Traffic security analysis platform and system

Abstract

The present invention discloses a flow security analysis platform and system, including an equipment monitoring management module, an Internet behavior analysis module and a data display module, wherein the equipment monitoring management module includes a data receiving unit and a flow monitoring unit, wherein the data receiving unit is used to receive Internet behavior data from at least one router and store it in a database, and the flow monitoring unit is used to monitor the flow data uploaded by the router; the Internet behavior analysis module is used to respond to the flow alarm prompt of the flow monitoring unit, determine the alarm router and read the Internet behavior data from the database to perform flow security analysis, and obtain the analysis result; the data display module includes an analysis result display unit and a map topology display unit, wherein the analysis result display unit is used to display the analysis result, and the map topology display unit is used to mark the geographical location corresponding to the alarm router on the map topology. The present invention can improve the work efficiency of operation and maintenance personnel.

Description

Technical Field

[0001] The present invention relates to the field of security technology, and in particular to a traffic security analysis platform and system. Background Art

[0002] Network traffic security protection is widely used by different enterprise users. Routers are usually used to monitor user traffic. When the traffic exceeds the threshold, an alarm is issued to notify operation and maintenance personnel to conduct traffic anomaly inspection. In order to improve the work efficiency of operation and maintenance personnel, it is necessary to develop a corresponding traffic security analysis platform and system. Summary of the invention

[0003] The present invention aims to solve at least one of the technical problems existing in the prior art. To this end, the present invention proposes a traffic security analysis platform and system, which can improve the work efficiency of operation and maintenance personnel.

[0004] An embodiment of the present invention provides a traffic security analysis platform, including:

[0005] The device monitoring management module includes a data receiving unit and a flow monitoring unit, wherein the data receiving unit is used to receive Internet behavior data from at least one router and store it in a database, and the flow monitoring unit is used to perform flow monitoring on the flow data uploaded by the router;

[0006] An online behavior analysis module, for responding to the traffic alarm prompt of the traffic monitoring unit, determining an alarm router and reading the online behavior data from the database to perform traffic security analysis and obtain an analysis result;

[0007] A data display module, comprising an analysis result display unit and a map topology display unit, wherein the analysis result display unit is used to display the analysis result, and the map topology display unit is used to mark the geographical location corresponding to the alarm router on the map topology;

[0008] The reading of Internet behavior data for traffic security analysis includes:

[0009] Intercepting first online behavior data and second online behavior data, wherein the first online behavior data is used to represent online behavior data between a first moment and a second moment, and the second online behavior data is used to represent online behavior data within a preset time period before the first moment, wherein the first moment is used to represent a moment when a traffic anomaly begins to occur or a moment of a preset time period before a traffic anomaly occurs, and the second moment is used to represent a moment when a traffic alarm is triggered;

[0010] Performing statistical analysis on the first online behavior data and the second online behavior data respectively to determine a first address data set and a second address data set;

[0011] Performing risk screening on the first address data set to determine a third address data set and a risk address data set, wherein the risk screening includes regional distribution screening and blacklist and whitelist screening;

[0012] Based on the second address data set, the third address data set is compared and checked to determine a fourth address data set.

[0013] According to some embodiments of the present invention, the device monitoring management module further includes a device management unit, and the device management unit is used to enter new device information and maintain device information for the router.

[0014] According to some embodiments of the present invention, the device monitoring management module further includes a load status monitoring unit, which is used to collect operating load status data of the router and issue an alarm when the operating load status is characterized by overload.

[0015] According to some embodiments of the present invention, the device monitoring management module further includes a connection status monitoring unit, which is used to collect the connection status of the router and issue an alarm when the connection status is characterized by disconnection.

[0016] According to some embodiments of the present invention, the traffic security analysis platform further includes a tenant management module, and the tenant management module is used to create and maintain tenants.

[0017] According to some embodiments of the present invention, the traffic security analysis platform further includes a device grouping module, wherein the device grouping module includes a grouping unit, and the grouping unit is used to perform device grouping management on the router based on existing or newly created tenants.

[0018] According to some embodiments of the present invention, the device grouping module further includes a geographic information entry unit, and the geographic information entry unit is used to enter the geographic location information of the router in the corresponding group.

[0019] According to some embodiments of the present invention, the geographic information entry unit includes a first information entry component and a second information entry component, the first information entry component is used to enter the corresponding location information according to the IP address of the router, and the second information entry component is used to enter the longitude and latitude information of the router in the corresponding group.

[0020] According to some embodiments of the present invention, the database is a time series database.

[0021] On the other hand, an embodiment of the present invention provides a traffic security analysis system, including a router and the above-mentioned traffic security analysis platform, wherein the router is configured with an API interface and is deployed on the user side, and the router is communicatively connected to the traffic security analysis platform.

[0022] The embodiments of the present invention have at least the following beneficial effects:

[0023] The traffic security analysis platform can receive monitoring data from routers, perform traffic security analysis when a traffic alarm is triggered, and visualize the results through the analysis result display unit and the map topology display unit, so that operation and maintenance personnel can quickly determine the alarm router and understand the risk address information and address information to be checked based on the risk address data set and the fourth address data set, which is conducive to improving the work efficiency of operation and maintenance personnel.

[0024] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The above and / or additional aspects and advantages of the present invention will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0026] Figure 1 This is one of the principle block diagrams of the traffic security analysis platform according to an embodiment of the present invention;

[0027] Figure 2 for Figure 1 The functional block diagram of the device monitoring and management module of the traffic security analysis platform shown;

[0028] Figure 3 This is the second principle block diagram of the traffic security analysis platform according to an embodiment of the present invention;

[0029] Figure 4 This is one of the schematic diagrams of flow rate and time changes in an embodiment of the present invention;

[0030] Figure 5 This is the second schematic diagram of the change of flow rate and time according to an embodiment of the present invention.

[0031] Reference numerals:

[0032] Equipment monitoring management module 100, data receiving unit 110, traffic monitoring unit 120, equipment management unit 130, load status monitoring unit 140, wiring status monitoring unit 150, Internet behavior analysis module 200, data display module 300, analysis result display unit 310, map topology display unit 320, tenant management module 400, equipment grouping module 500, grouping unit 510, geographic information entry unit 520, first information entry component 521, second information entry component 522. DETAILED DESCRIPTION

[0033] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be understood as limiting the present invention.

[0034] In the description of the present invention, "several" means one or more, "multiple" means more than two, greater than, less than, and exceeding are understood as not including the number itself, and "above", "below", and "within" are understood as including the number itself. If there is a description of "first", "second", etc., it is only used for the purpose of distinguishing technical features, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features or implicitly indicating the order of the indicated technical features.

[0035] In the description of the present invention, unless otherwise clearly defined, words such as “configuration” and “setting” should be understood in a broad sense, and technicians in the relevant technical field can reasonably determine the specific meanings of the above words in the present invention in combination with the specific content of the technical solution.

[0036] Please refer to Figure 1 This embodiment discloses a traffic security analysis platform, including a device monitoring management module 100, an Internet behavior analysis module 200 and a data display module 300.

[0037] Please refer to Figure 2The device monitoring management module 100 includes a data receiving unit 110 and a traffic monitoring unit 120. The data receiving unit 110 is used to receive Internet behavior data from at least one router and store it in a database. The traffic monitoring unit 120 is used to monitor the traffic data uploaded by the router. Exemplarily, the user group of this embodiment is mostly corporate users, and each corporate user is configured with a router. Of course, if an enterprise has multiple subsidiaries, each subsidiary can also be configured with a router, that is, a corporate user is configured with multiple routers. Since the memory of the router is small and the amount of Internet behavior data is large, the collected Internet behavior data needs to be uploaded to the data for storage. During this process, the router can also upload the collected traffic data to facilitate traffic monitoring. The Internet behavior analysis module 200 is used to respond to the traffic alarm prompt of the traffic monitoring unit 120, determine the alarm router, and read the Internet behavior data from the database to perform traffic security analysis (see below for details), and obtain the analysis results (such as the risk address data set and the fourth address data set below). Please refer to Figure 1 The data display module 300 includes an analysis result display unit 310 and a map topology display unit 320. The analysis result display unit 310 is used to display the analysis results, and the map topology display unit 320 is used to mark the geographical location corresponding to the alarm router on the map topology. In actual applications, there are a large number of enterprise users, and their locations are distributed in many regions across the country. Each enterprise user may be configured with one or more routers. In order to quickly locate the enterprise users corresponding to the alarm router and the areas where the enterprise users are located, the geographical location corresponding to the alarm router is marked on the map topology by the map topology display unit 320, which is conducive to the operation and maintenance personnel to intuitively understand the users and geographical locations corresponding to the alarm router. In addition, the Internet behavior analysis module 200 conducts a preliminary investigation on the causes of abnormal traffic, and the analysis results are displayed by the analysis result display unit 310, which can facilitate the operation and maintenance personnel to quickly conduct risk investigation and reduce the amount of data to be investigated, which is conducive to improving the work efficiency of the operation and maintenance personnel.

[0038] Please refer to Figure 2 The device monitoring management module 100 further includes a device management unit 130, which is used to enter new device information and maintain device information for the router, for example, by setting a corresponding "new device" control on the software interface to enter the router's IP address, account number, password and other information, so as to facilitate communication between the router and the data receiving unit 110. The device management unit 130 can also maintain the router with entered information, for example, deleting the information of the router whose lease has expired, or modifying the information of the router.

[0039] Please continue to refer to Figure 2The device monitoring management module 100 also includes a load status monitoring unit 140, which is used to collect the operation load status data of the router and issue an alarm when the operation load status is characterized as overload. The operation and maintenance personnel or users can view the load status of the device through the corresponding page and set the corresponding load threshold. In this way, when the operation load status of the device is characterized as overload, an alarm can be issued to the operation and maintenance personnel and users to facilitate timely troubleshooting of abnormalities.

[0040] Please continue to refer to Figure 2 The device monitoring management module 100 also includes a connection status monitoring unit 150, which is used to collect the connection status of the router and issue an alarm when the connection status is characterized as disconnection. In this way, the connection status of the router can be monitored so that an alarm prompt can be issued in time when a disconnection fault occurs in the router, which is conducive to improving the operation and maintenance efficiency of the operation and maintenance personnel.

[0041] Please refer to Figure 3 The traffic security analysis platform also includes a tenant management module 400, which is used to create and maintain tenants. For example, a new tenant is created with the enterprise name of the enterprise user as the tenant name, and the company associated with the enterprise user is bound to establish a group. The tenant management module 400 can delete, modify or group edit the created tenants to improve the operation and maintenance efficiency.

[0042] Please continue to refer to Figure 3 The traffic security analysis platform also includes a device grouping module 500, which includes a grouping unit 510. The grouping unit 510 is used to manage the routers in device groups based on existing or newly created tenants. When in use, the router needs to be configured on the user side. Therefore, the existing or newly created tenants can be used as group names to manage the routers in device groups. For example, tenant A has 5 associated companies, and each company needs to be configured with a router. In this way, tenant A can be used as the group name for device group management to manage the 5 routers. In this way, when the router triggers an alarm prompt, the corresponding tenant information can be quickly learned.

[0043] The device grouping module 500 also includes a geographic information input unit 520, which is used to input the geographic location information of the router under the corresponding group. In order to facilitate the marking of the geographic location of the alarm router through the map topology unit, the geographic location information of the router can be pre-entered through the geographic information input unit 520.

[0044] The geographic information input unit 520 includes a first information input component 521 and a second information input component 522. The first information input component 521 is used to input the corresponding location information according to the IP address of the router, and the second information input component 522 is used to input the latitude and longitude information of the router under the corresponding group. The input of the router device includes the IP address, and the corresponding location information can be determined according to the IP address, such as China-X Province-Y City-Z District. If the router needs to be located more accurately, the latitude and longitude information can be input through the second information input component 522. In this way, when the traffic alarm prompt is triggered, the corresponding geographical location can be quickly located.

[0045] In this embodiment, the database is a time series database (TSDB). A time series database is a database system specifically used to store, process, and query time series data. Each data point contains a timestamp for indexing, aggregation, and sampling. A time series database has the following characteristics:

[0046] 1. High performance: Time series databases can efficiently store and query time series data, and their query performance far exceeds that of traditional relational databases;

[0047] 2. Large-scale support: It can process large-scale time series data and support horizontal expansion and load balancing deployment of data;

[0048] 3. Data compression: Time series data can be compressed to reduce storage space and effectively save costs;

[0049] 4. Accurate timestamp: can accurately record the timestamp of data, support high-precision timestamp and different time resolutions;

[0050] 5. Data analysis: supports a variety of statistical analysis and aggregation operations, such as data rolling average, aggregation calculation, data interpolation and prediction, etc.

[0051] Among them, in the online behavior analysis module 200, reading the online behavior data for traffic security analysis includes steps S100 to S400. It should be noted that the steps in this embodiment are numbered only for the convenience of review and understanding, rather than limiting the execution order of the steps. In actual application, adaptive adjustments can be made according to the logical relationship between the steps. The contents of each step are described in detail below:

[0052] S100, intercepting first online behavior data and second online behavior data, the first online behavior data is used to represent the online behavior data between a first moment and a second moment, and the second online behavior data is used to represent the online behavior data within a preset time before the first moment, the first moment is used to represent the moment when the traffic anomaly begins to occur or the moment before the traffic anomaly occurs for a preset time, and the second moment is used to represent the moment when the traffic alarm is triggered;

[0053] For example, different flow alarm thresholds are configured according to the needs of different users. When the actual flow value exceeds the flow alarm threshold, a flow alarm is issued. Of course, in order to avoid false alarms caused by instantaneous peak values, in actual applications, the alarm monitoring can be delayed. For example, please refer to Figure 4 , the dotted line L1 represents the flow alarm threshold. If the actual flow value exceeds the flow alarm threshold (such as at moment t3) and lasts for a period of time (such as at moment t2), a flow alarm is issued. The first moment is recorded as t1, the second moment is recorded as t2, and the moment when the flow abnormality begins to appear is recorded as t0. Then, in some application examples, t1=t0, that is, when a flow alarm occurs (at moment t3 or t2), forward analysis is performed to determine the moment when the flow abnormality begins to appear as the first moment; in other application examples, in order to improve the accuracy of data analysis, the buffer time tm can be configured, then t1=t0-tm, that is, when t0 is determined, the tm time is traced forward to obtain the first moment. It should be noted that the "forward" here is based on the time axis as a reference. For a certain moment on the time axis, the past time is "before" and the future time is "after".

[0054] During operation, according to different routing speed limit strategies, in some application examples, when a traffic alarm is triggered, the router can limit the speed of the relevant port or stop the network service, while in other application examples, when a traffic alarm is triggered, the router continues to provide network services normally and continues to collect traffic data. The traffic data collected by the router is uploaded to the corresponding management platform (such as the traffic security analysis platform mentioned above), and the data is intercepted on the management platform. Of course, the traffic data can also be uploaded to the database, and the traffic data in the database can be called and intercepted on the management platform. Under normal circumstances, the traffic used by users usually does not exceed the preset traffic threshold, and when traffic anomalies occur, some cases are due to frequent access or more bandwidth occupied by the same or similar IP addresses, resulting in a surge in traffic. Based on this, the Internet behavior data between the first moment and the second moment can be used as an analysis object to find out the IP addresses with risks, and the Internet behavior data within the preset time before the first moment can be used as a comparison object with lower risks to further reduce the amount of screening data. The preset duration can be determined based on experience or experiments. For example, the Internet behavior data within 1 hour, 1.5 hours or 3 hours before the first moment can be intercepted as the second Internet behavior data, or the Internet behavior data from 0:00 on the same day to the first moment can be intercepted as the second Internet behavior data. In actual applications, the format of the Internet behavior data can be customized, but usually includes information such as the source IP address, destination IP address, port number, access time, and the protocol used by the destination IP address. Of course, in some application scenarios, the URL (Uniform Resource Locator) of the application can be used as one of the parameters of the Internet behavior data through the router.

[0055] S200, performing statistical analysis on the first online behavior data and the second online behavior data respectively to determine a first address data set and a second address data set;

[0056] Exemplarily, the first online behavior data and the second online behavior data are both collected raw data, which are not convenient for direct analysis. Therefore, a statistical analysis is performed on the first online behavior data to determine the first address data set, and a statistical analysis is performed on the second online behavior data to determine the second address data set, so as to facilitate subsequent analysis based on the first address data set and the second address data set.

[0057] S300, performing risk screening on the first address data set to determine a third address data set and a risk address data set, wherein the risk screening includes regional distribution screening and blacklist and whitelist screening;

[0058] For example, for some users, their main business is in China, and the frequency of visits to overseas websites is low or even zero. Therefore, by checking the regional distribution of the destination IP address, it can be preliminarily determined whether the destination IP address is at risk; and by checking the blacklist and whitelist, it can be determined whether the destination IP address is at risk or belongs to a risk-free object in the whitelist. The destination IP addresses that are at risk or suspected of being at risk are stored in the risk address data set, and the risk level of the destination IP address is marked, and the corresponding source IP address and the protocol used are associated. Since both the regional distribution check and the blacklist and whitelist check require the user to pre-configure the corresponding comparison data, it is impossible to identify all destination IP addresses, which is a limited check. Therefore, the data that has not been risk checked in the first address data set is stored as the third address data set for further checking based on the second address data set.

[0059] S400: Based on the second address data set, compare and check the third address data set to determine a fourth address data set.

[0060] Exemplarily, since the second address data set is derived from the Internet behavior data before the first moment, before the first moment, the traffic collected by the router is within the normal range, and it can be considered that the risk of the Internet behavior data before the first moment is very low. In this way, the second address data set is used as a reference object for comparison and investigation, and the destination IP addresses with no risk or low risk can be investigated to a certain extent, and the fourth address data set is obtained, which is convenient for operation and maintenance personnel to quickly determine the alarm router and understand the risk address information and address information to be investigated based on the risk address data set and the fourth address data set, reduce the workload of subsequent investigation, and help improve the work efficiency of operation and maintenance personnel. It should be noted that the risk address data set and the fourth address data set can be retrieved and displayed on the management platform, for example, by displaying them through the analysis result display unit 310. Of course, according to actual operation needs, the fifth address data set with no risk or low risk during the investigation process can also be retrieved.

[0061] In the above scheme, the method of determining the second moment is relatively clear. However, the determination of the first moment has a greater impact on the accuracy and efficiency of data analysis. Therefore, it is necessary to reasonably determine the first moment to balance the accuracy and comprehensiveness of traffic security analysis. The following two schemes are provided:

[0062] The first solution is to analyze the traffic change rate based on intercepted traffic data:

[0063] Before step S100, the method further includes:

[0064] S110A, in response to a flow alarm, determining a second time;

[0065] S120A, obtaining flow data of a preset time period before a second moment;

[0066] S130A, determining a flow rate change rate of the flow data based on a preset first analysis time interval;

[0067] S140A. Determine a first moment according to a flow rate change rate and a preset change rate threshold.

[0068] Exemplarily, the determination condition of the second moment is relatively clear, therefore, the second moment is determined first, and then the first moment is determined with the second moment as the time reference. After determining the second moment, the flow data of a period of time before the second moment can be used as the analysis object, and the specific duration can be adaptively configured according to the actual application requirements. For example, in order to reduce the amount of data analysis, the flow data of half an hour before the second moment can be intercepted; and if in order to improve the comprehensiveness of the investigation, the flow data of 1 to 2 hours before the second moment can be intercepted. Since the acquired flow data is collected and uploaded by the router based on a certain sampling frequency, considering that some abnormal flows are disguised, that is, the flow change will gradually increase, therefore, by setting the first analysis time interval, the flow data is determined to obtain the flow change rate. For example, assuming that the sampling frequency of the router is 10 seconds, the first analysis time interval can be set to 30 seconds, 43 seconds, 55 seconds or 1 minute, etc., so that the flow change rate of the flow data can be more obvious. If the flow change rate at a certain moment is greater than or equal to the preset change rate threshold, the moment is determined as the first moment.

[0069] In the above scheme, the length of the first analysis time interval has a great influence on the accuracy of the first moment. In order to improve the accuracy of determining the first moment, step S140A determines the first moment according to the flow rate change rate and a preset change rate threshold, and then further includes:

[0070] S150A, obtaining flow data of a preset time period before and after the first moment;

[0071] S160A, calculating the flow rate change rate of the flow data based on a preset second analysis time interval, the second analysis time interval being smaller than the first analysis time interval;

[0072] S170A: Update the first moment according to the flow rate change rate and the change rate threshold.

[0073] Exemplarily, assume that the first analysis time interval is tn, and the first moment is denoted as t1. Then, the traffic data between the moments of t1 - N * tn and t1 + N * tn can be obtained, where N is a positive number. The second analysis time interval can be configured as k * tn, where 0 < k < 1. In this way, the traffic change rate of the traffic data can be calculated. When the traffic change rate at a certain moment is greater than the change rate threshold, that moment is determined as the first moment, i.e., t1 is updated. Of course, the second analysis time interval can be adjusted multiple times, and steps S150A to S170A can be executed to obtain a more accurate first moment, which is convenient for determining the attack time of abnormal traffic and is beneficial for operation and maintenance personnel to analyze.

[0074] The second solution is to analyze based on historical traffic data:

[0075] Before step S100, it also includes:

[0076] S110B. In response to a traffic alarm, determine the second moment;

[0077] S120B. Obtain the traffic data of a preset duration before the second moment;

[0078] S130B. Based on the historical traffic data, determine the traffic average value at the same cycle position;

[0079] S140B. Determine the moment closest to the second moment among the moments in the traffic data where the traffic value is equal to the traffic average value as the first moment.

[0080] Exemplarily, the work of some users has strong regularity. For example, taking one week (7 days) as a work cycle, the traffic used on the same day of each week (such as Monday) is roughly the same. In this way, by analyzing the historical traffic data of multiple work cycles, the traffic average value corresponding to the day when the traffic alarm occurs (i.e., the same cycle position) can be determined. Please refer to Figure 5 , the dotted line L1 represents the traffic alarm threshold. Using the traffic average value (such as the dotted line L2) as a reference benchmark, one or more t1 (such as points A1, A2, and A3) can be determined. Considering that the traffic data may exceed the traffic average value instantaneously or in a short period of time, among one or more t1, the t1 closest to the second moment (such as t2) is determined as the first moment.

[0081] In some application examples, to improve the accuracy of determining the first moment, the above first solution and the second solution can be used simultaneously to determine t1, and the t1 obtained from the two solutions can be combined to determine the first moment, for example, based on principles such as the closest in time, the farthest in time, or the average in time.

[0082] The first address data set and the second address data set contain the same fields, including source IP address, destination IP address, region to which the source IP address belongs, region to which the destination IP address belongs, access traffic, and number of accesses.

[0083] Step S200, performing statistical analysis on the first online behavior data and the second online behavior data respectively to determine the first address data set and the second address data set, including:

[0084] S210, performing field extraction on the first online behavior data and the second online behavior data respectively to obtain a first intermediate data set and a second intermediate data set;

[0085] S220 . Based on the destination IP address, merge the first intermediate data set and the second intermediate data set to obtain a first address data set and a second address data set.

[0086] Exemplarily, the online behavior data usually includes information such as the source IP address, the destination IP address, the port number, the access time, and the protocol used by the destination IP address. The first online behavior data is subjected to field extraction to obtain the first intermediate data set; the second online behavior data is subjected to field extraction to obtain the second intermediate data set. For example, the IP address contains information about the region to which it belongs, so the region to which the source IP address belongs can be determined based on the source IP address, and the region to which the destination IP address belongs can be determined based on the destination IP address. In the first intermediate data set, the data with the same destination IP address are merged, and the merging process counts the access traffic and access frequency of the IP address, thereby obtaining the first address data set; similarly, in the second intermediate data set, the data with the same destination IP address are merged to obtain the second address data set, so as to facilitate subsequent risk investigation.

[0087] S400: Based on the second address data set, the third address data set is compared and checked to determine a fourth address data set, which also includes:

[0088] S401. Perform risk screening on the second address data set and update the second address data set. The risk screening includes regional distribution screening and blacklist and whitelist screening.

[0089] For example, although the traffic before the first moment is considered safe by taking the first moment as the boundary, some abnormal traffic is disguised, so by conducting a risk check on the second address data set, the whitelist data in the second address data set can be removed and the second address data set can be updated; if a risky IP address or a potential risky IP address is found in the second address data set, the second address data set and the risky address data set are updated, and the trust level of the second address data set is updated. When the trust level is characterized as untrustworthy, the second moment is updated to the first moment, that is, t2=t1, and the moment corresponding to the risky address (recorded as t4) is determined as the first moment, that is, t1=t4, and the process returns to step S100 for re-checking.

[0090] In the above scheme, the traffic alarm may be issued after the actual traffic value exceeds the traffic alarm threshold and lasts for a period of time. Therefore, step S100 may also determine a third moment, which is the moment when the traffic value exceeds the traffic alarm threshold and is closest to the second moment. Accordingly, step S100 also includes intercepting third Internet behavior data, which is used to characterize the Internet behavior data between the third moment and the second moment. Step S300 also includes performing risk screening on the third Internet behavior data set based on the feature library, determining risky Internet behavior data, and performing statistical analysis on the risky Internet behavior data to update the risk address data set. In this way, performing risk screening on Internet behavior data that exceeds the traffic alarm threshold based on the feature library can improve the accuracy of the screening and reduce the amount of data screened, which is conducive to improving analysis efficiency.

[0091] This embodiment also provides a traffic security analysis system, including a router and the above-mentioned traffic security analysis platform, the router is configured with an API interface and deployed on the user side, and the router is in communication with the traffic security analysis platform. It is hoped that it is understood that this traffic security analysis system embodiment and the above-mentioned traffic security analysis platform are based on the same inventive concept, and in order to avoid redundancy, the contents not involved in this traffic security analysis system embodiment can refer to the above-mentioned traffic security analysis platform embodiment.

[0092] The traffic security analysis platform can receive monitoring data from routers, perform traffic security analysis when a traffic alarm is triggered, and visualize the results through the analysis result display unit and the map topology display unit, so that operation and maintenance personnel can quickly determine the alarm router and understand the risk address information and address information to be checked based on the risk address data set and the fourth address data set, which is conducive to improving the work efficiency of operation and maintenance personnel.

[0093] The embodiments of the present invention are described in detail above with reference to the accompanying drawings, but the present invention is not limited to the above embodiments, and various changes can be made within the knowledge scope of ordinary technicians in the relevant technical field without departing from the purpose of the present invention.

Claims

1. A traffic security analysis platform, characterized in that: include: The device monitoring management module includes a data receiving unit and a flow monitoring unit, wherein the data receiving unit is used to receive Internet behavior data from at least one router and store it in a database, and the flow monitoring unit is used to perform flow monitoring on the flow data uploaded by the router; An online behavior analysis module, for responding to the traffic alarm prompt of the traffic monitoring unit, determining an alarm router and reading the online behavior data from the database to perform traffic security analysis and obtain an analysis result; A data display module, comprising an analysis result display unit and a map topology display unit, wherein the analysis result display unit is used to display the analysis result, and the map topology display unit is used to mark the geographical location corresponding to the alarm router on the map topology; The reading of Internet behavior data for traffic security analysis includes: In response to the flow alarm, determining a second time, the second time being used to characterize the time when the flow alarm is triggered; Acquire the flow data of a preset time period before the second moment; Determining a flow rate change rate of the flow data based on a preset first analysis time interval; When the flow rate change rate is greater than or equal to a preset change rate threshold, a first moment is determined, where the first moment is used to characterize the moment when the flow anomaly begins to occur or the moment of a preset length of time before the flow anomaly occurs; Obtaining traffic data for a preset time period before and after the first moment; Calculating a flow rate change rate of the flow data based on a preset second analysis time interval, wherein the second analysis time interval is smaller than the first analysis time interval; When the flow rate change rate is greater than the change rate threshold, updating the first time; intercepting first online behavior data and second online behavior data, wherein the first online behavior data is used to represent online behavior data between a first moment and a second moment, and the second online behavior data is used to represent online behavior data within a preset time period before the first moment; Performing statistical analysis on the first online behavior data and the second online behavior data respectively to determine a first address data set and a second address data set, wherein the statistical analysis includes field extraction and data merging; Perform risk screening on the first address data set to determine a third address data set and a risk address data set, wherein the risk screening includes regional distribution screening and blacklist and whitelist screening, and the third address data set is obtained by storing data in the first address data set that has not been subjected to risk screening; Based on the second address data set, the third address data set is compared and checked to determine a fourth address data set, wherein the fourth address data set stores destination IP addresses with no risk or low risk.

2. The traffic security analysis platform according to claim 1, characterized in that: The device monitoring management module also includes a device management unit, and the device management unit is used to enter new device information and maintain device information for the router.

3. The traffic security analysis platform according to claim 1, characterized in that: The device monitoring management module further includes a load status monitoring unit, which is used to collect the operation load status data of the router and issue an alarm when the operation load status is characterized as overload.

4. The traffic security analysis platform according to claim 1, 2 or 3, characterized in that: The device monitoring management module further includes a connection status monitoring unit, which is used to collect the connection status of the router and issue an alarm when the connection status is characterized as disconnection.

5. The traffic security analysis platform according to claim 1, characterized in that: The traffic security analysis platform also includes a tenant management module, which is used to create and maintain tenants.

6. The traffic security analysis platform according to claim 5, characterized in that: The traffic security analysis platform also includes a device grouping module, which includes a grouping unit, and the grouping unit is used to perform device grouping management on the router based on existing or newly created tenants.

7. The traffic security analysis platform according to claim 6, characterized in that: The device grouping module further includes a geographic information entry unit, and the geographic information entry unit is used to enter the geographic location information of the router in the corresponding group.

8. The traffic security analysis platform according to claim 7, characterized in that: The geographic information input unit includes a first information input component and a second information input component. The first information input component is used to input the corresponding location information according to the IP address of the router, and the second information input component is used to input the latitude and longitude information of the router in the corresponding group.

9. The traffic security analysis platform according to claim 1, characterized in that: The database is a time series database.

10. A traffic security analysis system, characterized in that: It comprises a router and a traffic security analysis platform as described in any one of claims 1 to 9, wherein the router is configured with an API interface and is deployed on the user side, and the router is communicatively connected with the traffic security analysis platform.

Images