A network port security protection method and system

Abstract

The present application discloses a network port security protection method and system, the method comprising: obtaining the physical data of the network port, performing feature processing on the physical data, and obtaining a physical feature vector; obtaining the physical state of the network port according to a preset abnormal physical feature vector library and the physical feature vector; obtaining the access behavior data entering the network port, performing feature processing on the access behavior data, and obtaining an access behavior feature vector; obtaining abnormal access behavior data entering the network port according to a preset normal access behavior feature vector library and the access behavior feature vector; judging whether to send a cut-off instruction to a relay connected to the network port according to the physical state and the abnormal access behavior data, so as to cut off the power supply and signal line of the network port. The embodiment of the present application can be used to perform comprehensive detection on the network port, effectively improve the network port security protection capability, and reduce security risks.

Description

Technical Field

[0001] The present application relates to the field of network port technology, and in particular to a network port security protection method and system. Background Art

[0002] A network port is an interface used to connect computers, network devices, and other external devices. When unauthorized or malicious users use these external devices to illegally access, they can be blocked by cutting off the network port channel.

[0003] The current method of network port security protection is to identify unauthorized users or malicious users by detecting network-level information such as IP, and then cut off the network port channel to block intrusion. However, this solution only detects information at the network level, which has certain limitations. For example, malicious users may physically damage or illegally operate the network port to bypass network-level detection through means such as IP spoofing, resulting in the inability to block intrusion, which poses a greater security risk. Summary of the invention

[0004] The present application provides a network port security protection method and system to solve the problem that the prior art only detects information at the network level and has certain limitations.

[0005] To achieve the above objectives, the present application provides a network port security protection method, which is applied to an edge computing node, including:

[0006] Acquire physical data of the network port, perform feature processing on the physical data, and obtain a physical feature vector; the physical data includes at least one of amplitude, inclination and displacement;

[0007] Obtaining the physical state of the network port according to a preset abnormal physical feature vector library and the physical feature vector;

[0008] Acquire access behavior data entering the network port, perform feature processing on the access behavior data, and obtain an access behavior feature vector;

[0009] Obtaining abnormal access behavior data entering the network port according to a preset normal access behavior feature vector library and the access behavior feature vector;

[0010] According to the physical state and the abnormal access behavior data, it is determined whether to send a cut-off instruction to a relay connected to the network port to cut off the power supply and signal lines of the network port.

[0011] As an improvement of the above solution, obtaining the physical state of the network port according to the preset abnormal physical feature vector library and the physical feature vector includes:

[0012] Acquire a preset abnormal physical feature vector library; the abnormal physical feature vector library includes a plurality of abnormal physical feature vectors;

[0013] Determining a similarity range according to at least one of a material of the network port, a connection mode of the network port, and an environmental parameter of the network port;

[0014] Calculating the similarity between the physical feature vector and each of the abnormal physical feature vectors;

[0015] The physical state of the network port is obtained according to the relationship between the maximum similarity and the similarity range.

[0016] As an improvement of the above solution, the similarity range is determined according to at least one of the material of the network port, the connection mode of the network port and the environmental parameter of the network port:

[0017] Determining a similarity threshold according to at least one of a material of the network port, a connection mode of the network port, and an environmental parameter of the network port;

[0018] The similarity threshold is set as the maximum value of the similarity range, and the product of a preset constant and the similarity threshold is set as the minimum value of the similarity range, where the preset constant is greater than 0 and less than 1.

[0019] As an improvement of the above solution, obtaining the physical state of the network port according to the relationship between the maximum similarity and the similarity range includes:

[0020] When the maximum similarity is greater than the maximum value of the similarity range, determining that the physical state of the network port is seriously abnormal;

[0021] When the maximum similarity is within the similarity range, determining that the physical state of the network port is slightly abnormal;

[0022] When the maximum similarity is smaller than the minimum value of the similarity range, it is determined that the physical state of the network port is normal.

[0023] As an improvement of the above solution, the acquiring of the physical data of the network port and the feature processing of the physical data to obtain the physical feature vector include:

[0024] Obtaining initial physical data detected by a physical sensor installed at the network port;

[0025] Denoising the initial physical data to obtain physical data;

[0026] Extracting features from the physical data through wavelet transform and principal component analysis to obtain a sub-physical feature vector;

[0027] Feature fusion is performed on the sub-physical feature vectors to obtain a physical feature vector.

[0028] As an improvement of the above solution, the step of acquiring access behavior data entering the network port and performing feature processing on the access behavior data to obtain an access behavior feature vector includes:

[0029] Obtaining log data of the network port, and extracting access behavior data of each access request from the log data; the access behavior data includes: at least one of access request time, source address, protocol type, identity certificate, data packet payload size, and TCP flag;

[0030] Feature extraction is performed on the access behavior data of each access request to obtain an access behavior feature vector of each access request.

[0031] As an improvement of the above solution, the abnormal access behavior data entering the network port is obtained according to the preset normal access behavior feature vector library and the access behavior feature vector, including:

[0032] Acquire a preset normal access behavior feature vector library; the normal access behavior feature vector library includes a number of normal access behavior feature vectors;

[0033] Clustering the access behavior feature vectors to obtain a number of clusters;

[0034] Calculating the distance between each of the clusters and each of the normal access behavior feature vectors;

[0035] Taking the cluster whose distance is less than the preset distance as the first target cluster, and calculating the local outlier factor of the target cluster;

[0036] The first target clustering cluster having a value greater than the local outlier factor is used as a second target clustering cluster, and abnormal access behavior data entering the network port is obtained according to the access behavior feature vector of the second target clustering cluster.

[0037] As an improvement of the above solution, judging whether to send a cut-off instruction to a relay connected to the network port to cut off the power supply and signal line of the network port according to the physical state and the abnormal access behavior data includes:

[0038] digitizing the physical state to obtain a first value;

[0039] Numerizing the abnormal access behavior data to obtain a second numerical value;

[0040] Performing a weighted summation on the first value and the second value to obtain a third value;

[0041] When the third value is greater than a preset value threshold, a cut-off instruction is sent to a relay connected to the network port to cut off the power supply and signal lines of the network port.

[0042] To achieve the above purpose, the present application also provides a network port security protection system, including:

[0043] A first feature processing module is used to obtain physical data of the network port, perform feature processing on the physical data, and obtain a physical feature vector; the physical data includes at least one of amplitude, inclination and displacement;

[0044] A first acquisition module, configured to obtain the physical state of the network port according to a preset abnormal physical feature vector library and the physical feature vector;

[0045] A second feature processing module is used to obtain access behavior data entering the network port, perform feature processing on the access behavior data, and obtain an access behavior feature vector;

[0046] A second acquisition module, configured to obtain abnormal access behavior data entering the network port according to a preset normal access behavior feature vector library and the access behavior feature vector;

[0047] A judgment module is used to judge whether to send a cut-off instruction to the relay connected to the network port to cut off the power supply and signal lines of the network port according to the physical state and the abnormal access behavior data.

[0048] As an improvement of the above solution, obtaining the physical state of the network port according to the preset abnormal physical feature vector library and the physical feature vector includes:

[0049] Acquire a preset abnormal physical feature vector library; the abnormal physical feature vector library includes a plurality of abnormal physical feature vectors;

[0050] Determining a similarity range according to at least one of a material of the network port, a connection mode of the network port, and an environmental parameter of the network port;

[0051] Calculating the similarity between the physical feature vector and each of the abnormal physical feature vectors;

[0052] The physical state of the network port is obtained according to the relationship between the maximum similarity and the similarity range.

[0053] Compared with the prior art, the embodiment of the present application provides a network port security protection method and system, which obtains physical data of the network port, performs feature processing on the physical data, and obtains a physical feature vector; the physical data includes at least one of amplitude, inclination and displacement; obtains the physical state of the network port according to a preset abnormal physical feature vector library and the physical feature vector; obtains access behavior data entering the network port, performs feature processing on the access behavior data, and obtains an access behavior feature vector; obtains abnormal access behavior data entering the network port according to a preset normal access behavior feature vector library and the access behavior feature vector; and determines whether to send a cut-off command to a relay connected to the network port according to the physical state and the abnormal access behavior data to cut off the power supply and signal lines of the network port. It can be seen that the embodiment of the present application performs comprehensive detection of the network port by integrating information at the physical level (i.e., the physical data of the network port) and information at the network level (i.e., the access behavior data of the network port), thereby avoiding the phenomenon of bypassing network-level detection and resulting in the inability to block intrusion. It can timely block physical attacks and illegal access to the network port, effectively improve the security protection capabilities of the network port, reduce security risks, and achieve rapid response through edge computing. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 It is a flow chart of a network port security protection method provided by an embodiment of the present application;

[0055] Figure 2 It is a structural block diagram of a network port security protection system provided by an embodiment of the present application;

[0056] Figure 3 It is a structural block diagram of a network port security protection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0057] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0058] See also Figure 1 , Figure 1 : is a flow chart of a network port security protection method provided in an embodiment of the present application, the network port security protection method is applied to an edge computing node, and the network port security protection method includes:

[0059] S1. Acquire physical data of the network port, perform feature processing on the physical data, and obtain a physical feature vector; the physical data includes at least one of amplitude, inclination and displacement;

[0060] S2. Obtaining the physical state of the network port according to a preset abnormal physical feature vector library and the physical feature vector;

[0061] S3, obtaining access behavior data entering the network port, performing feature processing on the access behavior data, and obtaining an access behavior feature vector;

[0062] S4. Obtaining abnormal access behavior data entering the network port according to a preset normal access behavior feature vector library and the access behavior feature vector;

[0063] S5. According to the physical state and the abnormal access behavior data, determine whether to send a cut-off instruction to a relay connected to the network port to cut off the power supply and signal lines of the network port.

[0064] In an embodiment of the present application, physical data of a network port is obtained, and feature processing is performed on the physical data to obtain a physical feature vector; the physical data includes at least one of amplitude, inclination and displacement; the physical state of the network port is obtained according to a preset abnormal physical feature vector library and the physical feature vector; access behavior data entering the network port is obtained, and feature processing is performed on the access behavior data to obtain an access behavior feature vector; abnormal access behavior data entering the network port is obtained according to a preset normal access behavior feature vector library and the access behavior feature vector; according to the physical state and the abnormal access behavior data, it is determined whether to send a cut-off instruction to a relay connected to the network port to cut off the power supply and signal line of the network port; by integrating information at the physical level (i.e., the physical data of the network port) and information at the network level (i.e., the access behavior data of the network port), the network port is comprehensively detected to avoid bypassing the network level detection and resulting in the inability to block the intrusion, and physical attacks and illegal access to the network port can be blocked in time, effectively improving the security protection capability of the network port, reducing security risks, and achieving rapid response through edge computing.

[0065] In an optional embodiment, the acquiring physical data of the network port and performing feature processing on the physical data to obtain a physical feature vector includes:

[0066] Obtaining initial physical data detected by a physical sensor installed at the network port;

[0067] Denoising the initial physical data to obtain physical data;

[0068] Extracting features from the physical data through wavelet transform and principal component analysis to obtain a sub-physical feature vector;

[0069] Feature fusion is performed on the sub-physical feature vectors to obtain a physical feature vector.

[0070] In the embodiment of the present application, a physical sensor is installed at the network port to collect initial physical data detected by the physical sensor; specifically, the physical sensor detects the initial physical data of the network port, encrypts the initial physical data, obtains encrypted data, and sends it to the edge computing node; the edge computing node receives the encrypted data and decrypts it to obtain the initial physical data. The physical sensor includes at least one of an amplitude sensor, an inclination sensor, and a displacement sensor.

[0071] In order to eliminate noise interference, the initial physical data is denoised to obtain physical data; specifically, a moving average filter with an adaptive window size is used for denoising.

[0072] In order to obtain a more accurate feature vector, the physical data is subjected to feature extraction through wavelet transform and principal component analysis to obtain a sub-physical feature vector; specifically, the physical data is subjected to wavelet transform to obtain wavelet coefficients; the wavelet coefficients are used as feature information to perform principal component analysis to extract the principal components to obtain a sub-physical feature vector;

[0073] Finally, feature fusion is performed on the sub-physical feature vectors to obtain a physical feature vector.

[0074] In an optional embodiment, obtaining the physical state of the network port according to a preset abnormal physical feature vector library and the physical feature vector includes:

[0075] Acquire a preset abnormal physical feature vector library; the abnormal physical feature vector library includes a plurality of abnormal physical feature vectors;

[0076] Determining a similarity range according to at least one of a material of the network port, a connection mode of the network port, and an environmental parameter of the network port;

[0077] Calculating the similarity between the physical feature vector and each of the abnormal physical feature vectors;

[0078] The physical state of the network port is obtained according to the relationship between the maximum similarity and the similarity range.

[0079] In the embodiment of the present application, the physical state of the network port is obtained by comparing the physical feature vector with a preset abnormal physical feature vector library.

[0080] It can be understood that the abnormal physical feature vectors in the abnormal physical feature vector library are physical feature vectors when the physical state of the network port is in an abnormal situation, and the acquisition method is similar to the acquisition method of the physical feature vector, specifically: obtaining the initial abnormal physical data detected by the physical sensor installed at the abnormal network port; the abnormal network port is a network port whose physical state is in an abnormal situation; denoising the initial abnormal physical data to obtain abnormal physical data; extracting features from the abnormal physical data through wavelet transform and principal component analysis to obtain sub-abnormal physical feature vectors; performing feature fusion on the sub-abnormal physical feature vectors to obtain abnormal physical feature vectors, so as to construct an abnormal physical feature vector library.

[0081] In order to improve the accuracy of judging the physical state of the network port, the similarity range is determined according to the material of the network port, the connection method of the network port, and at least one of the environmental parameters of the network port. Among them, environmental parameters include but are not limited to temperature, humidity, etc. Specifically, the edge computing node presets a mapping relationship about the similarity range, and the similarity range corresponding to at least one of the material of the network port, the connection method of the network port, and the environmental parameters of the network port can be obtained from the mapping relationship. For example, the temperature is 25°C and the humidity is 60%. From the mapping relationship, the similarity range corresponding to the temperature of 25°C and the humidity of 60% is 0.17-0.85.

[0082] Next, the similarities between the physical feature vector and each of the abnormal physical feature vectors are calculated; for example, cosine similarity calculation can be used to obtain the similarities between the physical feature vector and each of the abnormal physical feature vectors, and the maximum similarity is selected.

[0083] Finally, the physical state of the network port is obtained according to the relationship between the maximum similarity and the similarity range.

[0084] In an optional embodiment, the similarity range is determined according to at least one of the material of the network port, the connection mode of the network port, and the environmental parameter of the network port:

[0085] Determining a similarity threshold according to at least one of a material of the network port, a connection mode of the network port, and an environmental parameter of the network port;

[0086] The similarity threshold is set as the maximum value of the similarity range, and the product of a preset constant and the similarity threshold is set as the minimum value of the similarity range, where the preset constant is greater than 0 and less than 1.

[0087] In the embodiment of the present application, the edge computing node is preset with a mapping relationship about the similarity threshold, and the similarity threshold corresponding to at least one of the material of the network port, the connection mode of the network port, and the environmental parameter of the network port can be obtained from the mapping relationship. For example, the temperature is 25°C and the humidity is 60%. From the mapping relationship, the similarity threshold corresponding to the temperature of 25°C and the humidity of 60% is 0.85.

[0088] The similarity threshold is set as the maximum value of the similarity range, and the product of a preset constant and the similarity threshold is set as the minimum value of the similarity range, wherein the preset constant is greater than 0 and less than 1. Preferably, the preset constant is 0.2.

[0089] In an optional embodiment, obtaining the physical state of the network port according to the relationship between the maximum similarity and the similarity range includes:

[0090] When the maximum similarity is greater than the maximum value of the similarity range, determining that the physical state of the network port is seriously abnormal;

[0091] When the maximum similarity is within the similarity range, determining that the physical state of the network port is slightly abnormal;

[0092] When the maximum similarity is smaller than the minimum value of the similarity range, it is determined that the physical state of the network port is normal.

[0093] In the embodiment of the present application, when the maximum similarity is greater than the maximum value of the similarity range, it means that the physical feature vector is very similar to the abnormal physical feature vector, and at this time, the physical state of the network port can be determined to be seriously abnormal;

[0094] When the maximum similarity is within the similarity range, it indicates that the physical feature vector is relatively similar to the abnormal physical feature vector, and at this time, it can be determined that the physical state of the network port is slightly abnormal;

[0095] When the maximum similarity is smaller than the minimum value of the similarity range, it indicates that the physical feature vector is not very similar to the abnormal physical feature vector, and at this time, it can be determined that the physical state of the network port is normal.

[0096] In an optional embodiment, the acquiring access behavior data entering the network port and performing feature processing on the access behavior data to obtain an access behavior feature vector includes:

[0097] Obtaining log data of the network port, and extracting access behavior data of each access request from the log data; the access behavior data includes: at least one of access request time, source address, protocol type, identity certificate, data packet payload size, and TCP flag;

[0098] Feature extraction is performed on the access behavior data of each access request to obtain an access behavior feature vector of each access request.

[0099] In the embodiment of the present application, the access behavior data of each access request is extracted through the log data of the network port, and then the access behavior data of each access request is subjected to feature extraction to obtain the access behavior feature vector of each access request. Optionally, the log data includes system logs and identity authentication logs.

[0100] In an optional embodiment, obtaining abnormal access behavior data entering the network port according to a preset normal access behavior feature vector library and the access behavior feature vector includes:

[0101] Acquire a preset normal access behavior feature vector library; the normal access behavior feature vector library includes a number of normal access behavior feature vectors;

[0102] Clustering the access behavior feature vectors to obtain a number of clusters;

[0103] Calculating the distance between each of the clusters and each of the normal access behavior feature vectors;

[0104] Taking the cluster whose distance is less than the preset distance as the first target cluster, and calculating the local outlier factor of the target cluster;

[0105] The first target clustering cluster having a value greater than the local outlier factor is used as a second target clustering cluster, and abnormal access behavior data entering the network port is obtained according to the access behavior feature vector of the second target clustering cluster.

[0106] It can be understood that the normal access behavior feature vector in the normal access behavior feature vector library is the access behavior data of the access request entering the network port in normal mode, and its acquisition method is similar to the acquisition method of the access behavior feature vector, specifically: obtaining the log data of the network port, and extracting the normal access behavior data of each normal access request entering the network port in normal mode from the log data; performing feature extraction on the normal access behavior data of each normal access request respectively, and obtaining the normal access behavior feature vector of each normal access request, so as to construct a normal access behavior feature vector library.

[0107] Each access request corresponds to an access behavior, so the access behavior of each access request can be obtained.

[0108] Then, the access behavior feature vectors are clustered to obtain several clusters; the distance between each cluster and each normal access behavior feature vector is calculated; the cluster whose distance is less than the preset distance is taken as the first target cluster, and the local outlier factor of the target cluster is calculated; the first target cluster whose distance is greater than the local outlier factor is taken as the second target cluster, and the access behavior feature vector in the second target cluster is the abnormal access behavior feature vector, and the corresponding access request is the abnormal access request, that is, the abnormal access behavior entering the network port can be obtained, and finally the abnormal access behavior data entering the network port is obtained.

[0109] In an optional embodiment, judging whether to send a cut-off instruction to a relay connected to the network port to cut off the power supply and signal line of the network port according to the physical state and the abnormal access behavior data includes:

[0110] digitizing the physical state to obtain a first value;

[0111] Numerizing the abnormal access behavior data to obtain a second numerical value;

[0112] Performing a weighted summation on the first value and the second value to obtain a third value;

[0113] When the third value is greater than a preset value threshold, a cut-off instruction is sent to a relay connected to the network port to cut off the power supply and signal lines of the network port.

[0114] In an embodiment of the present application, the physical state and the abnormal access behavior data are digitized respectively to obtain a first value and a second value; the first value and the second value are weightedly summed to obtain a third value; when the third value is greater than a preset numerical threshold, a cut-off command is sent to a relay connected to the network port to cut off the power supply and signal lines of the network port, thereby blocking the intrusion.

[0115] See also Figure 2 , Figure 2 1 is a structural block diagram of a network port security protection system 10 provided in an embodiment of the present application, wherein the network port security protection system 10 includes:

[0116] A first feature processing module 11 is used to obtain physical data of the network port, perform feature processing on the physical data, and obtain a physical feature vector; the physical data includes at least one of amplitude, inclination and displacement;

[0117] A first acquisition module 12, configured to obtain the physical state of the network port according to a preset abnormal physical feature vector library and the physical feature vector;

[0118] A second feature processing module 13 is used to obtain access behavior data entering the network port, perform feature processing on the access behavior data, and obtain an access behavior feature vector;

[0119] A second acquisition module 14, configured to obtain abnormal access behavior data entering the network port according to a preset normal access behavior feature vector library and the access behavior feature vector;

[0120] The judgment module 15 is used to judge whether to send a cut-off instruction to the relay connected to the network port to cut off the power supply and signal line of the network port according to the physical state and the abnormal access behavior data.

[0121] Optionally, obtaining the physical state of the network port according to a preset abnormal physical feature vector library and the physical feature vector includes:

[0122] Acquire a preset abnormal physical feature vector library; the abnormal physical feature vector library includes a plurality of abnormal physical feature vectors;

[0123] Determining a similarity range according to at least one of a material of the network port, a connection mode of the network port, and an environmental parameter of the network port;

[0124] Calculating the similarity between the physical feature vector and each of the abnormal physical feature vectors;

[0125] The physical state of the network port is obtained according to the relationship between the maximum similarity and the similarity range.

[0126] Optionally, the similarity range is determined according to at least one of a material of the network port, a connection mode of the network port, and an environmental parameter of the network port:

[0127] Determining a similarity threshold according to at least one of a material of the network port, a connection mode of the network port, and an environmental parameter of the network port;

[0128] The similarity threshold is set as the maximum value of the similarity range, and the product of a preset constant and the similarity threshold is set as the minimum value of the similarity range, where the preset constant is greater than 0 and less than 1.

[0129] Optionally, obtaining the physical state of the network port according to the relationship between the maximum similarity and the similarity range includes:

[0130] When the maximum similarity is greater than the maximum value of the similarity range, determining that the physical state of the network port is seriously abnormal;

[0131] When the maximum similarity is within the similarity range, determining that the physical state of the network port is slightly abnormal;

[0132] When the maximum similarity is smaller than the minimum value of the similarity range, it is determined that the physical state of the network port is normal.

[0133] Optionally, the acquiring physical data of the network port and performing feature processing on the physical data to obtain a physical feature vector includes:

[0134] Obtaining initial physical data detected by a physical sensor installed at the network port;

[0135] Denoising the initial physical data to obtain physical data;

[0136] Extracting features from the physical data through wavelet transform and principal component analysis to obtain a sub-physical feature vector;

[0137] Feature fusion is performed on the sub-physical feature vectors to obtain a physical feature vector.

[0138] Optionally, the acquiring access behavior data entering the network port and performing feature processing on the access behavior data to obtain an access behavior feature vector includes:

[0139] Obtaining log data of the network port, and extracting access behavior data of each access request from the log data; the access behavior data includes: at least one of access request time, source address, protocol type, identity certificate, data packet payload size, and TCP flag;

[0140] Feature extraction is performed on the access behavior data of each access request to obtain an access behavior feature vector of each access request.

[0141] Optionally, obtaining abnormal access behavior data entering the network port according to a preset normal access behavior feature vector library and the access behavior feature vector includes:

[0142] Acquire a preset normal access behavior feature vector library; the normal access behavior feature vector library includes a number of normal access behavior feature vectors;

[0143] Clustering the access behavior feature vectors to obtain a number of clusters;

[0144] Calculating the distance between each of the clusters and each of the normal access behavior feature vectors;

[0145] Taking the cluster whose distance is less than the preset distance as the first target cluster, and calculating the local outlier factor of the target cluster;

[0146] The first target clustering cluster having a value greater than the local outlier factor is used as a second target clustering cluster, and abnormal access behavior data entering the network port is obtained according to the access behavior feature vector of the second target clustering cluster.

[0147] Optionally, judging whether to send a cut-off instruction to a relay connected to the network port to cut off the power supply and signal lines of the network port according to the physical state and the abnormal access behavior data includes:

[0148] digitizing the physical state to obtain a first value;

[0149] Numerizing the abnormal access behavior data to obtain a second numerical value;

[0150] Performing a weighted summation on the first value and the second value to obtain a third value;

[0151] When the third value is greater than a preset value threshold, a cut-off instruction is sent to a relay connected to the network port to cut off the power supply and signal lines of the network port.

[0152] It is worth noting that the working process of each module in the network port security protection system 10 described in the embodiment of the present application can refer to the working process of the network port security protection method described in the above embodiment, and will not be repeated here.

[0153] The embodiment of the present application provides a network port security protection system 10, which obtains the physical data of the network port, performs feature processing on the physical data, and obtains a physical feature vector; the physical data includes at least one of amplitude, inclination and displacement; obtains the physical state of the network port according to the preset abnormal physical feature vector library and the physical feature vector; obtains the access behavior data entering the network port, performs feature processing on the access behavior data, and obtains the access behavior feature vector; obtains the abnormal access behavior data entering the network port according to the preset normal access behavior feature vector library and the access behavior feature vector; and determines whether to send a cut-off instruction to the relay connected to the network port according to the physical state and the abnormal access behavior data to cut off the power supply and signal line of the network port. It can be seen that the embodiment of the present application performs a comprehensive detection of the network port by integrating the information at the physical level (i.e., the physical data of the network port) and the information at the network level (i.e., the access behavior data of the network port), avoids the phenomenon of bypassing the detection at the network level and causing the intrusion to be unable to be blocked, can timely block physical attacks and illegal access to the network port, effectively improve the security protection capability of the network port, reduce security risks, and achieve rapid response through edge computing.

[0154] In addition, an embodiment of the present application further provides a computer-readable storage medium, which includes a stored computer program; wherein, when the computer program is running, it controls the device where the computer-readable storage medium is located to execute the network port security protection method as described in any of the above embodiments.

[0155] In addition, an embodiment of the present application also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the network port security protection method as described in any of the above embodiments.

[0156] See also Figure 3 , Figure 3 : is a structural block diagram of a network port security protection device 20 provided in an embodiment of the present application, and the network port security protection device 20 includes: a processor 21, a memory 22, and a computer program stored in the memory 22 and executable on the processor 21. When the processor 21 executes the computer program, the steps in the above-mentioned network port security protection method embodiment are implemented. Alternatively, when the processor 21 executes the computer program, the functions of each module / unit in the above-mentioned device embodiments are implemented.

[0157] Exemplarily, the computer program may be divided into one or more modules / units, which are stored in the memory 22 and executed by the processor 21 to complete the present application. The one or more modules / units may be a series of computer program instruction segments capable of completing specific functions, which are used to describe the execution process of the computer program in the network port security protection device 20.

[0158] The network port security protection device 20 may include, but is not limited to, a processor 21 and a memory 22. Those skilled in the art will appreciate that the schematic diagram is merely an example of the network port security protection device 20 and does not constitute a limitation on the network port security protection device 20. The network port security protection device 20 may include more or fewer components than shown in the diagram, or may combine certain components, or different components. For example, the network port security protection device 20 may also include input and output devices, network access devices, buses, and the like.

[0159] The processor 21 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor 21 is the control center of the network port security protection device 20, and uses various interfaces and lines to connect various parts of the entire network port security protection device 20.

[0160] The memory 22 can be used to store the computer program and / or module. The processor 21 realizes various functions of the network port security protection device 20 by running or executing the computer program and / or module stored in the memory 22 and calling the data stored in the memory 22. The memory 22 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.); the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.). In addition, the memory 22 can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0161] Wherein, if the module / unit integrated in the network port security protection device 20 is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor 21. Wherein, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium, etc.

[0162] It should be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the accompanying drawings of the device embodiments provided by the present application, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines. A person of ordinary skill in the art can understand and implement it without paying any creative work.

[0163] The above is a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications are also considered to be within the scope of protection of the present application.

Claims

1. A network port security protection method, characterized in that: Applied to edge computing nodes, including: Acquire physical data of the network port, perform feature processing on the physical data, and obtain a physical feature vector; the physical data includes at least one of amplitude, inclination and displacement; Obtaining the physical state of the network port according to a preset abnormal physical feature vector library and the physical feature vector; Acquire access behavior data entering the network port, perform feature processing on the access behavior data, and obtain an access behavior feature vector; Obtaining abnormal access behavior data entering the network port according to a preset normal access behavior feature vector library and the access behavior feature vector; According to the physical state and the abnormal access behavior data, determining whether to send a cut-off instruction to a relay connected to the network port to cut off the power supply and signal lines of the network port; Wherein, obtaining the physical state of the network port according to the preset abnormal physical feature vector library and the physical feature vector includes: Acquire a preset abnormal physical feature vector library; the abnormal physical feature vector library includes a plurality of abnormal physical feature vectors; Determining a similarity range according to at least one of a material of the network port, a connection mode of the network port, and an environmental parameter of the network port; Calculating the similarity between the physical feature vector and each of the abnormal physical feature vectors; The physical state of the network port is obtained according to the relationship between the maximum similarity and the similarity range.

2. The network port security protection method according to claim 1, characterized in that: The similarity range is determined according to at least one of the material of the network port, the connection mode of the network port, and the environmental parameters of the network port: Determining a similarity threshold according to at least one of a material of the network port, a connection mode of the network port, and an environmental parameter of the network port; The similarity threshold is set as the maximum value of the similarity range, and the product of a preset constant and the similarity threshold is set as the minimum value of the similarity range, where the preset constant is greater than 0 and less than 1.

3. The network port security protection method according to claim 2, characterized in that: The obtaining the physical state of the network port according to the relationship between the maximum similarity and the similarity range includes: When the maximum similarity is greater than the maximum value of the similarity range, determining that the physical state of the network port is seriously abnormal; When the maximum similarity is within the similarity range, determining that the physical state of the network port is slightly abnormal; When the maximum similarity is smaller than the minimum value of the similarity range, it is determined that the physical state of the network port is normal.

4. The network port security protection method according to claim 1, characterized in that: The acquiring of physical data of the network port and performing feature processing on the physical data to obtain a physical feature vector includes: Obtaining initial physical data detected by a physical sensor installed at the network port; Denoising the initial physical data to obtain physical data; Extracting features from the physical data through wavelet transform and principal component analysis to obtain a sub-physical feature vector; Feature fusion is performed on the sub-physical feature vectors to obtain a physical feature vector.

5. The network port security protection method according to claim 1, characterized in that: The acquiring access behavior data entering the network port and performing feature processing on the access behavior data to obtain an access behavior feature vector includes: Obtaining log data of the network port, and extracting access behavior data of each access request from the log data; the access behavior data includes: at least one of access request time, source address, protocol type, identity certificate, data packet payload size, and TCP flag; Feature extraction is performed on the access behavior data of each access request to obtain an access behavior feature vector of each access request.

6. The network port security protection method according to claim 1, characterized in that: The obtaining of abnormal access behavior data entering the network port according to a preset normal access behavior feature vector library and the access behavior feature vector includes: Acquire a preset normal access behavior feature vector library; the normal access behavior feature vector library includes a number of normal access behavior feature vectors; Clustering the access behavior feature vectors to obtain a number of clusters; Calculating the distance between each of the clusters and each of the normal access behavior feature vectors; Taking the cluster whose distance is less than the preset distance as the first target cluster, and calculating the local outlier factor of the target cluster; The first target clustering cluster having a value greater than the local outlier factor is used as a second target clustering cluster, and abnormal access behavior data entering the network port is obtained according to the access behavior feature vector of the second target clustering cluster.

7. The network port security protection method according to claim 1, characterized in that: The determining, based on the physical state and the abnormal access behavior data, whether to send a cut-off instruction to a relay connected to the network port to cut off the power supply and signal line of the network port includes: digitizing the physical state to obtain a first value; Numerizing the abnormal access behavior data to obtain a second numerical value; Performing a weighted summation on the first value and the second value to obtain a third value; When the third value is greater than a preset value threshold, a cut-off instruction is sent to a relay connected to the network port to cut off the power supply and signal lines of the network port.

8. A network port security protection system, characterized in that: include: A first feature processing module is used to obtain physical data of the network port, perform feature processing on the physical data, and obtain a physical feature vector; the physical data includes at least one of amplitude, inclination and displacement; A first acquisition module, configured to obtain the physical state of the network port according to a preset abnormal physical feature vector library and the physical feature vector; A second feature processing module is used to obtain access behavior data entering the network port, perform feature processing on the access behavior data, and obtain an access behavior feature vector; A second acquisition module, configured to obtain abnormal access behavior data entering the network port according to a preset normal access behavior feature vector library and the access behavior feature vector; A judgment module, used for judging whether to send a cut-off instruction to a relay connected to the network port to cut off the power supply and signal line of the network port according to the physical state and the abnormal access behavior data; Wherein, obtaining the physical state of the network port according to the preset abnormal physical feature vector library and the physical feature vector includes: Acquire a preset abnormal physical feature vector library; the abnormal physical feature vector library includes a plurality of abnormal physical feature vectors; Determining a similarity range according to at least one of a material of the network port, a connection mode of the network port, and an environmental parameter of the network port; Calculating the similarity between the physical feature vector and each of the abnormal physical feature vectors; The physical state of the network port is obtained according to the relationship between the maximum similarity and the similarity range.

Images