Network security data dynamic interaction method, monitoring processing and protection system

Abstract

The present invention relates to a network security data dynamic interaction method, monitoring processing and protection system, comprising: constructing a simulation receiving end, wherein a virtual space is provided in the simulation receiving end to simulate the operation of a real terminal, and the real terminal is constructed into a functional network based on Shannon theory; constructing a Clos multi-stage network switching model, wherein an input stage, an intermediate stage and an output stage are provided in the Clos multi-stage network switching model; acquiring and parsing network data to obtain application layer protocol fields, network layer protocol fields, network layer load data and service data packets of the network data; performing preliminary security screening on the application layer protocol fields, network layer protocol fields and network layer load data at the input stage; after passing the screening at the input layer, selecting a transmission route according to the application layer protocol fields and inputting it to the intermediate stage; the intermediate stage inputting the service data packets into the simulation receiving end according to the network layer protocol fields and the network layer load data, and inputting them to the output stage after a delay of T.

Description

Technical Field

[0001] The present invention relates to the technical field of network data security, and in particular to a network security data dynamic interaction method, a monitoring processing and a protection system. Background Art

[0002] As the application scope of computer network technology becomes wider and wider, global informatization has developed rapidly, and informatization content has been deeply penetrated in various fields. The background environment of big data has changed people's worldview. The advent of the big data era has significantly changed people's lives and given people a new view of the world. In particular, the application of computer network technology and the effective integration of data in the data era have accelerated the speed of information processing and also better and faster statistical acquisition of information. With the popularization of computer technology, data security issues have become increasingly prominent.

[0003] In the current Internet environment, website security issues are becoming increasingly severe, with frequent hacker attacks and malicious activities, posing a huge threat to personal privacy and corporate data. Most mainstream traditional security products use "signature-based rule fingerprint" matching technology to identify fixed and limited attack behaviors, which has shown its inadequacy in the normalized confrontation with hackers. In the process of continuous iteration and update of attack and defense technologies, the technology of feature rule matching can no longer guarantee resistance to hacker attacks. In the choice between large-scale cost control and technological evolution, the development of traditional security products faces great challenges.

[0004] In order to protect the security of websites and their users, traditional website security products usually use "signature-based rule fingerprint" matching technology, which relies on known attack patterns and rules to detect malicious behavior. However, this traditional security protection method has shortcomings in the following aspects:

[0005] 1. Limited recognition capabilities: Rule-based signature matching technology can only identify known attack patterns and cannot effectively respond to new, unknown attack methods. Hackers continue to improve their attack techniques, and rule matching technology cannot keep up with the evolution.

[0006] 2. High false alarm rate: Traditional security products often generate a large number of false alarms, that is, they mistakenly identify normal user behavior as malicious behavior, which not only affects the user experience, but also increases the workload of the security team.

[0007] 3. High cost of rule maintenance: The rule base needs to be constantly updated to adapt to new attack patterns and vulnerabilities. This requires a lot of manpower and time resources, which is costly.

[0008] 4. Difficult to cope with complex scenarios: Traditional methods perform poorly when dealing with complex network environments and large-scale traffic, and it is difficult to effectively detect diverse attacks.

[0009] Therefore, faced with evolving attack techniques and complex network environments, traditional rule-based website security protection systems face serious challenges in protecting website security.

[0010] To this end, the present invention proposes a network security data dynamic interaction method, monitoring processing and protection system. Summary of the invention

[0011] The present invention aims at the technical problems existing in the prior art and provides a network security data dynamic interaction method, a monitoring processing and a protection system.

[0012] The technical solution of the present invention to solve the above technical problems is as follows: a network security data dynamic interaction method, monitoring processing and protection system;

[0013] The method for dynamic network security data interaction includes the following steps:

[0014] Constructing a simulation receiving terminal, wherein the simulation receiving terminal is provided with a virtual space to simulate the operation of a real terminal, and constructing the real terminal into a functional network based on Shannon theory;

[0015] Constructing a Clos multi-stage network switching model, wherein the Clos multi-stage network switching model is provided with an input stage, an intermediate stage and an output stage; the intermediate stage is connected to a simulated receiving end, and the output stage is provided on a real terminal;

[0016] S1: Acquire and parse network data to obtain application layer protocol fields, network layer protocol fields, network layer payload data, and service data packets;

[0017] S2: Perform preliminary security screening on the application layer protocol fields, network layer protocol fields, and network layer payload data at the input level;

[0018] S3: After passing the screening of the input layer, the transmission route is selected according to the application layer protocol field and input to the intermediate level;

[0019] S4: The intermediate stage inputs the service data packet into the simulation receiving end according to the network layer protocol field and the network layer load data, and inputs it to the output stage after a delay of T.

[0020] Furthermore, in the method for dynamic interaction of network security data, the simulation receiving end comprises:

[0021] The simulation receiving end is constructed using a node network:

[0022] Step 1: Collect the relevant information in the real terminal and set it as a node. Define the relevant information as the feedback of the real terminal under each operation;

[0023] Step 2: Convert the correlation information into a correlation matrix and determine the threshold matrix based on the threshold;

[0024] Step 3: Finally, extract the functional network of the simulated receiving end relative to the real terminal.

[0025] Furthermore, in the method for dynamic interaction of network security data, the correlation matrix in step 2 includes:

[0026] Define element c ij is the correlation value between the feedback j of the real terminal under operation i, and defines the correlation threshold r. When c ij When it is greater than the threshold r, the functional correlation between the associated information is considered, otherwise it is considered irrelevant.

[0027] Furthermore, in the method for dynamic interaction of network security data, S3 includes preliminary screening of application layer protocol fields, network layer protocol fields, and network layer load data by a clustering algorithm, and the clustering algorithm includes:

[0028] Extract attack information feature vectors according to a preset unsafe attack information database, and compare them with the information contained in the application layer protocol field, network layer protocol field, and network layer payload data:

[0029] The Gaussian kernel concept is introduced. Given the attack information feature R as a kernel, the information x contained in the application layer protocol field, network layer protocol field, and network layer payload data is defined as a subset of R. The kernel function K h (R,x) represents the mapping of x in space h. Calculating the inner product of the kernel function can obtain the similarity between x and R features in the feature space. According to the Gaussian kernel:

[0030]

[0031] Among them, σ is an adjustable parameter. Since the feature space of the Gaussian kernel is infinite-dimensional, the weight ratio of the adjustable parameter σ to the space of each dimension is consistent. Therefore, two adjustable parameters c and d are introduced to use different widths to express the feature information in different dimensions:

[0032]

[0033] Finally, we get a linear superposition of Gaussian kernels of different widths c, d c is the weight coefficient, which controls the relative weight of the Gaussian kernel according to the Gaussian kernel at different widths.

[0034] Furthermore, the method for dynamic interaction of network security data, the step S4 also includes:

[0035] According to the concept of Shannon information entropy, the discrete random variable operation Y is defined as {y1,y2,...,y m} random states, whose probabilities are {p1,p2,...,p m}, then the information entropy of the random variable operation Y is:

[0036]

[0037] The joint Shannon entropy of a random variable operation Y and another random variable Q is defined as:

[0038]

[0039] Mutual information of Y and Q: MI(Y,Q)=H(Y)+H(Q)-H(Y,Q).

[0040] Furthermore, the network security data dynamic interaction method further includes a vector set of spatial information for analyzing nodes generated by discrete random variable operation Y at interval t:

[0041]

[0042] n nodes increase.

[0043] A network security data monitoring, processing and protection system is applied to any of the network security data dynamic interaction methods, the monitoring, processing and protection system comprising: a user access layer, a business application layer, a system management layer and a basic component layer;

[0044] The business application layer is used to implement a method for dynamic network security data interaction:

[0045] S1: Acquire and parse network data to obtain application layer protocol fields, network layer protocol fields, network layer payload data, and service data packets;

[0046] S2: Perform preliminary security screening on the application layer protocol fields, network layer protocol fields, and network layer payload data at the input level;

[0047] S3: After passing the screening of the input layer, the transmission route is selected according to the application layer protocol field and input to the intermediate level;

[0048] S4: The intermediate stage inputs the service data packet into the simulation receiving end according to the network layer protocol field and the network layer load data, and inputs it to the output stage after a delay of T.

[0049] Furthermore, in the network security data dynamic monitoring, processing and protection system, the basic component layer is provided with a monitoring and processing module, the monitoring and processing module is provided with a simulation receiving end, and the simulation receiving end includes:

[0050] Collection module: collects the relevant information in the real terminal and sets it as a node. It defines the relevant information as the feedback of the real terminal under each operation;

[0051] Conversion module: converts the correlation information into a correlation matrix and determines the threshold matrix according to the threshold;

[0052] Building module: Finally, extract the functional network of the simulated receiving end relative to the real terminal;

[0053] Information entropy comparison module: compares whether the node increase is consistent with the node increase preset in the business data packet. If they are consistent, it means that the business data packet is safe. Otherwise, the business data packet is judged to be unsafe.

[0054] Unsafe information extraction module: when the business data is determined to be unsafe, extract the dangerous data in the business data packet and update it in the preset unsafe attack information library.

[0055] An electronic device, comprising:

[0056] Memory for storing computer software programs;

[0057] The processor is used to read and execute the computer software program, thereby implementing any one of the methods for dynamic interaction of network security data.

[0058] A non-transitory computer-readable storage medium, wherein a computer software program is stored in the storage medium, and when the computer software program is executed by a processor, any one of the methods for dynamic interaction of network security data is implemented.

[0059] The beneficial effects of the present invention are:

[0060] Layered processing: By distributing security measures at the user access layer, business application layer, system management layer, and basic component layer, the system provides more comprehensive protection; each layer has its own unique function, and together they build a more powerful defense network.

[0061] Multi-dimensional analysis: From acquiring network data to analyzing and responding, this system comprehensively considers all aspects of network security, including application layer, network layer protocol and data content, which is more comprehensive than single-dimensional security measures.

[0062] Emulated Receiver: By simulating the operating environment of a real terminal, the system is able to detect and respond to potential threats in advance, rather than just responding after an attack occurs; this proactive defense strategy is lacking in traditional systems.

[0063] Information entropy analysis: Data analysis using information entropy theory can more accurately predict and identify abnormal behaviors, improving the ability to detect complex and covert attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] Figure 1 A schematic diagram of the process of the network security data dynamic interaction method of the present invention;

[0065] Figure 2 A schematic diagram of the network security data dynamic monitoring, processing and protection system of the present invention;

[0066] Figure 3 A schematic diagram of an electronic device according to an embodiment of the present invention;

[0067] Figure 4 A schematic diagram of an embodiment of a computer-readable storage medium provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0068] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0069] In the description of this application, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, "plurality" means two or more, unless otherwise clearly and specifically defined.

[0070] In the description of the present application, the term "for example" is used to mean "used as an example, illustration or description". Any embodiment described as "for example" in the present application is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is given to enable any technician in the field to implement and use the present invention. In the following description, details are listed for the purpose of explanation. It should be understood that a person of ordinary skill in the art can recognize that the present invention can be implemented without using these specific details. In other examples, well-known structures and processes will not be elaborated in detail to avoid unnecessary details to obscure the description of the present invention. Therefore, the present invention is not intended to be limited to the embodiments shown, but is consistent with the widest scope consistent with the principles and features disclosed in the present application.

[0071] Example 1

[0072] The method for dynamic interaction of network security data includes the following steps:

[0073] Constructing a simulation receiving terminal, wherein the simulation receiving terminal is provided with a virtual space to simulate the operation of a real terminal, and constructing the real terminal into a functional network based on Shannon theory;

[0074] Constructing a Clos multi-stage network switching model, wherein the Clos multi-stage network switching model is provided with an input stage, an intermediate stage and an output stage; the intermediate stage is connected to a simulated receiving end, and the output stage is provided on a real terminal;

[0075] S1: Acquire and parse network data to obtain the application layer protocol field, network layer protocol field, network layer payload data, and business data packet of the network data; specifically: application layer protocol field: indicates the application layer protocol used by the data, such as HTTP, FTP, etc., network layer protocol field: indicates the network layer of the data packet, such as the IP layer information, network layer payload data: the actual transmission data contained in the network layer, business data packet: a data set carrying actual business information;

[0076] S2: Perform preliminary security screening on the application layer protocol fields, network layer protocol fields, and network layer payload data at the input level; specifically, the security screening includes checking whether the data complies with security policies or matches known threat patterns;

[0077] S3: After passing the screening of the input layer, the transmission route is selected according to the application layer protocol field and input to the intermediate level;

[0078] S4: The intermediate stage inputs the service data packet into the simulation receiving end according to the network layer protocol field and the network layer load data, and inputs it to the output stage after a delay of T; specifically: the delay of T is for the simulation receiving end to further process it.

[0079] In this embodiment, the simulated receiving end is a virtual environment similar to the operating environment of a real network terminal. In this simulated environment, the operation of a real terminal can be simulated to test and verify security issues in network communications. A functional network is constructed based on the theory of Claude Shannon, the founder of information theory, which can simulate the information transformation of a real terminal, such as what kind of changes will occur in a real terminal after receiving a file. For example, after receiving a file, a folder is added to the real terminal; after installing an application, a launcher similar to starting the application, application code, etc. are added to the real terminal; here, the Clos model is a network architecture for efficiently processing data interaction. It is divided into three levels: input level, intermediate level and output level. Security screening between the two levels is used to achieve security assurance in the data interaction process.

[0080] In one embodiment, Clos switching networks can be classified into the following four types according to hardware conditions:

[0081] 1) SSS-type Clos network: that is, the three-level Clos switching units are all non-cached, and each level of switching units is composed of a Crossbar switching matrix. Since the three-level switching units are all non-cached, there can be no competition when establishing a link connection, and precise switching and scheduling flows are required, which directly leads to complex routing algorithm design and a large overhead for the system, so it is not widely used.

[0082] 2) MMM type Clos network: that is, the three-level Clos switching units are all equipped with cache, and generally use shared cache or output cache. Since there are multiple links between each input-level switching unit and the output-level switching unit, routing is required. Generally, there are two ways: packet-based routing or connection-based routing. Packet-based routing is to group at the input level, route them separately, and reach the output level through different intermediate-level switching units. After receiving the packets at the output level, they are reassembled, but there is a disorder problem and reordering is required. Connection-based routing is to reach the same output-level switching unit port through the same path, ensuring that the packet can reach the destination output-level port without blocking, but the number of intermediate-level switching units required is relatively large, so it is relatively complicated in terms of managing and controlling internal links and bandwidth allocation, so it is rarely used.

[0083] 3) MSM type Clos network: that is, there is no cache in the middle level, but there is cache in the input and output level switching units. Generally, a shared cache or a VOQ-based input cache is used, and the arriving packets are routed in each time slot based on the packet-based routing method. Different VOQs are established for each different output level port in the input level cache, so that packets arriving at different output level ports can use resources fairly according to their priorities. The output level cache can store packets that fail to arrive at the output level switching unit in the current time slot, reducing the number of internal links required to achieve unblocked conditions. MSM type is the most widely used Clos network.

[0084] 4) SMM type Clos network: that is, there is cache in the intermediate level and input level or output level switching unit, which is less used.

[0085] The most widely used one at present is the MSM type Clos network, which can achieve zero packet loss through a suitable scheduling algorithm and use VOQ cache to make fair use of switching resources. However, the SSS structure without cache requires global mastery of the resource utilization and status of each level of port when implementing routing, so it has high requirements on the routing algorithm and is not conducive to fair use of resources. In this embodiment, the MSM type Clos network is used.

[0086] In one embodiment, the simulation receiving end includes:

[0087] The simulation receiving end is constructed using a node network:

[0088] Step 1: Collect the relevant information in the real terminal and set it as a node. Define the relevant information as the feedback of the real terminal under each operation;

[0089] Step 2: Convert the correlation information into a correlation matrix and determine the threshold matrix based on the threshold;

[0090] Step 3: Finally, extract the functional network of the simulated receiving end relative to the real terminal.

[0091] In step 2, the correlation matrix includes:

[0092] Define element c ij is the correlation value between the feedback j of the real terminal under operation i, and defines the correlation threshold r. When c ij When it is greater than the threshold r, the functional correlation between the associated information is considered, otherwise it is considered irrelevant.

[0093] In this embodiment, firstly, the association information is collected from the real terminal. The association information is the response or feedback made by the real terminal for each operation. The information will be regarded as a single node. These nodes are connected to each other to form a network. The association information collected in step 1 is converted into a correlation matrix. In the correlation matrix, each element represents the correlation between the feedback of the real terminal under a specific operation. Then a threshold r is set to evaluate whether there is functional correlation between the association information. The threshold matrix is ​​derived from the correlation matrix according to the threshold r. By comparing the element value of the matrix with the threshold r, it can be determined which associations are functionally meaningful and which nodes (i.e., the feedback of the real terminal) have actual and meaningful connections. These connections constitute the functional network of the simulation receiving end, which processes network data by imitating the behavior of the real terminal. The construction method and analysis process of this simulation receiving end can be used to simulate the response of the real terminal to the network operation, so as to detect and block potential threats in advance before the actual network data flows to the real terminal; by constructing such a simulation receiving end, the ability of network security data processing can be effectively improved and complex attack behaviors can be better simulated and responded to.

[0094] In one embodiment, S3 includes preliminary screening of application layer protocol fields, network layer protocol fields, and network layer load data by a clustering algorithm, wherein the clustering algorithm includes:

[0095] Extract attack information feature vectors according to a preset unsafe attack information database, and compare them with the information contained in the application layer protocol field, network layer protocol field, and network layer payload data:

[0096] The Gaussian kernel concept is introduced. Given the attack information feature R as a kernel, the information x contained in the application layer protocol field, network layer protocol field, and network layer payload data is defined as a subset of R. The kernel function K h (R,x) represents the mapping of x in space h. Calculating the inner product of the kernel function can obtain the similarity between x and R features in the feature space. According to the Gaussian kernel:

[0097]

[0098] Among them, σ is an adjustable parameter. Since the feature space of the Gaussian kernel is infinite-dimensional, the weight ratio of the adjustable parameter σ to the space of each dimension is consistent. Therefore, two adjustable parameters c and d are introduced to use different widths to express the feature information in different dimensions:

[0099]

[0100] Finally, we get a linear superposition of Gaussian kernels of different widths c, d c is the weight coefficient, which controls the relative weight of the Gaussian kernel according to the Gaussian kernel at different widths.

[0101] In this embodiment, a clustering algorithm is used to classify network data based on its feature vectors. By comparing the characteristics of network data (such as application layer protocol fields, network layer protocol fields, network layer load data) with preset attack information feature vectors, clustering algorithms can help identify data packets that may represent security threats. Gaussian kernel is a method of measuring vector similarity in feature space, which can map raw data to a higher dimensional space. Here, the attack information feature R is used as a kernel to compare with the network data feature x. By linearly superimposing Gaussian kernels of different widths, a comprehensive kernel can be created, which combines feature information in multiple dimensions, allowing the algorithm to have better flexibility and adaptability when processing complex network data features. By adjusting the parameters of the Gaussian kernel function, the system can more accurately identify data packets similar to known attack features, thereby achieving preliminary screening of potential security threats. Example explanation: Assume a scenario in which a network security team is trying to monitor their company's network and identify possible malicious behavior through the Gaussian kernel clustering algorithm. The network security company first creates a malicious attack information database, which contains a wide range of attack feature vectors; these feature vectors represent known attack types, such as DDoS attack features, malware signatures, abnormal login patterns, etc. The company uses the network Network monitoring tools capture data flowing in and out of their network boundaries; each data packet contains information such as application layer protocol fields, network layer protocol fields, and network layer payload data. When the data packets are captured, the clustering algorithm starts working and uses the known attack information features R to evaluate each data packet. Example: Attack information feature R: Assume that this is a series of well-defined values ​​that represent the characteristics of a specific type of attack, such as: [0.2, -0.4, 0.7]; Packet information x: Each data packet is also converted into a feature vector, such as: [0.1, -0.35, 0.65]; The clustering algorithm will perform clustering on the data features. The Gaussian kernel function is applied to the vector to calculate the similarity between the vector and the attack information feature R; if the similarity is high enough, the system may mark the data packet as suspicious; in the Gaussian kernel, the σ parameter determines the width of the function curve; if σ is small, only very similar feature vectors are considered close to the kernel; if σ is large, a wider range of feature vectors is allowed to be included; if there are multiple Gaussian kernels, each kernel corresponds to a different parameter σ, and each kernel focuses on similarities of different widths. By linearly superimposing these kernels, a comprehensive mapping can be created, which can more comprehensively detect attack behaviors of different types and scales.

[0102] In one embodiment, the step S4 further includes:

[0103] According to the concept of Shannon information entropy, the discrete random variable operation Y is defined as {y1,y2,...,y m} random states, whose probabilities are {p1,p2,...,p m}, then the information entropy of the random variable operation Y is:

[0104]

[0105] The joint Shannon entropy of a random variable operation Y and another random variable Q is defined as:

[0106]

[0107] Mutual information of Y and Q: MI(Y,Q)=H(Y)+H(Q)-H(Y,Q).

[0108] The vector set of spatial information that also includes the analysis of nodes generated by the discrete random variable operation Y under interval t is:

[0109]

[0110] n nodes increase.

[0111] In this embodiment, information entropy can be used to detect abnormal or potential malicious behavior. When another random variable Q is introduced, the joint Shannon entropy of Y and Q can be defined to measure the uncertainty of the common state of the two random variables. At the same time, the mutual information of Y and Q is used to measure the amount of information shared by Y and Q, indicating the contribution of understanding one variable to reducing the uncertainty of another variable. A large number of network requests are observed in a short period of time. The status and additional information of these requests may show different patterns in the information entropy calculation, which is significantly different from normal network traffic; by analyzing these patterns and the increase in nodes, abnormal behavior can be identified and corresponding security measures can be taken. In a given embodiment, by using the calculation of information entropy and mutual information, uncertainty and abnormal patterns in network operations can be quantified and analyzed; this method can help identify which operations may represent attacks or other unexpected behaviors, so that network security systems can more accurately predict and defend against potential threats. For example: in one scenario, the simulated receiving end is performing data interaction. Before the data interaction, the network requests received by the simulated receiving end are fixed at Y. During the data interaction, n network requests are received for the data interaction. After calculating the information entropy, n+u real network requests are received. It can be seen that these u network requests are the source of unsafe information. By testing these u network requests separately in the simulated receiving end, its source can be known, and these data can be intercepted or eliminated in the real terminal.

[0112] Example 2

[0113] A network security data monitoring, processing and protection system is applied to any of the network security data dynamic interaction methods, the monitoring, processing and protection system comprising: a user access layer, a business application layer, a system management layer and a basic component layer;

[0114] The business application layer is used to implement a method for dynamic network security data interaction:

[0115] S1: Acquire and parse network data to obtain application layer protocol fields, network layer protocol fields, network layer payload data, and service data packets;

[0116] S2: Perform preliminary security screening on the application layer protocol fields, network layer protocol fields, and network layer payload data at the input level;

[0117] S3: After passing the screening of the input layer, the transmission route is selected according to the application layer protocol field and input to the intermediate level;

[0118] S4: The intermediate stage inputs the service data packet into the simulation receiving end according to the network layer protocol field and the network layer load data, and inputs it to the output stage after a delay of T.

[0119] The basic component layer is provided with a monitoring processing module, and the monitoring processing module is provided with a simulation receiving end, and the simulation receiving end includes:

[0120] Collection module: collects the relevant information in the real terminal and sets it as a node. It defines the relevant information as the feedback of the real terminal under each operation;

[0121] Conversion module: converts the correlation information into a correlation matrix and determines the threshold matrix according to the threshold;

[0122] Building module: Finally, extract the functional network of the simulated receiving end relative to the real terminal;

[0123] Information entropy comparison module: compares whether the node increase is consistent with the node increase preset in the business data packet. If they are consistent, it means that the business data packet is safe. Otherwise, the business data packet is judged to be unsafe.

[0124] Unsafe information extraction module: when the business data is determined to be unsafe, extract the dangerous data in the business data packet and update it in the preset unsafe attack information library.

[0125] In this embodiment, this is the interface for the system to interact with the user. In general, the user may be a network administrator or an automated security tool, which accesses the system functions through this layer. The system management layer is responsible for the monitoring and management tasks of the system, which may include configuring security policies, updating threat signature libraries, maintaining system logs and alarms, etc. The basic component layer is the underlying architecture of the system, supporting the operation of the system from the physical or virtual components.

[0126] In the specific implementation: a network security data monitoring, processing and protection system is set up, including a user access layer, a business application layer, a system management layer and a basic component layer, wherein the user access layer is accessed through tools such as a Web browser and a browser transmission plug-in, and the data interaction function is realized in the business application layer, wherein file sharing, sending and receiving mailboxes, etc. are provided to realize data interaction, and functions such as file type inspection, sensitive information inspection, and virus inspection are also provided; the system management layer is used for functions such as organization and user management, space configuration management, etc., and a built-in antivirus engine, a file type inspection engine, etc. are provided in the basic component layer; the construction of the protection system is realized by setting these functional plug-ins, and at the same time, in order to realize its monitoring and processing functions, a simulation receiving end is constructed to simulate the real terminal to process the data interaction situation in advance, wherein the delay T is to allow the simulation receiving end to process the interactive data in advance during the data interaction process and realize data security detection, and at the same time, for the data that has been received, the simulation receiving end and the real terminal also run asynchronously at a time interval of T, and if there is a problem on the simulation receiving end, it can be fed back to the real terminal in real time, so that the real terminal can intercept or disinfect the problem data in advance.

[0127] See also Figure 3 , Figure 3 Schematic diagram of an electronic device provided by an embodiment of the present invention. Figure 3 As shown, an embodiment of the present invention provides an electronic device 500, including a memory 510, a processor 520, and a computer program 511 stored in the memory 510 and executable on the processor 520. When the processor 520 executes the computer program 511, the following steps are implemented:

[0128] S1: Acquire and parse network data to obtain application layer protocol fields, network layer protocol fields, network layer payload data, and service data packets;

[0129] S2: Perform preliminary security screening on the application layer protocol fields, network layer protocol fields, and network layer payload data at the input level;

[0130] S3: After passing the screening of the input layer, the transmission route is selected according to the application layer protocol field and input to the intermediate level;

[0131] S4: The intermediate stage inputs the service data packet into the simulation receiving end according to the network layer protocol field and the network layer load data, and inputs it to the output stage after a delay of T.

[0132] See also Figure 4 , Figure 4 A schematic diagram of an embodiment of a computer-readable storage medium provided in an embodiment of the present invention. Figure 4 As shown, this embodiment provides a computer-readable storage medium 600, on which a computer program 611 is stored. When the computer program 611 is executed by a processor, the following steps are implemented:

[0133] S1: Acquire and parse network data to obtain application layer protocol fields, network layer protocol fields, network layer payload data, and service data packets;

[0134] S2: Perform preliminary security screening on the application layer protocol fields, network layer protocol fields, and network layer payload data at the input level;

[0135] S3: After passing the screening of the input layer, the transmission route is selected according to the application layer protocol field and input to the intermediate level;

[0136] S4: The intermediate stage inputs the service data packet into the simulation receiving end according to the network layer protocol field and the network layer load data, and inputs it to the output stage after a delay of T.

[0137] It should be noted that in the above embodiments, the description of each embodiment has its own emphasis, and for parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0138] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0139] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded computer, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0140] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0141] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0142] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0143] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A method for dynamic interaction of network security data, characterized in that: The following steps are involved: Constructing a simulation receiving terminal, wherein the simulation receiving terminal is provided with a virtual space to simulate the operation of a real terminal; Constructing a Clos multi-stage network switching model, wherein the Clos multi-stage network switching model is provided with an input stage, an intermediate stage and an output stage; the intermediate stage is connected to a simulated receiving end, and the output stage is provided on a real terminal; S1: Acquire and parse network data to obtain application layer protocol fields, network layer protocol fields, network layer payload data, and service data packets; S2: Perform preliminary security screening on the application layer protocol fields, network layer protocol fields, and network layer payload data at the input level; S3: After passing the screening of the input layer, the service data packet selects a transmission route according to the application layer protocol field and inputs it into the intermediate level; S4: The intermediate stage inputs the service data packet into the simulation receiving end according to the network layer protocol field and network layer load data, and inputs it into the output stage after a delay of T; S3 includes preliminary screening of the application layer protocol field, the network layer protocol field, and the network layer load data by a clustering algorithm, wherein the clustering algorithm includes: Extract attack information feature vectors according to a preset unsafe attack information database, and compare them with the information contained in the application layer protocol field, network layer protocol field, and network layer payload data: The Gaussian kernel concept is introduced. Given the attack information feature R as a kernel, the information x contained in the application layer protocol field, network layer protocol field, and network layer payload data is defined as a subset of R. The kernel function K h (R,x) represents the mapping of x in space h. Calculating the inner product of the kernel function can obtain the similarity between x and R features in the feature space. According to the Gaussian kernel: Among them, σ is an adjustable parameter. Since the feature space of the Gaussian kernel is infinite-dimensional, the weight ratio of the adjustable parameter σ to the space of each dimension is consistent. Therefore, two adjustable parameters c and d are introduced to use different widths to express the feature information in different dimensions: Finally, we get a linear superposition of Gaussian kernels of different widths c, d c is the weight coefficient, which controls the relative weight of the Gaussian kernel according to the Gaussian kernel at different widths; The S4 step also includes: According to the concept of Shannon information entropy, the discrete random variable operation Y is defined as {y1,y2,...,y m } random states, whose probabilities are {p1,p2,...,p m }, then the information entropy of the random variable operation Y is: The joint Shannon entropy of a random variable operation Y and another random variable Q is defined as: Mutual information of Y and Q: MI(Y,Q)=H(Y)+H(Q)-H(Y,Q).

2. The method for dynamic network security data interaction according to claim 1, characterized in that: The simulation receiving end comprises: The simulation receiving end is constructed using a node network: Step 1: Collect the relevant information in the real terminal and set it as a node. Define the relevant information as the feedback of the real terminal under each operation; Step 2: Convert the correlation information into a correlation matrix and determine the threshold matrix based on the threshold; Step 3: Finally, construct a simulated receiving terminal that has the same functions as the real terminal.

3. According to the method for dynamic interaction of network security data in claim 2, in step 2, the correlation matrix comprises: Define element c ij is the correlation value between the feedback j of the real terminal under operation i, and defines the correlation threshold r. When c ij When it is greater than the threshold r, the functional correlation between the associated information is considered, otherwise it is considered irrelevant.

4. A network security data monitoring, processing and protection system, characterized in that: The network security data dynamic interaction method applied to any one of claims 1 to 3, wherein the monitoring, processing and protection system comprises: a user access layer, a business application layer, a system management layer and a basic component layer; The business application layer is used to implement a method for dynamic network security data interaction: S1: Acquire and parse network data to obtain application layer protocol fields, network layer protocol fields, network layer payload data, and service data packets; S2: Perform preliminary security screening on the application layer protocol fields, network layer protocol fields, and network layer payload data at the input level; S3: After passing the screening of the input layer, the service data packet selects a transmission route according to the application layer protocol field and inputs it into the intermediate level; S4: The intermediate stage inputs the service data packet into the simulation receiving end according to the network layer protocol field and the network layer load data, and inputs it into the output stage after a delay of T.

5. The network security data monitoring, processing and protection system according to claim 4 is characterized in that: The basic component layer is provided with a monitoring processing module, and the monitoring processing module is provided with a simulation receiving end, and the simulation receiving end includes: Collection module: collects the relevant information in the real terminal and sets it as a node. It defines the relevant information as the feedback of the real terminal under each operation; Conversion module: converts the correlation information into a correlation matrix and determines the threshold matrix according to the threshold; Construction module: Finally, a simulated receiving terminal with the same functions as the real terminal is constructed; Information entropy comparison module: compares whether the node increase is consistent with the node increase preset in the business data packet. If they are consistent, it means that the business data packet is safe. Otherwise, the business data packet is judged to be unsafe. Unsafe information extraction module: when the business data is determined to be unsafe, extract the dangerous data in the business data packet and update it in the preset unsafe attack information library.

6. An electronic device, characterized in that: include: Memory for storing computer software programs; A processor is used to read and execute the computer software program, thereby implementing the method for dynamic interaction of network security data as described in any one of claims 1-3.

7. A non-transitory computer-readable storage medium, characterized in that: The storage medium stores a computer software program, which, when executed by a processor, implements the method for dynamic interaction of network security data according to any one of claims 1 to 3.

Images