The unknown scanning detection model has the ability to monitor whether there are unknown scanning or vulnerability scanning behaviors in the network, and to issue alerts for unknown scanning behaviors.
[0070] 7. Network Segment Scanning Model
[0071] The session-based scanning detection-network segment scanning model has the ability to monitor whether network segment scanning behavior exists in the network and to issue alerts for such behavior.
[0072] 8. Specific IP Scanning Model
[0073] The session-based scanning detection-specific IP scanning model has the ability to monitor whether specific IP scanning behavior exists in the network and to issue alerts for specific IP scanning behavior.
[0074] 9. Specific Port Scanning Model
[0075] The session scan detection-specific port scan model has the ability to monitor whether specific port scan behavior exists in the network and to issue alerts for specific port scan behavior.
[0076] The filtered real-time anomaly data from the nine anomaly models is saved to database table f in real time for easy analysis later.
[0077] Step 8: Configure Monitoring Topics: Specific target monitoring topics include combined topics and application topics. Determine the IP addresses or ports to be monitored based on actual needs. Combined topics primarily monitor IP addresses, while application topics primarily monitor ports. The topic time and update frequency are set in database table a.
[0078] Step 9: Configure monitoring tasks: The IP addresses or ports to be monitored. For application-based topics, the monitoring rules are stored in database table b, and for combined topic tasks, the monitoring rules are stored in database table c.
[0079] Step 10: Set up scheduled tasks to monitor specific target topics. By using the monitoring rules configured in the topic, monitor the tasks in each topic according to the corresponding rules.
[0080] Step 11: Start the monitoring rule task: Start the configured monitoring task to begin monitoring specific IP addresses or ports on the internal network. The main methods are as follows:
[0081] Since both application-based and composite projects have multiple scheduled tasks, using the same scheduler would result in blocking execution, leading to low efficiency. Therefore, setting up two schedulers avoids blocking and necessitates increasing the number of threads in the thread pool.
[0082] For application-oriented topics:
[0083] 1. Schedule incomplete tasks. Retrieve incomplete and failed tasks from task table b and put them into the same thread. The table has a field for task status (status, 0: incomplete, 1: completed, 2: failed) to determine whether the task is completed.
[0084] 2. Next, retrieve the source and destination port asset information of the unfinished tasks from the Elasticsearch asset repository on the search server, and then batch insert the information into the application task baseline data table d.
[0085] 3. Modify the task status of incomplete tasks in task table b.
[0086] 4. Execute the scheduling of completed tasks and obtain the asset whitelist IP list (Tianqing, leak detection device) in the asset table;
[0087] 5. Check if the whitelist of IP addresses is empty. If it is not empty, delete the data in table d corresponding to that IP address in batches.
[0088] 6. Then retrieve the completed tasks (task status 1) from task table b and put them into the same thread.
[0089] 7. When querying the Elasticsearch asset repository, add asset type conditions (Tianqing and leak scan) to filter and obtain the source and destination port asset information of completed tasks, and then insert the information into the data table d in batches.
[0090] 8. Extract the number of baseline data for each task from data table d.
[0091] 9. Modify the task status and the number of new tasks added to each task in each topic of Task Table b.
[0092] 10. Update the status of the application-type topic in database table a. If any tasks in this topic have been completed, change the topic status (status, 0 for incomplete, 1 for completed) to 1.
[0093] For combined topics:
[0094] 1. Schedule unfinished tasks: retrieve unfinished tasks from task table c and place them into the same thread. The table has a field for task status (status, 0: incomplete, 1: completed, 2: failed).
[0095] 2. Classify tasks by topic, and for each topic, perform alarm and anomaly queries for each task.
[0096] 3. For task alarm queries, different situations are addressed, and monitoring is conducted by classifying them into IP ranges and single IPs based on task patterns.
[0097] 4. Monitor by IP range. Break down the IP range into individual IPs for querying. Use topic table a to obtain the start and end times of the topic. Then, use the monitoring rules of each task to query the Elasticsearch alarm database on the search server to obtain alarm data, count the number of alarms, and put the data into the corresponding task.
[0098] 5. Using single-IP monitoring, obtain the start and end times of the topic through topic table a, and then perform batch queries in the Elasticsearch alarm database on the search server according to the monitoring rules of each task to obtain alarm data, count the number of alarms, and put the data into the corresponding task.
[0099] 6. For anomaly queries of tasks, set the start and end times of anomaly queries for each topic task through topic table a, as well as IP and port conditions. Filter from the anomaly cache (inserted in the schedule of combined topic updates) based on the conditions, and then count the anomaly data.
[0100] 7. Modify the status (status, 0 for incomplete, 1 for complete) of the tasks in task table c that have counted alarms and anomalies to 1. Modify the status of combined topics in topic table a. If any tasks in this topic have been completed, change the topic status (status, 0 for incomplete, 1 for complete) to 1.
[0101] 8. Execute the schedule for combined topic updates. The timeout for this schedule is set to once every 10 seconds. The shorter the timeout, the more accurate the frequency of combined topic updates.
[0102] 9. Load the anomaly analysis data, retrieve the anomaly list from table f based on different anomalies, and put it into the anomaly cache.
[0103] 10. When updating the task again, obtain the topic update frequency through task table c. If the topic update frequency plus the last time of task execution minus the current time is less than 0, re-execute the task to count the number of alarms and anomalies (the same as the alarm query and anomaly query for the scheduling of incomplete tasks). If it is not less than 0, proceed directly without going through step 12.
[0104] Step 12: Combined topics can obtain specific information on task alarms and anomalies. According to the monitoring rules of the task in task table c, query the alarm database through Elasticsearch to obtain all specific alarm information data of the task. Then, according to the monitoring rules of the task, query all specific anomaly information data of the task in database table f.
[0105] Step 13: For application-specific topics, retrieve all tasks from task table b, perform application statistics, and, based on the monitoring rules for each task, calculate the total number of connections and the number of connections today for the corresponding port in data table d. For application device statistics, retrieve the specified task from task table b, and calculate the IP address of the task port and the total number of times these IP addresses were accessed / the number of new accesses today for that task in data table d. For application task details, query the asset repository using Elasticsearch with the provided specified IP address and time range to retrieve the asset details for the specified IP address in the asset repository for the specified task.
[0106] Through the above steps, the internal network domain can be monitored in real time using a variety of IP addresses and ports to obtain alarm or abnormal information and port information for specific tasks. This allows for the rapid acquisition of alarm, abnormal, and session information, thereby identifying potential risks.
[0107] The technical solutions of the present invention are not limited to the specific embodiments described above. Any technical modifications made in accordance with the technical solutions of the present invention fall within the protection scope of the present invention.
Claims
1. A task-based method for thematic monitoring of specific targets within an intranet domain, characterized in that: include: S1. Obtain intranet domain alarm data, preprocess the alarm data, and store it in the search server after preprocessing. S2. Acquire traffic data in real time and preprocess it; S3. Identify abnormal data after traffic data preprocessing and save the abnormal data in database table f; S4. Configure the target topics, monitoring tasks, and monitoring rules for the tasks. The monitoring tasks include the topic update frequency and topic status. The topic update frequency and topic status are stored in topic table a. The target topics include application-type topics and combined topics. The monitoring rules for application-type topics are stored in task table b, and the monitoring rules for combined topics are stored in task table c. S5. Set up scheduled tasks to monitor target topics. Through the monitoring rules configured in the topics, monitor the tasks in each topic according to the corresponding rules. S6. Monitoring and analysis were conducted on application-type and combined-type topics respectively to obtain monitoring results; Monitoring and analysis of application-related topics: Using task table b, retrieve all tasks for the application-related topics, perform application device statistics, and, based on the monitoring rules for each task, calculate the total number of connections and the number of connections today for the corresponding port in data table d; Application device statistics: Using task table b, retrieve a specified task, and, based on the specified task, calculate the IP address of the task port and the total number of times these IP addresses were accessed / the number of new accesses today in data table d; Application task details: Using a provided specified IP address and time range, query the asset database through the search server to obtain details of assets available in the asset database for the specified IP address within the specified task; Monitoring of combined topics is performed by monitoring IP addresses: According to the monitoring rules in task table c, the alarm database is queried through the search server to obtain specific alarm information data for the task; then, specific anomaly information data for the task is queried from database table f through the search server; specifically including: ① Determine if the task is completed. If not, place the task in the same scheduler and proceed to ②; otherwise, place the task in another scheduler and proceed to ④. ② Classify tasks by topic; for existing topics, perform alarm and anomaly queries for each task, and conduct data statistics. ③ Modify the status of the statistical data in task table c to "completed", and update the status of combined topics in topic table a. If there are completed tasks in each topic, change the status of that topic to "completed". ④ Obtain the exception list from table f through different abnormal behaviors, put it into the exception cache, and then update the task again. Obtain the topic update frequency through task table c. The topic update frequency plus the task end time minus the current time. If it is less than 0, classify the tasks by topic. For existing topics, perform alarm query and exception query for each task, and perform data statistics. Alarm queries for tasks are categorized into IP segment monitoring and single IP monitoring based on monitoring rules. For IP segment monitoring: the IP segment is broken down into individual IPs for querying. The start and end times of the topic are obtained from topic table a. Then, the alarm data is retrieved from the alarm database of the search server according to the monitoring rules of each task. The number of alarms is counted and the data is placed into the corresponding task. For single IP monitoring: the start and end times of the topic are obtained from topic table a. Then, the alarm data is retrieved from the alarm database of the search server according to the monitoring rules of each task. The number of alarms is counted and the data is placed into the corresponding task.
2. The intranet domain-specific target thematic monitoring method based on task construction according to claim 1, characterized in that, In S3, preprocessed abnormal data is placed into high-frequency connection anomaly model, network behavior anomaly model, remote access anomaly model, one-way invalid access model, data aggregation anomaly model, unknown scan detection model, network segment scan model, specific IP scan model, and specific port scan model. The high-frequency connection anomaly model is used to monitor whether there are high-frequency abnormal connections in the network. The network behavior anomaly model is used to monitor whether there are abnormal network behaviors in the network. The remote access anomaly model is used to monitor whether there are abnormal remote access behaviors in the network. The one-way invalid access model is used to monitor whether there are one-way invalid access behaviors in the network. The data aggregation anomaly model is used to monitor whether there are abnormal data aggregation behaviors in the network. The unknown scan detection model is used to monitor whether there are unknown scan detection behaviors or vulnerability scan behaviors in the network. The network segment scan model based on session scan detection is used to monitor whether there are network segment scan behaviors in the network. The specific IP scan model based on session scan detection is used to monitor whether there are specific IP scan behaviors in the network. The specific port scan model based on session scan detection is used to monitor whether there are specific port scan behaviors in the network.
3. The intranet domain-specific target thematic monitoring method based on task construction according to claim 1, characterized in that, The application-specific topics are monitored through the monitoring port.
4. The intranet domain-specific target thematic monitoring method based on task construction according to claim 3, characterized in that, Monitoring and analysis of application-oriented topics specifically includes: 1) Determine if the task is completed. If not, place the task in the same scheduler and proceed to step 2); otherwise, place the task in a different scheduler and proceed to step 4). 2) Retrieve relevant information about incomplete tasks from the asset database of the search server, batch insert the relevant information into the application task baseline data table d, modify the status of the task in the task table b, and proceed to step 5). 3) Execute the scheduling of completed tasks, obtain the asset whitelist IP list from the asset table, and delete the data in the corresponding IP list that is not empty in the task table b; 4) When querying the asset database of the search server, add asset type filtering to obtain relevant information of completed tasks, and then insert the relevant information into data table d in batches; 5) Extract the baseline data quantity for each task from data table d; 6) Modify the task status and the number of new tasks in each topic of Task Table b; 7) Update the status of application-type topics in topic table a. If any tasks in a topic are completed, change the topic status to completed.
5. The intranet domain-specific target thematic monitoring method based on task construction according to claim 1, characterized in that, For anomaly queries of tasks: Set the start and end times, as well as IP and port conditions for anomaly queries of each task in topic table a. Filter from the anomaly cache based on the conditions and then count the anomaly data.