Network security authentication method and system based on TCP

Abstract

The present invention relates to the field of network security technology, and in particular to a TCP-based network security authentication method and system. The present invention obtains the device risk level of each network device by analyzing the network traffic data of the device and the interaction between the devices; clusters all network devices to obtain multiple device clusters; obtains the abnormal propagation possibility of each device cluster according to the distribution of device risk levels of network devices in each device cluster and the number of interactions between different network devices; traverses the propagation directed graph, obtains the propagation risk update level of each network device according to the device risk levels of different starting devices and the corresponding propagation risk levels between adjacent network devices on each propagation path; screens out security devices and performs network security authentication on the security devices. The present invention improves the accuracy of network security authentication judgment by obtaining the accurate security risk level of each network device.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a TCP-based network security authentication method and system. Background Art

[0002] When the current network devices are centrally managed in the industrial control platform, the network devices, as clients, request to establish a TCP connection with the platform. During the TCP connection process, each network device needs to undergo network security authentication. However, before network security authentication, it is necessary to determine whether the network device has security risks. If the device is infected by malware or attacked by hackers, it is determined that the device has security risks, and the platform will reject the device's connection request to ensure that only authorized network devices can establish a connection with the platform, effectively preventing illegal devices from accessing the platform and reducing the risk of malicious attacks.

[0003] In the prior art, the historical communication data of network devices is analyzed in time series to evaluate the risk situation of the devices to determine whether there are security risks. However, since network attacks are often complex and hidden, they may be propagated and spread through multiple devices and paths, and abnormal situations may occur when the risk spreads between devices. The propagation situation between devices is not taken into account, resulting in a lack of comprehensive understanding of the security status of the entire network system, and the effect of security risk judgment is poor. Summary of the invention

[0004] In order to solve the technical problem that the effect of security risk judgment is poor without considering the transmission situation between devices, the purpose of the present invention is to provide a TCP-based network security authentication method and system, and the technical solution adopted is as follows:

[0005] The present invention proposes a network security authentication method based on TCP, the method comprising:

[0006] Acquire the communication data of each network device in the current local area network, wherein the communication data includes network traffic data and device interaction logs, and the device interaction logs include the interaction time and number of interactions between different devices;

[0007] Obtain the target time when each network device interacts with an external device in the device interaction log, and obtain the device risk level of each network device based on the difference in network traffic data between the neighborhood range before and after each target time, as well as the device interaction situation;

[0008] A corresponding propagation directed graph is constructed with the communication data of network devices, and all network devices in the propagation directed graph are clustered according to the device risk level of each network device to obtain multiple device clusters; the abnormal propagation possibility of each device cluster is obtained according to the distribution of device risk levels of network devices in each device cluster and the number of interactions between different network devices; the propagation risk level between network devices is obtained according to the abnormal propagation possibility of device clusters to which different network devices belong and the number of interactions between corresponding network devices;

[0009] Traverse the propagation directed graph to obtain the propagation paths between network devices; obtain the updated propagation risk level of each network device based on the device risk level of the starting point devices on different propagation paths and the corresponding propagation risk level between adjacent network devices;

[0010] Screen out secure devices based on the degree of transmission risk update of all network devices, and perform network security certification on secure devices.

[0011] Furthermore, the method for obtaining the risk level of the equipment includes:

[0012] According to the difference in network traffic data between each network device and the neighborhood range before and after each target time, the traffic mutation degree at each target time and the corresponding maximum value time are obtained;

[0013] Obtain the ratio between the number of interactions between each network device and external devices in the device interaction log and the total number of interactions of each network device, merge the ratio result with the maximum value of the traffic mutation degree, and obtain the traffic mutation risk degree of each network device;

[0014] The difference in the number of interactions between each network device and other network devices in the neighborhood range before and after the maximum value, as well as the difference in the number of interacting devices, are obtained; the device risk level of each network device is obtained based on the traffic mutation risk level, the difference in the number of interactions, and the difference in the number of interacting devices. The traffic mutation risk level, the difference in the number of interactions, and the difference in the number of interacting devices are all positively correlated with the device risk level.

[0015] Furthermore, obtaining the degree of traffic mutation at each target moment and the corresponding maximum value moment includes:

[0016] Obtain the mean difference of network traffic data between the neighborhood ranges before and after each target time for each network device as the traffic mutation degree at each target time;

[0017] The maximum value of the traffic mutation degree among all target moments is selected, and the corresponding target moment is taken as the maximum value moment.

[0018] Furthermore, the method for obtaining the possibility of abnormal propagation includes:

[0019] The mean value of the traffic mutation risk level of all devices in each device cluster is obtained as the average traffic mutation; the cumulative value of the number of interactions between all network devices in the corresponding device cluster is obtained;

[0020] According to the average traffic mutation and the accumulated value of each device cluster, the abnormal propagation possibility of each device cluster is obtained, the average traffic mutation is positively correlated with the abnormal propagation possibility, and the accumulated value is negatively correlated with the abnormal propagation possibility.

[0021] Furthermore, the method for obtaining the degree of transmission risk includes:

[0022] Obtain the average value of the abnormal propagation probability of the device clusters where different network devices are located as the average abnormal propagation probability;

[0023] The average anomaly propagation possibility and the number of interactions between corresponding network devices are fused and normalized to obtain the degree of propagation risk between network devices.

[0024] Furthermore, the method for acquiring the propagation path includes:

[0025] The propagation path between each network device and other network devices is obtained by deep traversal of the propagation directed graph.

[0026] Furthermore, the method for obtaining the updated degree of the transmission risk includes:

[0027] For the starting device of each propagation path, the device risk level of the starting device is used as the local propagation risk level of the corresponding network device;

[0028] For the endpoint device of each propagation path, the device risk level of the starting device on each propagation path and the propagation risk level between all corresponding adjacent network devices are integrated to obtain the local propagation risk level of the corresponding network device;

[0029] The local propagation risk degree of each network device in all propagation paths is accumulated and normalized to obtain the updated propagation risk degree of each network device.

[0030] Furthermore, the method of screening out safe devices according to the propagation risk update degree of all network devices includes:

[0031] If the propagation risk update degree of the network device is less than the preset risk threshold, the corresponding network device is judged to be a safe device.

[0032] Furthermore, the method for obtaining the device clustering cluster includes:

[0033] According to the device risk level of each network device, DBSCAN clustering is performed on all network devices in the propagation directed graph to obtain multiple device clusters.

[0034] The present invention also proposes a TCP-based network security authentication system, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements any one of the steps of the TCP-based network security authentication method.

[0035] The present invention has the following beneficial effects:

[0036] The present invention takes into account the security risks caused by attacks on network devices by external network devices, obtains the target time of each network device interacting with the external device in the device interaction log, obtains the device risk level of each network device according to the change difference of network traffic data between the neighborhood range before and after each target time, and the device interaction situation, and has a more comprehensive understanding of the activity mode of the device, which is helpful to evaluate the risk level of the device; obtains the propagation directed graph corresponding to the device interaction log, clusters all network devices in the propagation directed graph according to the device risk level of each network device, and obtains multiple device clusters. Through clustering, network devices with similar device risk levels can be classified into one category, which is helpful to better understand the device risk distribution; obtains the device risk level distribution of each device cluster according to the device risk level distribution of the network devices in each device cluster and the number of interactions between different network devices. The possibility of abnormal transmission is considered, and the potential mutual influence and risk transmission level between devices are revealed more comprehensively and deeply considering the influence of local areas; the degree of transmission risk between network devices is obtained according to the abnormal transmission possibility of the device clusters where different network devices are located and the number of interactions between the corresponding network devices, which more comprehensively and accurately reflects the risk status between network devices; traversing the transmission directed graph, the transmission path between network devices is obtained, and the overall structure of the network and the transmission situation between each device can be deeply understood; considering that the risk of a device may be transmitted to other devices in the network through multiple paths, and the network devices are interdependent, the transmission risk update degree of each network device is obtained according to the device risk degree of the starting device on different transmission paths, and the corresponding transmission risk degree between adjacent network devices; screen out safe devices and perform network security certification on the safe devices. The present invention improves the accuracy of network security certification judgment by obtaining the accurate security risk degree of each network device. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0038] Figure 1 A flowchart of a TCP-based network security authentication method provided by an embodiment of the present invention;

[0039] Figure 2 A flow chart of a method for obtaining the risk level of equipment provided by an embodiment of the present invention;

[0040] Figure 3 A schematic diagram of a propagation directed graph provided by an embodiment of the present invention;

[0041] Figure 4 A flow chart of a method for acquiring an update degree of propagation risk provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0042] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the following is a detailed description of a TCP-based network security authentication method and system proposed by the present invention, its specific implementation method, structure, features and effects, in conjunction with the accompanying drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" does not necessarily refer to the same embodiment. In addition, specific features, structures or characteristics in one or more embodiments may be combined in any suitable form.

[0043] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0044] The following is a detailed description of a TCP-based network security authentication method and system provided by the present invention in conjunction with the accompanying drawings.

[0045] See also Figure 1 , which shows a flowchart of a TCP-based network security authentication method provided by an embodiment of the present invention, and the specific method includes:

[0046] Step S1: Acquire the communication data of each network device in the current local area network. The communication data includes network traffic data and device interaction logs. The device interaction logs include the interaction time and number of interactions between different devices.

[0047] In an embodiment of the present invention, in the industrial Internet, when an industrial control network device acts as a client and requests to establish a TCP connection with a platform, it is necessary to perform network security authentication on each network device. After successful authentication, the device can access the platform. Considering that when there is a risk in the network device, it will cause damage to the control platform, so it is necessary to evaluate the risk of the device according to the communication situation between the network devices; first, use the network mapping tool Namp to identify all devices in the network, and use the network analysis tool Wireshark to capture the network traffic, device interaction log and other communication data of the network device, wherein the device interaction log is a log that records detailed information on the interaction process and results between devices, records the time when the device interaction occurs, marks the devices involved in the interaction and the specific operation method, etc.; obtain the communication data of each network device in the current local area network, the communication data includes network traffic data and device interaction log, and the device interaction log includes the interaction time and number of interactions between different devices.

[0048] It should be noted that, in one embodiment of the present invention, the time range for acquiring communication data is set to half a month; in other embodiments of the present invention, the size of the time range can be set according to specific circumstances, and is not limited or elaborated here.

[0049] Step S2: Obtain the target time of interaction between each network device and the external device in the device interaction log, and obtain the device risk level of each network device based on the change difference of network traffic data between the neighborhood range before and after each target time of each network device, as well as the device interaction situation.

[0050] Since malicious attacks usually spread viruses through remote access in the external network or external storage devices connected to devices in the local area network, obtaining the target time of each network device interacting with an external device in the device interaction log will help identify the time points that may be at risk. Among them, external devices refer to devices that are not in the current local area network.

[0051] Network traffic data can reflect the usage of network devices and help identify devices with large data transmission volumes. By analyzing the differences in network traffic data between the neighborhood ranges before and after each target moment for each network device, the corresponding moments of abnormal traffic fluctuations can be identified. The more likely it is to be attacked from the outside, the more security risks the device has. Device interaction can identify information such as the frequency and type of device interaction, and provide a more comprehensive understanding of the device's activity patterns, which helps assess the risk level of the device. Based on the differences in network traffic data between the neighborhood ranges before and after each target moment for each network device, as well as the device interaction, the device risk level of each network device can be obtained.

[0052] Preferably, in one embodiment of the present invention, the method for obtaining the risk level of the device can be found in Figure 2 , which shows a flow chart of a method for obtaining the risk level of a device, including:

[0053] Step S201: According to the difference in network traffic data between each network device and the neighborhood range before and after each target moment, the traffic mutation degree at each target moment and the corresponding maximum value moment are obtained.

[0054] Network traffic is a direct reflection of network communication activities and reflects the operating status of the network. By analyzing the changes in device network traffic, we can more intuitively understand the abnormal changes in network traffic. The greater the abnormal changes, the more likely it is that the network is under attack or there are security risks.

[0055] Preferably, in one embodiment of the present invention, obtaining the degree of traffic mutation at each target moment and the corresponding maximum moment includes:

[0056] Obtain the mean difference of network traffic data between the neighborhood ranges before and after each target time for each network device as the traffic mutation degree at each target time;

[0057] The maximum value of the traffic mutation degree among all target moments is selected, and the corresponding target moment is taken as the maximum value moment.

[0058] In one embodiment of the present invention, the formula for the degree of traffic mutation is expressed as:

[0059] ;

[0060] in, Indicates that each network device is The degree of traffic mutation at the target moment; Indicates that each network device is The average value of the network traffic of devices in the previous neighborhood range at the target time; Indicates that each network device is The average value of the network traffic of devices in the neighborhood range after the target time; Indicates taking the absolute value.

[0061] In the formula for the degree of traffic mutation, Indicates the calculation of each network device in the The difference in the mean value of the device network traffic between the neighborhood ranges before and after the target moment. The larger the difference, the greater the change in the device network traffic between the neighborhood ranges before and after, and the greater the degree of traffic mutation.

[0062] It should be noted that, in one embodiment of the present invention, the front neighborhood range of each target moment is the range consisting of each target moment and all previous moments; the front neighborhood range of each target moment is the range consisting of each target moment and all subsequent moments.

[0063] Step S202: Obtain the ratio between the number of interactions between each network device and external devices in the device interaction log and the total number of interactions of each network device, merge the ratio result with the maximum traffic mutation degree, and obtain the traffic mutation risk degree of each network device.

[0064] It should be noted that, in some embodiments of the present invention, the ratio and the maximum value of the flow mutation may be fused by addition or multiplication. The specific means are well known to those skilled in the art and will not be elaborated here.

[0065] In one embodiment of the present invention, the formula for the risk level of traffic mutation is expressed as:

[0066] ;

[0067] in, Indicates the risk level of traffic mutation of network devices; Indicates the number of interactions between network devices and external devices; Indicates the number of all interactions of network devices; Indicates the maximum value of traffic mutation degree.

[0068] In the formula for the risk of traffic mutation, the greater the number of interactions between network devices and external devices, the greater the possibility of being attacked, the greater the maximum value of the traffic mutation, and the greater the risk of traffic mutation.

[0069] Step S203: Obtain the difference in the number of interactions between each network device and other network devices in the neighborhood range before and after the maximum value, as well as the difference in the number of interacting devices; obtain the device risk level of each network device based on the traffic mutation risk level, the difference in the number of interactions, and the difference in the number of interacting devices. The traffic mutation risk level, the difference in the number of interactions, and the difference in the number of interacting devices are all positively correlated with the device risk level.

[0070] Among them, the positive correlation indicates that the dependent variable will increase as the independent variable increases, and the dependent variable will decrease as the independent variable decreases, that is, the greater the risk of traffic mutation, the greater the difference in the number of interactions, and the greater the difference in the number of interactive devices, indicating that the stability of the interaction between network devices is poor, the more likely it is to be affected by external factors, and the greater the risk of the equipment.

[0071] In one embodiment of the present invention, the formula for the equipment risk level is expressed as:

[0072] ;

[0073] ;

[0074] in, Indicates the device risk level of the network device; Indicates the risk level of traffic mutation of network devices; Indicates the moment when the degree of traffic mutation corresponds to the maximum value; Indicates the maximum value of each network device and other network devices The number of interactions within the previous neighborhood of ; Indicates the maximum value of each network device and other network devices The number of interactions within the neighborhood of ; Indicates the difference in the number of interacting devices between the neighborhood range before and after the maximum moment; represents the adjustment parameter; Indicates taking the absolute value; represents the normalized exponential function.

[0075] In the formula for the equipment risk level, The function will Normalized to 0~1; It means calculating the maximum value of each network device and other network devices The difference in the number of interactions between the front and back neighborhoods. The greater the difference in the number of interactions, the sudden increase or decrease in the interaction frequency of the network device, the worse the stability, and the greater the risk of the device. The greater the risk of traffic mutation of the network device, the more likely it is that there will be a large external device impact. The greater the difference in the number of interactions, the greater the risk of the device.

[0076] It should be noted that, considering that there is no change in the number of interacting devices between the neighborhood ranges before and after the maximum value, the impact on the device risk is small. Only the interaction between network devices and the change in network traffic need to be considered. Therefore, the adjustment parameter is set to 1. If the number of interacting devices changes, the greater the change, the more unstable the interaction between network devices, and the larger the adjustment parameter needs to be adjusted. The data difference of the interacting devices is used as the adjustment parameter.

[0077] Step S3: Construct a corresponding propagation directed graph based on the communication data of the network devices, cluster all network devices in the propagation directed graph according to the device risk level of each network device, and obtain multiple device clusters; obtain the abnormal propagation possibility of each device cluster according to the device risk level distribution of the network devices in each device cluster and the number of interactions between different network devices; obtain the propagation risk level between network devices according to the abnormal propagation possibility of the device clusters to which different network devices belong and the number of interactions between the corresponding network devices.

[0078] The propagation directed graph can intuitively display the communication interaction relationship between network devices, which helps to understand the path and method of risk propagation in network devices; the corresponding propagation directed graph is constructed based on the communication data of network devices. Each network device is used as a node of the propagation directed graph, and the nodes are connected with directed arrows according to the flow direction of network traffic data in the communication data, and the number of interactions between network devices is used as the weight value on the propagation directed graph, such as Figure 3 , which shows a schematic diagram of a propagation directed graph.

[0079] Different network devices play different roles in the network and have different risk levels. Clustering can be used to group network devices with similar risk levels into one category, which helps to better understand the distribution of device risks and conduct targeted analysis. All network devices in the propagation directed graph are clustered according to the risk level of each network device to obtain multiple device clusters.

[0080] Preferably, in one embodiment of the present invention, the method for acquiring device clustering includes:

[0081] According to the device risk level of each network device, DBSCAN clustering is performed on all network devices in the propagation directed graph to obtain multiple device clusters.

[0082] It should be noted that the specific DBSCAN clustering is a technical means well known to those skilled in the art and will not be described in detail here.

[0083] Device clustering is to classify network devices with similar characteristics into one category. The risk level of the device clustering is often localized. By analyzing the distribution of device risk levels of network devices, the overall risk situation of the device clustering is evaluated. The number of interactions between network devices is an important medium for risk transmission. The more interactions, the more frequent the data transmission and information exchange between devices. If a device is abnormal or attacked, the greater the possibility of risk transmission to other devices. According to the distribution of device risk levels of network devices in each device clustering and the number of interactions between different network devices, the abnormality transmission possibility of each device clustering is obtained.

[0084] Preferably, in one embodiment of the present invention, the method for obtaining the possibility of abnormal propagation includes:

[0085] The mean value of the traffic mutation risk level of all devices in each device cluster is obtained as the average traffic mutation; the cumulative value of the number of interactions between all network devices in the corresponding device cluster is obtained;

[0086] According to the average traffic mutation and cumulative value of each device cluster, the abnormal propagation possibility of each device cluster is obtained. The average traffic mutation is positively correlated with the abnormal propagation possibility, and the cumulative value is negatively correlated with the abnormal propagation possibility.

[0087] Among them, the positive correlation relationship indicates that the dependent variable will increase as the independent variable increases, and the dependent variable will decrease as the independent variable decreases, that is, the larger the average traffic mutation, the greater the risk of traffic mutation for all devices, and the greater the possibility of abnormal propagation; the negative correlation relationship indicates that the dependent variable will decrease as the independent variable increases, and the dependent variable will increase as the independent variable decreases, that is, the larger the cumulative value, the greater the number of interactions between devices, the better the device propagation, and the smaller the possibility of abnormal propagation.

[0088] In one embodiment of the present invention, the formula for the probability of abnormal propagation is expressed as:

[0089] ;

[0090] in, Indicates The probability of abnormal propagation of clusters of devices; Indicates The first device in the cluster The device risk level of each network device; Indicates The number of network devices in a device cluster; Indicates The first device in the cluster The number of interactions between network devices; Indicates The number of interactions between different network devices in a device cluster; represents the normalized exponential function.

[0091] In the formula for the probability of anomaly propagation, The function will Normalized to 0~1; Indicates The average of the traffic mutation risk levels of all devices in a device cluster, that is, the average traffic mutation. The greater the average traffic mutation level, the greater the possibility of abnormal propagation. Indicates The cumulative value of the number of interactions between all network devices in a device cluster. The larger the cumulative value, the greater the number of exchanges between network devices, the better the propagation, and the smaller the possibility of abnormal propagation.

[0092] Devices in the same device cluster may exhibit similar abnormal behaviors when facing security threats. By analyzing the possibility of abnormal propagation within the device cluster, the possibility of abnormal propagation of each network device can be reflected. The more frequent the interactions between network devices, the greater the chance of risk propagation and the greater the degree of propagation risk. By combining the possibility of abnormal propagation of the device cluster and the number of interactions between devices to assess the degree of propagation risk, the risk status between network devices can be more comprehensively and accurately reflected. Therefore, the degree of propagation risk between network devices can be obtained based on the possibility of abnormal propagation of the device cluster to which different network devices belong and the number of interactions between the corresponding network devices.

[0093] Preferably, in one embodiment of the present invention, the method for obtaining the degree of transmission risk includes:

[0094] Obtain the mean of the anomaly propagation probability of the device clusters to which different network devices belong as the average anomaly propagation probability;

[0095] The average anomaly propagation possibility and the number of interactions between corresponding network devices are fused and normalized to obtain the degree of propagation risk between network devices.

[0096] In one embodiment of the present invention, the formula for the degree of transmission risk is expressed as:

[0097] ;

[0098] in, Indicates network device and the degree of risk of transmission between them; Indicates network device The possibility of abnormal propagation in the device cluster; Indicates network device The possibility of abnormal propagation in the device cluster; Indicates network device and The number of interactions between .

[0099] In the formula for the degree of transmission risk, the greater the possibility of abnormal transmission of the device cluster in which the network device is located, the more times the devices interact, the more likely it is that more risks will be transmitted, and the greater the degree of transmission risk.

[0100] Step S4: traverse the propagation directed graph to obtain the propagation path between network devices; obtain the updated propagation risk level of each network device according to the device risk level of the starting point device on different propagation paths and the corresponding propagation risk level between adjacent network devices.

[0101] By traversing the propagation directed graph, we can deeply understand the overall structure of the network and the propagation between each device, and more intuitively understand the structure and risk distribution of the network. Traverse the propagation directed graph to obtain the propagation path between network devices.

[0102] Preferably, in one embodiment of the present invention, the method for acquiring the propagation path includes:

[0103] The propagation path between each network device and other network devices is obtained by deep traversal of the propagation directed graph.

[0104] It should be noted that deep traversal is a technical means well known to those skilled in the art and will not be elaborated here.

[0105] In a complex network environment, risk propagation is often not a single-path, but multi-path and multi-level. The risk of a device may propagate to other devices in the network through multiple paths. In addition, considering that network devices are interdependent, the security status of a device may be affected by other devices connected to it. Therefore, the updated degree of propagation risk of each network device is obtained based on the device risk level of the starting device on different propagation paths and the corresponding degree of propagation risk between adjacent network devices.

[0106] Preferably, in one embodiment of the present invention, the method for obtaining the updated degree of propagation risk is as follows: Figure 4 , which shows a flow chart of a method for obtaining an updated degree of transmission risk, including:

[0107] Step S401: For the starting point device of each propagation path, the device risk level of the starting point device is used as the local propagation risk level of the corresponding network device.

[0108] Considering that the starting device of each transmission path is often the source of risk transmission, its risk level directly affects the risk level of subsequent transmission. Therefore, the device risk level of the starting device is directly used as the local transmission risk level of the corresponding network device on the transmission path, providing a benchmark for assessing the risk of the entire transmission path.

[0109] Step S402: For the terminal device of each propagation path, the device risk level of the starting device on each propagation path and the corresponding propagation risk level between all adjacent network devices are integrated to obtain the local propagation risk level of the corresponding network device.

[0110] Since the risk of the endpoint device is affected by the degree of transmission risk among all devices on the entire transmission path, the device risk degree of the starting device and the transmission risk degree between all adjacent devices on the transmission path are comprehensively considered. The greater the device risk degree, the greater the transmission risk degree and the greater the local transmission risk degree.

[0111] It should be noted that, in some embodiments of the present invention, the device risk level of the starting device on each propagation path and the corresponding propagation risk level between all adjacent network devices may be integrated by adding or multiplying.

[0112] In one embodiment of the present invention, if the transmission path is from the starting device A through the network device C to the end device D, the formula for the local transmission risk degree is expressed as:

[0113] ;

[0114] in, Indicates the local transmission risk level of network device D corresponding to the transmission path from the starting device A to the end device D; Indicates the starting device The risk level of the equipment; Indicates network device and the degree of risk of transmission between them; Indicates network device and The risk of transmission between them.

[0115] In the formula of the local transmission risk level, the device risk level of the starting device, the greater the transmission risk level between network devices, the more likely it is that the risk will be transmitted to the next device, and the greater the local transmission risk level.

[0116] Step S403: Accumulate the local propagation risk level of each network device in all propagation paths and normalize them to obtain an updated propagation risk level of each network device.

[0117] In order to comprehensively analyze the updated degree of the transmission risk of each network device, considering that a network device may be the starting point or end point of multiple transmission paths at the same time, its risk level needs to be comprehensively considered for all relevant transmission paths. Therefore, the local risk level of each network device in all transmission paths is accumulated. The larger the accumulated result, the greater the overall updated degree of the transmission risk.

[0118] It should be noted that the starting device of the propagation path is the first network device on the propagation path, and the end device of the propagation path is the last network device reached on the propagation path.

[0119] Step S5: Screen out safe devices according to the update degree of the propagation risk of all network devices, and perform network security authentication on the safe devices.

[0120] Different network devices face different transmission risks due to their different functions and deployment locations. The transmission risk update degree of network devices is a measure of the risk level of the device being attacked or used to spread malware in the current network environment. The greater the risk level, the greater the transmission risk update degree. Therefore, screening out security devices based on the distribution of transmission risk update degrees of all network devices and performing network security certification on security devices can ensure that these devices comply with relevant security standards and requirements and have high security protection capabilities.

[0121] Preferably, in one embodiment of the present invention, screening out security devices includes:

[0122] If the propagation risk update degree of the network device is less than the preset risk threshold, the corresponding network device is judged to be a safe device.

[0123] It should be noted that, in one embodiment of the present invention, the preset risk threshold is 0.7; in other embodiments of the present invention, the preset risk threshold may be set according to specific circumstances, which is not limited or elaborated herein.

[0124] Based on this, security devices are selected for network security authentication. Security devices can be used as clients to request to establish a TCP connection with the platform and negotiate the protocol version number for communication between the client and the server. If the negotiation is successful, the keys used for operations such as login and message encryption can be exchanged, otherwise the TCP connection is closed; after exchanging keys, the client initiates a login request to the server. If the login is successful, the authentication is passed and data interaction can be carried out. Otherwise, the TCP connection is closed. By selecting security devices for network security authentication, the security and reliability of device access to the network can be improved, which helps to protect user data and privacy security.

[0125] In summary, the present invention obtains the device risk level of each network device by analyzing the network traffic data of the device and the interaction between the devices; clusters all network devices to obtain multiple device clusters; obtains the abnormal propagation possibility of each device cluster according to the device risk level distribution of the network devices in each device cluster and the number of interactions between different network devices; traverses the propagation directed graph, obtains the propagation risk update level of each network device according to the device risk level of different starting devices and the corresponding propagation risk level between adjacent network devices on each propagation path; screens out safe devices and performs network security authentication on the safe devices. The present invention improves the accuracy of network security authentication judgment by obtaining the accurate security risk level of each network device.

[0126] The present invention also proposes a TCP-based network security authentication system, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements any one of the steps of a TCP-based network security authentication method.

[0127] It should be noted that the sequence of the above embodiments of the present invention is only for description and does not represent the advantages and disadvantages of the embodiments. The processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0128] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

Claims

1. A TCP-based network security authentication method, characterized in that: The method comprises: Acquire the communication data of each network device in the current local area network, wherein the communication data includes network traffic data and device interaction logs, and the device interaction logs include the interaction time and number of interactions between different devices; Obtain the target time when each network device interacts with an external device in the device interaction log, and obtain the device risk level of each network device based on the difference in network traffic data between the neighborhood range before and after each target time, as well as the device interaction situation; A corresponding propagation directed graph is constructed with the communication data of network devices, and all network devices in the propagation directed graph are clustered according to the device risk level of each network device to obtain multiple device clusters; the abnormal propagation possibility of each device cluster is obtained according to the distribution of device risk levels of network devices in each device cluster and the number of interactions between different network devices; the propagation risk level between network devices is obtained according to the abnormal propagation possibility of device clusters to which different network devices belong and the number of interactions between corresponding network devices; Traverse the propagation directed graph to obtain the propagation paths between network devices; obtain the updated propagation risk level of each network device based on the device risk level of the starting point devices on different propagation paths and the corresponding propagation risk level between adjacent network devices; Screen out safe devices based on the degree of transmission risk update of all network devices, and perform network security certification on the safe devices; The method for obtaining the risk level of the equipment includes: According to the difference in network traffic data between each network device and the neighborhood range before and after each target time, the traffic mutation degree at each target time and the corresponding maximum value time are obtained; Obtain the ratio between the number of interactions between each network device and external devices in the device interaction log and the total number of interactions of each network device, merge the ratio result with the maximum value of the traffic mutation degree, and obtain the traffic mutation risk degree of each network device; Obtain the difference in the number of interactions between each network device and other network devices in the neighborhood range before and after the maximum value, as well as the difference in the number of interacting devices; obtain the device risk level of each network device based on the traffic mutation risk level, the difference in the number of interactions, and the difference in the number of interacting devices. The traffic mutation risk level, the difference in the number of interactions, and the difference in the number of interacting devices are all positively correlated with the device risk level; The method for obtaining the possibility of abnormal propagation includes: The mean value of the traffic mutation risk level of all devices in each device cluster is obtained as the average traffic mutation; the cumulative value of the number of interactions between all network devices in the corresponding device cluster is obtained; According to the average traffic mutation and the accumulated value of each device cluster, the abnormal propagation possibility of each device cluster is obtained, the average traffic mutation is positively correlated with the abnormal propagation possibility, and the accumulated value is negatively correlated with the abnormal propagation possibility.

2. A TCP-based network security authentication method according to claim 1, characterized in that: The method of obtaining the traffic mutation degree at each target moment and the corresponding maximum value moment includes: Obtain the mean difference of network traffic data between the neighborhood ranges before and after each target time for each network device as the traffic mutation degree at each target time; The maximum value of the traffic mutation degree among all target moments is selected, and the corresponding target moment is taken as the maximum value moment.

3. A TCP-based network security authentication method according to claim 1, characterized in that: The method for obtaining the degree of transmission risk includes: Obtain the mean of the anomaly propagation probability of the device clusters to which different network devices belong as the average anomaly propagation probability; The average anomaly propagation possibility and the number of interactions between corresponding network devices are fused and normalized to obtain the degree of propagation risk between network devices.

4. A TCP-based network security authentication method according to claim 1, characterized in that: The method for acquiring the propagation path includes: The propagation path between each network device and other network devices is obtained by deep traversal of the propagation directed graph.

5. A TCP-based network security authentication method according to claim 1, characterized in that: The method for obtaining the updated degree of the transmission risk includes: For the starting device of each propagation path, the device risk level of the starting device is used as the local propagation risk level of the corresponding network device; For the endpoint device of each propagation path, the device risk level of the starting device on each propagation path and the propagation risk level between all corresponding adjacent network devices are integrated to obtain the local propagation risk level of the corresponding network device; The local propagation risk degree of each network device in all propagation paths is accumulated and normalized to obtain the updated propagation risk degree of each network device.

6. A TCP-based network security authentication method according to claim 1, characterized in that: The security devices are screened out according to the transmission risk update degree of all network devices, including: If the propagation risk update degree of the network device is less than the preset risk threshold, the corresponding network device is judged to be a safe device.

7. A TCP-based network security authentication method according to claim 1, characterized in that: The method for obtaining the device clustering cluster includes: According to the device risk level of each network device, DBSCAN clustering is performed on all network devices in the propagation directed graph to obtain multiple device clusters.

8. A TCP-based network security authentication system, the system comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of a TCP-based network security authentication method are implemented as described in any one of claims 1 to 7.

Images