A method, system and device for identifying access rights based on network security

Abstract

The present invention relates to the technical field of network security authentication, and in particular to a method, system and device for identifying access rights based on network security, wherein the method comprises: receiving multiple access requests from multiple user nodes within a preset monitoring period; determining multiple user groups corresponding to each monitoring moment within the preset monitoring period according to the number of access requests of each user node in the multiple user nodes monitored at each monitoring moment within the preset monitoring period and the sending time of each access request, wherein each user group includes at least one user node; determining a target monitoring moment within the preset monitoring period according to the spillover index of access data packets of the multiple user groups corresponding to each monitoring moment within the preset monitoring period; determining an abnormal user group according to the flow tendency value of the access data packets of each user group in the multiple user groups corresponding to the target monitoring moment. The present invention improves the accuracy of abnormal user identification.

Description

Technical Field

[0001] The present invention relates to the technical field of network security authentication, and in particular to a method, system and device for identifying access rights based on network security. Background Art

[0002] Internet technology plays an important role in the national economy. With the rapid development of Internet technology, network malicious behaviors have gradually increased. Malicious behaviors are not limited to malware, network viruses, hacker attacks, etc. Network malicious behaviors have posed a threat to the network security environment, affecting personal privacy security, Internet financial information security, and the safe operation of network infrastructure. Network servers need to accurately identify network nodes with malicious behaviors and restrict access rights to intercept malicious behaviors. However, malicious actors will steal network users with normal permissions to disguise themselves as attackers, so it is necessary to identify the permissions of network users. Network malicious behaviors affect network service providers and network users by mixing malicious traffic in the network with the traffic of network sites. A large number of network malicious behaviors need to be successfully responded to by network nodes before they can affect network nodes. Therefore, network nodes are equipped with malicious traffic filtering systems to securely identify and filter inbound network traffic and restrict the inbound permissions of user sites suspected of attack risks.

[0003] Existing methods usually use a dynamic security load factor to perform traffic fusing (that is, after reaching the traffic threshold, the node is forcibly disconnected from the public network). Although the deployment and implementation are simple, the security load factor is not very accurate in identifying sudden attacks by malicious nodes, and the attack identification trigger is not sensitive, which can easily cause serious network congestion and needs to be optimized. Summary of the invention

[0004] In order to solve the technical problem of accurately identifying and timely updating the network access rights of malicious network users, the purpose of the present invention is to provide a method, system and device for identifying access rights based on network security. The technical solution adopted is as follows:

[0005] In a first aspect, an embodiment of the present invention provides a method for access rights authentication based on network security, comprising the following steps:

[0006] Receiving multiple access requests from multiple user nodes within a preset monitoring period, each of the multiple access requests including: identification information of the user node, an access data packet and its size, and a sending time of the access request; the preset monitoring period includes multiple monitoring moments in a chronological order;

[0007] Determine, according to the number of access requests of each user node in the plurality of user nodes monitored at each monitoring moment in the preset monitoring period and the sending time of each access request, a plurality of user groups corresponding to each monitoring moment in the preset monitoring period, wherein each user group includes at least one user node;

[0008] Determining a target monitoring time within the preset monitoring period according to the spillover indexes of access data packets of multiple user groups corresponding to each monitoring time within the preset monitoring period;

[0009] An abnormal user group is determined according to the flow tendency value of the access data packet of each user group in the multiple user groups corresponding to the target monitoring time.

[0010] Preferably, determining multiple user groups corresponding to each monitoring moment in the preset monitoring period according to the number of access requests of each user node in the multiple user nodes monitored at each monitoring moment in the preset monitoring period and the sending time of each access request includes:

[0011] Determine a two-dimensional sample space of user nodes corresponding to each monitoring moment in the preset monitoring period according to the number of access requests of each user node among the multiple user nodes monitored at each monitoring moment in the preset monitoring period and the sending time of each access request, wherein the two-dimensional sample space of user nodes includes a normalized value of access frequency and a transmission delay of access data packets of each user node at the current monitoring moment;

[0012] Clustering is performed on the two-dimensional sample space to obtain multiple user groups corresponding to each monitoring moment.

[0013] Preferably, according to the number of access requests of each user node among the multiple user nodes monitored at each monitoring moment in the preset monitoring period and the sending time of each access request, determining the two-dimensional sample space of user nodes corresponding to each monitoring moment in the preset monitoring period includes:

[0014] Determine a normalized value of the access frequency of each user node at each monitoring moment according to the number of access requests of each user node monitored at each monitoring moment;

[0015] Determine the access data packet transmission delay in the access request corresponding to each user node monitored at each monitoring moment according to the sending time of each access request of each user node monitored at each monitoring moment;

[0016] With the transmission delay as the horizontal axis and the normalized access frequency as the vertical axis, the two-dimensional sample space of the user node corresponding to each monitoring moment is determined according to the normalized access frequency value and the transmission delay of each user node monitored at each monitoring moment.

[0017] Preferably, determining the target monitoring time within the preset monitoring period according to the spillover indexes of the access data packets of the plurality of user groups corresponding to each monitoring time within the preset monitoring period comprises:

[0018] Determine the spillover index of access data packets of multiple user groups corresponding to each monitoring moment according to the number of access data packet flows of each user group monitored at each monitoring moment;

[0019] Determining at least one state interval of access requests corresponding to multiple user groups monitored within the preset monitoring period according to the spillover index and the time sequence of each monitoring moment;

[0020] The target monitoring time is determined according to the spillover indexes of the access data packets corresponding to the multiple user groups monitored at each monitoring time and at least one of the state intervals.

[0021] Preferably, determining the spillover index of access data packets of multiple user groups corresponding to each monitoring moment according to the number of access data packet flows of each user group monitored at each monitoring moment includes:

[0022] Determine the flow tendency value of the access data packets of each user group monitored at each monitoring moment according to the flow quantity of the access data packets of each user group monitored at each monitoring moment; the flow quantity of the access data packets includes: the number of access data packets flowing into the current user group and the number of access data packets flowing out of the current user group;

[0023] According to the flow tendency value of the access data packets of each user group, the spillover index of the access data packets of multiple user groups corresponding to each monitoring moment is determined.

[0024] Preferably, determining at least one state interval of access requests corresponding to a plurality of user groups monitored within the preset monitoring period according to the spillover index and the time sequence of each monitoring moment includes:

[0025] Arranging the spillover indexes according to the time sequence of each monitoring moment to obtain a spillover index sequence;

[0026] Determine at least one evaluation interval of the spillover index sequence, each evaluation interval in the at least one evaluation interval including at least one spillover index;

[0027] At least one status interval of access requests corresponding to multiple user groups monitored within the preset monitoring period is determined according to the average of all spillover indexes of each evaluation interval in at least one of the evaluation intervals, and each of the at least one status interval includes at least one evaluation interval.

[0028] Preferably, determining the target monitoring time according to the spillover indexes of access data packets corresponding to the plurality of user groups monitored at each monitoring time and at least one of the state intervals includes:

[0029] Determine an evaluation value of each monitoring moment within the preset monitoring period and a last state interval in at least one of the state intervals;

[0030] According to the evaluation value, a target monitoring time within the preset monitoring period is determined.

[0031] Preferably, the access rights authentication method based on network security further includes:

[0032] The abnormal user group is disconnected from the network service end, and the permissions of all user nodes in the abnormal user group are updated.

[0033] In a second aspect, an embodiment of the present invention further provides a network security-based access rights authentication system, comprising: a plurality of user terminals and a network service terminal connected to the plurality of said client terminals through a core network;

[0034] The network service end includes a core network including: a firewall module deployed at the boundary of the network service end and a bastion host module deployed behind the firewall module and connected to the firewall module in communication; the firewall module is used to receive multiple access requests from multiple user nodes of multiple user terminals within a preset monitoring period, and each of the multiple access requests includes: identification information of the user node, access data packet and its size, and sending time of the access request; the preset monitoring period includes multiple monitoring moments that follow a chronological order;

[0035] The bastion host module is used to determine multiple user groups corresponding to each monitoring moment in the preset monitoring period according to the number of access requests of each user node in the multiple user nodes monitored at each monitoring moment in the preset monitoring period and the sending time of each access request, wherein each user group includes at least one user node; determine the target monitoring moment in the preset monitoring period according to the spillover index of the access data packets of the multiple user groups corresponding to each monitoring moment in the preset monitoring period; determine the abnormal user group according to the flow tendency value of the access data packets of each user group in the multiple user groups corresponding to the target monitoring moment.

[0036] In a third aspect, an embodiment of the present invention further provides an access rights authentication device based on network security, comprising: a memory and a processor, wherein the memory is used to store executable program code, and the processor is used to call and run the executable program code from the memory, so that the device executes any one of the above-mentioned access rights authentication methods based on network security.

[0037] The present invention has the following beneficial effects:

[0038] By determining the number of access requests received from each user node in a preset monitoring period and the sending time of each access request, multiple user groups corresponding to each monitoring moment in the preset monitoring period are determined to realize the network topology structure division of the user nodes, and the local topology range formed by each user group can reduce the probability of abnormal user nodes caused by network delay factors in this range; further, according to the spillover index of the access data packets of the multiple user groups corresponding to each monitoring moment in the preset monitoring period, the target monitoring moment in the preset monitoring period is determined; and according to the flow tendency value of the access data packets of each user group in the multiple user groups corresponding to the target monitoring moment, the abnormal user group is determined, so as to facilitate the subsequent update of the access rights of the abnormal user nodes in the abnormal user group; by analyzing the changes in the traffic behavior of the abnormal user nodes after being attacked, and comprehensively considering the abnormal characteristics of the group traffic behavior generated by the abnormal user nodes continuing to penetrate other normal user nodes in the network, the intelligent authentication of abnormal users is performed, thereby improving the accuracy of abnormal user node identification and the timeliness of access right update. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0040] Figure 1 A flow chart of a method for identifying access rights based on network security provided by an embodiment of the present invention;

[0041] Figure 2 An architectural diagram of a network security-based access rights authentication system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0042] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the following is a detailed description of the method, system and device for identifying access rights based on network security proposed by the present invention, its specific implementation, structure, features and effects in combination with the accompanying drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" does not necessarily refer to the same embodiment. In addition, specific features, structures or characteristics in one or more embodiments may be combined in any suitable form.

[0043] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0044] The following describes in detail a method, system and device for access rights authentication based on network security provided by the present invention in conjunction with the accompanying drawings.

[0045] See also Figure 1 , which shows a flow chart of a method for identifying access rights based on network security provided by an embodiment of the present invention, the method comprising the following steps:

[0046] Step 11, receiving multiple access requests from multiple user nodes within a preset monitoring period, each of the multiple access requests includes: identification information of the user node, an access data packet and its size, and the sending time of the access request; the preset monitoring period includes multiple monitoring moments that follow a chronological order.

[0047] Here, the size of the access data packet can indicate the size of the traffic change in the network when the current user node accesses the network; multiple monitoring moments are set within the preset monitoring period to monitor the access requests sent by multiple user nodes; at each monitoring moment, at least one access request sent by each user node can be monitored, and based on the user node identification information corresponding to the access request received from each user node, the traffic change of each user node at each monitoring moment can be confirmed, and at the same time, combined with the sending time of the access request of each user node, a basis is provided for the subsequent division of user groups.

[0048] Step 12, based on the number of access requests of each user node in the multiple user nodes monitored at each monitoring moment in the preset monitoring period and the sending time of each access request, determine multiple user groups corresponding to each monitoring moment in the preset monitoring period, wherein each user group includes at least one user node.

[0049] Since user nodes need to transmit access data packets to the network server when accessing, and user nodes are distributed in different locations, the transmission delays to the network server are not the same. In order to avoid low-latency user nodes not receiving the confirmation acceptance information sent by high-latency user nodes, and thus avoid low-latency user nodes continuously sending access requests containing access data packets to cause network congestion, the transmission delay of user nodes can be used as one of the bases for user node division, and at the same time, abnormal network behavior user nodes caused by network delay factors can be avoided; here, the transmission delay of the user node access data packet can be determined according to the sending time of the access request;

[0050] Since the abnormal user nodes formed by the attacker after attacking the normal user nodes will continuously send access requests carrying access data packets, the access data packets of the same user node may be monitored and continuously received within a monitoring time, while the number of access requests carrying access data packets sent by other user nodes normally will be small. Therefore, the access requests of the user nodes monitored at a monitoring time can be used as another basis for user node division; by dividing the user nodes, the user nodes with similar transmission delays and access frequencies can be combined. Each user group obtained after the division can represent the local topology structure in the entire network topology structure at the current monitoring time, so as to provide a basis for the accurate judgment of subsequent abnormal user nodes;

[0051] When dividing user groups based on the number of access requests and the sending time of each access request, the following may be specifically included:

[0052] Step 121, determining a two-dimensional sample space of user nodes corresponding to each monitoring moment in the preset monitoring period according to the number of access requests of each user node in the plurality of user nodes monitored at each monitoring moment in the preset monitoring period and the sending time of each access request; here, the two-dimensional sample space of user nodes includes a normalized value of the access frequency of each user node at the current monitoring moment and a transmission delay of the access data packet;

[0053] Here, the access frequency normalization value of each user node at each monitoring moment can be determined according to the access request number of each user node monitored at each monitoring moment; specifically: the access request number of all user nodes within the time series range from the current monitoring moment to the previous monitoring moment is used to perform linear normalization processing on the access request number of the current user node; the purpose of linear normalization is to map the value of an interval to the [0, 1] interval, so as to facilitate the subsequent division of user groups;

[0054] Here, the transmission delay of the user node access data packet can be determined according to the sending time of the access request; specifically: according to the sending time of each access request of each user node monitored at each monitoring moment, and in combination with the time when the network server receives the corresponding access request, the transmission delay of the access data packet in the access request corresponding to each user node monitored at each monitoring moment can be determined (the transmission delay T of the access data packet in the corresponding access request is obtained by subtracting the sending time of the access request from the time when the network server receives the access request, which is also the access delay of the corresponding user node);

[0055] Furthermore, the transmission delay is used as the horizontal coordinate, and the direction of increasing transmission delay is used as the positive direction of the horizontal axis; the normalized value of access frequency is used as the vertical coordinate, and the direction of increasing normalized value of access frequency is used as the positive direction of the vertical axis; and according to the normalized value of access frequency and transmission delay of each user node monitored at each monitoring moment, the two-dimensional sample space of multiple user nodes corresponding to each monitoring moment is determined, so as to facilitate the division of user groups and provide a basis for subsequent analysis.

[0056] Step 122: clustering the two-dimensional sample space to obtain multiple user groups corresponding to each monitoring moment.

[0057] Clustering is performed on the sample points in the two-dimensional sample space (corresponding to the normalized value of the access frequency of each user node at the current monitoring time and the coordinate points of the access data packet transmission delay in the two-dimensional sample space) to obtain a user group consisting of at least one user node with similar access frequency and transmission delay;

[0058] In this embodiment, the ISODATA iterative self-organizing clustering algorithm can be used to cluster the two-dimensional sample space to obtain multiple clusters, and each cluster is recorded as a user set; further, all clusters are traversed to obtain the division of user groups at the current monitoring moment; here, the ISODATA iterative self-organizing clustering algorithm is a prior art and will not be described in detail here.

[0059] Step 13: determining a target monitoring time within the preset monitoring period according to the spillover indexes of access data packets of multiple user groups corresponding to each monitoring time within the preset monitoring period.

[0060] After being attacked, normal user nodes will continuously send out access requests carrying access data packets, which will lead to uneven traffic distribution in the network. Here, the spillover index represents the scale of abnormal traffic brought by abnormal user nodes generated by attacks in multiple user groups in the entire network. Since the user nodes have been divided, if there are abnormal user nodes in the local topological structure formed by a single user group, the spillover index will be more obvious. By analyzing the spillover index of the local topological structure corresponding to different user groups at different monitoring times, the corresponding target monitoring time under attack can be determined.

[0061] Step 131 , determining the spillover index of access data packets of multiple user groups corresponding to each monitoring moment according to the flow quantity of access data packets of each user group monitored at each monitoring moment.

[0062] Here, the access data packet flow quantity may include: the access data packet quantity flowing into the current user group, the access data packet quantity flowing out of the current user group;

[0063] Further, the flow tendency value of the access data packets of each user group monitored at each monitoring moment may be determined according to the flow quantity of the access data packets of each user group monitored at each monitoring moment;

[0064] After normal user nodes send access requests carrying access data packets, the target user node responds to the access data packet instructions and packages the execution results and transmits them back to the sending user node. At this time, the sending user node completes an instruction interaction; while the access data packets of the attack of the abnormal user node achieve the purpose of occupying the computing resources of the target user node by making the target user node continuously respond to instructions, and do not need to receive the instruction execution results of the target user node. Therefore, according to the difference in the number of access data packets entering and leaving each user group (local topology structure), the communication sending status of the access data packets sent by the abnormal user node and the normal access data packets can be analyzed, and then the flow tendency value of the access data packets of each user group can be obtained; preferably, the flow tendency value can be calculated by the following formula:

[0065] ;

[0066] in, Indicates the flow tendency value of access data packets of each user group. The number of outbound access packets of all user nodes in the current user group j , the number of packets accessed by the group The higher the ratio is, the higher the access data packets sent by the user nodes in the local topology structure where the current user group is located are much higher than the access data packets received, proving that the current user group j tends to output data packets, j=1, 2, 3...k.

[0067] is the number of user nodes in the current user group j Total number of user nodes The larger the value of the ratio, the more outgoing data packets there are when the current user group j occupies a large number of nodes, which reflects that the current user group is more willing to increase the tendency of data packets to flow outward, which means that there is a greater possibility of abnormal traffic data in the current user group; for multiple user groups within each monitoring time within the preset monitoring time, the corresponding flow tendency value can be calculated by the above formula;

[0068] Since the distribution difference of flow tendency formed by the distribution of different local topological structures corresponding to different user groups in the network topological structure at the current monitoring time represents the imbalanced distribution of network traffic in the current network, the flow tendency between user groups is similar and concentrated in the non-biased situation, which reflects: there are fewer attacked user nodes in the network topological structure, resulting in less abnormal traffic; the distribution of flow tendency between user groups at the current monitoring time t is analyzed to identify the spillover of the impact caused by abnormal user nodes; here, the spillover index of the access data packets of multiple user groups corresponding to each monitoring time can be determined according to the flow tendency value of the access data packets of each user group; specifically, for the current monitoring time t, the spillover index of all user groups is calculated based on the flow tendency value corresponding to all user groups at the current monitoring time t:

[0069] ;

[0070] in: represents the spillover index for all user groups; The number of user groups divided at the current monitoring time t; For the rth (r=1, 2, 3... ) The mobility tendency of each user group; represents the mean of the mobility tendency values ​​of all user groups at the current time t, represents the standard deviation of the mobility tendency values ​​of all user groups at the current time t; The smaller it is, the more concentrated the user groups and their flow tendency values ​​obtained at the current monitoring time are at the mean position, indicating that at the current monitoring time, the ratio of outbound and inbound access data packets between user groups maintains a relatively stable range. The closer it is to 0, the smaller the scale of malicious user nodes may be, and the smaller the access data packets containing abnormal traffic sent out are. It is convenient to gradually increase the number of malicious traffic overflows in the future, so as to locate abnormal behavior user nodes and identify and update their permissions.

[0071] Step 132, determining at least one state interval of access requests corresponding to multiple user groups monitored within a preset monitoring period according to the spillover index and the time sequence of each monitoring moment;

[0072] After an abnormal user node appears in the network topology, the abnormal user node continuously sends malicious traffic outward, causing the malicious spillover index to increase. Therefore, the malicious behavior attack time is determined based on the stable characteristics of the spillover index sequence in the local time series range (state interval) generated by the stability of the network topology, so as to facilitate the subsequent confirmation of the abnormal user group;

[0073] Specifically, the above step 132 may include:

[0074] Step 1321, arranging the spillover indexes according to the time sequence of each monitoring moment to obtain a spillover index sequence;

[0075] Step 1322, determining at least one evaluation interval of the spillover index sequence, each evaluation interval in the at least one evaluation interval including at least one spillover index;

[0076] Step 1323, determining at least one state interval of access requests corresponding to multiple user groups monitored within a preset monitoring period according to the average of all spillover indexes in each evaluation interval in at least one evaluation interval, wherein each state interval in at least one status interval includes at least one evaluation interval.

[0077] Here, the spillover index corresponding to each monitoring moment can be arranged in the chronological order of the monitoring moments to obtain a spillover index sequence; further, the upward rounded value of the mean of the number of divisions for user group k at each monitoring moment up to the current monitoring moment t is obtained as the judgment range R, and the spillover index sequence is composed of a local evaluation interval with each R consecutive data, and the mean of all the spillover indexes in any evaluation interval is calculated. ; Place the mean of each evaluation interval in the order of the evaluation interval to obtain a mean sequence, and perform first-order difference on the mean sequence to obtain a differential mean sequence;

[0078] Furthermore, AMPD (Automatic Multi-Scale Peak Finding Algorithm) can be used to find the maximum difference position in the differential mean sequence, by finding the index means of the two evaluation intervals corresponding to the maximum difference position as endpoints, and selecting the sequence sandwiched between the endpoints screened out from different maximum difference positions as a state interval; here, AMPD (Automatic Multi-Scale Peak Finding Algorithm) is an existing technology and will not be described in detail here.

[0079] Step 133 , determining a target monitoring time according to the spillover indexes of access data packets corresponding to the multiple user groups monitored at each monitoring time and at least one state interval.

[0080] Screening is performed for changes in the state interval: malicious user nodes are accompanied by malicious traffic of the generated access data packets, resulting in normal user nodes in the network being attacked, thereby causing the malicious user nodes to gradually control more user nodes in the network topology, causing the user nodes in the network topology to be differentiated into different user node classifications such as abnormal user nodes, attacked user nodes, and normal user nodes, thereby making the change in the flow tendency of data packets in the network topology more obvious; then the above step 133, specifically, may include:

[0081] Step 1331, determining the evaluation value of each monitoring moment and the last state interval in at least one state interval within the preset monitoring period;

[0082] Step 1332, determining a target monitoring time within a preset monitoring period according to the evaluation value.

[0083] Here, after the user node is attacked, the abnormal user node is accompanied by malicious traffic, which causes the normal user nodes in the network to be attacked, resulting in the abnormal user node gradually controlling more normal user nodes in the entire network topology, causing the nodes in the network topology to be divided into different node classifications such as abnormal user nodes-attacked user nodes-normal user nodes, thereby making the change in the flow tendency of data packets in the network topology more obvious; at this time, according to the monitoring time The corresponding spillover index of all user groups and the last state interval that has been divided The spillover index mean is judged and the evaluation value S is obtained;

[0084] ;

[0085] in, Indicates monitoring time The corresponding spillover index; Indicates the mean of the spillover index of all user groups in the last state interval that has been divided; represents the deviation of the mean of the spillover index at all monitoring moments;

[0086] In this formula, the larger the evaluation value S is, the more abnormal the environment in the overall network topology is; when the evaluation value S is greater than or equal to a preset threshold, the monitoring time can be confirmed. It is the target monitoring moment when the attack begins in the network topology structure; preferably, the preset threshold value can be set according to an empirical value, and more preferably, it can be 0.7.

[0087] Step 14: determine an abnormal user group according to the flow tendency value of the access data packet of each user group in the multiple user groups corresponding to the target monitoring time.

[0088] After locating the target monitoring moment that is under attack, all user groups corresponding to the target monitoring moment are screened, and all user groups with corresponding flow tendency values ​​greater than 0 are obtained, and these user groups are confirmed as abnormal user groups. At the same time, all user nodes in the user group are confirmed as abnormal user nodes.

[0089] Furthermore, based on the above steps 11 to 14, the following steps may also be included:

[0090] Step 15: disconnect the abnormal user group from the network server, and update the permissions of all user nodes in the abnormal user group.

[0091] The firewall module in the network server forcibly disconnects all abnormal user nodes in the abnormal user group from the network server; the bastion host module in the network server identifies and updates the permissions of all abnormal user nodes in the abnormal user group, and broadcasts the updated abnormal user node form to the topology.

[0092] The above-mentioned embodiment of the present invention receives multiple access requests from multiple user nodes within a preset monitoring period, and determines multiple user groups corresponding to each monitoring moment within the preset monitoring period according to the number of access requests of each user node in the multiple user nodes monitored at each monitoring moment within the preset monitoring period and the sending time of each access request, wherein each user group includes at least one user node; determines the target monitoring moment within the preset monitoring period according to the spillover index of the access data packets of the multiple user groups corresponding to each monitoring moment within the preset monitoring period; determines the abnormal user group according to the flow tendency value of the access data packets of each user group in the multiple user groups corresponding to the target monitoring moment; and performs intelligent authentication of user nodes by network sites based on the abnormal characteristics of group traffic behavior caused by the attacker continuing to infiltrate other user nodes in the network with the currently infiltrated user node, thereby improving the accuracy of abnormal user identification.

[0093] like Figure 2 As shown, in other embodiments, a network security-based access rights authentication system is also provided, including: a plurality of user terminals and a network service terminal connected to a plurality of client terminals through a core network;

[0094] The network service end includes a core network including: a firewall module deployed at the boundary of the network service end and a bastion host module deployed behind the firewall module and connected to the firewall module in communication; the firewall module is used to receive multiple access requests from multiple user nodes of multiple user ends within a preset monitoring period, and each of the multiple access requests includes: identification information of the user node, access data packet and its size, and sending time of the access request; the preset monitoring period includes multiple monitoring moments that follow a chronological order;

[0095] The bastion host module is used to determine multiple user groups corresponding to each monitoring moment in the preset monitoring period based on the number of access requests of each user node in the multiple user nodes monitored at each monitoring moment in the preset monitoring period and the sending time of each access request, wherein each user group includes at least one user node; determine the target monitoring moment in the preset monitoring period based on the spillover index of the access data packets of the multiple user groups corresponding to each monitoring moment in the preset monitoring period; determine the abnormal user group based on the flow tendency value of the access data packets of each user group in the multiple user groups corresponding to the target monitoring moment.

[0096] Here, the user node may be a user connected to the access network through a terminal device, and the connection mode may be a wireless or wired connection;

[0097] When the firewall module receives the access request from the user node, it first intercepts it, and then transmits the identification information of the user node to the bastion host module for identification. At the same time, it can allow or deny the transmission of the access request carrying the sample data packet according to the security rules, thereby protecting the internal network from external threats and attacks;

[0098] The bastion host module can be used as a secure channel between the internal network and the external network, providing a centralized controlled access point for users and administrators, storing user node access permission data. When the bastion host module identifies the user node permissions as normal, it returns information to the firewall module. The firewall module passes the user node's access request, and the network service request it needs to enjoy passes through the bastion host module. The bastion host module calls the network resources in the core network to provide network services for the user node; when the user node in the user group corresponding to the local topology of the network becomes an abnormal user node, the network connection between the core network and the access network is cut off to ensure the security of the core network;

[0099] The system may also include: a service provision module and a power supply module; wherein the service provision module is mainly used for access and mobility management function AMF, call management function SMF and user plane function unit UPF.

[0100] In other embodiments, a device for access rights authentication based on network security is also provided, including a memory and a processor. The memory is used to store executable program code, and the processor is used to call and run the executable program code from the memory, so that the device executes a method for access rights authentication based on network security provided in the above embodiment. The device can be specifically a chip, a component or a module, and the chip may include a connected processor and a memory; wherein the memory is used to store instructions, and when the processor calls and executes the instructions, the chip can execute a method for access rights authentication based on network security provided in the above embodiment.

[0101] In other embodiments, a computer program product is also provided. When the computer program product runs on a computer, the computer executes the above-mentioned related steps to implement a method for identifying access rights based on network security provided in the above-mentioned embodiment.

[0102] In other embodiments, a computer-readable storage medium is also provided, in which a computer program code is stored. When the computer program code runs on a computer, the computer executes the above-mentioned related method steps to implement a network security-based access rights identification method provided in the above-mentioned embodiment.

[0103] Among them, the provided systems, devices, computer program products, and computer-readable storage media are all used to execute the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding methods provided above and will not be repeated here.

[0104] It should be noted that the sequence of the above embodiments of the present invention is for description only and does not represent the advantages and disadvantages of the embodiments. The processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0105] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

Claims

1. A method for identifying access rights based on network security, characterized in that: include: Receiving multiple access requests from multiple user nodes within a preset monitoring period, each of the multiple access requests including: identification information of the user node, an access data packet and its size, and a sending time of the access request; the preset monitoring period includes multiple monitoring moments in a chronological order; Determine, according to the number of access requests of each user node in the plurality of user nodes monitored at each monitoring moment in the preset monitoring period and the sending time of each access request, a plurality of user groups corresponding to each monitoring moment in the preset monitoring period, wherein each user group includes at least one user node; Determining a target monitoring time within the preset monitoring period according to the spillover indexes of access data packets of multiple user groups corresponding to each monitoring time within the preset monitoring period; An abnormal user group is determined according to the flow tendency value of the access data packet of each user group in the multiple user groups corresponding to the target monitoring time.

2. The method for identifying access rights based on network security according to claim 1, characterized in that: Determining a plurality of user groups corresponding to each monitoring moment in the preset monitoring period according to the number of access requests of each user node in the plurality of user nodes monitored at each monitoring moment in the preset monitoring period and the sending time of each access request, comprising: Determine a two-dimensional sample space of user nodes corresponding to each monitoring moment in the preset monitoring period according to the number of access requests of each user node among the multiple user nodes monitored at each monitoring moment in the preset monitoring period and the sending time of each access request, wherein the two-dimensional sample space of user nodes includes a normalized value of access frequency and a transmission delay of access data packets of each user node at the current monitoring moment; Clustering is performed on the two-dimensional sample space to obtain multiple user groups corresponding to each monitoring moment.

3. The method for identifying access rights based on network security according to claim 2, characterized in that: Determining a two-dimensional sample space of user nodes corresponding to each monitoring moment in the preset monitoring period according to the number of access requests of each user node in a plurality of user nodes monitored at each monitoring moment in the preset monitoring period and the sending time of each access request, comprising: Determine a normalized value of the access frequency of each user node at each monitoring moment according to the number of access requests of each user node monitored at each monitoring moment; Determine the access data packet transmission delay in the access request corresponding to each user node monitored at each monitoring moment according to the sending time of each access request of each user node monitored at each monitoring moment; With the transmission delay as the horizontal axis and the normalized access frequency as the vertical axis, the two-dimensional sample space of the user node corresponding to each monitoring moment is determined according to the normalized access frequency value and the transmission delay of each user node monitored at each monitoring moment.

4. The method for identifying access rights based on network security according to claim 1, characterized in that: Determining a target monitoring time within the preset monitoring period according to the spillover indexes of access data packets of multiple user groups corresponding to each monitoring time within the preset monitoring period includes: Determine the spillover index of access data packets of multiple user groups corresponding to each monitoring moment according to the number of access data packet flows of each user group monitored at each monitoring moment; Determining at least one state interval of access requests corresponding to multiple user groups monitored within the preset monitoring period according to the spillover index and the time sequence of each monitoring moment; The target monitoring time is determined according to the spillover indexes of the access data packets corresponding to the multiple user groups monitored at each monitoring time and at least one of the state intervals.

5. The method for identifying access rights based on network security according to claim 4, characterized in that: According to the number of access data packets of each user group monitored at each monitoring moment, the spillover index of the access data packets of multiple user groups corresponding to each monitoring moment is determined, including: Determine the flow tendency value of the access data packets of each user group monitored at each monitoring moment according to the flow quantity of the access data packets of each user group monitored at each monitoring moment; the flow quantity of the access data packets includes: the number of access data packets flowing into the current user group and the number of access data packets flowing out of the current user group; According to the flow tendency value of the access data packets of each user group, the spillover index of the access data packets of multiple user groups corresponding to each monitoring moment is determined.

6. The method for identifying access rights based on network security according to claim 4, characterized in that: Determining at least one state interval of access requests corresponding to multiple user groups monitored within the preset monitoring period according to the spillover index and the time sequence of each monitoring moment, including: Arranging the spillover indexes according to the time sequence of each monitoring moment to obtain a spillover index sequence; Determine at least one evaluation interval of the spillover index sequence, each evaluation interval in the at least one evaluation interval including at least one spillover index; At least one status interval of access requests corresponding to multiple user groups monitored within the preset monitoring period is determined according to the average of all spillover indexes of each evaluation interval in at least one of the evaluation intervals, and each of the at least one status interval includes at least one evaluation interval.

7. The method for identifying access rights based on network security according to claim 4, characterized in that: Determining the target monitoring time according to the spillover indexes of access data packets corresponding to the plurality of user groups monitored at each monitoring time and at least one of the state intervals includes: Determine an evaluation value of each monitoring moment within the preset monitoring period and a last state interval in at least one of the state intervals; According to the evaluation value, a target monitoring time within the preset monitoring period is determined.

8. The method for identifying access rights based on network security according to claim 1, characterized in that: Also includes: The abnormal user group is disconnected from the network service end, and the permissions of all user nodes in the abnormal user group are updated.

9. A network security-based access rights authentication system, characterized in that: include: A plurality of user terminals and a network service terminal connected to the plurality of said client terminals through a core network; The network service end includes a core network including: a firewall module deployed at the boundary of the network service end and a bastion host module deployed behind the firewall module and connected to the firewall module in communication; the firewall module is used to receive multiple access requests from multiple user nodes of multiple user terminals within a preset monitoring period, and each of the multiple access requests includes: identification information of the user node, access data packet and its size, and sending time of the access request; the preset monitoring period includes multiple monitoring moments that follow a chronological order; The bastion host module is used to determine multiple user groups corresponding to each monitoring moment in the preset monitoring period according to the number of access requests of each user node in the multiple user nodes monitored at each monitoring moment in the preset monitoring period and the sending time of each access request, wherein each user group includes at least one user node; determine the target monitoring moment in the preset monitoring period according to the spillover index of the access data packets of the multiple user groups corresponding to each monitoring moment in the preset monitoring period; determine the abnormal user group according to the flow tendency value of the access data packets of each user group in the multiple user groups corresponding to the target monitoring moment.

10. A network security-based access rights authentication device, characterized in that: include: A memory and a processor, wherein the memory is used to store executable program code, and the processor is used to call and run the executable program code from the memory, so that the device executes the network security-based access authority authentication method as described in any one of claims 1 to 8.

Images