Network path analysis system and method for network security anomaly detection

Abstract

The application discloses a network path analysis system and method for network security anomaly detection, and relates to the technical field of network analysis systems.The analysis system performs self-checking analysis on its operating conditions at regular time intervals, judges whether the current operating conditions support the security anomaly detection of the network path, obtains all special scenes in the network path operating environment, obtains regression coefficients after analyzing all the special scenes based on a regression analysis model, combines the regression coefficients with the operating conditions of the analysis system to generate a correction index, and obtains a dynamic flow threshold value after adjusting the initial flow threshold value through the correction index.The analysis system performs real-time self-checking during use to guarantee the stability of network path detection, and obtains a dynamic flow threshold value after adjusting the initial flow threshold value according to the special scenes in the operating environment and the operating conditions of the analysis system, effectively avoiding frequent false positives and other problems of the analysis system in special scenes.

Description

Technical Field

[0001] This invention relates to the field of network analysis system technology, and more specifically to a network path analysis system and method for detecting network security anomalies. Background Technology

[0002] With the popularization of the Internet and the continuous development of technology, network security threats have become increasingly complex and covert. Traditional security protection methods may not be able to effectively deal with new types of attacks and threats. Therefore, more advanced and intelligent security technologies are needed to address these challenges. Network security anomaly detection is a key component in protecting computer systems and networks from malicious attacks. Network path analysis systems are an important technology for network security anomaly detection. They identify abnormal behaviors and potential security threats in the network by monitoring and analyzing network traffic, data packets, logs and other relevant information.

[0003] The existing technology has the following shortcomings:

[0004] 1. Existing analysis systems typically perform security anomaly detection on network paths. However, in practical applications, if the analysis system itself has anomalies, it may cause over-detection or under-detection. Over-detection will lead to frequent false alarms from the analysis system, while under-detection will lead to a decrease in detection accuracy.

[0005] 2. If the analysis system itself is not abnormal, the existing analysis system usually analyzes the traffic of the network path. After obtaining the traffic of the network path in real time, it compares the real-time traffic with the preset traffic threshold. When the real-time traffic exceeds the traffic threshold, the network path is analyzed to be abnormal. However, when the network path is used in special scenarios, the traffic of the network path will also increase. Using a fixed traffic threshold as a reference value for analysis will lead to frequent false alarms from the analysis system. Summary of the Invention

[0006] The purpose of this invention is to provide a network path analysis system and method for detecting network security anomalies, in order to address the shortcomings in the prior art.

[0007] To achieve the above objectives, the present invention provides the following technical solution: a network path analysis method for network security anomaly detection, the analysis method comprising the following steps:

[0008] S1: Analyze the system port to obtain historical traffic data of the network path operating environment. The historical traffic data includes normal traffic data and abnormal traffic data. Based on the normal traffic data and abnormal traffic data, the initial traffic threshold of the current operating environment is generated through a threshold algorithm.

[0009] S2: The analysis system periodically performs self-checks to analyze its own operating status and determines whether the current operating status supports network path security anomaly detection. If the current operating status does not support network path security anomaly detection, a warning signal is sent to the network administrator.

[0010] S3: If the operating status supports the detection of security anomalies in the network path, the analysis system will monitor the network traffic of the network path in real time.

[0011] S4: Obtain all special scenarios in the network path operation environment, analyze all special scenarios based on the regression analysis model to obtain regression coefficients, and combine the regression coefficients with the operation status of the analysis system to generate a correction index.

[0012] S5: The analysis system obtains a dynamic traffic threshold after adjusting the initial traffic threshold by correcting the index. It compares the real-time network traffic with the dynamic traffic threshold. When the network traffic exceeds the dynamic traffic threshold, it generates a corresponding management policy and sends a warning signal to the administrator.

[0013] In a preferred embodiment, step S1, generating the initial traffic threshold for the current operating environment based on normal traffic data and abnormal traffic data using a threshold algorithm, includes the following steps:

[0014] S101: Obtain the average traffic and standard deviation of traffic when the network path is used normally in the current operating environment;

[0015] S102: Obtain the average traffic of abnormal traffic when the network path is used in the current operating environment;

[0016] S103: The initial flow threshold is calculated by taking the average flow value of abnormal flow, the standard deviation of normal flow, and the average flow value of normal flow. The expression is:

[0017] In the formula, yz 初始 Y is the initial flow threshold. avg Y represents the average flow rate of abnormal flow. max P represents the maximum flow rate of abnormal flow, P represents the average flow rate of normal flow, and LQ represents the standard deviation of normal flow.

[0018] In a preferred embodiment, the expression for calculating the standard deviation LQ of the normal flow rate is: In the formula, This represents the average flow rate during normal operation, and i = {1, 2, 3, ..., n}, where n represents the number of normal flow sampling points, and n is a positive integer. P i This represents the flow rate value at the i-th normal flow sampling point;

[0019] The formula for calculating the average flow value of the abnormal flow is:

[0020] In the formula, j = {1, 2, 3, ..., m}, m represents the number of abnormal flow sampling points, and m is a positive integer. j Y represents the flow rate value at the j-th abnormal flow sampling point. avg This represents the average flow rate of abnormal traffic.

[0021] In a preferred embodiment, step S2, where the analysis system periodically performs self-checks to analyze its own operational status and determines whether the current operational status supports network path security anomaly detection, includes the following steps:

[0022] S201: The time period for obtaining computing power warnings and the time period for error warnings;

[0023] S202: Integrate the time periods for computing power warnings and error warnings to obtain the self-checking coefficients zj of the analysis system. x , expressed as: Z(t) represents the change in the response time of the analyzed system, [t x , t y [t] represents the time period for computing power warning. i , t j [This refers to the time period for error alerts;]

[0024] S203: Obtain the self-test coefficient zj x Then, the self-check coefficient zj x The system is compared with a preset first self-test threshold and a second self-test threshold. The second self-test threshold is used to determine whether the analysis system supports security anomaly detection of network paths, and the first self-test threshold is used to determine whether there are minor anomalies in the analysis system.

[0025] S204: If the self-checking coefficient zj x > The second self-test threshold determines that the analysis system does not support security anomaly detection of network paths and sends a warning signal to the network administrator;

[0026] S205: If the self-checking coefficient zj x If the value is less than or equal to the second self-test threshold, the system is deemed to support security anomaly detection of network paths.

[0027] S206: If the first self-test threshold is less than the self-test coefficient zj x If the threshold is less than or equal to the second self-test threshold, it indicates that the analysis system supports the detection of security anomalies in network paths, but the analysis system has minor anomalies, and the initial threshold needs to be dynamically adjusted.

[0028] S207: If the self-checking coefficient zjx If the value is less than or equal to the first self-test threshold, it is determined that the analysis system supports security anomaly detection of network paths and that there are no anomalies in the analysis system.

[0029] In a preferred embodiment, the analysis system monitors real-time computing power. When the real-time computing power is lower than the computing power threshold, the system records this time period. The longer the real-time computing power is lower than the computing power threshold, the less the analysis system supports the detection of security anomalies in network paths. The time period when the real-time computing power is lower than the computing power threshold is used as the computing power warning period.

[0030] When the analysis system reports an error, it records the number of consecutive errors. When the number of consecutive errors exceeds a threshold, the time period during which the number of consecutive errors exceeds the threshold is the period for error warning.

[0031] In a preferred embodiment, step S4 involves obtaining all special scenarios in the network path operation environment and then analyzing all special scenarios based on a regression analysis model to obtain regression coefficients, including the following steps:

[0032] Identify all special scenarios affecting network traffic growth in the current operating environment. These special scenarios include primary and secondary scenarios. Create a set `s` containing all primary special scenarios, where each primary special scenario in `s` is represented as {s1, s2, ..., s...}. k Let k be the number of major special scenarios in set s. The regression coefficients are calculated using Logistic regression analysis, and the coefficient expression is:

[0033]

[0034] In the formula, hg z Here, is the regression coefficient, and Q is a constant term with a value of 0.442, representing the magnitude of the influence of the secondary special scenario on the regression coefficient when the primary special scenario does not exist. {s1, s2, ..., s...} k Let {ω1, ω2, ..., ω} be the variables. k} represents the regression coefficients of each variable, and the regression coefficient w>0.

[0035] In a preferred embodiment, step S4, which combines the regression coefficients with the operating status of the analysis system to generate the correction index, includes the following steps:

[0036] If the first self-test threshold is less than the self-test coefficient zj x If the threshold is less than or equal to the second self-test threshold, it indicates that the analysis system supports the detection of security anomalies in network paths, but the analysis system has a minor anomaly, and the initial threshold is dynamically adjusted.

[0037] The self-check coefficient zj is obtained when the analysis system has a slight anomaly. xThe value zj represents the self-checking coefficient when the analysis system exhibits a slight anomaly. x Value and regression coefficient hg z The correction index is generated by combining these factors, and the calculation expression is as follows: In the formula, zj x hg is the self-test coefficient. z xz represents the regression coefficient. s To correct the index.

[0038] In a preferred embodiment, step S4, obtaining the dynamic flow threshold after adjusting the initial flow threshold by a correction exponent, includes the following steps: obtaining the dynamic flow threshold after adjusting the initial flow threshold by a correction exponent, expressed as: In the formula, yz 动态 For dynamic traffic thresholds, yz 初始 xz is the initial traffic threshold. s To correct the index.

[0039] In a preferred embodiment, step S5, where the analysis system compares the real-time acquired network traffic with the dynamic traffic threshold, includes the following steps:

[0040] S501: After the analysis system obtains the dynamic traffic threshold, it compares the network traffic of the network path obtained in real time with the dynamic traffic threshold.

[0041] S502: If network traffic is less than or equal to the dynamic traffic threshold, the analysis shows that there are no security anomalies in the current network path;

[0042] S503: If network traffic exceeds the dynamic traffic threshold, analyze the current network path for security anomalies, generate corresponding management policies, and send warning signals to the administrator.

[0043] This invention also provides a network path analysis system for detecting network security anomalies, including a port module, an initialization module, a self-test module, a traffic monitoring module, a scenario analysis module, a threshold optimization module, and an alert module.

[0044] Port module: Obtains historical traffic data of the network path operating environment. The historical traffic data includes normal traffic data and abnormal traffic data. The normal traffic data and abnormal traffic data are sent to the initialization module.

[0045] Initialization module: Based on normal traffic data and abnormal traffic data, it generates the initial traffic threshold for the current operating environment through a threshold algorithm, and sends the initial traffic threshold to the threshold optimization module;

[0046] Self-check module: Performs self-checks and analyses of its own operating status at regular intervals, and determines whether the current operating status supports network path security anomaly detection. If the current operating status does not support network path security anomaly detection, it sends a warning signal to the network administrator, and the network path judgment result is sent to the traffic monitoring module.

[0047] Traffic monitoring module: If the operating status supports the detection of security anomalies in the network path, the analysis system monitors the network traffic of the network path in real time and sends the network traffic to the alert module;

[0048] Scenario Analysis Module: Acquires all special scenarios in the network path operation environment, analyzes all special scenarios based on a regression analysis model to obtain regression coefficients, combines the regression coefficients with the operating status of the analysis system to generate a correction index, and sends the correction index to the threshold optimization module.

[0049] Threshold optimization module: Obtains dynamic traffic threshold by adjusting the initial traffic threshold through a correction index;

[0050] Alert module: Compares real-time network traffic with dynamic traffic thresholds. When network traffic exceeds the dynamic traffic threshold, it generates corresponding management policies and sends alert signals to the administrator.

[0051] The technical effects and advantages provided by the present invention in the above technical solution are as follows:

[0052] 1. This invention analyzes the system's operational status periodically to determine if it supports network path security anomaly detection. If not, it sends a warning signal to the network administrator. If the system supports detection, it monitors network traffic in real-time, identifies all special scenarios within the network path's operating environment, analyzes these scenarios using a regression analysis model to obtain regression coefficients, and combines these coefficients with the system's operational status to generate a correction index. This correction index is then used to adjust the initial traffic threshold, resulting in a dynamic traffic threshold. This system performs real-time self-checks during use to ensure the stability of network path detection. Furthermore, by adjusting the initial traffic threshold based on specific scenarios in the operating environment and the system's operational status, it effectively avoids frequent false alarms in special scenarios. Attached Figure Description

[0053] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0054] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0055] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0056] Example 1: Please refer to Figure 1 As shown in this embodiment, the network path analysis method for network security anomaly detection includes the following steps:

[0057] The system analyzes historical traffic data from the network path operating environment, including both normal and abnormal traffic data. Based on this data, an initial traffic threshold is generated using a threshold algorithm. The system periodically performs self-checks to determine its operational status and whether it supports network path security anomaly detection. If not, an alert is sent to the network administrator. If support is provided, the system monitors network traffic in real-time, identifying all special scenarios within the network path operating environment. These scenarios are then analyzed using a regression model to obtain regression coefficients. These coefficients are combined with the system's operational status to generate a correction index. The initial traffic threshold is adjusted using this index to obtain a dynamic traffic threshold. The system compares the real-time network traffic with the dynamic traffic threshold. When network traffic exceeds the dynamic threshold, a corresponding management policy is generated, and an alert is sent to the administrator.

[0058] This application analyzes the system's operational status periodically to determine if it supports network path security anomaly detection. If not, it sends a warning signal to the network administrator. If the system supports detection, it monitors network traffic in real-time, identifying all special scenarios within the network path's operating environment. These scenarios are then analyzed using a regression model to obtain regression coefficients. These coefficients are combined with the system's operational status to generate a correction index. The initial traffic threshold is adjusted using this correction index to obtain a dynamic traffic threshold. This system performs real-time self-checks during use to ensure the stability of network path detection. Furthermore, by adjusting the initial traffic threshold based on specific scenarios in the operating environment and the system's operational status, it effectively avoids frequent false alarms in special scenarios.

[0059] Analyze the system ports to obtain historical traffic data of the network path operating environment. Historical traffic data includes both normal and abnormal traffic data. Specifically:

[0060] Normal traffic data: Understanding the patterns of normal traffic, including peak and off-peak periods, common communication patterns, and traffic periodicity, helps establish a baseline for normal traffic and makes it easier to detect abnormal traffic that does not conform to normal patterns. Analyzing the ports involved in normal traffic, including common service ports and application ports, and understanding the usage frequency and communication patterns of different ports, enables the identification of unusual port activity in subsequent anomaly detection. Analyzing users and devices related to traffic and understanding their normal behavior patterns, including login frequency, data transmission patterns, etc., helps detect abnormal activities that differ from normal behavior.

[0061] Anomaly traffic data: Studying port-related security event logs, including connection denials, malware propagation attempts, port scans, etc., helps identify specific port activity associated with abnormal behavior and detect unauthorized access behaviors, such as the use of unauthorized ports, illegal port scans, intrusion attempts, etc. This can be achieved by examining network logs and security event logs related to port activity. Analyzing abnormal data traffic, including large-scale data transfers, abnormal data transfer patterns, and unusually frequent connections and disconnections, helps to discover potential data breaches or attacks.

[0062] Based on normal and abnormal traffic data, an initial traffic threshold for the current operating environment is generated using a threshold algorithm, specifically:

[0063] Obtain the average traffic and standard deviation of the network path under normal traffic conditions in the current operating environment (i.e., the security tools of the current operating environment have not detected any attacks or anomalies);

[0064] in:

[0065] The expression for calculating the standard deviation (LQ) of normal flow is: In the formula, This represents the average flow rate during normal operation, and i = {1, 2, 3, ..., n}, where n represents the number of normal traffic sampling points (i.e., the traffic value obtained per day or hour), and n is a positive integer. i This represents the flow rate value at the i-th normal flow sampling point;

[0066] The average traffic of abnormal traffic (i.e., attacks or anomalies detected by security tools in the current operating environment) when the network path is used is calculated using the following expression:

[0067] In the formula, j = {1, 2, 3, ..., m}, m represents the number of abnormal traffic sampling points (i.e., the traffic value obtained per day or hour), m is a positive integer, and Y j Y represents the flow rate value at the j-th abnormal flow sampling point. avg The average flow rate value representing abnormal flow;

[0068] Then the average flow value Y of the abnormal flow avg The standard deviation of normal flow rate (LQ) and the average flow rate of normal flow rate. The initial traffic threshold is calculated using the following expression:

[0069] In the formula, yz 初始 Y is the initial flow threshold. avg Y represents the average flow rate of the abnormal flow. max P represents the maximum flow rate of abnormal flow, P represents the average flow rate of normal flow, and LQ represents the standard deviation of normal flow.

[0070] The analysis system periodically performs self-checks to analyze its own operational status and determine whether the current operational status supports network path security anomaly detection. If the current operational status does not support network path security anomaly detection, an alert signal is sent to the network administrator. If the operational status supports network path security anomaly detection, the analysis system monitors network traffic in real time, acquires all special scenarios in the network path's operating environment, analyzes all special scenarios based on a regression analysis model to obtain regression coefficients, combines the regression coefficients with the analysis system's operational status to generate a correction index, adjusts the initial traffic threshold using the correction index to obtain a dynamic traffic threshold, and compares the real-time network traffic with the dynamic traffic threshold. When the network traffic exceeds the dynamic traffic threshold, the analysis system generates corresponding management policies and sends an alert signal to the administrator.

[0071] Example 2: The analysis system periodically performs self-checks to analyze its own operational status and determines whether the current operational status supports network path security anomaly detection. If the current operational status does not support network path security anomaly detection, an alert signal is sent to the network administrator. If the operational status supports network path security anomaly detection, the analysis system monitors network traffic along the network path in real time, specifically:

[0072] Because the analysis system needs to maintain a certain computing power when performing network path security anomaly detection to avoid analysis delays or even pauses, the analysis system monitors real-time computing power. When the real-time computing power is lower than the computing power threshold, this time period is recorded. The longer the real-time computing power is lower than the computing power threshold, the less the analysis system supports network path security anomaly detection. Therefore, the time period when the real-time computing power is lower than the computing power threshold is used as the computing power warning period.

[0073] When the analysis system frequently reports errors during operation, it indicates that the analysis system may have problems such as data loss, crashes, or freezes. Therefore, when the analysis system reports an error, the number of consecutive error reports should be recorded (the time interval between consecutive error reports should be within 5 minutes; if the time interval between the next error report and the previous error report exceeds 5 minutes, it will not be counted as a consecutive error report). When the number of consecutive error reports exceeds the threshold, the analysis system may be unable to continue monitoring the network path or the analysis system may go offline directly. Therefore, the time period when the number of consecutive error reports exceeds the threshold is the error warning period.

[0074] The self-checking coefficient zj of the analysis system is obtained by integrating the time periods of computing power warning and error warning. x , expressed as: Z(t) represents the change in the response time of the analyzed system, [t x , t y [t] represents the time period for computing power warning. i , t j [This refers to the time period for error alerts;]

[0075] Obtain the self-test coefficient zj x Then, the self-check coefficient zj x The system is compared with a preset first self-test threshold and a second self-test threshold. The second self-test threshold is used to determine whether the analysis system supports security anomaly detection of network paths, and the first self-test threshold is used to determine whether there are minor anomalies in the analysis system.

[0076] If the self-test coefficient zj x > The second self-test threshold determines whether the analysis system does not support security anomaly detection for network paths;

[0077] If the self-test coefficient zj xIf the value is less than or equal to the second self-test threshold, the system is deemed to support security anomaly detection of network paths, and the system monitors network traffic of network paths in real time.

[0078] If the first self-test threshold is less than the self-test coefficient zj x If the threshold is less than or equal to the second self-test threshold, it indicates that the analysis system supports the detection of security anomalies in network paths, but the analysis system has minor anomalies, and the initial threshold needs to be dynamically adjusted.

[0079] If the self-test coefficient zj x If the value is less than or equal to the first self-test threshold, it is determined that the analysis system supports security anomaly detection of network paths and that there are no anomalies in the analysis system.

[0080] All special scenarios in the network path operation environment are identified, and regression coefficients are obtained after analyzing all special scenarios based on a regression analysis model. Specifically:

[0081] Identify all special scenarios affecting network traffic growth in the current operating environment. These special scenarios include primary and secondary scenarios. Create a set `s` containing all primary special scenarios, where each primary special scenario in `s` is represented as {s1, s2, ..., s...}. k Let k be the number of major special scenarios in set s. The regression coefficients are calculated using Logistic regression analysis, and the coefficient expression is:

[0082]

[0083] In the formula, hg z Here, is the regression coefficient, and Q is a constant term with a value of 0.442, representing the magnitude of the influence of the secondary special scenario on the regression coefficient when the primary special scenario does not exist. {s1, s2, ..., s...} k} represents the number of special scenarios, {ω1, ω2, ..., ω k} represents the regression coefficients of each variable, and the regression coefficient w>0;

[0084] To better illustrate the Logistic Regression analysis method, we provide the following example:

[0085] For example, for e-commerce platforms, in some special scenarios (such as Double 11, when e-commerce platforms will carry out various promotions and traffic will increase sharply), the number of online users increases, and therefore, the traffic of e-commerce platforms will increase sharply in special scenarios. Therefore, regression analysis can be performed by obtaining the number of online users on the e-commerce platform in special scenarios over a period of time.

[0086] Q is a constant term with a value of 0.442, representing the influence of secondary special scenarios on the regression coefficient when the main special scenarios do not exist. For example, taking an e-commerce platform as an example, during holidays, the number of users online is usually higher than the number of users online on non-holidays.

[0087] The regression coefficient hg used in this invention z The logical components are as follows: Taking the impact of major special scenarios on network traffic as an example, the components are: first, indicators, i.e., the factors that cause changes in special scenarios (in this invention, the impact of major special scenarios on network traffic growth); second, the weights of these indicators, i.e., the proportion that each major special scenario accounts for when it occurs; and third, the calculation equation, i.e., the mathematical calculation process used to obtain the result, and the regression coefficient hg obtained by calculating the indicators with their respective weights through the calculation equation. z .

[0088] The main specific scenarios obtained from the sample were transformed and processed into data language recognizable by computer software. Secondly, these evaluation factors were analyzed using SPSS software through Logistic Regression to identify factors and their weights that were significantly correlated with the results. Thirdly, the evaluation factors and weights were input into the Logistic Regression equation to obtain the results, specifically:

[0089] First, ensure the integrity of the main special scenarios, handle missing and outlier values, and convert the data to a format that SPSS software can recognize. This is typically done by storing the data in .csv, .xlsx, or similar formats, and then importing it into SPSS. Open SPSS, import the processed data file, and transform the variables as needed. For example, for continuous variables, perform standardization or normalization. Select the "Analyze" menu, then select the "Regression" option and choose the "Bivariate Logistic" option. In the dialog box, add the dependent variable (outcome) and independent variables (main special scenarios) to the corresponding boxes. SPSS will then fit a Logistic regression based on the selected variables. The model output will show information such as coefficients, standard errors, and p-values. Examining the coefficients and p-values ​​helps determine which variables are significantly correlated with the outcome. Typically, a p-value less than 0.05 is considered significant. While fitting the model, variable selection methods, such as stepwise regression, are used to help screen for the most relevant factors. Based on the coefficients of the logistic regression model, the magnitude of the coefficients reflects the degree of influence of each factor on the outcome, and the sign of the coefficients indicates the direction of influence. After obtaining the significant factors and their coefficients, the logistic regression equation is obtained. This equation is used to calculate the probability of each sample and thus predict the outcome.

[0090] The regression coefficients are combined with the operating status of the analysis system to generate a correction index. The initial flow threshold is then adjusted using this correction index to obtain the dynamic flow threshold. Specifically:

[0091] If the first self-test threshold is less than the self-test coefficient zj x If the threshold is less than or equal to the second self-test threshold, it indicates that the analysis system supports the detection of security anomalies in network paths, but the analysis system has minor anomalies, and the initial threshold needs to be dynamically adjusted.

[0092] When the analysis system has a slight anomaly, it indicates that the analysis efficiency of the analysis system has decreased. In order to ensure the timely detection of network path security anomalies by the analysis system, the initial threshold needs to be reduced to avoid the analysis system failing to detect anomalies in a timely manner.

[0093] From the regression coefficient hg z From the calculation expression, we can see that the regression coefficient hg z It is mainly used to analyze special scenarios where network path traffic increases. When special scenarios occur in the operating environment, the initial threshold needs to be increased to avoid frequent false alarms from the analysis system.

[0094] The self-check coefficient zj is obtained when the analysis system has a slight anomaly. x The value zj represents the self-checking coefficient when the analysis system exhibits a slight anomaly. x Value and regression coefficient hg z The correction index is generated by combining these factors, and the calculation expression is as follows: In the formula, zj x hg is the self-test coefficient. z xz represents the regression coefficient. s To correct the index, the larger the correction index, the more necessary it is to increase the initial flow threshold.

[0095] The dynamic traffic threshold is obtained by adjusting the initial traffic threshold using a correction exponent, and the expression is: In the formula, yz 动态 For dynamic traffic thresholds, yz 初始 xz is the initial traffic threshold. s To correct the index.

[0096] The analysis system compares real-time network traffic with dynamic traffic thresholds. When network traffic exceeds the dynamic traffic threshold, it generates corresponding management policies and sends warning signals to the administrator. Specifically:

[0097] After the analysis system obtains the dynamic traffic threshold, it compares the network traffic of the network path obtained in real time with the dynamic traffic threshold.

[0098] If network traffic is less than or equal to the dynamic traffic threshold, the analysis shows that there are no security anomalies in the current network path.

[0099] If network traffic exceeds the dynamic traffic threshold, an anomaly is detected in the current network path. A corresponding management policy is generated, and an alert signal is sent to the administrator. Specifically:

[0100] Based on the results of anomaly analysis, corresponding management policies are generated. These may include blocking specific IP addresses, closing specific ports, and isolating infected systems. Considering overall network security, management policies may also include updating firewall rules, adjusting access control lists (ACLs), and configuring real-time response mechanisms to ensure that the system can take swift action when anomalies are detected. This may involve automated scripts, API calls, or integration with other security devices to ensure that response policies are granular to minimize interference with normal business operations.

[0101] Upon confirming a security anomaly, generate a detailed report and alerts, including a description of the anomalous behavior, its scope of impact, and threat level. Send real-time alerts to administrators, typically via email, SMS, instant messaging, or integration into a Security Information and Event Management (SIEM) system. Develop a detailed security report, including implemented management strategies, a timeline of the anomalous behavior, and its scope of impact. The report should be easy to understand to assist administrators in quickly understanding and responding to security incidents. Collect and analyze administrator feedback on alerts to ensure the accuracy and effectiveness of the system. Continuously optimize and adjust the system to adapt to new threats and changes in the network environment. Ensure that generated management strategies and alerts comply with relevant compliance and regulatory requirements. When notifying administrators, provide relevant compliance information to ensure the organization's compliance with regulatory requirements during security incident response.

[0102] Example 3: The network path analysis system for network security anomaly detection described in this example includes a port module, an initialization module, a self-test module, a traffic monitoring module, a scenario analysis module, a threshold optimization module, and an alert module.

[0103] Port module: Obtains historical traffic data of the network path operating environment. The historical traffic data includes normal traffic data and abnormal traffic data. The normal traffic data and abnormal traffic data are sent to the initialization module.

[0104] Initialization module: Based on normal traffic data and abnormal traffic data, it generates the initial traffic threshold for the current operating environment through a threshold algorithm, and sends the initial traffic threshold to the threshold optimization module;

[0105] Self-check module: Performs self-checks and analyses of its own operating status at regular intervals, and determines whether the current operating status supports network path security anomaly detection. If the current operating status does not support network path security anomaly detection, it sends a warning signal to the network administrator, and the network path judgment result is sent to the traffic monitoring module.

[0106] Traffic monitoring module: If the operating status supports the detection of security anomalies in the network path, the analysis system monitors the network traffic of the network path in real time and sends the network traffic to the alert module;

[0107] Scenario Analysis Module: Acquires all special scenarios in the network path operation environment, analyzes all special scenarios based on a regression analysis model to obtain regression coefficients, combines the regression coefficients with the operating status of the analysis system to generate a correction index, and sends the correction index to the threshold optimization module.

[0108] Threshold optimization module: Obtains dynamic traffic threshold by adjusting the initial traffic threshold through a correction index;

[0109] Alert module: Compares real-time network traffic with dynamic traffic thresholds. When network traffic exceeds the dynamic traffic threshold, it generates corresponding management policies and sends alert signals to the administrator.

[0110] The above formulas are all dimensionless calculations. The formulas are derived from software simulations based on a large amount of collected data to obtain the most recent real-world results. The preset parameters in the formulas are set by those skilled in the art according to the actual situation.

[0111] It should be understood that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. A and B can be singular or plural. Additionally, the character " / " in this article generally indicates an "or" relationship between the preceding and following related objects, but it can also represent an "and / or" relationship. Please refer to the context for a more accurate understanding.

[0112] It should be understood that in the various embodiments of this application, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0113] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0114] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A network path analysis method for network security anomaly detection, characterized in that: The analytical method includes the following steps: S1: Analyze the system port to obtain historical traffic data of the network path operating environment. The historical traffic data includes normal traffic data and abnormal traffic data. Based on the normal traffic data and abnormal traffic data, the initial traffic threshold of the current operating environment is generated through a threshold algorithm. S2: The analysis system periodically performs self-checks to analyze its own operating status and determines whether the current operating status supports network path security anomaly detection. If the current operating status does not support network path security anomaly detection, a warning signal is sent to the network administrator. S3: If the operating status supports the detection of security anomalies in the network path, the analysis system will monitor the network traffic of the network path in real time. S4: Obtain all special scenarios in the network path operation environment, analyze all special scenarios based on the regression analysis model to obtain regression coefficients, and combine the regression coefficients with the operation status of the analysis system to generate a correction index. S5: The analysis system obtains a dynamic traffic threshold after adjusting the initial traffic threshold by correcting the index. It compares the real-time network traffic with the dynamic traffic threshold. When the network traffic exceeds the dynamic traffic threshold, it generates a corresponding management policy and sends a warning signal to the administrator.

2. The network path analysis method for network security anomaly detection according to claim 1, characterized in that: In step S1, generating the initial traffic threshold for the current operating environment based on normal and abnormal traffic data using a threshold algorithm includes the following steps: S101: Obtain the average traffic and standard deviation of traffic when the network path is used normally in the current operating environment; S102: Obtain the average traffic of abnormal traffic when the network path is used in the current operating environment; S103: The initial flow threshold is calculated by taking the average flow value of abnormal flow, the standard deviation of normal flow, and the average flow value of normal flow. The expression is: In the formula, yz 初始 Y is the initial flow threshold. avg Y represents the average flow rate of the abnormal flow. max The maximum abnormal traffic value. LQ represents the average flow rate of normal flow, and LQ represents the standard deviation of normal flow.

3. The network path analysis method for network security anomaly detection according to claim 2, characterized in that: The expression for calculating the standard deviation (LQ) of the normal flow rate is: In the formula, This represents the average flow rate during normal operation, and n represents the number of normal flow sampling points, where n is a positive integer, and P i This represents the flow rate value at the i-th normal flow sampling point; The formula for calculating the average flow value of the abnormal flow is: In the formula, j = {1, 2, 3, ..., m}, m represents the number of abnormal flow sampling points, and m is a positive integer. j Y represents the flow rate value at the j-th abnormal flow sampling point. avg This represents the average flow rate of abnormal traffic.

4. The network path analysis method for network security anomaly detection according to claim 3, characterized in that: In step S2, the analysis system periodically performs self-checks to analyze its own operational status and determines whether the current operational status supports the detection of security anomalies in the network path, including the following steps: S201: The time period for obtaining computing power warnings and the time period for error warnings; S202: Integrate the time periods for computing power warnings and error warnings to obtain the self-checking coefficients zj of the analysis system. x , expressed as: Z(t) represents the change in the response time of the analyzed system, [t x , t y [t] represents the time period for computing power warning. i , t j [This refers to the time period for error alerts;] S203: Obtain the self-test coefficient zj x Then, the self-check coefficient zj x The system is compared with a preset first self-test threshold and a second self-test threshold. The second self-test threshold is used to determine whether the analysis system supports security anomaly detection of network paths, and the first self-test threshold is used to determine whether there are minor anomalies in the analysis system. S204: If the self-checking coefficient zj x > The second self-test threshold determines that the analysis system does not support security anomaly detection of network paths and sends a warning signal to the network administrator; S205: If the self-checking coefficient zj x If the value is less than or equal to the second self-test threshold, the system is deemed to support security anomaly detection of network paths. S206: If the first self-test threshold is less than the self-test coefficient zj x If the threshold is less than or equal to the second self-test threshold, it indicates that the analysis system supports the detection of security anomalies in network paths, but the analysis system has minor anomalies, and the initial threshold needs to be dynamically adjusted. S207: If the self-check coefficient zj x If the value is less than or equal to the first self-test threshold, it is determined that the analysis system supports security anomaly detection of network paths and that there are no anomalies in the analysis system.

5. The network path analysis method for network security anomaly detection according to claim 4, characterized in that: The analysis system monitors real-time computing power. When the real-time computing power is lower than the computing power threshold, it records this time period. The longer the real-time computing power is lower than the computing power threshold, the less the analysis system supports the detection of security anomalies in the network path. The time period when the real-time computing power is lower than the computing power threshold is used as the computing power warning period. When the analysis system reports an error, it records the number of consecutive errors. When the number of consecutive errors exceeds a threshold, the time period during which the number of consecutive errors exceeds the threshold is the period for error warning.

6. The network path analysis method for network security anomaly detection according to claim 5, characterized in that: In step S4, all special scenarios in the network path operation environment are obtained, and the regression coefficients are obtained after analyzing all special scenarios based on the regression analysis model, including the following steps: Identify all special scenarios affecting network traffic growth in the current operating environment. These special scenarios include primary and secondary scenarios. Create a set `s` containing all primary special scenarios, where each primary special scenario in `s` is represented as {s1, s2, ..., s...}. k Let k be the number of major special scenarios in set s. The regression coefficients are calculated using Logistic regression analysis, and the coefficient expression is: In the formula, hg z Here, is the regression coefficient, and Q is a constant term with a value of 0.442, representing the magnitude of the influence of the secondary special scenario on the regression coefficient when the primary special scenario does not exist. {s1, s2, ..., s...} k Let {ω1, ω2, ..., ω} be the variables. k } represents the regression coefficients of each variable, and the regression coefficient w>0.

7. The network path analysis method for network security anomaly detection according to claim 6, characterized in that: In step S4, the process of generating a correction index by combining the regression coefficients with the operating status of the analysis system includes the following steps: If the first self-test threshold is less than the self-test coefficient zj x If the threshold is less than or equal to the second self-test threshold, it indicates that the analysis system supports the detection of security anomalies in network paths, but the analysis system has a minor anomaly, and the initial threshold is dynamically adjusted. The self-check coefficient zj is obtained when the analysis system has a slight anomaly. x The value zj represents the self-checking coefficient when the analysis system exhibits a slight anomaly. x Value and regression coefficient hg z The correction index is generated by combining these factors, and the calculation expression is as follows: In the formula, zj x hg is the self-test coefficient. z xz represents the regression coefficient. s To correct the index.

8. The network path analysis method for network security anomaly detection according to claim 7, characterized in that: Step S4, obtaining the dynamic flow threshold after adjusting the initial flow threshold by the correction exponent, includes the following steps: The dynamic flow threshold is obtained after adjusting the initial flow threshold by the correction exponent, expressed as: In the formula, yz 动态 For dynamic traffic thresholds, yz 初始 xz is the initial traffic threshold. s To correct the index.

9. The network path analysis method for network security anomaly detection according to claim 8, characterized in that: In step S5, the analysis system compares the real-time network traffic with the dynamic traffic threshold, including the following steps: S501: After the analysis system obtains the dynamic traffic threshold, it compares the network traffic of the network path obtained in real time with the dynamic traffic threshold. S502: If network traffic is less than or equal to the dynamic traffic threshold, the analysis shows that there are no security anomalies in the current network path; S503: If network traffic exceeds the dynamic traffic threshold, analyze the current network path for security anomalies, generate corresponding management policies, and send warning signals to the administrator.

10. A network path analysis system for network security anomaly detection, used to implement the analysis method according to any one of claims 1-9, characterized in that: Includes a port module, initialization module, self-test module, traffic monitoring module, scenario analysis module, threshold optimization module, and alert module. Port module: Obtains historical traffic data of the network path operating environment. The historical traffic data includes normal traffic data and abnormal traffic data. The normal traffic data and abnormal traffic data are sent to the initialization module. Initialization module: Based on normal traffic data and abnormal traffic data, it generates the initial traffic threshold for the current operating environment through a threshold algorithm, and sends the initial traffic threshold to the threshold optimization module; Self-check module: Performs self-checks and analyses of its own operating status at regular intervals, and determines whether the current operating status supports network path security anomaly detection. If the current operating status does not support network path security anomaly detection, it sends a warning signal to the network administrator, and the network path judgment result is sent to the traffic monitoring module. Traffic monitoring module: If the operating status supports the detection of security anomalies in the network path, the analysis system monitors the network traffic of the network path in real time and sends the network traffic to the alert module; Scenario Analysis Module: Acquires all special scenarios in the network path operation environment, analyzes all special scenarios based on a regression analysis model to obtain regression coefficients, combines the regression coefficients with the operating status of the analysis system to generate a correction index, and sends the correction index to the threshold optimization module. Threshold optimization module: Obtains dynamic traffic threshold by adjusting the initial traffic threshold through a correction index; Alert module: Compares real-time network traffic with dynamic traffic thresholds. When network traffic exceeds the dynamic traffic threshold, it generates corresponding management policies and sends alert signals to the administrator.

Images