A network equipment monitoring method and monitoring terminal for network security

Abstract

The present invention is applicable to the field of network security technology, and in particular, relates to a networked device monitoring method and monitoring terminal for network security, the method comprising: obtaining networked device information, determining the number of each networked device; receiving data to be sent, constructing data volume coordinates, and constructing a data interception function; performing data interception, constructing data segment coordinates based on multiple data segments obtained by data interception, and fitting a data transmission control function; transmitting the data transmission control function to the networked device, receiving packaged data, performing data transmission verification, and determining whether the networked device is abnormal. The present invention monitors the data transmission process, constructs a data transmission control function, and uses the data transmission control function to control the transmission data of the networked device, thereby performing real-time statistics on the data information sent by the networked device, and verifies whether the data transmission is normal, thereby realizing active abnormal monitoring of the networked device and improving network security.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a networked device monitoring method and a monitoring terminal for network security. Background Art

[0002] Network security refers to a series of measures and practices to protect the hardware, software and data carried in computer network systems, prevent them from being damaged, altered or leaked due to accidental or malicious reasons, and ensure the continuous and reliable operation of the system and uninterrupted network services. It is a broad field that covers both technical and management levels, and aims to maintain the security, confidentiality, integrity, availability and controllability of the network environment.

[0003] In the current network security monitoring process, abnormal traffic or device performance is often monitored to determine whether it is under external attack. The existing technology lacks the technical means to actively monitor network attacks, making it difficult to identify network attacks in their early stages. Summary of the invention

[0004] The purpose of the present invention is to provide a networked device monitoring method for network security, aiming to solve the problem that the prior art lacks technical means for active monitoring of network attacks and is difficult to identify network attacks in their early stages.

[0005] The present invention is implemented as follows: a networked device monitoring method for network security, the method comprising:

[0006] Obtaining network device information, determining network devices in the current network environment, and determining the number of each network device;

[0007] Receive data to be sent to each networked device, count the amount of data sent to each networked device, construct data amount coordinates, and construct a data interception function based on the data amount coordinates;

[0008] According to the data interception function, data to be transmitted is intercepted, data segment coordinates are constructed based on multiple data segments obtained by the data interception, and a data transmission control function is obtained based on the data segment coordinates fitting;

[0009] A data transmission control function is sent to a networked device, packaged data is received from the networked device, data transmission verification is performed based on the packaged data, and whether an abnormality occurs in the networked device is determined based on the verification result. The networked device packages and sends the data to the gateway according to the data transmission control function.

[0010] Preferably, the steps of receiving the data to be sent to each networked device, counting the amount of data sent to each networked device, constructing data amount coordinates, and constructing a data interception function based on the data amount coordinates specifically include:

[0011] Receive data, and when receiving data to be sent, parse the data to be sent and determine the networked device corresponding to the data to be sent;

[0012] Count the amount of data to be sent to each networked device in the same time period, and construct data volume coordinates based on the number of the networked device and the amount of data;

[0013] The data quantity coordinates are fitted one by one according to the preset fitting function type library, and the fitting function type with the highest fitting accuracy is selected to obtain the data interception function through fitting.

[0014] Preferably, the step of intercepting the data to be transmitted according to the data interception function, constructing data segment coordinates based on a plurality of data segments obtained by the data interception, and obtaining the data transmission control function based on the data segment coordinate fitting specifically includes:

[0015] Retrieving a preset random number sequence, importing the random number sequence into a data interception function, and generating data interception source data, wherein the number of decimal characters contained in the data interception source data is not less than a preset value;

[0016] Treat the data interception source data as a decimal string, intercept and obtain multiple decimal numbers, determine the number of each group of decimal numbers, and determine the data division ratio based on multiple ratios between the decimal numbers;

[0017] Based on the data division ratio, the preset proportion of the data to be sent of the networked devices is intercepted, the number of characters contained in each data segment is counted, the data segment coordinates are constructed, and the data sending control function is fitted.

[0018] Preferably, the steps of transmitting a control function to a networked device, receiving packaged data sent from the networked device, performing data transmission verification based on the packaged data, and determining whether an abnormality occurs in the networked device based on the verification result specifically include:

[0019] Transmitting a data transmission control function to a networked device, and receiving the data transmission control function through the networked device;

[0020] The networked device records the time value of data transmission, imports the time value into the data transmission control function, generates transmission control source data, and packages the data sent to the gateway into multiple copies based on a preset reference value. The networked device packages the data to obtain multiple packaged data. The amount of data contained in the multiple packaged data is determined according to the transmission control source data. The first packaged data contains a data transmission mark and a time value.

[0021] Receive the packaged data, extract the time value, check the amount of data contained in the packaged data based on the time value and the data sending control function, and after the check is completed, determine whether there is an abnormality in the networked device.

[0022] Preferably, when a networked device is determined to be abnormal, an abnormal prompt message is sent to the management end, and the network transmission of the networked device is restricted.

[0023] Another object of the present invention is to provide a networked device monitoring terminal for network security, the terminal comprising:

[0024] The device identification module is used to obtain the network device information, determine the network devices in the current network environment, and determine the number of each network device;

[0025] An interception function fitting module is used to receive data to be sent to each networked device, count the amount of data sent to each networked device, construct data amount coordinates, and construct a data interception function based on the data amount coordinates;

[0026] A control function fitting module, used for intercepting the data to be transmitted according to the data interception function, constructing data segment coordinates based on multiple data segments obtained by data interception, and obtaining a data transmission control function based on the fitting of the data segment coordinates;

[0027] The data interaction monitoring module is used to transmit a data sending control function to a networked device, receive packaged data sent from the networked device, perform data transmission verification based on the packaged data, and determine whether the networked device has an abnormality based on the verification result. The networked device packages and sends the data to the gateway according to the data sending control function.

[0028] Preferably, the intercept function fitting module includes:

[0029] A data parsing unit is used to receive data and, when receiving data to be sent, parse the data to be sent and determine the networked device corresponding to the data to be sent;

[0030] A coordinate construction unit, used to count the amount of data to be sent to each networked device in the same time period, and to construct a data amount coordinate using the number of the networked device and the amount of data;

[0031] The first function fitting unit is used to fit the data quantity coordinates one by one according to a preset fitting function type library, select the fitting function type with the highest fitting accuracy, and obtain the data interception function through fitting.

[0032] Preferably, the control function fitting module includes:

[0033] A data interception unit, used to retrieve a preset random number sequence, import the random number sequence into a data interception function, and generate data interception source data, wherein the number of decimal characters contained in the data interception source data is not less than a preset value;

[0034] A division ratio calculation unit is used to regard the data interception source data as a decimal string, intercept a plurality of decimal numbers, determine the number of each group of decimal numbers, and determine the data division ratio based on multiple ratios between the decimal numbers;

[0035] The second function fitting unit is used to intercept a preset proportion of the data to be sent of the networked device based on the data division ratio, count the number of characters contained in each data segment, construct the data segment coordinates, and fit the data sending control function.

[0036] Preferably, the data interaction monitoring module includes:

[0037] A data transmission unit, used for transmitting a data transmission control function to a networked device, and receiving the data transmission control function through the networked device;

[0038] A data packaging unit is used to record the time value of data transmission through a networked device, import the time value into a data transmission control function, generate transmission control source data, and package the data sent to the gateway into multiple copies based on a preset reference value. The networked device packages the data to obtain multiple packaged data. The amount of data contained in the multiple packaged data is determined according to the transmission control source data. The first packaged data contains a data transmission mark and a time value.

[0039] The data verification unit is used to receive the packaged data, extract the time value, verify the amount of data contained in the packaged data based on the time value and the data transmission control function, and after the verification is completed, determine whether there is an abnormality in the networked device.

[0040] Preferably, when a networked device is determined to be abnormal, an abnormal prompt message is sent to the management end, and the network transmission of the networked device is restricted.

[0041] The present invention provides a networked device monitoring method for network security. The method monitors the data transmission process, constructs a data transmission control function, and uses the data transmission control function to control the transmission data of the networked device, thereby performing statistics on the data information sent by the networked device in real time, verifying whether the data transmission is normal, realizing active abnormal monitoring of the networked device, and improving network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 A flowchart of a networked device monitoring method for network security provided by an embodiment of the present invention;

[0043] Figure 2 A flowchart of the steps of receiving data to be sent to each networked device, counting the amount of data sent to each networked device, constructing data amount coordinates, and constructing a data interception function based on the data amount coordinates provided in an embodiment of the present invention;

[0044] Figure 3 A flowchart of the steps of intercepting data to be transmitted according to a data interception function, constructing data segment coordinates based on multiple data segments obtained by data interception, and obtaining a data transmission control function based on fitting of the data segment coordinates, provided in an embodiment of the present invention;

[0045] Figure 4 A flowchart of the steps of transmitting a control function for transmitting data to a networked device, receiving packaged data sent from the networked device, performing data transmission verification based on the packaged data, and determining whether an abnormality occurs in the networked device based on the verification result, provided in an embodiment of the present invention;

[0046] Figure 5 An architecture diagram of a networked device monitoring terminal for network security provided by an embodiment of the present invention;

[0047] Figure 6 An architecture diagram of an interception function fitting module provided in an embodiment of the present invention;

[0048] Figure 7 An architecture diagram of a control function fitting module provided by an embodiment of the present invention;

[0049] Figure 8 An architecture diagram of a data interaction monitoring module provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0051] It is understood that the terms "first", "second", etc. used in this application may be used herein to describe various elements, but unless otherwise specified, these elements are not limited by these terms. These terms are only used to distinguish a first element from another element. For example, without departing from the scope of this application, a first xx script may be referred to as a second xx script, and similarly, a second xx script may be referred to as a first xx script.

[0052] like Figure 1 FIG. 1 is a flow chart of a network device monitoring method for network security provided by an embodiment of the present invention, the method comprising:

[0053] S100, obtaining networked device information, determining networked devices in the current network environment, and determining the serial number of each networked device.

[0054] In this module, networked device information is obtained. In a local area network, there are multiple networked devices, which can be computer devices. The present invention is applied to gateways in a local area network. A gateway can connect multiple networked devices, and monitor the data transmission and reception of networked devices, thereby completing abnormal monitoring of networked devices. In order to confirm the identity of each networked device, a number is set for each networked device. The number is unique, so the networked device can be determined based on the number.

[0055] S200, receiving data to be sent to each networked device, counting the amount of data sent to each networked device, constructing data amount coordinates, and constructing a data interception function based on the data amount coordinates.

[0056] In this module, data to be sent to each networked device is received. When the gateway receives the data to be sent, it determines the networked device to which the data to be sent needs to be sent based on the address contained in the data to be sent. At this time, data statistics are performed on the data to be sent to each networked device. Different networked devices have different numbers. At the same time, the amount of data contained in the data to be sent sent to the networked device is also different. Data volume coordinates are constructed based on this. After obtaining multiple data volume coordinates, a preset function fitting tool is used to fit them to obtain a data interception function. For the data interception function, the amount of data contained in the data volume coordinates used for fitting is random. Therefore, each constant in the data interception function finally fitted is randomly determined. In other words, the data interception function is randomly generated.

[0057] S300, intercepting the data to be transmitted according to the data interception function, constructing data segment coordinates based on multiple data segments obtained by the data interception, and obtaining a data transmission control function based on the data segment coordinates.

[0058] In this module, data to be sent is intercepted according to the data interception function. After the data interception function is determined, a random number sequence is built into the gateway. The random number sequence is used to determine how to intercept the data to be sent. The random number sequence is imported into the data interception function, which will generate a sequence of calculation results. The calculation results are regarded as characters and concatenated to obtain a decimal string. The concatenated decimal string is then split into a preset number of decimal digits, thereby generating a preset number of decimal digits. The data division ratio is determined according to the numerical ratio between the multiple decimal digits. According to the data division ratio, part of the data to be sent is divided into multiple data segments, and the number of characters contained in each data segment is counted to construct the data segment coordinates. The horizontal axis of the data segment coordinates is the number of the data segment, and the vertical axis is the number of characters contained in the data segment. The preset function fitting tool is used to fit the data to obtain the data sending control function.

[0059] S400, transmit data to the networked device and send a control function, receive packaged data sent from the networked device, perform data transmission verification based on the packaged data, determine whether the networked device has an abnormality based on the verification result, and the networked device packages and sends the data to the gateway according to the data sending control function.

[0060] In this module, a data transmission control function is sent to the networked device. The gateway sends the data transmission control function to the corresponding networked device through the local area network. After receiving the data transmission control function, the networked device uses the data transmission control function to generate transmission control source data, splits the data to be transmitted into multiple packaged data of specific sizes according to the transmission control source data, and then sends the packaged data to the gateway for transmission using the gateway. When receiving the packaged data, the gateway identifies the data volume of each packaged data and the generation time of each packaged data, and verifies the data volume of the packaged data based on the generation time (time value) of the packaged data, the data volume of the packaged data and the data transmission control function. If the verification is successful, it is determined that there is no abnormality in the networked device, otherwise it is determined that there is an abnormality. When there is an abnormality, an abnormal prompt message is sent to the management end, and the network transmission of the networked device is restricted.

[0061] like Figure 2 As shown, as a preferred embodiment of the present invention, the steps of receiving the data to be sent to each networked device, counting the amount of data sent to each networked device, constructing the data amount coordinates, and constructing the data interception function based on the data amount coordinates specifically include:

[0062] S201, receiving data. When receiving the data to be sent, parsing the data to be sent, and determining the networked device corresponding to the data to be sent.

[0063] In this step, data is received. When the gateway is working, all data that needs to be transmitted to the networked devices from the outside will pass through the gateway. As a data transfer center, the gateway can clearly know the direction of each data. Then each networked device will have data to be sent. The data to be sent refers to the data that the gateway needs to forward to the networked device. The address of the networked device is recorded in the data to be sent, so the identity of the networked device can be directly determined.

[0064] S202, counting the data volume included in the data to be sent to each networked device in the same time period, and constructing a data volume coordinate using the number of the networked device and the data volume.

[0065] In this step, the amount of data to be sent to each networked device in the same time period is counted. For example, in a local area network, there are five networked devices numbered 1 to 5, and the amount of data to be sent corresponding to the networked devices is M1-M5 respectively. Then the data amount coordinate is (n, Mn), where n is the number of the networked device, and Mn is the amount of data to be sent corresponding to the nth networked device.

[0066] S203, fitting the data volume coordinates one by one according to a preset fitting function type library, selecting a fitting function type with the highest fitting accuracy, and fitting to obtain a data interception function.

[0067] In this step, the data quantity coordinates are fitted one by one according to the preset fitting function type library. In the fitting function type library, there are many commonly used function types recorded, such as quadratic polynomial function, cubic polynomial function, power function, exponential function, trigonometric function and logarithmic function, etc. Different function types are fitted to obtain multiple fitting results, and a set of fitting results with the highest fitting accuracy is selected to obtain the data interception function.

[0068] like Figure 3 As shown, as a preferred embodiment of the present invention, the steps of intercepting the data to be transmitted according to the data interception function, constructing data segment coordinates based on multiple data segments obtained by data interception, and obtaining the data transmission control function based on the data segment coordinates fitting specifically include:

[0069] S301, calling a preset random number sequence, importing the random number sequence into a data interception function, generating data interception source data, wherein the number of decimal characters contained in the data interception source data is not less than a preset value.

[0070] In this step, a preset random number sequence is called. The gateway has a built-in random number sequence. The random numbers contained in the above random number sequence are all random natural numbers that can be generated by a random algorithm. They are imported into the data interception function one by one. Each import will generate a calculation result, and the calculation result is regarded as a character for splicing until the number of decimal characters contained in the spliced ​​data interception source data is not less than the preset value. If the preset value is 100, the data interception source data contains 100 decimal characters.

[0071] S302, treating the data interception source data as a decimal string, intercepting a plurality of decimal digits, determining the number of each group of decimal digits, and determining the data division ratio based on multiple ratios between the decimal digits.

[0072] In this step, the data interception source data is regarded as a decimal string, and the data interception source data is split according to the preset number of divisions to obtain multiple decimal numbers. For example, the preset number of divisions is 5, and the data interception source data is 2400098460123542919041934, then after equal division, the five groups of decimal numbers obtained are 24000, 98460, 12354, 29190, and 41934. The ratio of the above numbers is calculated to obtain the data division ratio, which is 4000:16410:2059:4865:6989.

[0073] S303, intercepting a preset proportion of the data to be sent of the networked device based on the data division ratio, counting the number of characters contained in each data segment, constructing the data segment coordinates, and fitting to obtain a data sending control function.

[0074] In this step, based on the data division ratio, a preset proportion of the data to be sent of the networked device is intercepted. The preset proportion is between 0-100%, and specifically, it can be set to 50%. For example, if the data to be sent contains P characters, only the data contained in the first 50% of the data to be sent is intercepted during interception. According to the data division ratio, that is, 4000:16410:2059:4865:6989, multiple data segments will be obtained. Since the total amount of data contained in each data to be sent is different, the amount of data contained in the data segments corresponding to different networked devices is different. The data segment coordinates are constructed, and the horizontal axis of the data segment coordinates is the number of the data segment, and the vertical axis is the amount of data contained in the data segment. The data segment numbered 1 contains 2318245 characters, and the corresponding data segment coordinates are (1, 2328245). Similarly, the data fitting tool is used to perform function fitting to obtain the data transmission control function, such as .

[0075] like Figure 4As shown, as a preferred embodiment of the present invention, the steps of transmitting data to a networked device and sending a control function, receiving packaged data sent from the networked device, performing data transmission verification based on the packaged data, and determining whether an abnormality occurs in the networked device based on the verification result specifically include:

[0076] S401, transmitting a data transmission control function to a networked device, and receiving the data transmission control function through the networked device.

[0077] S402, recording the time value of data transmission through the networked device, importing the time value into the data transmission control function, generating transmission control source data, and packaging the data sent to the gateway into multiple copies based on a preset reference value. The networked device packages the data to obtain multiple packaged data. The amount of data contained in the multiple packaged data is determined according to the transmission control source data. The first packaged data contains a data transmission mark and a time value.

[0078] In this step, a data transmission control function is transmitted to the networked device. The networked device controls the data transmission control function. After the networked device learns the data transmission control function, it packages the data to be sent according to the data transmission control function. Specifically, when the networked device needs to send data, it records the time value of the data currently required to be sent and the data currently required to be sent, which is defined as the data to be transmitted. The time value is substituted into the data transmission control function to obtain a calculated value. In the preset reference value, the number of packaged data divided into which the data to be transmitted is recorded. If the reference value is set to 3, the data to be transmitted is divided into three packaged data, and the calculated value is 2. 378615, the calculated value is padded or deleted to the preset length. For example, if the preset length is 9 decimal digits and the calculated value is less than 9 digits, it is padded with 5. If it is more than 9 digits, it is deleted from the end. Taking 238145 as an example, if it is less than 9 digits, it is padded to 238145555. Taking 23812851582 as an example, if it is more than 9 digits, it is deleted to 238128515. The processed 9-digit decimal number is divided into the number of reference value records. Taking 238128515 as an example, 238, 128, and 515 are obtained. The total amount of data to be transmitted is P, so the amount of data contained in the first packaged data is , the amount of data contained in the second package data is , the amount of data contained in the third package data is , add data transmission mark and time value to the first package data.

[0079] S403, receiving the packaged data, extracting the time value, and checking the amount of data contained in the packaged data based on the time value and the data transmission control function. After the checking is completed, determining whether there is an abnormality in the networked device.

[0080] In this step, packaged data is received. When the gateway receives the above data, it can determine all the packaged data included in the current batch according to the data transmission mark, substitute the time value into the data sending control function, process based on the calculated value, determine the data volume included in each packaged data, and check the data volume of all the packaged data included in the current batch. If the theoretical ratio of the data volume included in each packaged data calculated by the gateway according to the time value and the data sending control function is the same as the actual ratio of each packaged data counted, it means that the current data transmission is normal. Otherwise, it means that the corresponding networked device has a network transmission abnormality. The above network transmission abnormality may be caused by external intrusion. For example, if the networked device is invaded, the system performance is severely occupied and the transmission data cannot be effectively processed, resulting in data transmission disorder, or abnormal traffic occupies the data transmission bandwidth, and the networked device cannot complete the processing of the data transmission process in time, or the external intruder restricts the normal operation of the data transmission program. After being determined to be abnormal, the data transmission request of the networked device is restricted, and its network transmission speed can be restricted, or its network connection can be disconnected, or it is only allowed to access specific security links.

[0081] like Figure 5 As shown, a networked device monitoring terminal for network security provided by an embodiment of the present invention includes:

[0082] The device identification module 100 is used to obtain networked device information, determine the networked devices in the current network environment, and determine the serial number of each networked device.

[0083] In this terminal, the device identification module 100 obtains the networked device information. In a local area network, there are multiple networked devices, and the networked devices can be computer devices. The present invention is applied to the gateway in the local area network. A gateway can connect multiple networked devices, and monitor the data transmission and reception of the networked devices, thereby completing the abnormal monitoring of the networked devices. In order to confirm the identity of each networked device, a number is set for each networked device. The number is unique, so the networked device can be determined according to the number.

[0084] The interception function fitting module 200 is used to receive the data to be sent to each networked device, count the amount of data sent to each networked device, construct data amount coordinates, and construct a data interception function based on the data amount coordinates.

[0085] In this terminal, the interception function fitting module 200 receives the data to be sent to each networked device. When the gateway receives the data to be sent, it determines the networked device to which the data to be sent needs to be sent based on the address contained in the data to be sent. At this time, data statistics are performed on the data to be sent to each networked device. Different networked devices have different numbers. At the same time, the amount of data contained in the data to be sent sent to the networked device is also different. Data amount coordinates are constructed based on this. After obtaining multiple data amount coordinates, a preset function fitting tool is used to fit them to obtain a data interception function. For the data interception function, the amount of data contained in the data amount coordinates used for fitting is random. Therefore, each constant in the data interception function finally fitted is randomly determined. In other words, the data interception function is randomly generated.

[0086] The control function fitting module 300 is used to intercept the data to be sent according to the data interception function, construct data segment coordinates based on multiple data segments obtained by data interception, and obtain the data sending control function based on the data segment coordinates.

[0087] In this terminal, the control function fitting module 300 intercepts the data to be sent according to the data interception function. After determining the data interception function, a random number sequence is built into the gateway. The random number sequence is used to determine how to intercept the data to be sent. The random number sequence is imported into the data interception function, which will generate a sequence of calculation results. The obtained calculation results are regarded as characters and spliced ​​together to obtain a decimal string. The spliced ​​decimal string is then split into a preset number of decimal digits, thereby generating a preset number of decimal digits. The data division ratio is determined according to the numerical ratio between the multiple decimal digits. According to the data division ratio, part of the data to be sent is divided into multiple data segments, and the number of characters contained in each data segment is counted to construct the data segment coordinates. The horizontal axis of the data segment coordinates is the number of the data segment, and the vertical axis is the number of characters contained in the data segment. Fitting is performed through a preset function fitting tool to obtain a data sending control function.

[0088] The data interaction monitoring module 400 is used to transmit a data sending control function to a networked device, receive packaged data sent from the networked device, perform data transmission verification based on the packaged data, and determine whether the networked device has an abnormality based on the verification result. The networked device packages and sends the data to the gateway according to the data sending control function.

[0089] In this terminal, the data interaction monitoring module 400 transmits a data sending control function to the networked device, and the gateway sends the data sending control function to the corresponding networked device through the local area network. After receiving the data sending control function, the networked device uses the data sending control function to generate transmission control source data, and splits the data to be transmitted into multiple packaged data of specific sizes according to the transmission control source data, and then sends the packaged data to the gateway for transmission using the gateway. When receiving the packaged data, the gateway identifies the data volume of each packaged data and the generation time of each packaged data, and verifies the data volume of the packaged data based on the generation time (time value) of the packaged data, the data volume of the packaged data and the data sending control function. If the verification is successful, it is determined that there is no abnormality in the networked device, otherwise it is determined that there is an abnormality. When there is an abnormality, an abnormal prompt information is sent to the management end, and the network transmission of the networked device is restricted.

[0090] like Figure 6 As shown, as a preferred embodiment of the present invention, the intercept function fitting module 200 includes:

[0091] The data parsing unit 201 is used for receiving data. When receiving the data to be sent, the data to be sent is parsed to determine the networked device corresponding to the data to be sent.

[0092] In this module, the data parsing unit 201 receives data. When the gateway is working, all data that needs to be transmitted to the networked devices from the outside will pass through the gateway. As a data transfer center, the gateway can clearly know the direction of each data. Then each networked device will have data to be sent. The data to be sent refers to the data that the gateway needs to forward to the networked device. The address of the networked device is recorded in the data to be sent, so the identity of the networked device can be directly determined.

[0093] The coordinate construction unit 202 is used to count the data volume contained in the data to be sent to each networked device in the same time period, and to construct the data volume coordinates according to the number of the networked device and the data volume.

[0094] In this module, the coordinate construction unit 202 counts the amount of data to be sent to each networked device in the same time period. For example, in a local area network, there are five networked devices numbered 1 to 5, and the amount of data to be sent corresponding to the networked devices is M1-M5 respectively. Then the data amount coordinate is (n, Mn), where n is the number of the networked device, and Mn is the amount of data to be sent corresponding to the nth networked device.

[0095] The first function fitting unit 203 is used to fit the data volume coordinates one by one according to a preset fitting function type library, select the fitting function type with the highest fitting accuracy, and obtain the data interception function through fitting.

[0096] In this module, the first function fitting unit 203 fits the data quantity coordinates one by one according to the preset fitting function type library. In the fitting function type library, a variety of commonly used function types are recorded, such as quadratic polynomial function, cubic polynomial function, power function, exponential function, trigonometric function and logarithmic function, etc. Different function types are fitted to obtain multiple fitting results, and a group of fitting results with the highest fitting accuracy are selected to obtain the data interception function.

[0097] like Figure 7 As shown, as a preferred embodiment of the present invention, the control function fitting module 300 includes:

[0098] The data interception unit 301 is used to retrieve a preset random number sequence, import the random number sequence into a data interception function, and generate data interception source data, wherein the number of decimal characters contained in the data interception source data is not less than a preset value.

[0099] In this module, the data interception unit 301 calls a preset random number sequence. In the gateway, a random number sequence is built in. The random numbers contained in the above random number sequence are all random natural numbers, which can be generated by a random algorithm and imported into the data interception function one by one. Each import will generate a calculation result, and the calculation result will be regarded as a character for splicing until the number of decimal characters contained in the spliced ​​data interception source data is not less than the preset value. If the preset value is 100, the data interception source data contains 100 decimal characters.

[0100] The division ratio calculation unit 302 is used to regard the data interception source data as a decimal string, intercept a plurality of decimal numbers, determine the number of each group of decimal numbers, and determine the data division ratio based on multiple ratios between the decimal numbers.

[0101] In this module, the division ratio calculation unit 302 regards the data interception source data as a decimal string, and splits the data interception source data according to the preset division number to obtain multiple decimal numbers. For example, if the preset division number is 5 and the data interception source data is 2400098460123542919041934, then after equal division, the five groups of decimal numbers obtained are 24000, 98460, 12354, 29190, and 41934. The ratio of the above numbers is calculated to obtain the data division ratio, which is 4000:16410:2059:4865:6989.

[0102] The second function fitting unit 303 is used to intercept a preset proportion of the data to be sent of the networked device based on the data division ratio, count the number of characters contained in each data segment, construct the data segment coordinates, and fit the data sending control function.

[0103] In this module, the second function fitting unit 303 intercepts a preset proportion of the data to be sent of the networked device based on the data division ratio. The preset proportion is between 0-100%, and specifically, can be set to 50%. For example, if the data to be sent contains P characters, only the data contained in the first 50% of the data to be sent is intercepted during interception. According to the data division ratio, i.e., 4000:16410:2059:4865:6989, multiple data segments will be obtained. Since the total amount of data contained in each data to be sent is different, the data segments corresponding to different networked devices contain different amounts of data. The data segment coordinates are constructed, and the horizontal coordinate of the data segment coordinates is the number of the data segment, and the vertical coordinate is the amount of data contained in the data segment. The data segment numbered 1 contains 2318245 characters, and the corresponding data segment coordinates are (1, 2328245). Similarly, the data fitting tool is used to perform function fitting to obtain the data transmission control function, such as .

[0104] like Figure 8 As shown, as a preferred embodiment of the present invention, the data interaction monitoring module 400 includes:

[0105] The data transmission unit 401 is used to transmit a data transmission control function to a networked device, and receive the data transmission control function through the networked device.

[0106] The data packaging unit 402 is used to record the time value of data transmission through the networked device, import the time value into the data transmission control function, generate transmission control source data, and package the data sent to the gateway into multiple copies based on a preset reference value. The networked device obtains multiple packaged data after packaging the data. The amount of data contained in the multiple packaged data is determined according to the transmission control source data. The first packaged data contains a data transmission mark and a time value.

[0107] In this module, the data transmission unit 401 transmits a data transmission control function to the networked device, and the networked device sends the data to the control function. After the networked device learns the data transmission control function, it packages the data to be sent according to the data transmission control function. Specifically, when the networked device needs to send data, it records the time value of the data currently required to be sent and the data currently required to be sent, which is defined as the data to be transmitted. The time value is substituted into the data transmission control function to obtain a calculated value. In the preset reference value, the number of packaged data divided into which the data to be transmitted is recorded. If the reference value is set to 3, the data to be transmitted is divided into three packaged data, and the calculation is If the calculated value is 2378615, the calculated value is padded or deleted to the preset length. For example, if the preset length is 9 decimal digits and the calculated value is less than 9 digits, it is padded with 5. If it is more than 9 digits, it is deleted from the end. Taking 238145 as an example, if it is less than 9 digits, it is padded to 238145555. Taking 23812851582 as an example, if it exceeds 9 digits, it is deleted to 238128515. The processed 9-digit decimal number is divided into the number of reference value records. Taking 238128515 as an example, 238, 128, and 515 are obtained. The total amount of data to be transmitted is P, so the amount of data contained in the first packaged data is , the amount of data contained in the second package data is , the amount of data contained in the third package data is , add data transmission mark and time value to the first package data.

[0108] The data checking unit 403 is used to receive the packaged data, extract the time value, check the amount of data contained in the packaged data based on the time value and the data transmission control function, and after the check is completed, determine whether there is an abnormality in the networked device.

[0109] In this module, the data verification unit 403 receives the packaged data. When the gateway receives the above data, it can determine all the packaged data included in the current batch according to the data transmission mark, and substitute the time value into the data sending control function, process based on the calculated value, determine the data volume included in each packaged data, and verify the data volume of all the packaged data included in the current batch. If the theoretical ratio of the data volume included in each packaged data calculated by the gateway according to the time value and the data sending control function is the same as the actual ratio of each packaged data counted, it means that the current data transmission is normal. Otherwise, it means that the corresponding networked device has a network transmission anomaly. The above network transmission anomaly may be caused by external intrusion. For example, if the networked device is invaded, the system performance is seriously occupied and the transmission data cannot be effectively processed, resulting in data transmission disorder, or abnormal traffic occupies the data transmission bandwidth, and the networked device cannot complete the processing of the data transmission process in time, or the external intruder restricts the normal operation of the data transmission program. After being determined to be abnormal, the data transmission request of the networked device is restricted, and its network transmission speed can be restricted, or its network connection can be disconnected, or it is only allowed to access specific security links.

[0110] It should be understood that, although each step in the flow chart of each embodiment of the present invention is shown in sequence according to the indication of the arrow, these steps are not necessarily performed in sequence according to the order indicated by the arrow. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be performed in other orders. Moreover, at least a portion of the steps in each embodiment may include a plurality of sub-steps or a plurality of stages, and these sub-steps or stages are not necessarily performed at the same time, but can be performed at different times, and the execution order of these sub-steps or stages is not necessarily performed in sequence, but can be performed in turn or alternately with at least a portion of other steps or sub-steps or stages of other steps.

[0111] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a non-volatile computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0112] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0113] The above-mentioned embodiments only express several implementation methods of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the patent of the present invention. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

[0114] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A network device monitoring method for network security, characterized in that: The method comprises: Obtaining network device information, determining network devices in the current network environment, and determining the number of each network device; Receive data to be sent to each networked device, count the amount of data sent to each networked device, construct data amount coordinates, and construct a data interception function based on the data amount coordinates; According to the data interception function, data to be transmitted is intercepted, data segment coordinates are constructed based on multiple data segments obtained by the data interception, and a data transmission control function is obtained based on the data segment coordinates fitting; Transmitting data to the networked device and sending a control function, receiving packaged data sent from the networked device, performing data transmission verification based on the packaged data, and determining whether the networked device is abnormal based on the verification result, and the networked device packages and sends the data to the gateway according to the data sending control function; The steps of receiving data to be sent to each networked device, counting the amount of data sent to each networked device, constructing data amount coordinates, and constructing a data interception function based on the data amount coordinates specifically include: Receive data, and when receiving data to be sent, parse the data to be sent and determine the networked device corresponding to the data to be sent; Count the amount of data to be sent to each networked device in the same time period, and construct data volume coordinates based on the number of the networked device and the amount of data; According to the preset fitting function type library, the data quantity coordinates are fitted one by one, and the fitting function type with the highest fitting accuracy is selected to obtain the data interception function through fitting; The step of intercepting the data to be transmitted according to the data interception function, constructing data segment coordinates based on the multiple data segments obtained by the data interception, and fitting the data transmission control function based on the data segment coordinates specifically includes: Retrieving a preset random number sequence, importing the random number sequence into a data interception function, and generating data interception source data, wherein the number of decimal characters contained in the data interception source data is not less than a preset value; Treat the data interception source data as a decimal string, intercept and obtain multiple decimal numbers, determine the number of each group of decimal numbers, and determine the data division ratio based on multiple ratios between the decimal numbers; Based on the data division ratio, the preset proportion of the data to be sent of the networked devices is intercepted, the number of characters contained in each data segment is counted, the data segment coordinates are constructed, and the data sending control function is fitted.

2. The network device monitoring method for network security according to claim 1, characterized in that: The steps of transmitting data to the networked device and sending a control function, receiving packaged data sent from the networked device, performing data transmission verification based on the packaged data, and determining whether the networked device is abnormal based on the verification result specifically include: Transmitting a data transmission control function to a networked device, and receiving the data transmission control function through the networked device; The networked device records the time value of data transmission, imports the time value into the data transmission control function, generates transmission control source data, and packages the data sent to the gateway into multiple copies based on a preset reference value. The networked device packages the data to obtain multiple packaged data. The amount of data contained in the multiple packaged data is determined according to the transmission control source data. The first packaged data contains a data transmission mark and a time value. Receive the packaged data, extract the time value, check the amount of data contained in the packaged data based on the time value and the data sending control function, and after the check is completed, determine whether there is an abnormality in the networked device.

3. The network device monitoring method for network security according to claim 1, characterized in that: When a networked device is judged to be abnormal, an abnormal prompt message is sent to the management end, and the network transmission of the networked device is restricted.

4. A networked device monitoring terminal for network security, characterized in that: The terminal comprises: The device identification module is used to obtain the network device information, determine the network devices in the current network environment, and determine the number of each network device; An interception function fitting module is used to receive data to be sent to each networked device, count the amount of data sent to each networked device, construct data amount coordinates, and construct a data interception function based on the data amount coordinates; A control function fitting module, used for intercepting the data to be transmitted according to the data interception function, constructing data segment coordinates based on multiple data segments obtained by data interception, and obtaining a data transmission control function based on the fitting of the data segment coordinates; A data interaction monitoring module is used to transmit a data transmission control function to a networked device, receive packaged data sent from the networked device, perform data transmission verification based on the packaged data, and determine whether the networked device is abnormal based on the verification result. The networked device packages and sends the data to the gateway according to the data transmission control function; The intercept function fitting module comprises: A data parsing unit is used to receive data and, when receiving data to be sent, parse the data to be sent and determine the networked device corresponding to the data to be sent; A coordinate construction unit, used to count the amount of data to be sent to each networked device in the same time period, and to construct a data amount coordinate using the number of the networked device and the amount of data; The first function fitting unit is used to fit the data quantity coordinates one by one according to a preset fitting function type library, select the fitting function type with the highest fitting accuracy, and obtain the data interception function by fitting; The control function fitting module comprises: A data interception unit, used to retrieve a preset random number sequence, import the random number sequence into a data interception function, and generate data interception source data, wherein the number of decimal characters contained in the data interception source data is not less than a preset value; A division ratio calculation unit is used to regard the data interception source data as a decimal string, intercept a plurality of decimal numbers, determine the number of each group of decimal numbers, and determine the data division ratio based on multiple ratios between the decimal numbers; The second function fitting unit is used to intercept a preset proportion of the data to be sent of the networked device based on the data division ratio, count the number of characters contained in each data segment, construct the data segment coordinates, and fit the data sending control function.

5. The networked device monitoring terminal for network security according to claim 4, characterized in that: The data interaction monitoring module includes: A data transmission unit, used for transmitting a data transmission control function to a networked device, and receiving the data transmission control function through the networked device; A data packaging unit is used to record the time value of data transmission through a networked device, import the time value into a data transmission control function, generate transmission control source data, and package the data sent to the gateway into multiple copies based on a preset reference value. The networked device packages the data to obtain multiple packaged data. The amount of data contained in the multiple packaged data is determined according to the transmission control source data. The first packaged data contains a data transmission mark and a time value. The data verification unit is used to receive the packaged data, extract the time value, verify the amount of data contained in the packaged data based on the time value and the data transmission control function, and after the verification is completed, determine whether there is an abnormality in the networked device.

6. The networked device monitoring terminal for network security according to claim 4, characterized in that: When a networked device is judged to be abnormal, an abnormal prompt message is sent to the management end, and the network transmission of the networked device is restricted.

Images