Monitoring and operation methods, systems, electronic equipment and media for network security competitions

Abstract

The present invention provides a monitoring and operation method, system, electronic device and medium for a network security competition, which solves the technical problem of lack of effective monitoring means for the behaviors of contestants at the competition site during the competition operation and maintenance process. The method includes: synchronously collecting monitoring data of the physical layer, network layer and application layer according to the defined monitoring data source; and correlating the monitoring data to establish a unified perspective dimension; and then processing the monitoring data according to the event preset strategy to form monitoring event identification; classifying resources and matching responses to clear monitoring events according to the event response database and to fuzzy monitoring events according to the event experience database, and adjusting the operation and maintenance resource allocation and response time. It provides a new perspective for event operation and maintenance, and can define event and response classification and grading rules. It is conducive to accumulating event operation and maintenance experience, improving service quality and reducing operation and maintenance pressure, discovering and responding to problems in advance, and improving operation and maintenance efficiency.

Description

Technical Field

[0001] The present invention relates to the field of network monitoring technology, and in particular to a monitoring and operation method, system, electronic equipment and medium for a network security competition. Background Art

[0002] With the development of cybersecurity work, the country attaches great importance to the training and capacity improvement of cybersecurity talents. Cybersecurity competitions are gradually accepted by all walks of life and become the main way to test the capabilities of cyber talents and select talents. The platform resources of cyber competitions have relevant mature technical resources for cloud platform monitoring and scheduling, which can achieve real-time monitoring and analysis of competition resources during the competition. After multiple applications, they have good maturity and stability. The increasingly rich competitions have improved the robustness and stability of the cybersecurity competition platform technology.

[0003] During the event, especially in the scenario of thousands of people, the participants include the on-site operation and maintenance support team of the event service provider, the participating teams, the referees (who usually do not participate, and only participate when cheating or difficult things happen), the event organizers, etc., which takes up a lot of human resources. There are many matters that need to be responded to, and the event environment is relatively complex, resulting in an increase in uncontrollable factors, and the need for increased automatic supervision and inspection. The lack of a centralized monitoring platform makes it impossible for operation and maintenance personnel to coordinate resources, and it is impossible to comprehensively handle various demands at different levels in many aspects. For event problems with unclear issues, unknown priorities, and unknown content, a large number of experienced personnel are required to handle and respond on site, resulting in high human expenditure costs for event operation and maintenance.

[0004] As the scale and level of activities expand, industry applications deepen, and cybersecurity competitions become increasingly complex, higher requirements are placed on the operation of the competition platform, especially the need to improve the monitoring quality for changes in the physical environment of the competition and abnormal operations of contestants before, during, and after the competition. At present, the problems that violate fairness, such as the inability to access the competition environment or submitting correct / incorrect answers to the competition questions without checking the questions, caused by changes in the contestants' network connections and deterioration of network connectivity, mainly occur in places where contestants have more interactive behaviors, such as access areas and answering areas, and the existing cloud platform monitoring technology cannot take care of them. Summary of the invention

[0005] In view of the above problems, the embodiments of the present invention provide a monitoring and operation method, system, electronic device and medium for a network security competition to solve the technical problem of lack of effective monitoring means for the behavior of contestants at the competition site during the competition operation and maintenance process.

[0006] The monitoring and operation method of the network security competition according to the embodiment of the present invention includes:

[0007] Synchronously collect monitoring data of the physical layer, network layer and application layer according to the defined monitoring data source;

[0008] Associate monitoring data based on network identifiers to establish a unified perspective dimension for monitoring data;

[0009] Under the unified perspective dimension, the monitoring data is processed according to the event preset strategy to form monitoring event identification;

[0010] According to the event response database, resources are classified and responses are graded for clear monitoring events. According to the event experience database, resources are classified and responses are graded for fuzzy monitoring events. Operation and maintenance resource allocation and response time are adjusted based on classified resources and graded responses.

[0011] In one embodiment of the present invention, the synchronous collection of monitoring data of the physical layer, the network layer and the application layer according to the defined monitoring data source includes:

[0012] Use IP video equipment at the physical layer to collect video from the competition site;

[0013] At the network layer, use the network traffic monitoring protocol and / or network configuration management protocol to collect the transmission status of the competition site;

[0014] At the application layer, the event process is connected through the Restful API interface to obtain event information of event participants.

[0015] In one embodiment of the present invention, associating the monitoring data according to the network identifier to establish a unified perspective dimension of the monitoring data includes:

[0016] Bind the video collection data to the network identification of the event participants;

[0017] Bind the network transmission status collection data with the network identification of the event participants;

[0018] The event application information data is bound to the network identification of the event participants;

[0019] The monitoring data of event participants are organized according to network identification to form a unified perspective dimension.

[0020] In one embodiment of the present invention, the step of processing monitoring data according to event preset strategies to form monitoring event identification under a unified perspective dimension includes:

[0021] Process the physical layer monitoring data according to the event preset strategy to extract clear monitoring events triggered by physical state changes;

[0022] Process network layer monitoring data according to event preset strategies to extract clear monitoring events triggered by changes in network status;

[0023] Process the application layer monitoring data according to the event preset strategy to extract clear monitoring events triggered by application status changes;

[0024] According to the event preset strategy, the comprehensive monitoring data involving physical state changes, network state changes and application state changes are processed to extract fuzzy monitoring events.

[0025] In one embodiment of the present invention, the resource classification and response hierarchical matching includes:

[0026] Compare the monitoring events with the contents of the event response database to obtain the corresponding resource classification and response level;

[0027] Compare the fuzzy monitoring events with the event experience database content to obtain the corresponding resource classification and response classification;

[0028] The adjustment of operation and maintenance resource allocation and response time according to classified resources and graded responses includes:

[0029] The operation and maintenance resource allocation and response time are adjusted based on the processing feedback of the monitoring events.

[0030] The monitoring and operation system of the network security competition according to the embodiment of the present invention includes:

[0031] A data definition collection device is used to synchronously collect monitoring data of the physical layer, network layer and application layer according to the defined monitoring data source;

[0032] A data association and normalization device is used to associate monitoring data according to network identifiers and establish a unified perspective dimension for monitoring data;

[0033] A data event recognition device is used to process monitoring data according to event preset strategies to form monitoring event recognition under a unified perspective dimension;

[0034] The event resource matching device is used to classify resources and grade responses for clear monitoring events according to the event response database, classify resources and grade responses for fuzzy monitoring events according to the event experience database, and adjust operation and maintenance resource allocation and response time according to the classified resources and graded responses.

[0035] An electronic device according to an embodiment of the present invention includes:

[0036] processor, memory, and an interface for communicating with a gateway;

[0037] The memory is used to store programs and data, and the processor calls the program stored in the memory to execute the above method.

[0038] The computer-readable storage medium of the embodiment of the present invention is characterized in that the computer-readable storage medium includes a program, and the program is used to execute the above method when executed by a processor.

[0039] The monitoring and operation and maintenance method, system, electronic device and medium of the network security competition of the embodiment of the present invention utilizes the redefinition of the monitoring data source to redirect part of the monitoring data to form effective monitoring data that highlights the attention of the event participation level. Use effective data association to form a unified perspective dimension for the event participants, covering the implicit and explicit data features that characterize the object behavior. Through the event preset strategy, the object behavior is graded and quantified, and operation and maintenance resources are allocated to respond to the event participants or establish event warnings. The monitoring system for the in-game security of the participating teams integrates the resources and technologies at the three levels of physical, network and application, and can comprehensively and friendly reflect the situation of the participating teams. Provide a new perspective for event operation and maintenance, define events and rules, realize the hierarchical and classified processing of events, and facilitate timely response and disposal. It is conducive to accumulating event operation and maintenance experience, improving service quality and reducing operation and maintenance pressure, discovering and responding to problems in advance, and improving operation and maintenance efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 Shown is a flow chart of a monitoring and operation method for a network security competition according to an embodiment of the present invention.

[0041] Figure 2 Shown is a schematic diagram of the architecture of a monitoring and operation system for a network security competition according to an embodiment of the present invention.

[0042] Figure 3 FIG. 1 is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solution and advantages of the present invention clearer and more understandable, the present invention is further described below in conjunction with the accompanying drawings and specific implementation methods. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0044] A monitoring and operation method for a network security competition according to an embodiment of the present invention is as follows Figure 1 As shown. Figure 1 This embodiment includes:

[0045] Step 100: Synchronously collect monitoring data of the physical layer, network layer and application layer according to the defined monitoring data source.

[0046] Those skilled in the art can understand that the sensors, network element devices, transmission protocols and application data processing protocols supported by the competition platform can obtain a wide range of types of monitoring data through relevant mature monitoring technologies. In view of the normality and fairness of the event monitoring and operation and maintenance, the monitoring data related to the competition behavior and environment can be redirected to be converted into a monitoring data source corresponding to the operation and maintenance concerns. Then, the platform monitoring means or the stadium monitoring means are used to form a synchronous collection of monitoring data for the monitoring data sources of the physical layer, network layer and application layer. The monitoring and operation of the competition process is independent of the overall monitoring of the competition platform, highlighting the attention of the event participation level.

[0047] Step 200: Associate the monitoring data according to the network identifier to establish a unified perspective dimension of the monitoring data.

[0048] Those skilled in the art can understand that the network identifier is an important network symbol for the competition platform to provide competition services for different competition participants, and it is unique. The monitoring data is associated with the network identifier as a benchmark, and the specific behavior of the competition participants is characterized by the monitoring data to form an observation dimension for the behavior of the competition participants, that is, to define a unified perspective dimension, which is used to implicitly characterize the behavior of the object through the associated monitoring data.

[0049] Step 300: Under the unified perspective dimension, the monitoring data is processed according to the event preset strategy to form monitoring event identification.

[0050] The event preset strategy includes a set of basic rules for performing logical judgments on specific states between related monitoring data. A logical judgment on the state of a group of related monitoring data is formed through a rule, and a specific monitoring event is determined based on the logical judgment. A group of related monitoring data includes at least one type of monitoring data in the physical layer, network layer and application layer. The state identification of the monitoring data is judged based on the corresponding threshold, switch value, state value or the degree of difference between the previous and next data. The event preset strategy provides a logical judgment process between the states of the monitoring data. One monitoring event corresponds to a logical judgment process. The logical judgment process performs a logical judgment on the state of a group of related monitoring data, and determines the type of monitoring event based on the judgment result. According to the matching accuracy requirements of the logical judgment process, there are two types of monitoring event classifications: clear monitoring events and fuzzy monitoring events.

[0051] Step 400: Classify resources and grade responses for explicit monitoring events according to the event response database, classify resources and grade responses for fuzzy monitoring events according to the event experience database, and adjust operation and maintenance resource allocation and response time according to the classified resources and graded responses.

[0052] The event response database classifies and grades explicit monitoring events in a standard way, and responds to events to event participants at different response speeds using human resources of different technical levels according to the preset operation and maintenance resource allocation strategies corresponding to the classification and grading. The event experience database classifies and grades fuzzy monitoring events according to their approximate possibilities, and provides event warnings to event participants at different response speeds using human resources of different technical levels according to the preset operation and maintenance resource allocation strategies corresponding to the classification and grading. Approximate possibilities are used to warn of potential or certain probability fuzzy events.

[0053] The monitoring and operation method of the network security competition of the embodiment of the present invention utilizes the redefinition of the monitoring data source to redirect part of the monitoring data to form effective monitoring data that highlights the attention of the event participation level. Use effective data association to form a unified perspective dimension for the event participants, covering the implicit and explicit data features that characterize the object behavior. Through the event preset strategy, the object behavior is graded and quantified, and operation and maintenance resources are allocated to respond to the event participants or establish event warnings. The monitoring system for the in-game security of the participating teams integrates the resources and technologies at the three levels of physical, network, and application, and can comprehensively and friendly reflect the situation of the participating teams. Provide a new perspective for event operation and maintenance, define events and rules, realize the hierarchical and classified processing of events, and facilitate timely response and disposal. It is conducive to accumulating event operation and maintenance experience, improving service quality and reducing operation and maintenance pressure, discovering and responding to problems in advance, and improving operation and maintenance efficiency.

[0054] like Figure 1 As shown, in one embodiment of the present invention, step 100 includes:

[0055] Step 110: Use IP video equipment at the physical layer to capture video of the competition site.

[0056] Video capture is used to capture the actions of event participants at the event site in real time. It is also used to capture the network access environment of the event site constructed by hardware devices such as network switches and important application servers in real time.

[0057] Video acquisition uses RTSP, rtmp, webscoket and other video streaming protocols to obtain real-time video information. The monitoring data source includes but is not limited to the camera ID of the video application platform, the camera IP address, port number, access key ID, and the spatial coordinates and geographic coordinates of the camera's viewing angle.

[0058] Step 120: At the network layer, use a network traffic monitoring protocol and / or a network configuration management protocol to collect the transmission status of the competition site.

[0059] Transmission data collection is used to collect the data transmission status of the network access devices used by event participants at the event site in real time. Network access devices include access layer and aggregation layer switch devices. Sflow and Netstream network traffic monitoring protocols or network configuration management protocols such as SNMP, NETCONF, and RESTCONF are used. Monitoring data sources include switch traffic statistics and alarm data.

[0060] Step 130: Connect to the event process through the Restful API interface at the application layer to obtain event information of event participants.

[0061] The event process connection is used to collect the status of event participants at the event site in real time. The monitoring data source includes the login and access information of the event platform of the participating teams and event participants, the submitted event result information, the submitted help requests or interactive messages within the platform, etc., in order to obtain the latest event information of the participating teams.

[0062] The monitoring and operation method of the network security competition in the embodiment of the present invention ensures the type of monitoring data source that highlights the attention of the event participants, and ensures the timeliness consistency of the data of the physical layer, network layer and application layer of the event participants at the event site.

[0063] like Figure 1 As shown, in one embodiment of the present invention, step 200 includes:

[0064] Step 210: Bind the video acquisition data with the network identification of the event participant.

[0065] Binding enables the video footage of the participating teams to be quickly located in the area by combining the location distribution and superimposing the names of the participating teams and other information.

[0066] Step 220: Bind the network transmission status collection data with the network identification of the event participant.

[0067] Binding enables the participating teams to connect their network access interface names, used IP addresses / historically used IP addresses, VLAN / VXLAN IDs, interface traffic statistics, and physical layer data, and achieves connection from the business layer to the network layer and interface location. It also connects with the network security competition platform. The network security competition platform uses cloud platform technologies such as virtualization technology and SDN technology, and uses VLAN or VXLAN to achieve fairness and isolation in the competition environment; at the same time, it will uniformly configure hardware network switches (supporting the openflow protocol) or virtual SDN switches.

[0068] Step 230: The event application information data is bound to the network identification of the event participant.

[0069] Binding connects the team ID, user account, historical access address, and environment table of the participating teams (all participating teams have independent and fair competition environments). The competition environment includes virtual machines, network equipment, test environment, and network IDs that can be used by participating teams.

[0070] Step 240: Organize the monitoring data of the event participants according to the network identifier to form a unified perspective dimension.

[0071] The monitoring and operation method of the network security competition in the embodiment of the present invention forms the connection of monitoring data of the physical layer, network layer and application layer through network identification, and establishes a unified perspective of monitoring data of each layer based on network identification that characterizes the behavior of the object in the operation and maintenance process. This allows data storage, organization and analysis to be normalized around the network identification, which is conducive to forming a complete data set and data association for obtaining explicit and implicit object behaviors.

[0072] like Figure 1 As shown, in one embodiment of the present invention, step 300 includes:

[0073] Step 310: Process the physical layer monitoring data according to the event preset strategy to extract clear monitoring events triggered by physical state changes.

[0074] Specific monitoring events include but are not limited to events where event participants leave the field of view, enter the field of view, extreme operation events, and abnormal operation events.

[0075] Step 320: Process the network layer monitoring data according to the event preset strategy to extract clear monitoring events triggered by changes in network status.

[0076] Specific monitoring events include but are not limited to alarm events of corresponding status generated by changes in the interface status of network switches, abnormal events collected through the SNMP protocol, logical judgment events of data collected through the sflow and netstream protocols, and core events of logical judgment of whether there are unexpected physical changes through video monitoring.

[0077] Step 330: Process the application layer monitoring data according to the event preset strategy to extract clear monitoring events triggered by application state changes.

[0078] Clearly monitor events include but are not limited to logical judgment events for changes in the user names, IP addresses, and network interface status of participating teams, and logical judgment events for help information from the competition teams. The help information includes the name of the participating team, the submitter, the submission time, the event type (help), and the content (help details)

[0079] Step 340: Process the comprehensive monitoring data involving physical state changes, network state changes, and application state changes according to the event preset strategy to extract fuzzy monitoring events.

[0080] Fuzzy monitoring events include, but are not limited to, potential expected fuzzy monitoring events that make comprehensive logical judgments on state changes at all levels.

[0081] The monitoring and operation method of the network security competition in the embodiment of the present invention makes full use of the monitoring data of the unified perspective dimension to form a basis for judging the process of the network security competition and a basis for resource allocation.

[0082] like Figure 1 As shown, in one embodiment of the present invention, step 400 includes:

[0083] Step 410: Compare the clear monitoring event with the content of the event response database to obtain the corresponding resource classification and response level.

[0084] Step 420: Compare the fuzzy monitoring event with the content of the event experience database to obtain the corresponding resource classification and response level.

[0085] Step 430: Adjustment of operation and maintenance resource allocation and response time is formed based on the operation and maintenance resources and response time for the processing feedback of the monitoring event.

[0086] Combined with the historical event response database and event experience database, targeted disposal suggestions and methods are made for the current events. Operation and maintenance managers can directly arrange on-site service support personnel resources and respond within a limited time. Afterwards, the feedback suggestions are processed, the event is closed-loop filled, and included in each event database.

[0087] In one embodiment of the present invention, the contestant's failure is reflected as an important emergency event with the highest priority, and a high-level operation and maintenance personnel is arranged to connect and arrange for processing within 5 minutes.

[0088] A monitoring and operation system for a network security competition according to an embodiment of the present invention is as follows Figure 2 As shown. Figure 2 In this embodiment, the present invention includes:

[0089] The data definition collection device 10 is used to synchronously collect monitoring data of the physical layer, the network layer and the application layer according to the defined monitoring data source;

[0090] The data association and normalization device 20 is used to associate the monitoring data according to the network identifier and establish a unified perspective dimension of the monitoring data;

[0091] The data event identification device 30 is used to process the monitoring data according to the event preset strategy to form monitoring event identification under the unified perspective dimension;

[0092] The event resource matching device 40 is used to classify resources and grade responses for clear monitoring events according to the event response database, classify resources and grade responses for fuzzy monitoring events according to the event experience database, and adjust operation and maintenance resource allocation and response time according to the classified resources and graded responses.

[0093] like Figure 2 As shown, in one embodiment of the present invention, the data definition collection device 10 includes:

[0094] The physical layer acquisition module 11 is used to acquire video of the competition site by using IP video equipment at the physical layer;

[0095] The network layer collection module 12 is used to collect the transmission status of the competition site by using the network flow monitoring protocol and / or the network configuration management protocol at the network layer;

[0096] The application layer acquisition module 13 is used to connect to the event process through the Restful API interface at the application layer to obtain the event information of the event participants.

[0097] like Figure 2 As shown, in one embodiment of the present invention, the data association and normalization device 20 includes:

[0098] A physical data association module 21, used to bind the video acquisition data with the network identification of the event participant;

[0099] A network data association module 22, used to bind the network transmission status collection data with the network identification of the event participant;

[0100] Application data association module 23, used to bind event application information data with network identifications of event participants;

[0101] The associated data normalization module 24 is used to organize the monitoring data of the event participants according to the network identifier to form a unified perspective dimension.

[0102] like Figure 2 As shown, in one embodiment of the present invention, the data event identification device 30 includes:

[0103] A physical event identification module 31 is used to process the physical layer monitoring data according to the event preset strategy to extract clear monitoring events triggered by physical state changes;

[0104] A network event identification module 32 is used to process the network layer monitoring data according to the event preset strategy to extract clear monitoring events triggered by changes in network status;

[0105] Application event identification module 33, used to process application layer monitoring data according to event preset strategy to extract clear monitoring events triggered by application state changes;

[0106] The fuzzy event identification module 34 is used to process the comprehensive monitoring data involving physical state changes, network state changes and application state changes according to the event preset strategy to extract fuzzy monitoring events.

[0107] like Figure 2 As shown, in one embodiment of the present invention, the event resource matching device 40 includes:

[0108] The precise classification and grading module 41 is used to compare the clear monitoring events with the content of the event response database to obtain the corresponding resource classification and response classification;

[0109] A fuzzy classification and grading module 42 is used to compare the fuzzy monitoring events with the content of the event experience database to obtain corresponding resource classification and response grading;

[0110] The classification and grading iteration module 43 is used to adjust the operation and maintenance resource allocation and response time according to the operation and maintenance resources and response time for the processing feedback of the monitoring events.

[0111] The embodiments of the present application also provide a specific implementation of an electronic device that can implement all the steps in the method in the above embodiments, see Figure 3 , the electronic device 600 specifically includes the following contents:

[0112] Processor 610, memory 620, communication unit 630 and bus 640;

[0113] The processor 610, the memory 620, and the communication unit 630 communicate with each other via the bus 640; the communication unit 630 is used to realize information transmission between server-side devices and terminal devices and other related devices.

[0114] The processor 610 is used to call the computer program in the memory 620. When the processor executes the computer program, all the steps in the monitoring and operation method of the network security competition in the above embodiment are implemented.

[0115] Those skilled in the art should understand that the memory may be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), etc. The memory is used to store programs, and the processor executes the programs after receiving the execution instruction. Furthermore, the software programs and modules in the above-mentioned memory may also include an operating system, which may include various software components and / or drivers for managing system tasks (such as memory management, storage device control, power management, etc.), and may communicate with various hardware or software components to provide an operating environment for other software components.

[0116] The processor may be an integrated circuit chip having the ability to process signals. The above-mentioned processor may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc. The methods, steps, and logic block diagrams disclosed in the embodiments of the present application may be implemented or executed. The general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.

[0117] The present application also provides a computer-readable storage medium, which includes a program. When the program is executed by a processor, it is used to execute the monitoring and operation method of the network security competition provided by any of the aforementioned method embodiments.

[0118] Those skilled in the art should understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk, etc., various media that can store program codes, and the specific media type is not limited in this application.

[0119] The above is only a preferred specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A monitoring and operation method for a network security competition, characterized in that: include: Synchronous collection of monitoring data at the physical layer, network layer, and application layer based on the defined monitoring data source, including: At the physical layer, IP video equipment is used to collect video of the competition site. Video collection is used to collect the actions of the participants at the competition site in real time. At the network layer, the network traffic monitoring protocol and / or the network configuration management protocol are used to collect the transmission status of the competition site. The transmission status collection is used to collect the data transmission status of the network access devices used by the event participants at the event site in real time; At the application layer, the event process is connected through the Restful API interface to obtain the event information of the event participants. The event process connection is used to collect the participation status of the event participants at the event site in real time; The monitoring data is associated according to the network identifier to establish a unified perspective dimension of the monitoring data, including: Bind the video collection data to the network identification of the event participants; Bind the network transmission status collection data with the network identification of the event participants; The event application information data is bound to the network identification of the event participants; Organize the monitoring data of event participants according to network identification to form a unified perspective dimension; Under the unified perspective dimension, monitoring data is processed according to the event preset strategy to form monitoring event identification, including: Processing the physical layer monitoring data according to the event preset strategy to extract clear monitoring events triggered by physical state changes, wherein the clear monitoring events triggered by physical state changes include events of leaving the viewing angle, entering the viewing angle, extreme operation events, and abnormal operation events of the event participants; Processing the network layer monitoring data according to the event preset strategy to extract clear monitoring events triggered by changes in network status, wherein the clear monitoring events triggered by changes in network status include alarm events of corresponding status generated by changes in the interface status of the network switch, abnormal events collected through the SNMP protocol, logical judgment events of data collected through the sflow or netstream protocol, and logical judgment events of whether there are unexpected physical changes through video monitoring; Processing the application layer monitoring data according to the event preset strategy to extract explicit monitoring events triggered by application status changes, wherein the explicit monitoring events triggered by application status changes include logical judgment events for changes in user names, IP addresses and network interface statuses of participating teams, and logical judgment events for help information of competition teams, wherein the help information includes the name of the participating team, the submitter, the submission time, the event type and content; According to the event preset strategy, the comprehensive monitoring data involving physical state changes, network state changes and application state changes are processed to extract fuzzy monitoring events; the fuzzy monitoring events include potential expected fuzzy monitoring events that make comprehensive logical judgments on state changes at all levels; According to the event response database, resources are classified and response levels are matched for clear monitoring events. According to the event experience database, resources are classified and response levels are matched for fuzzy monitoring events. According to the resource classification and response level, operation and maintenance resource allocation and response time are adjusted.

2. The monitoring and operation method of the network security competition according to claim 1, characterized in that: The resource classification and response classification matching include: Compare the monitoring events with the event response database to obtain the corresponding resource classification and response level; Compare the fuzzy monitoring events with the event experience database content to obtain the corresponding resource classification and response classification; The adjustment of operation and maintenance resource allocation and response time according to resource classification and response classification includes: The operation and maintenance resource allocation and response time are adjusted based on the processing feedback of the monitoring events.

3. A monitoring and operation system for a network security competition, characterized in that: include: A data definition collection device is used to synchronously collect monitoring data of the physical layer, network layer and application layer according to the defined monitoring data source; The data definition collection device comprises: The physical layer acquisition module is used to use IP video equipment at the physical layer to collect video of the competition site. The video acquisition is used to collect the actions of the event participants at the event site in real time. A network layer acquisition module is used to collect the transmission status of the competition site using a network traffic monitoring protocol and / or a network configuration management protocol at the network layer. The transmission status acquisition is used to collect the data transmission status of the network access devices used by the competition participants at the competition site in real time. The application layer collection module is used to connect to the event process through the Restful API interface at the application layer to obtain the event information of the event participants. The event process connection is used to collect the participation status of the event participants at the event site in real time; The data association and normalization device is used to associate the monitoring data according to the network identifier and establish a unified perspective dimension of the monitoring data; the data association and normalization device includes: A physical data association module is used to bind the video acquisition data with the network identification of the event participants; A network data association module is used to bind the network transmission status collection data with the network identification of the event participants; Application data association module, used to bind event application information data with the network identification of event participants; The associated data normalization module is used to organize the monitoring data of event participants according to network identification to form a unified perspective dimension; The data event recognition device is used to process the monitoring data according to the event preset strategy under the unified perspective dimension to form monitoring event recognition; the data event recognition device includes: A physical event recognition module is used to process the physical layer monitoring data according to the event preset strategy to extract clear monitoring events triggered by physical state changes, wherein the clear monitoring events triggered by physical state changes include events of leaving the viewing angle, entering the viewing angle, extreme operation events, and abnormal operation events of the event participants; A network event identification module is used to process the network layer monitoring data according to the event preset strategy to extract clear monitoring events triggered by changes in network status, wherein the clear monitoring events triggered by changes in network status include alarm events of corresponding status generated by changes in the interface status of the network switch, abnormal events collected through the SNMP protocol, logical judgment events of data collected through the sflow or netstream protocol, and logical judgment events of whether there are unexpected physical changes through video monitoring; An application event identification module is used to process the application layer monitoring data according to the event preset strategy to extract clear monitoring events triggered by application state changes, wherein the clear monitoring events triggered by application state changes include logical judgment events for changes in user names, IP addresses and network interface states involved in the participating teams, and logical judgment events for the help information of the competition teams, wherein the help information includes the name of the participating team, the submitter, the submission time, the event type and content; The fuzzy event recognition module is used to process the comprehensive monitoring data involving physical state changes, network state changes and application state changes according to the event preset strategy to extract fuzzy monitoring events; the fuzzy monitoring events include potential expected fuzzy monitoring events that make comprehensive logical judgments on state changes at all levels; An event resource matching device is used to classify resources and match responses in different levels for clear monitoring events according to an event response database, to classify resources and match responses in different levels for fuzzy monitoring events according to an event experience database, and to adjust operation and maintenance resource allocation and response time according to resource classification and response classification.

4. An electronic device, characterized in that: include: A processor, a memory, and an interface for communicating with a gateway; The memory is used to store programs and data, and the processor calls the program stored in the memory to execute the method according to any one of claims 1 to 2.

5. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a program, and when the program is executed by a processor, the program is used to perform the method according to any one of claims 1 to 2.

Images