Firewall real-time data flow monitoring method, device, system and medium

Abstract

The present application provides a method, device, system and medium for monitoring real-time data flow of a firewall. The method obtains a first transmission characteristic parameter of the first data to be monitored passing through a first layer of firewall on a first communication link, and a second transmission characteristic parameter passing through a second layer of firewall, wherein the second transmission characteristic parameter includes first actual flow information of the first data to be monitored, and then determines a first data monitoring state of the first data to be monitored according to the first expected flow information, the first actual flow information and the first authorization information, and determines a third communication link according to the first data monitoring state and a preset communication link selection model, thereby transmitting the first data to be monitored to a target terminal device, and then realizing real-time data flow monitoring based on a multi-layer firewall to determine the first data monitoring state, so as to ensure that the firewall effectively monitors data packets with abnormal data flow, so as to ensure the security of network transmission.

Description

Technical Field

[0001] The present application relates to data processing technology, and in particular to a method, device, system and medium for monitoring real-time data traffic of a firewall. Background Art

[0002] Firewall technology is a technology that helps computer networks build a relatively isolated protective barrier between their internal and external networks by organically combining various software and hardware devices used for security management and screening, so as to protect the security of user data and information.

[0003] The function of firewall technology is mainly to promptly discover and deal with security risks, data transmission and other problems that may exist during the operation of computer networks. The treatment measures include isolation and protection. At the same time, it can record and detect various operations in computer network security to ensure the security of computer network operation and the integrity of user data and information, providing users with a better and safer computer network experience.

[0004] However, existing firewalls are unable to monitor data packets with abnormal traffic during network transmission. Summary of the invention

[0005] The present application provides a method, device, system and medium for monitoring real-time data flow of a firewall, so as to solve the technical problem that the existing firewall cannot monitor data packets with abnormal flow during network transmission.

[0006] In a first aspect, the present application provides a method for monitoring real-time data traffic of a firewall, comprising:

[0007] Acquire a first transmission characteristic parameter of the first data to be monitored passing through the first layer firewall on the first communication link, wherein the first transmission characteristic parameter includes first protocol information of the first data to be monitored, and the first protocol information includes first estimated flow information and first authorization information corresponding to the first data to be monitored;

[0008] Acquire a second transmission characteristic parameter of the first data to be monitored passing through a second layer firewall, wherein the second transmission characteristic parameter includes first actual flow information of the first data to be monitored;

[0009] Determine a first data monitoring state of the first to-be-monitored data according to the first expected flow information, the first actual flow information, and the first authorization information;

[0010] A third communication link is determined according to the first data monitoring state and a preset communication link selection model, and the third communication link is used to transmit the first to-be-monitored data to a target terminal device.

[0011] Optionally, determining the first data monitoring state of the first to-be-monitored data according to the first estimated flow information, the first actual flow information, and the first authorization information includes:

[0012] determining a first flow deviation according to the first estimated flow information and the first actual flow information;

[0013] If the first flow deviation is greater than or equal to a preset first flow deviation threshold, the first data monitoring state is an abnormal state;

[0014] If the first flow deviation is less than the preset first flow deviation threshold and greater than the preset second flow deviation threshold, determining a corresponding first authority range according to the first authorization information;

[0015] If the first authority range is higher than the preset authority range, the first data monitoring state is a normal state;

[0016] If the first authority range is lower than the preset authority range, the first data monitoring state is a flow pending confirmation state.

[0017] Optionally, determining the third communication link according to the first data monitoring state and a preset communication link selection model includes:

[0018] If the first data monitoring state is the normal state, determining the third communication link according to the first terminal device information in the first protocol information, the first terminal device information is the terminal device information of the first terminal device that initiates the request for the first data to be monitored, and the target terminal device is the first terminal device;

[0019] If the first data monitoring state is the pending confirmation state, the third communication link is a communication link used only to connect to the review terminal device; or, the third communication link is a communication link used to connect to the first terminal device and the review terminal device;

[0020] If the first data monitoring state is the abnormal state, the third communication link is a communication link for connecting to a monitoring terminal device.

[0021] Optionally, after determining the third communication link according to the first data monitoring state and a preset communication link selection model, the method further includes:

[0022] If the third communication link is a communication link used only to connect to the review terminal device, a prompt message is displayed on the review terminal device, and the prompt message is used to prompt the first data to be monitored to be reviewed within a preset time period; if the review result is passed, the review terminal device sends the first data to be monitored to the first terminal device through the fourth communication link; if the review result is not passed, the review terminal device sends the first data to be monitored to the monitoring terminal device through the fifth communication link; or,

[0023] If the third communication link is a communication link for connecting to the first terminal device and the review terminal device, the first terminal device displays a review mark before displaying the first data to be monitored, and the review mark is used to identify that the first data to be monitored is in a review state; if review waiting confirmation information is received on the first terminal device, the first terminal device sends a review prompt to the review terminal to display the prompt information on the review terminal device; if the review result is passed, the review terminal device sends a review confirmation information to the first data to be monitored via the fourth communication link; if the review result is failed, the review terminal device sends data deletion information to the first data to be monitored via the fifth communication link.

[0024] Optionally, after determining the third communication link according to the first data monitoring state and a preset communication link selection model, the method further includes:

[0025] If the third communication link is a communication link for connecting to a monitoring terminal device, the monitoring terminal disconnects the network connection of the monitoring terminal device in response to a data monitoring instruction, and the data monitoring instruction is used to open the first data to be monitored.

[0026] Optionally, before determining the third communication link according to the first data monitoring state and a preset communication link selection model, the method further includes:

[0027] A preset firewall attack detection model is used, and based on the second transmission characteristic parameter, it is determined that the first monitored data is in a safe state after passing through the second layer firewall. The preset firewall attack detection model is a detection module obtained by training a preset Bayesian network neural model using a preset firewall state sample database.

[0028] Optionally, the method for monitoring the real-time data flow of the firewall further includes:

[0029] Obtain the log information of the second layer firewall, wherein the log information includes a data transmission behavior sequence D={d1, d2, ..., d i ,…,d n} corresponds to the data transmission behavior feature set C = {c1, c2, …, c i ,…,c n}, where the i-th data transmission behavior feature c in the data transmission behavior feature set C i is a data transmission behavior feature corresponding to the i-th data transmission behavior in the data transmission sequence D, wherein the data transmission behavior feature includes a plurality of data transmission behavior sub-features, and the data transmission behavior sub-features are at least one of data transmission time, source area, source port, source IP address, communication link switching frequency, and number of transmission actions;

[0030] Generate a behavior feature data set according to the data transmission behavior feature set C Wherein, n is the number of data transmission behaviors in the data transmission behavior sequence D, and m is the number of data transmission behavior sub-features in the data transmission behavior feature;

[0031] Determine the i-th data transmission behavior feature c according to the behavior feature data set P i The corresponding characteristic factor t i , and generate a hash fuzzy matching lookup table based on the characteristic factors corresponding to each data transmission behavior feature in the data transmission behavior feature set C and the log information;

[0032] Generate a keyword matching lookup table according to the data transmission time, the source area, the source port, and the source IP address of each data transmission behavior feature in the data transmission behavior feature set C;

[0033] Generate a sensitive feature matching lookup table according to the communication link switching frequency and the number of transmission actions of each data transmission behavior feature in the data transmission behavior feature set C;

[0034] The preset firewall status sample database is generated according to the hash fuzzy matching lookup table, the keyword matching lookup table and the sensitive feature matching lookup table.

[0035] In a second aspect, the present application provides a firewall real-time data traffic monitoring device, including:

[0036] an acquisition module, configured to acquire a first transmission characteristic parameter of the first data to be monitored passing through the first layer firewall on the first communication link, wherein the first transmission characteristic parameter includes first protocol information of the first data to be monitored, and the first protocol information includes first estimated flow information and first authorization information corresponding to the first data to be monitored;

[0037] The acquisition module is further used to acquire a second transmission characteristic parameter of the first data to be monitored passing through the second layer firewall on the first communication link, wherein the second transmission characteristic parameter includes first actual flow information of the first data to be monitored;

[0038] a processing module, configured to determine a first data monitoring state of the first to-be-monitored data according to the first estimated flow information, the first actual flow information, and the first authorization information;

[0039] The processing module is further used to determine a third communication link according to the first data monitoring state and a preset communication link selection model, and the third communication link is used to transmit the first to-be-monitored data to a target terminal device.

[0040] Optionally, the processing module is specifically used to:

[0041] determining a first flow deviation according to the first estimated flow information and the first actual flow information;

[0042] If the first flow deviation is greater than or equal to a preset first flow deviation threshold, the first data monitoring state is an abnormal state;

[0043] If the first flow deviation is less than the preset first flow deviation threshold and greater than the preset second flow deviation threshold, determining a corresponding first authority range according to the first authorization information;

[0044] If the first authority range is higher than the preset authority range, the first data monitoring state is a normal state;

[0045] If the first authority range is lower than the preset authority range, the first data monitoring state is a flow pending confirmation state.

[0046] Optionally, the processing module is specifically used to:

[0047] If the first data monitoring state is the normal state, determining the third communication link according to the first terminal device information in the first protocol information, the first terminal device information is the terminal device information of the first terminal device that initiates the request for the first data to be monitored, and the target terminal device is the first terminal device;

[0048] If the first data monitoring state is the pending confirmation state, the third communication link is a communication link used only to connect to the review terminal device; or, the third communication link is a communication link used to connect to the first terminal device and the review terminal device;

[0049] If the first data monitoring state is the abnormal state, the third communication link is a communication link for connecting to a monitoring terminal device.

[0050] Optionally, the processing module is specifically used to:

[0051] If the third communication link is a communication link used only to connect to the review terminal device, a prompt message is displayed on the review terminal device, and the prompt message is used to prompt the first data to be monitored to be reviewed within a preset time period; if the review result is passed, the review terminal device sends the first data to be monitored to the first terminal device through the fourth communication link; if the review result is not passed, the review terminal device sends the first data to be monitored to the monitoring terminal device through the fifth communication link; or,

[0052] If the third communication link is a communication link for connecting to the first terminal device and the review terminal device, the first terminal device displays a review mark before displaying the first data to be monitored, and the review mark is used to identify that the first data to be monitored is in a review state; if review waiting confirmation information is received on the first terminal device, the first terminal device sends a review prompt to the review terminal to display the prompt information on the review terminal device; if the review result is passed, the review terminal device sends a review confirmation information to the first data to be monitored via the fourth communication link; if the review result is failed, the review terminal device sends data deletion information to the first data to be monitored via the fifth communication link.

[0053] Optionally, the processing module is specifically used to:

[0054] If the third communication link is a communication link for connecting to a monitoring terminal device, the monitoring terminal disconnects the network connection of the monitoring terminal device in response to a data monitoring instruction, and the data monitoring instruction is used to open the first data to be monitored.

[0055] Optionally, the processing module is specifically used to:

[0056] A preset firewall attack detection model is used, and based on the second transmission characteristic parameter, it is determined that the first monitored data is in a safe state after passing through the second layer firewall. The preset firewall attack detection model is a detection module obtained by training a preset Bayesian network neural model using a preset firewall state sample database.

[0057] Optionally, the processing module is specifically used to:

[0058] Obtain the log information of the second layer firewall, wherein the log information includes a data transmission behavior sequence D={d1, d2, ..., d i ,…,d n} corresponds to the data transmission behavior feature set C = {c1, c2, …, c i ,…,c n}, where the i-th data transmission behavior feature c in the data transmission behavior feature set C i is a data transmission behavior feature corresponding to the i-th data transmission behavior in the data transmission sequence D, wherein the data transmission behavior feature includes a plurality of data transmission behavior sub-features, and the data transmission behavior sub-features are at least one of data transmission time, source area, source port, source IP address, communication link switching frequency, and number of transmission actions;

[0059] Generate a behavior feature data set according to the data transmission behavior feature set C Wherein, n is the number of data transmission behaviors in the data transmission behavior sequence D, and m is the number of data transmission behavior sub-features in the data transmission behavior feature;

[0060] Determine the i-th data transmission behavior feature c according to the behavior feature data set P i The corresponding characteristic factor t i , and generate a hash fuzzy matching lookup table based on the characteristic factors corresponding to each data transmission behavior feature in the data transmission behavior feature set C and the log information;

[0061] Generate a keyword matching lookup table according to the data transmission time, the source area, the source port, and the source IP address of each data transmission behavior feature in the data transmission behavior feature set C;

[0062] Generate a sensitive feature matching lookup table according to the communication link switching frequency and the number of transmission actions of each data transmission behavior feature in the data transmission behavior feature set C;

[0063] The preset firewall status sample database is generated according to the hash fuzzy matching lookup table, the keyword matching lookup table and the sensitive feature matching lookup table.

[0064] In a third aspect, the present application provides an electronic device, including:

[0065] processor; and,

[0066] A memory, configured to store executable instructions of the processor;

[0067] The processor is configured to perform any possible method described in the first aspect by executing the executable instructions.

[0068] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement any possible method described in the first aspect.

[0069] The present application provides a method, device, system and medium for monitoring real-time data traffic of a firewall. By obtaining a first transmission characteristic parameter of the first data to be monitored passing through a first layer firewall on a first communication link, and a second transmission characteristic parameter of the first data to be monitored passing through a second layer firewall, the second transmission characteristic parameter includes first actual traffic information of the first data to be monitored, and then determining a first data monitoring state of the first data to be monitored according to the first expected traffic information, the first actual traffic information and the first authorization information, and determining a third communication link according to the first data monitoring state and a preset communication link selection model, so as to transmit the first data to be monitored to a target terminal device, thereby realizing real-time data traffic monitoring based on a multi-layer firewall to determine the first data monitoring state, so as to ensure that the firewall effectively monitors data packets with abnormal data traffic, so as to ensure the security of network transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0071] Figure 1 It is a flowchart of a method for monitoring real-time data traffic of a firewall according to an exemplary embodiment of the present application;

[0072] Figure 2 is a flowchart of a method for monitoring real-time data traffic of a firewall according to another exemplary embodiment of the present application;

[0073] Figure 3 It is a structural diagram of a firewall real-time data traffic monitoring system according to an exemplary embodiment of the present application;

[0074] Figure 4 It is a schematic diagram of the structure of an electronic device according to an exemplary embodiment of the present application.

[0075] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0076] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0077] Figure 1 FIG. 1 is a flow chart of a method for monitoring real-time data traffic of a firewall according to an exemplary embodiment of the present application. Figure 1 As shown, the method provided in this embodiment includes:

[0078] S101. Obtain first transmission characteristic parameters of first monitored data through a first layer firewall on a first communication link.

[0079] Specifically, it may be to obtain the first transmission characteristic parameter of the first data to be monitored through the first layer of firewall on the first communication link, wherein the first transmission characteristic parameter includes the first protocol information of the first data to be monitored, and the first protocol information includes the first expected traffic information and the first authorization information corresponding to the first data to be monitored. By verifying the above-mentioned first authorization information by the firewall, unauthorized access can be prevented and non-compliant data packets can be rejected from passing through the firewall. In addition, when the first data to be monitored is relevant data sent from the user from the external network to the internal network, different permission ranges can be set for the user, and then the first authorization range can be determined according to the above-mentioned first authorization information, so as to determine the authorization degree and security of the first data to be monitored according to the first authorization range.

[0080] The first estimated traffic information can be determined by determining different protocol header sizes according to different types of network protocols, then determining the size of the existing option field, determining the size of the encapsulation information according to the application layer protocol, and determining the size of the content data according to the data content actually carried in the data packet. In addition, the padding bit and the checksum field can also be obtained to determine the first estimated traffic information. In another optional implementation, a packet capture tool can be used to capture and analyze the data packet, thereby automatically obtaining all components and the total length of the data packet.

[0081] S102: Obtain a second transmission characteristic parameter of the first monitored data passing through the second layer firewall.

[0082] Optionally, a second transmission characteristic parameter of the first monitored data passing through the second layer firewall is obtained, and the second transmission characteristic parameter includes first actual flow information of the first monitored data. Optionally, for the above-mentioned first actual flow information, it can be through a specific instruction in the firewall to view or count the actual flow of the interface in real time, or it can be through the use of Simple Network Management Protocol (SNMP) to obtain more detailed real-time flow information.

[0083] S103: Determine a first data monitoring state of first data to be monitored according to the first estimated flow information, the first actual flow information, and the first authorization information.

[0084] A first data monitoring state of first data to be monitored is determined according to the first estimated flow information, the first actual flow information, and the first authorization information.

[0085] Specifically, the first flow deviation may be determined according to the first estimated flow information and the first actual flow information.

[0086] If the first flow deviation is greater than or equal to a preset first flow deviation threshold, the first data monitoring state is an abnormal state.

[0087] If the first flow deviation is smaller than a preset first flow deviation threshold and larger than a preset second flow deviation threshold, the corresponding first authority range is determined according to the first authorization information.

[0088] If the first authority range is higher than the preset authority range, the first data monitoring state is a normal state.

[0089] If the first authority range is lower than the preset authority range, the first data monitoring state is a flow pending confirmation state.

[0090] If the first flow deviation is less than the preset second flow deviation threshold, the first data monitoring state is a normal state.

[0091] It is worth noting that in network security, if other information with potential security risks is included in the data packets sent from the external network to the internal network, it is easy to cause danger to the internal network. In addition, if other internal information is included when sending data packets from the internal network to the external network, it is easy to cause information leakage in the internal network.

[0092] Therefore, the first traffic deviation can be determined by the first expected traffic information and the first actual traffic information to determine whether other information is included outside the original data packet, that is, outside the protocol information of the original data packet. In addition, by verifying the authority size of the first authority range corresponding to the first authorization information, the monitoring status is judged for the situation where the traffic deviation is less than the preset first traffic deviation threshold and greater than the preset second traffic deviation threshold, which effectively avoids the situation where users with higher authority cannot perform efficient data interaction due to the deviation between the expected traffic and the actual traffic calculation. For users with lower authority, they are also classified as traffic pending confirmation status, and data is released or intercepted after subsequent confirmation.

[0093] S104: Determine a third communication link according to the first data monitoring state and a preset communication link selection model.

[0094] A third communication link is determined according to the first data monitoring state and a preset communication link selection model, and the third communication link is used to transmit the first data to be monitored to the target terminal device.

[0095] Specifically, if the first data monitoring state is normal, the third communication link is determined according to the first terminal device information in the first protocol information, the first terminal device information is the terminal device information of the first terminal device that initiates the request for the first monitored data, and the target terminal device is the first terminal device.

[0096] If the first data monitoring state is a pending confirmation state, the third communication link is a communication link used only to connect to the review terminal device; or, the third communication link is a communication link used to connect to the first terminal device and the review terminal device.

[0097] If the third communication link is a communication link used only to connect to a review terminal device, a prompt message is displayed on the review terminal device, and the prompt message is used to prompt the first monitored data to be reviewed within a preset time period; if the review result is passed, the review terminal device sends the first monitored data to the first terminal device via the fourth communication link; if the review result is failed, the review terminal device sends the first monitored data to the monitoring terminal device via the fifth communication link.

[0098] If the third communication link is a communication link for connecting to the first terminal device and the review terminal device, the first terminal device displays a review mark before displaying the first data to be monitored, and the review mark is used to indicate that the first data to be monitored is in a review state; if the review waiting confirmation information is received on the first terminal device, the first terminal device sends a review prompt to the review terminal to display the prompt information on the review terminal device; if the review result is passed, the review terminal device sends a review confirmation information to the first data to be monitored via the fourth communication link; if the review result is failed, the review terminal device sends a data deletion information to the first data to be monitored via the fifth communication link.

[0099] If the first data monitoring state is an abnormal state, the third communication link is a communication link for connecting to the monitoring terminal device.

[0100] If the third communication link is a communication link for connecting to the monitoring terminal device, the monitoring terminal disconnects the network connection of the monitoring terminal device in response to the data monitoring instruction, and the data monitoring instruction is used to open the first data to be monitored, thereby effectively avoiding the first data to be monitored that has a high risk of being opened in the network state, and further improving the network security. After the confirmation instruction is input and it is determined that the first data to be monitored is safe data, the network connection of the monitoring terminal device is automatically connected.

[0101] In this embodiment, by obtaining the first transmission characteristic parameter of the first data to be monitored through the first layer firewall on the first communication link, and the second transmission characteristic parameter of the first data to be monitored through the second layer firewall, the second transmission characteristic parameter includes the first actual flow information of the first data to be monitored, and then, the first data monitoring state of the first data to be monitored is determined according to the first expected flow information, the first actual flow information and the first authorization information, and the third communication link is determined according to the first data monitoring state and the preset communication link selection model, so that the first data to be monitored is transmitted to the target terminal device, and then the first data monitoring state is determined by realizing real-time data flow monitoring based on multi-layer firewalls, so as to ensure that the firewall effectively monitors the data packets with abnormal data flow, so as to ensure the security of network transmission.

[0102] Figure 2 FIG. 1 is a flow chart of a method for monitoring real-time data traffic of a firewall according to another exemplary embodiment of the present application. Figure 2 As shown, the method provided in this embodiment includes:

[0103] S201. Obtain first transmission characteristic parameters of first monitored data through a first layer firewall on a first communication link.

[0104] Specifically, it may be to obtain the first transmission characteristic parameter of the first data to be monitored through the first layer of firewall on the first communication link, wherein the first transmission characteristic parameter includes the first protocol information of the first data to be monitored, and the first protocol information includes the first expected traffic information and the first authorization information corresponding to the first data to be monitored. By verifying the above-mentioned first authorization information by the firewall, unauthorized access can be prevented and non-compliant data packets can be rejected from passing through the firewall. In addition, when the first data to be monitored is relevant data sent from the user from the external network to the internal network, different permission ranges can be set for the user, and then the first authorization range can be determined according to the above-mentioned first authorization information, so as to determine the authorization degree and security of the first data to be monitored according to the first authorization range.

[0105] The first estimated traffic information can be determined by determining different protocol header sizes according to different types of network protocols, then determining the size of the existing option field, determining the size of the encapsulation information according to the application layer protocol, and determining the size of the content data according to the data content actually carried in the data packet. In addition, the padding bit and the checksum field can also be obtained to determine the first estimated traffic information. In another optional implementation, a packet capture tool can be used to capture and analyze the data packet, thereby automatically obtaining all components and the total length of the data packet.

[0106] S202: Obtain a second transmission characteristic parameter of the first monitored data passing through the second layer firewall.

[0107] Optionally, a second transmission characteristic parameter of the first monitored data passing through the second layer firewall is obtained, and the second transmission characteristic parameter includes first actual flow information of the first monitored data. Optionally, for the above-mentioned first actual flow information, specific instructions in the firewall can be used to view or count the actual flow of the interface in real time, or SNMP can be used to obtain more detailed real-time flow information.

[0108] S203: Determine a first data monitoring state of first data to be monitored according to the first estimated flow information, the first actual flow information, and the first authorization information.

[0109] A first data monitoring state of first data to be monitored is determined according to the first estimated flow information, the first actual flow information, and the first authorization information.

[0110] Specifically, the first flow deviation may be determined according to the first estimated flow information and the first actual flow information.

[0111] If the first flow deviation is greater than or equal to a preset first flow deviation threshold, the first data monitoring state is an abnormal state.

[0112] If the first flow deviation is smaller than a preset first flow deviation threshold and larger than a preset second flow deviation threshold, the corresponding first authority range is determined according to the first authorization information.

[0113] If the first authority range is higher than the preset authority range, the first data monitoring state is a normal state.

[0114] If the first authority range is lower than the preset authority range, the first data monitoring state is a flow pending confirmation state.

[0115] If the first flow deviation is less than the preset second flow deviation threshold, the first data monitoring state is a normal state.

[0116] It is worth noting that in network security, if other information with potential security risks is included in the data packets sent from the external network to the internal network, it is easy to cause danger to the internal network. In addition, if other internal information is included when sending data packets from the internal network to the external network, it is easy to cause information leakage in the internal network.

[0117] Therefore, the first traffic deviation can be determined by the first expected traffic information and the first actual traffic information to determine whether other information is included outside the original data packet, that is, outside the protocol information of the original data packet. In addition, by verifying the authority size of the first authority range corresponding to the first authorization information, the monitoring status is judged for the situation where the traffic deviation is less than the preset first traffic deviation threshold and greater than the preset second traffic deviation threshold, which effectively avoids the situation where users with higher authority cannot perform efficient data interaction due to the deviation between the expected traffic and the actual traffic calculation. For users with lower authority, they are also classified as traffic pending confirmation status, and data is released or intercepted after subsequent confirmation.

[0118] S204: Using a preset firewall attack detection model and according to the second transmission characteristic parameter, determine that the first monitored data is in a safe state when passing through the second layer firewall.

[0119] Specifically, a preset firewall attack detection model can be used to determine, based on the second transmission characteristic parameter, that the first monitored data is in a safe state when passing through the second layer firewall. The preset firewall attack detection model is a detection model obtained by training a preset Bayesian network neural model using a preset firewall state sample database.

[0120] As for the construction of the preset firewall status sample database, the log information of the second-layer firewall can be obtained. The log information includes a data transmission behavior sequence D = {d1, d2, ..., d i ,…,d n} corresponds to the data transmission behavior feature set C = {c1, c2, …, ci ,…,c n}, where the i-th data transmission behavior feature c in the data transmission behavior feature set C i The data transmission behavior feature corresponding to the i-th data transmission behavior in the data transmission sequence D includes multiple data transmission behavior sub-features, and the data transmission behavior sub-features are at least one of the data transmission time, source area, source port, source IP address, communication link switching frequency, and number of transmission actions. Optionally, it can be done in the log information, and each data transmission behavior of the data transmission behavior sequence D can be marked in advance as a safe state or an unsafe state by marking.

[0121] Based on the data transmission behavior characteristics Wherein, n is the number of data transmission behaviors in the data transmission behavior sequence D, and m is the number of data transmission behavior sub-features in the data transmission behavior feature.

[0122] Among them, the source IP address in the above-mentioned data transmission behavior sub-feature may be an element in the behavior feature data set P after binary conversion, and other data transmission behavior sub-features may be standardized, wherein the standardized processing method refers to the following formula:

[0123]

[0124] Among them, x' is the data after standardization, x is the original data corresponding to the data transmission behavior sub-feature, {x1,x2,…,x n} is a sequence formed by the log information including the original data of the data transmission behavior sub-features in the data transmission behavior sequence D.

[0125] The behavior feature dataset P can be recorded as P = [P1 … P i … P n ], where P i It is an m*1-order matrix. Calculate the correlation coefficient matrix R between the eigenvectors; because the variables in P have been standardized, the covariance matrix of the column variables of P is the correlation coefficient matrix.

[0126] Among them, r ij is the correlation coefficient between the i-th and j-th eigenvectors. Then, according to the correlation coefficient matrix R and P i Determine P i The characteristic value of is used as the characteristic value of the i-th data transmission behavior c i The corresponding characteristic factor t i .

[0127] Determine the i-th data transmission behavior feature c according to the behavior feature data set P i The corresponding characteristic factor t i , and generate a hash fuzzy matching lookup table based on the characteristic factors corresponding to each data transmission behavior feature in the data transmission behavior feature set C and the log information.

[0128] A keyword matching lookup table is generated according to the data transmission time, source area, source port and source IP address of each data transmission behavior feature in the data transmission behavior feature set C.

[0129] A sensitive feature matching lookup table is generated according to the communication link switching frequency and the number of transmission actions of each data transmission behavior feature in the data transmission behavior feature set C.

[0130] A preset firewall status sample database is generated based on a hash fuzzy matching lookup table, a keyword matching lookup table, and a sensitive feature matching lookup table.

[0131] Through the above steps, it is possible to obtain network traffic data and store and analyze the characteristic data in the log, so as to use the collected data to train machine learning and Bayesian neural networks in subsequent steps to solve the problem of traffic information evaluation. In addition, the preset firewall attack detection model built by the neural network model can also be used to assist in the identification and defense of abnormal network traffic, and overall an integrated processing solution from data acquisition, collection, processing, feedback and taking corresponding measures is realized.

[0132] S205: Determine a third communication link according to the first data monitoring state and a preset communication link selection model.

[0133] A third communication link is determined according to the first data monitoring state and a preset communication link selection model, and the third communication link is used to transmit the first data to be monitored to the target terminal device.

[0134] Specifically, if the first data monitoring state is normal, the third communication link is determined according to the first terminal device information in the first protocol information, the first terminal device information is the terminal device information of the first terminal device that initiates the request for the first monitored data, and the target terminal device is the first terminal device.

[0135] If the first data monitoring state is a pending confirmation state, the third communication link is a communication link used only to connect to the review terminal device; or, the third communication link is a communication link used to connect to the first terminal device and the review terminal device.

[0136] If the third communication link is a communication link used only to connect to a review terminal device, a prompt message is displayed on the review terminal device, and the prompt message is used to prompt the first monitored data to be reviewed within a preset time period; if the review result is passed, the review terminal device sends the first monitored data to the first terminal device via the fourth communication link; if the review result is failed, the review terminal device sends the first monitored data to the monitoring terminal device via the fifth communication link.

[0137] If the third communication link is a communication link for connecting to the first terminal device and the review terminal device, the first terminal device displays a review mark before displaying the first data to be monitored, and the review mark is used to indicate that the first data to be monitored is in a review state; if the review waiting confirmation information is received on the first terminal device, the first terminal device sends a review prompt to the review terminal to display the prompt information on the review terminal device; if the review result is passed, the review terminal device sends a review confirmation information to the first data to be monitored via the fourth communication link; if the review result is failed, the review terminal device sends a data deletion information to the first data to be monitored via the fifth communication link.

[0138] If the first data monitoring state is an abnormal state, the third communication link is a communication link for connecting to the monitoring terminal device.

[0139] If the third communication link is a communication link for connecting to the monitoring terminal device, the monitoring terminal disconnects the network connection of the monitoring terminal device in response to the data monitoring instruction, and the data monitoring instruction is used to open the first data to be monitored, thereby effectively avoiding the first data to be monitored that has a high risk of being opened in the network state, and further improving the network security. After the confirmation instruction is input and it is determined that the first data to be monitored is safe data, the network connection of the monitoring terminal device is automatically connected.

[0140] Figure 3 FIG. 1 is a schematic diagram of a system for monitoring real-time data traffic of a firewall according to an exemplary embodiment of the present application. Figure 3 As shown, the device 300 provided in this embodiment includes:

[0141] An acquisition module 310 is configured to acquire a first transmission characteristic parameter of first data to be monitored passing through a first layer firewall on a first communication link, wherein the first transmission characteristic parameter includes first protocol information of the first data to be monitored, and the first protocol information includes first estimated flow information and first authorization information corresponding to the first data to be monitored;

[0142] The acquisition module 310 is further configured to acquire a second transmission characteristic parameter of the first data to be monitored passing through the second layer firewall on the first communication link, wherein the second transmission characteristic parameter includes first actual flow information of the first data to be monitored;

[0143] A processing module 320, configured to determine a first data monitoring state of the first data to be monitored according to the first estimated flow information, the first actual flow information, and the first authorization information;

[0144] The processing module 320 is further used to determine a third communication link according to the first data monitoring state and a preset communication link selection model, and the third communication link is used to transmit the first to-be-monitored data to a target terminal device.

[0145] Optionally, the processing module 320 is specifically configured to:

[0146] determining a first flow deviation according to the first estimated flow information and the first actual flow information;

[0147] If the first flow deviation is greater than or equal to a preset first flow deviation threshold, the first data monitoring state is an abnormal state;

[0148] If the first flow deviation is less than the preset first flow deviation threshold and greater than the preset second flow deviation threshold, determining a corresponding first authority range according to the first authorization information;

[0149] If the first authority range is higher than the preset authority range, the first data monitoring state is a normal state;

[0150] If the first authority range is lower than the preset authority range, the first data monitoring state is a flow pending confirmation state.

[0151] Optionally, the processing module 320 is specifically configured to:

[0152] If the first data monitoring state is the normal state, determining the third communication link according to the first terminal device information in the first protocol information, the first terminal device information is the terminal device information of the first terminal device that initiates the request for the first data to be monitored, and the target terminal device is the first terminal device;

[0153] If the first data monitoring state is the pending confirmation state, the third communication link is a communication link used only to connect to the review terminal device; or, the third communication link is a communication link used to connect to the first terminal device and the review terminal device;

[0154] If the first data monitoring state is the abnormal state, the third communication link is a communication link for connecting to a monitoring terminal device.

[0155] Optionally, the processing module 320 is specifically configured to:

[0156] If the third communication link is a communication link used only to connect to the review terminal device, a prompt message is displayed on the review terminal device, and the prompt message is used to prompt the first data to be monitored to be reviewed within a preset time period; if the review result is passed, the review terminal device sends the first data to be monitored to the first terminal device through the fourth communication link; if the review result is not passed, the review terminal device sends the first data to be monitored to the monitoring terminal device through the fifth communication link; or,

[0157] If the third communication link is a communication link for connecting to the first terminal device and the review terminal device, the first terminal device displays a review mark before displaying the first data to be monitored, and the review mark is used to identify that the first data to be monitored is in a review state; if review waiting confirmation information is received on the first terminal device, the first terminal device sends a review prompt to the review terminal to display the prompt information on the review terminal device; if the review result is passed, the review terminal device sends a review confirmation information to the first data to be monitored via the fourth communication link; if the review result is failed, the review terminal device sends data deletion information to the first data to be monitored via the fifth communication link.

[0158] Optionally, the processing module 320 is specifically configured to:

[0159] If the third communication link is a communication link for connecting to a monitoring terminal device, the monitoring terminal disconnects the network connection of the monitoring terminal device in response to a data monitoring instruction, and the data monitoring instruction is used to open the first data to be monitored.

[0160] Optionally, the processing module 320 is specifically configured to:

[0161] A preset firewall attack detection model is used, and based on the second transmission characteristic parameter, it is determined that the first monitored data is in a safe state after passing through the second layer firewall. The preset firewall attack detection model is a detection module obtained by training a preset Bayesian network neural model using a preset firewall state sample database.

[0162] Optionally, the processing module 320 is specifically configured to:

[0163] Obtain the log information of the second layer firewall, wherein the log information includes a data transmission behavior sequence D={d1, d2, ..., d i ,…,d n} corresponds to the data transmission behavior feature set C = {c1, c2, …, c i ,…,c n}, where the i-th data transmission behavior feature c in the data transmission behavior feature set C i is a data transmission behavior feature corresponding to the i-th data transmission behavior in the data transmission sequence D, wherein the data transmission behavior feature includes a plurality of data transmission behavior sub-features, and the data transmission behavior sub-features are at least one of data transmission time, source area, source port, source IP address, communication link switching frequency, and number of transmission actions;

[0164] Generate a behavior feature data set according to the data transmission behavior feature set C Wherein, n is the number of data transmission behaviors in the data transmission behavior sequence D, and m is the number of data transmission behavior sub-features in the data transmission behavior feature;

[0165] Determine the i-th data transmission behavior feature c according to the behavior feature data set P i The corresponding characteristic factor t i , and generate a hash fuzzy matching lookup table based on the characteristic factors corresponding to each data transmission behavior feature in the data transmission behavior feature set C and the log information;

[0166] Generate a keyword matching lookup table according to the data transmission time, the source area, the source port, and the source IP address of each data transmission behavior feature in the data transmission behavior feature set C;

[0167] Generate a sensitive feature matching lookup table according to the communication link switching frequency and the number of transmission actions of each data transmission behavior feature in the data transmission behavior feature set C;

[0168] The preset firewall status sample database is generated according to the hash fuzzy matching lookup table, the keyword matching lookup table and the sensitive feature matching lookup table.

[0169] Figure 4 is a schematic diagram of the structure of an electronic device according to an exemplary embodiment of the present application. Figure 4 As shown, an electronic device 400 provided in this embodiment includes: a processor 401 and a memory 402; wherein:

[0170] The memory 402 is used to store computer programs, and the memory may also be a flash memory.

[0171] The processor 401 is used to execute the execution instructions stored in the memory to implement each step in the above method. For details, please refer to the relevant description in the above method embodiment.

[0172] Optionally, the memory 402 may be independent or integrated with the processor 401 .

[0173] When the memory 402 is a device independent of the processor 401, the electronic device 400 may further include:

[0174] The bus 403 is used to connect the memory 402 and the processor 401 .

[0175] This embodiment further provides a readable storage medium, in which a computer program is stored. When at least one processor of an electronic device executes the computer program, the electronic device executes the methods provided in the above-mentioned various implementation modes.

[0176] This embodiment also provides a program product, which includes a computer program stored in a readable storage medium. At least one processor of the electronic device can read the computer program from the readable storage medium, and at least one processor executes the computer program so that the electronic device implements the methods provided in the above various embodiments.

[0177] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the claims.

[0178] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A method for monitoring real-time data traffic of a firewall, characterized in that: include: Acquire a first transmission characteristic parameter of the first data to be monitored passing through the first layer firewall on the first communication link, wherein the first transmission characteristic parameter includes first protocol information of the first data to be monitored, and the first protocol information includes first estimated flow information and first authorization information corresponding to the first data to be monitored; Acquire a second transmission characteristic parameter of the first data to be monitored passing through a second layer firewall, wherein the second transmission characteristic parameter includes first actual flow information of the first data to be monitored; Determine a first data monitoring state of the first to-be-monitored data according to the first expected flow information, the first actual flow information, and the first authorization information; Determine a third communication link according to the first data monitoring state and a preset communication link selection model, wherein the third communication link is used to transmit the first to-be-monitored data to a target terminal device; The determining the first data monitoring state of the first to-be-monitored data according to the first estimated flow information, the first actual flow information, and the first authorization information includes: determining a first flow deviation according to the first estimated flow information and the first actual flow information; If the first flow deviation is greater than or equal to a preset first flow deviation threshold, the first data monitoring state is an abnormal state; If the first flow deviation is less than the preset first flow deviation threshold and greater than the preset second flow deviation threshold, determining a corresponding first authority range according to the first authorization information; If the first authority range is higher than the preset authority range, the first data monitoring state is a normal state; If the first authority range is lower than the preset authority range, the first data monitoring state is a flow pending confirmation state.

2. The method for monitoring real-time data flow of a firewall according to claim 1, characterized in that: The determining the third communication link according to the first data monitoring state and a preset communication link selection model includes: If the first data monitoring state is the normal state, determining the third communication link according to the first terminal device information in the first protocol information, the first terminal device information is the terminal device information of the first terminal device that initiates the request for the first data to be monitored, and the target terminal device is the first terminal device; If the first data monitoring state is the pending confirmation state, the third communication link is a communication link used only to connect to the review terminal device; or, the third communication link is a communication link used to connect to the first terminal device and the review terminal device; If the first data monitoring state is the abnormal state, the third communication link is a communication link for connecting to a monitoring terminal device.

3. The method for monitoring real-time data flow of a firewall according to claim 2, characterized in that: After determining the third communication link according to the first data monitoring state and the preset communication link selection model, the method further includes: If the third communication link is a communication link used only to connect to the review terminal device, a prompt message is displayed on the review terminal device, and the prompt message is used to prompt the first data to be monitored to be reviewed within a preset time period; if the review result is passed, the review terminal device sends the first data to be monitored to the first terminal device through the fourth communication link; if the review result is not passed, the review terminal device sends the first data to be monitored to the monitoring terminal device through the fifth communication link; or, If the third communication link is a communication link for connecting to the first terminal device and the review terminal device, the first terminal device displays a review mark before displaying the first data to be monitored, and the review mark is used to identify that the first data to be monitored is in a review state; if review waiting confirmation information is received on the first terminal device, the first terminal device sends a review prompt to the review terminal to display the prompt information on the review terminal device; if the review result is passed, the review terminal device sends a review confirmation information to the first data to be monitored via the fourth communication link; if the review result is failed, the review terminal device sends data deletion information to the first data to be monitored via the fifth communication link.

4. The method for monitoring real-time data flow of a firewall according to claim 3, characterized in that: After determining the third communication link according to the first data monitoring state and the preset communication link selection model, the method further includes: If the third communication link is a communication link for connecting to a monitoring terminal device, the monitoring terminal disconnects the network connection of the monitoring terminal device in response to a data monitoring instruction, and the data monitoring instruction is used to open the first data to be monitored.

5. The method for monitoring real-time data traffic of a firewall according to any one of claims 1 to 4, characterized in that: Before determining the third communication link according to the first data monitoring state and the preset communication link selection model, the method further includes: A preset firewall attack detection model is used, and based on the second transmission characteristic parameter, it is determined that the first monitored data is in a safe state after passing through the second layer firewall. The preset firewall attack detection model is a detection model obtained by training a preset Bayesian network neural model using a preset firewall state sample database.

6. The method for monitoring real-time data flow of a firewall according to claim 5, characterized in that: Also includes: Obtain the log information of the second layer firewall, wherein the log information includes a data transmission behavior sequence D={d1, d2, ..., d i ,…,d n } corresponds to the data transmission behavior feature set C = {c1, c2, …, c i ,…,c n }, where the i-th data transmission behavior feature c in the data transmission behavior feature set C i is a data transmission behavior feature corresponding to the i-th data transmission behavior in the data transmission sequence D, wherein the data transmission behavior feature includes a plurality of data transmission behavior sub-features, and the data transmission behavior sub-features are at least one of data transmission time, source area, source port, source IP address, communication link switching frequency, and number of transmission actions; Generate a behavior feature data set according to the data transmission behavior feature set C Wherein, n is the number of data transmission behaviors in the data transmission behavior sequence D, and m is the number of data transmission behavior sub-features in the data transmission behavior feature; Determine the i-th data transmission behavior feature c according to the behavior feature data set P i The corresponding characteristic factor t i , and generate a hash fuzzy matching lookup table based on the characteristic factors corresponding to each data transmission behavior feature in the data transmission behavior feature set C and the log information; Generate a keyword matching lookup table according to the data transmission time, the source area, the source port, and the source IP address of each data transmission behavior feature in the data transmission behavior feature set C; Generate a sensitive feature matching lookup table according to the communication link switching frequency and the number of transmission actions of each data transmission behavior feature in the data transmission behavior feature set C; The preset firewall status sample database is generated according to the hash fuzzy matching lookup table, the keyword matching lookup table and the sensitive feature matching lookup table.

7. A firewall real-time data flow monitoring system, characterized in that: include: an acquisition module, configured to acquire a first transmission characteristic parameter of the first data to be monitored through the first layer firewall on the first communication link, wherein the first transmission characteristic parameter includes first protocol information of the first data to be monitored, and the first protocol information includes first estimated flow information and first authorization information corresponding to the first data to be monitored; The acquisition module is further used to acquire a second transmission characteristic parameter of the first data to be monitored passing through the second layer firewall on the first communication link, wherein the second transmission characteristic parameter includes first actual flow information of the first data to be monitored; a processing module, configured to determine a first data monitoring state of the first to-be-monitored data according to the first estimated flow information, the first actual flow information, and the first authorization information; The processing module is further used to determine a third communication link according to the first data monitoring state and a preset communication link selection model, wherein the third communication link is used to transmit the first to-be-monitored data to a target terminal device; The determining the first data monitoring state of the first to-be-monitored data according to the first estimated flow information, the first actual flow information, and the first authorization information includes: determining a first flow deviation according to the first estimated flow information and the first actual flow information; If the first flow deviation is greater than or equal to a preset first flow deviation threshold, the first data monitoring state is an abnormal state; If the first flow deviation is less than the preset first flow deviation threshold and greater than the preset second flow deviation threshold, determining a corresponding first authority range according to the first authorization information; If the first authority range is higher than the preset authority range, the first data monitoring state is a normal state; If the first authority range is lower than the preset authority range, the first data monitoring state is a flow pending confirmation state.

8. An electronic device, characterized in that: include: processor; as well as, A memory, configured to store executable instructions of the processor; The processor is configured to perform the method of any one of claims 1 to 6 by executing the executable instructions.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 6 when executed by a processor.

Images