Staff network anomaly troubleshooting method and system

Abstract

The application discloses a kind of teaching staff network exception investigation method and system, it includes: based on WAPI technology is carried out in-campus network networking construction;Erect IDS system and corresponding configuration monitoring rule;If receiving abnormal information, record abnormal information generation time, defined as abnormal time node;Find and trace user network behavior, obtain the active user of abnormal time node, the user that is active in previous t1 duration and the user matched by abnormal information, marked as suspected user;Suspected user investigation, obtain target user;The position information of target user and the AP position information of access are acquired.This application has the effect of discovering campus network abnormal point in time, accelerates the processing efficiency of adverse event.

Description

Technical Field

[0001] This application relates to the field of campus network security technology, and in particular to a method and system for investigating network anomalies among faculty and staff. Background Technology

[0002] In daily life, people often see or hear about illegal or harmful information appearing on school websites and forums in the news and other media, which has a negative impact.

[0003] The above situations occur not only because the school website is maliciously attacked by illegal individuals, but also because faculty and staff members inadvertently click on deceptive websites during their daily work, bringing Trojans, worms, and viruses into the campus intranet, resulting in the theft of their access and related account information for dissemination.

[0004] Currently, some companies use big data and model analysis technologies to make security predictions and provide users with timely risk warnings to reduce the likelihood of such incidents. However, they provide relatively little help to relevant personnel in identifying anomalies after a serious incident has occurred. Summary of the Invention

[0005] In order to promptly detect anomalies in the campus network and expedite the handling of serious incidents, this application provides a method and system for investigating network anomalies among faculty and staff.

[0006] Firstly, this application provides a method for troubleshooting network anomalies among faculty and staff, employing the following technical solution:

[0007] A method for troubleshooting network anomalies among faculty and staff includes:

[0008] Campus intranet construction based on WAPI technology;

[0009] Set up an IDS system and configure the corresponding monitoring rules;

[0010] If abnormal information is received, the time when the abnormal information is generated is recorded and defined as the abnormal time node;

[0011] Search and trace user network behavior to obtain active users at abnormal time points, active users in the previous t1 time period, and users matched with abnormal information, and mark them as suspected users;

[0012] Send the corresponding contingency plan action execution / data overwrite request to the user matched by the abnormal information and several other suspected users;

[0013] If the request is approved, proceed with the planned actions / data overwrite;

[0014] If the request fails, a user ontology verification request is sent to the corresponding suspected user, and feedback is received and identified.

[0015] If all requests pass and the error information is retained, then select several more suspected users from those who have never sent a user identity verification request and send a user identity verification request again.

[0016] If the suspected user's abnormal information is changed after the pre-plan action execution / data overwrite request is approved, or if the feedback of the user's identity verification request is identified as abnormal, then the user is marked as the target user.

[0017] Obtain the location information of the target user and the location information of the access points (APs).

[0018] Optionally, the identification of the abnormal information includes:

[0019] Receive abnormal data packets from the IDS system and obtain the behavior category and information category;

[0020] Retrieve historical similar information of the corresponding user based on behavior category and information category;

[0021] Calculate the similarity between historical similar information and current abnormal data packets;

[0022] If the similarity is higher than the preset risk threshold, it is marked as abnormal information.

[0023] Optionally, several other filtering rules for suspected users may be used to send the pre-planned action execution / data overwrite request, including:

[0024] For other suspected users besides those matched by the abnormal information;

[0025] The number is sampled N times based on a pre-set random algorithm;

[0026] Other suspected users corresponding to the Nth sample number are the targets of the contingency plan action execution / data overwrite request.

[0027] Optionally, when a suspected user receives a request to execute a pre-planned action / overwrite data, an anomaly determination is performed. The anomaly determination includes: determining whether the request receives a response within a preset standard response time t2. If yes, the process ends; if no, after the user's active network behavior occurs, the request is determined to be an anomaly and the request is deemed unsuccessful.

[0028] Optionally, the user ontology verification request includes any one or more of the following: biometric information acquisition request, verification key acquisition request, and real-time scene acquisition request.

[0029] Optionally, when the user ontology request includes a real-time scene acquisition request, the feedback identification of the user ontology verification request includes:

[0030] Obtain the attributes of the image corresponding to the real-time scene and identify the image capture time;

[0031] If the image capture time matches the time between when the user's ontology verification request is sent and before the feedback is received, then image recognition will be performed to obtain the feature recognition result within the image.

[0032] If the image capture time does not match the time between sending the user ontology verification request and receiving feedback, the user ontology verification request feedback will be abnormal.

[0033] The image feature recognition results are compared with security features in the standard sample library. If the comparison is successful, the process ends; otherwise, the user ontology verification request is returned as an error.

[0034] Secondly, this application provides a system for investigating network anomalies among faculty and staff, employing the following technical solution:

[0035] A system for investigating network anomalies among faculty and staff includes a server, an AC controller, an AP device, and a terminal. The server stores a computer program that can be loaded and executed as any of the above-described methods for investigating network anomalies among faculty and staff.

[0036] Optionally, it also includes an information-based work badge, which includes a badge body and a control module, a positioning module, and an acceleration sensing unit embedded in the badge body. The control module is electrically connected to the positioning module and the acceleration sensing unit. The positioning module integrates a wireless communication unit, and the control module is configured as follows:

[0037] Timing;

[0038] If the current time matches the location activation period, the location module will be activated and location data will be retrieved once.

[0039] The location data is compared with the pre-stored campus coordinate dataset to determine whether the information board sign is located on campus. If it is, the location module is kept awake and the location data is sent to the server; otherwise, the location module is put into sleep mode.

[0040] In summary, this application includes at least one of the following beneficial technical effects: it can help relevant personnel gradually eliminate and identify target users who may cause abnormalities in the campus intranet, and locate them, so as to help relevant personnel discover abnormal points in the campus network in a timely manner and speed up the handling of serious incidents; at the same time, because of the location of the AP, even if the target user's location information permissions are closed, the approximate area can still be relatively locked. Attached Figure Description

[0041] Figure 1 This is a schematic diagram of the architecture of this application. Detailed Implementation

[0042] The following is in conjunction with the appendix Figure 1 This application will be described in further detail.

[0043] This application discloses a method for troubleshooting network anomalies among faculty and staff.

[0044] Reference Figure 1 Methods for investigating network anomalies among faculty and staff include:

[0045] 1. Building a campus intranet based on WAPI technology.

[0046] WAPI, or WLAN Authentication and Privacy Infrastructure, consists of WAI (Wireless LAN Authentication Infrastructure) and WPI (Wireless LAN Privacy Infrastructure). An AS (Authentication Server) can be installed in the campus computer room, and AP (Access Point) devices can be installed in various faculty and staff offices, playgrounds, and other areas. Corresponding AC (Access Controller) controllers can then be installed to configure and maintain each AP device. The AP devices provide access to various terminals, thus creating a campus intranet for faculty and staff.

[0047] The WAPI technology is used in this method for networking in order to utilize its function of tracing user network behavior and to achieve location positioning by means of the AP device connected to the user, which will be explained in detail below.

[0048] 2. Set up the IDS system and configure the corresponding monitoring rules.

[0049] Among them, the IDS system, or intrusion detection system, is a relatively mature computer security tool. In this method, we aim to utilize its ability to detect abnormal information, so it will not be described in detail.

[0050] Once the above basic conditions are met, anomaly investigation can begin, specifically:

[0051] 1) If abnormal information is received, the time when the abnormal information is generated is recorded and defined as the abnormal time node.

[0052] In this embodiment, the aforementioned anomaly information may be detected by the IDS system, or it may be actively discovered and identified by other computer security tools, firewalls, or relevant personnel. Once the anomaly information appears, its generation time is retrieved.

[0053] 2) Locate and trace user network behavior (which can be implemented by WAPI) to obtain active users at abnormal time points, active users in the previous t1 time period, and users matched with abnormal information, and mark them as suspected users.

[0054] For campus network incidents caused by "impulsive" behavior, the users matched by abnormal information are more likely to be suspected users or related persons; while for "premeditated" behavior, there are cases where users cannot be identified by abnormal information matching or the matching is incorrect. Therefore, in this method, the active groups on the Internet during the period are directly defined by time, and then identified.

[0055] The duration t1 can be determined based on the server's computing power; the stronger the computing power, the longer the duration t1 can be.

[0056] 3) Send the corresponding pre-plan action execution / data overwrite request to the user matched by the abnormal information and several other suspected users;

[0057] If the request is approved, the planned actions will be executed / data will be overwritten. For example, if the abnormal information is that a campus website has posted inappropriate or risky information, the planned actions could be to delete the post or overwrite the content of the corresponding post with a warning message.

[0058] If the request fails, a user ontology verification request is sent to the corresponding suspected user, and feedback is received and identified.

[0059] If all requests pass and the error information is retained, then select several more suspected users from those who never sent a user identity verification request and send them a user identity verification request again.

[0060] As can be seen from the above, this method attempts to automatically remove anomalies on the one hand, and to identify targets from suspected users on the other hand; and because it does not send requests to all suspected users at the beginning, the data analysis and processing pressure is smaller and the analysis efficiency is higher.

[0061] 4) If the abnormal information of a suspected user is changed after the pre-plan action execution / data overwrite request is approved, or the feedback of the user's identity verification request is identified as abnormal, then the user is marked as the target user.

[0062] Obtain the location information of the target user and the location information of the access points (APs).

[0063] As can be seen from the above, this method can help relevant personnel gradually eliminate and identify target users who may be causing abnormal information, and locate them, so as to help relevant personnel discover abnormal points in the campus network in a timely manner and speed up the handling of serious incidents; at the same time, because of the location of the AP, even if the target user's location information permission is closed, the general area can still be relatively locked.

[0064] In one embodiment of this method, the filtering rules for sending pre-planned action execution / data overwrite requests to several other suspected users include:

[0065] For other suspected users besides those matched by the abnormal information;

[0066] The number is sampled N times based on a pre-set random algorithm; N can be 5-8 times.

[0067] Other suspected users corresponding to the Nth sample number are the targets of the contingency plan action execution / data overwrite request.

[0068] The reason for randomly selecting the target of the request from suspected users in this method is to increase unpredictability through random sampling and reduce the chance of being exploited by the initiator of abnormal information.

[0069] In another embodiment of this method, considering that anomalies detected by the IDS system may be false alarms, frequent occurrences of such events would cause considerable inconvenience to faculty and staff, given the need for the aforementioned verification requests. Therefore, the identification of anomaly information in this method includes:

[0070] Receive abnormal data packets from the IDS system and obtain the behavior category and information category;

[0071] Retrieve historical similar information of the corresponding user based on behavior category and information category;

[0072] Calculate the similarity between historical similar information and current abnormal data packets;

[0073] If the similarity is higher than the preset risk threshold, it is marked as abnormal information.

[0074] The calculation of data similarity is a current technique and will not be elaborated upon further. This method aims to verify whether the data is abnormal through user behavior similarity analysis.

[0075] In one embodiment of this method, after the pre-plan action execution / data overwrite request is sent, it is not simply a matter of receiving request feedback. Because this method has relatively high timeliness requirements, when a suspected user receives the pre-plan action execution / data overwrite request, an anomaly determination is performed. The anomaly determination includes: determining whether the request has received feedback within a preset standard feedback time t2. If yes, the process ends; if no, after the user's active network behavior occurs, it is determined to be an anomaly and the request is deemed unsuccessful.

[0076] As can be seen from the above, if the user does not respond to the request after it is sent, but the user takes initiative to perform network behavior, this method will not wait indefinitely, but will directly determine to jump to the next step of user identity verification in order to reduce delays.

[0077] In one embodiment of this method, a user ontology verification request includes:

[0078] 1) Biometric information acquisition requests, such as requests to acquire facial or fingerprint information;

[0079] 2) Verification key retrieval request, for example: a verification key retrieval request pre-set by the user;

[0080] 3) Real-time scene acquisition request, for example: requesting the user to take a picture of the real-time scene in which they are located, and requiring it to have specific features, such as the nameplate in the office or the students in the classroom.

[0081] The user ontology verification request can include any one or more of the above requests.

[0082] It is important to note that when a user ontology verification request includes a real-time scene acquisition request, the feedback identification for the user ontology verification request includes:

[0083] Obtain the attributes of the image corresponding to the real-time scene and identify the image capture time;

[0084] If the image capture time matches the time between when the user's ontology verification request is sent and before the feedback is received, then image recognition will be performed to obtain the feature recognition result within the image.

[0085] If the image capture time does not match the time between sending the user ontology verification request and receiving feedback, the user ontology verification request feedback will be abnormal.

[0086] The image feature recognition results are compared with security features in the standard sample library. If the comparison is successful, such as finding a matching feature, the process ends. If the comparison fails, the user ontology verification request returns an error.

[0087] As can be seen from the above, this method can reduce the probability of unauthorized personnel misusing faculty and staff accounts by utilizing real-time scenarios, and reduce misjudgments in the anomaly elimination process.

[0088] This application also discloses a system for investigating network anomalies among faculty and staff.

[0089] Reference Figure 1 The faculty and staff network anomaly investigation system includes a server, an AC controller, AP devices, and terminals. The server stores a computer program that can be loaded and executed as one of the faculty and staff network anomaly investigation methods described above.

[0090] Furthermore, the system also includes: an information-based badge, which modifies the badges worn by faculty and staff. Specifically, the information-based badge includes: a badge body and a control module, a positioning module, and an accelerometer embedded within the badge body. The control module consists of an integrated chip, peripheral circuitry, and a battery circuit board, and is electrically connected to the positioning module. The positioning module can be a GPS chip with an integrated wireless communication unit, specifically a GPS integrated chip with 4G functionality. The accelerometer is also electrically connected to the control module. The control module is configured as follows:

[0091] Timing refers to generating real-time time data based on a pre-calibrated time.

[0092] If the current time matches the location activation period, such as 8:00-20:00, then the location module will be woken up (either by powering it with the battery) and location data will be obtained once.

[0093] The location data is compared with the pre-stored campus coordinate dataset to determine whether the information board sign is located on campus. If it is, the location module is kept awake and the location data is sent to the server; otherwise, the location module is put into sleep mode.

[0094] As can be seen from the above, the location information uploaded by the employee badge in this system can be used to verify whether the abnormal information location is accurate and whether it has been misused. When the location data of the target user is different from the location data of the employee badge, and the acceleration sensor unit corresponding to the employee badge indicates that the user (at this time, the identification) is moving, it can be considered that there is a risk of misuse.

[0095] The above are all preferred embodiments of this application, and are not intended to limit the scope of protection of this application. Therefore, all equivalent changes made in accordance with the structure, shape and principle of this application should be covered within the scope of protection of this application.

Claims

1. A method for investigating network anomalies among faculty and staff, characterized in that, include: Campus intranet construction based on WAPI technology; Set up an IDS system and configure the corresponding monitoring rules; If abnormal information is received, the time when the abnormal information is generated is recorded and defined as the abnormal time node; Search and trace user network behavior to obtain active users at abnormal time points, active users in the previous t1 time period, and users matched with abnormal information, and mark them as suspected users; Send the pre-planned action execution or data overwrite request corresponding to the abnormal information to the user matched by the abnormal information and several other suspected users; If the request is approved, proceed with the planned actions or overwrite the data; If the request fails, a user ontology verification request is sent to the corresponding suspected user, and feedback is received and identified. If all requests pass and the error information is retained, then select several more suspected users from those who have never sent a user identity verification request and send a user identity verification request again. If the suspected user's abnormal information is changed after the execution of the pre-planned action or the data overwrite request is approved, or if the feedback of the user's identity verification request is identified as abnormal, then the user is marked as the target user. Obtain the location information of the target user and the location information of the access points (APs). The identification of the abnormal information includes: Receive abnormal data packets from the IDS system and obtain the behavior category and information category; Retrieve historical similar information of the corresponding user based on behavior category and information category; Calculate the similarity between historical similar information and current abnormal data packets; If the similarity is higher than the preset risk threshold, it is marked as abnormal information; When a suspected user receives a request to execute a pre-planned action or overwrite data, an anomaly determination is performed. The anomaly determination includes: determining whether the request receives a response within a preset standard response time t2. If yes, the process ends; if no, after the user's active network behavior occurs, the request is determined to be an anomaly and the request is deemed unsuccessful. The user identity verification request includes any one or more of the following: biometric information acquisition request, verification key acquisition request, and real-time scene acquisition request. When the user ontology verification request includes a real-time scene acquisition request, the feedback identification for the user ontology verification request includes: Obtain the attributes of the image corresponding to the real-time scene and identify the image capture time; If the image capture time matches the time between when the user's ontology verification request is sent and before the feedback is received, then image recognition will be performed to obtain the feature recognition result within the image. If the image capture time does not match the time between sending the user ontology verification request and receiving feedback, the user ontology verification request feedback will be abnormal. The image feature recognition results are compared with security features in the standard sample library. If the comparison is successful, the process ends; otherwise, the user ontology verification request is returned as an error.

2. The method for investigating network anomalies among faculty and staff according to claim 1, characterized in that, The filtering rules for sending the pre-planned action execution or data overwrite request to several other suspected users include: For other suspected users besides those matched by the abnormal information; The number is sampled N times based on a pre-set random algorithm; Other suspected users corresponding to the Nth sampling number are the targets of the contingency plan action execution or data overwrite request.

3. A system for investigating network anomalies among faculty and staff, characterized in that: It includes a server, an AC controller, an AP device, and a terminal, wherein the server stores a computer program that can be loaded and executed as any one of the methods for troubleshooting network anomalies for faculty and staff as described in claims 1 to 2.

4. The faculty and staff network anomaly detection system according to claim 3, characterized in that: It also includes an information-based work badge, which comprises a badge body and a control module, a positioning module, and an acceleration sensing unit embedded in the badge body. The control module is electrically connected to the positioning module and the acceleration sensing unit. The positioning module integrates a wireless communication unit, and the control module is configured as follows: Timing; If the current time matches the location activation period, the location module will be activated and location data will be retrieved once. The location data is compared with the pre-stored campus coordinate dataset to determine whether the information board sign is located on campus. If it is, the location module is kept awake and the location data is sent to the server; otherwise, the location module is put into sleep mode.

Images