Data security transmission method and system based on computer network

Abstract

The present invention relates to the field of congestion control technology, and in particular to a data security transmission method and system based on a computer network. The method obtains a traffic malicious value based on the discrete degree of reference traffic data at the analysis moment and the complexity of the size data of all traffic packets corresponding to the reference traffic data, as well as the difference between the network traffic data at the analysis moment and its reference traffic data; selects a reference time period according to the fluctuation of the network traffic data, determines the network attack rate at the current moment according to the traffic malicious value at the current moment and the moment within the reference time period, uses it to adjust the congestion window, and transmits the data of the computer network according to the adjusted congestion window. The present invention adjusts the congestion window in real time to improve the reliability and security of data transmission in the computer network.

Description

Technical Field

[0001] The present invention relates to the technical field of congestion control, and in particular to a computer network-based data security transmission method and system. Background Art

[0002] The secure transmission of data in computer networks involves encryption, identity authentication, data integrity assurance, security protocols, and network security protection. Through the comprehensive application of these technologies and strategies, the security and privacy of data during transmission can be effectively protected to prevent unauthorized access and attacks. Therefore, the secure transmission of data in computer networks is of great significance.

[0003] In the process of secure data transmission in computer networks, the transmission control protocol ensures the reliability and security of data transmission through confirmation mechanisms, data retransmission, flow control and error detection. The dynamic adjustment mechanism of the transmission control protocol is to dynamically adjust the congestion window through relevant data such as packet loss and network delay, optimize network performance, and avoid congestion and data loss. However, since the dynamic adjustment of the congestion window is generally performed after packet loss and network delay, there will still be packet loss and network delay before the congestion window is adjusted, which reduces the reliability and security of data transmission in computer networks. Summary of the invention

[0004] In order to solve the technical problem that the congestion window is adjusted only after packet loss and network delay, which reduces the reliability and security of data transmission in computer networks, the purpose of the present invention is to provide a data security transmission method and system based on computer networks. The technical solutions adopted are as follows:

[0005] In a first aspect, an embodiment of the present invention provides a method for secure data transmission based on a computer network, the method comprising:

[0006] Obtain network traffic data of the application layer of the computer network at each moment within a preset time period and size data of all traffic packets corresponding to the network traffic data; the last moment within the preset time period is the current moment; and the moment within the preset time period is recorded as the analysis moment;

[0007] Obtain reference traffic data at the time of analysis; obtain the traffic maliciousness value at the time of analysis based on the discreteness of all reference traffic data at the time of analysis and the complexity of the size data of all traffic packets corresponding to the reference traffic data, the difference between the network traffic data at the time of analysis and its reference traffic data, and the difference between the reference traffic data at the time of analysis and the network traffic data at the time before the time of analysis;

[0008] Select a reference time period according to the fluctuation of network traffic data at a preset time period; obtain the network attack rate at the current time according to the traffic malicious value at the current time and the time within the reference time period;

[0009] Data on the computer network is transmitted according to the congestion window adjusted by the network attack rate.

[0010] Furthermore, the obtaining of the traffic maliciousness value at the time of analysis includes:

[0011] Obtain the maliciousness level value at the time of analysis based on the discreteness and change trend of all reference traffic data at the time of analysis, and the difference between the network traffic data at the time of analysis and its reference traffic data;

[0012] Obtain the possible malicious value at the analysis time according to the complexity of the size data of all traffic packets corresponding to all reference traffic data at the analysis time, and the difference between the reference traffic data at the analysis time and the network traffic data at the time before the analysis time;

[0013] The traffic malice value at the analysis time is obtained according to the malice degree value and the malice possibility value.

[0014] Furthermore, the obtaining of the maliciousness level value at the time of analysis includes:

[0015] Obtain the average difference of all reference flow data at the analysis time, and record it as the flow discrete value at the analysis time;

[0016] Arrange all reference flow data at the analysis time in time sequence to obtain a reference flow sequence at the analysis time; set local trend values ​​corresponding to the two reference flow data according to the positive or negative difference between any two adjacent reference flow data in the reference flow sequence; and take the cumulative sum of the local trend values ​​of all two adjacent reference flow data in the reference flow sequence as the overall trend value at the analysis time;

[0017] The absolute value of the difference between the network traffic data at the analysis time and the mode of all its reference traffic data is used as the reference difference value at the analysis time;

[0018] The maliciousness level value at the analysis moment is obtained according to the traffic discrete value, the overall trend value and the reference difference value.

[0019] Furthermore, the obtaining of the possible malicious value at the time of analysis includes:

[0020] Obtain the information entropy of the size data of all traffic packets corresponding to all reference traffic data at the analysis time, and record it as the traffic complexity value at the analysis time;

[0021] Divide the preset time period into different cycles; select the maximum value of the network traffic data at all times in each cycle as the target traffic data of each cycle; perform anomaly detection on the target traffic data of all cycles in the time period between the start time of the preset time period and the analysis time to obtain the normal traffic data at the analysis time; calculate the average of the absolute values ​​of the differences between the maximum value of all reference traffic data at the analysis time and the normal traffic data as the normal difference value at the analysis time;

[0022] According to the traffic complexity value and the normal difference value, the malicious possibility value at the analysis moment is obtained.

[0023] Furthermore, the step of selecting a reference time period according to fluctuations in network traffic data at moments within a preset time period includes:

[0024] A two-dimensional coordinate system is established with time as the horizontal axis and network traffic data as the vertical axis, and the network traffic data at all times within a preset time period are marked in the two-dimensional coordinate system to obtain coordinate points corresponding to the network traffic data;

[0025] Perform curve fitting on all coordinate points in the two-dimensional coordinate system to obtain a flow curve segment; obtain the time intervals between the corresponding moments of all inflection points of the flow curve segment and the current moment, select the corresponding moment of the inflection point with the smallest time interval as the marked moment; record the time period between the marked moment and the current moment as the marked time period;

[0026] The period at the current moment is recorded as the marking period, and a time period at the same position as the marking time period in the marking period is selected from the remaining periods except the marking period in the preset time period as the reference time period.

[0027] Furthermore, obtaining the network attack rate at the current moment includes:

[0028] The time corresponding to the malicious value of the traffic greater than the preset malicious threshold in each reference time period is recorded as the suspected malicious time in each reference time period;

[0029] Determine whether the total number of consecutive suspected malicious moments in each reference time period is greater than a preset number threshold, and if so, set the malicious parameter of each reference time period to a first preset value; if not, set the malicious parameter of each reference time period to a second preset value; the first preset value is greater than the second preset value;

[0030] Negative correlation mapping is performed on the total number of cycles between the current moment and each reference time period to obtain a data credibility index for each reference time period; the product of the malicious parameter and the data credibility index for each reference time period is used as the number of local attacks for each reference time period; the cumulative sum of the number of local attacks for all reference time periods within the preset time period is calculated and recorded as the comprehensive number of attacks at the current moment;

[0031] The network attack rate at the current moment is obtained according to the traffic maliciousness value at the current moment and the comprehensive attack number.

[0032] Furthermore, transmitting data on a computer network according to the congestion window adjusted by the network attack rate includes:

[0033] The network attack rate is negatively correlated and normalized to obtain an adjustment weight at the current moment; the preset congestion window scale is weighted by using the adjustment weight to obtain an optimal congestion window scale at the current moment;

[0034] Data in a computer network is transmitted using a congestion window of an optimal congestion window size.

[0035] Furthermore, the setting of the local trend value corresponding to the two reference flow data according to the positive or negative condition of the difference between any two adjacent reference flow data in the reference flow sequence includes:

[0036] Select any two adjacent reference flow data from the reference flow sequence as example flow data, and record the difference between the latter and the previous example flow data as the flow difference between the two example flow data;

[0037] When the flow difference is greater than the constant 0, the local trend values ​​of the two example flow data are set to a preset positive number;

[0038] When the flow difference is equal to a constant of 0, the local trend values ​​of the two example flow data are set to a constant of 0;

[0039] When the flow difference is less than the constant 0, the local trend values ​​of the two example flow data are set to a preset negative number;

[0040] The absolute values ​​of the preset positive number and the preset negative number are equal.

[0041] Furthermore, the reference traffic data at the analysis time is network traffic data at a time within a preset adjacent time period before the analysis time.

[0042] In a second aspect, another embodiment of the present invention provides a data security transmission system based on a computer network, the system comprising:

[0043] A data acquisition module is used to obtain network traffic data of the application layer of the computer network at each moment within a preset time period and size data of all traffic packets corresponding to the network traffic data; the last moment within the preset time period is the current moment; and the moment within the preset time period is recorded as the analysis moment;

[0044] The traffic maliciousness analysis module is used to obtain reference traffic data at the analysis time; according to the discrete degree of all reference traffic data at the analysis time and the complexity of the size data of all traffic packets corresponding to the reference traffic data, the difference between the network traffic data at the analysis time and its reference traffic data, and the difference between the reference traffic data at the analysis time and the network traffic data at the time before the analysis time, the traffic maliciousness value at the analysis time is obtained;

[0045] A network attack analysis module is used to select a reference time period according to the fluctuation of network traffic data at a preset time period; and obtain the network attack rate at the current time according to the traffic malicious value at the current time and the time within the reference time period;

[0046] The congestion window adjustment module is used to transmit data on the computer network according to the congestion window adjusted by the network attack rate.

[0047] The present invention has the following beneficial effects:

[0048] First, in order to solve the problem that the transmission control protocol dynamically adjusts the congestion window after packet loss and network delay, but packet loss and network delay still exist before the congestion window is adjusted, this solution obtains network traffic data in real time, and adjusts the congestion window in real time according to the relevant characteristics of the network traffic data at the current moment and its historical moments, effectively solving the problem of packet loss and network delay still existing before the congestion window is adjusted.

[0049] Second aspect: when the attacker attacks the network data, he will create a large amount of malicious traffic data, which makes the fluctuation range of network traffic larger and there will be a traffic peak, but under normal circumstances, the fluctuation range of network traffic is smaller; because the data carried by malicious traffic is inconsistent with the data carried by normal traffic, the complexity of the size data of the traffic data packet reflects the possibility of malicious traffic influence; the difference between the network traffic data at the analysis time and its reference traffic data is analyzed, and the malicious traffic information is analyzed based on the adjacent network traffic data. Therefore, the discrete degree of the reference traffic data at the analysis time and the complexity of the size data of all traffic packets corresponding to the reference traffic data, as well as the difference between the reference traffic data at the analysis time and the network traffic data at the time before the analysis time are analyzed to improve the accuracy of the malicious traffic influence at the analysis time, and obtain the traffic malicious value. The attacker attacks the network, which may be continuous or intermittent attacks for many days, and obtains the attack time selected by the attacker, that is, the reference time period; the number of attacks in the historical time shows the possibility of being attacked by the attacker at the current time, and the traffic malicious value at the time in the reference time period measures the number of attacks in the reference time period, and is combined with the traffic malicious value at the current time for analysis to obtain the probability of the network data at the current time being attacked by the attacker, that is, the network attack rate. By adjusting the congestion window in real time and adaptively according to the current network attack rate, and using the adjusted congestion window to transmit network traffic data of the computer network, the impact of malicious traffic on network data transmission can be effectively reduced, and the probability of packet loss and network delay during data transmission can be reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0051] Figure 1 A flowchart of a method for secure data transmission based on a computer network provided by an embodiment of the present invention;

[0052] Figure 2 A flowchart of a method for obtaining a malicious traffic value at an analysis time provided by an embodiment of the present invention;

[0053] Figure 3 A system structure diagram of a data security transmission system based on a computer network provided by an embodiment of the present invention;

[0054] Figure 4 A schematic diagram of a computer device of a data security transmission device based on a computer network provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0055] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the following is a detailed description of a data security transmission method and system based on a computer network proposed by the present invention, its specific implementation method, structure, features and effects, in conjunction with the accompanying drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" does not necessarily refer to the same embodiment. In addition, specific features, structures or characteristics in one or more embodiments may be combined in any suitable form.

[0056] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0057] The present invention is directed to a specific scenario in which packet loss and network delay still exist under the dynamic adjustment of the congestion window in the TCP protocol during secure data transmission in a computer network.

[0058] The following is a detailed description of a computer network-based data security transmission method and system provided by the present invention in conjunction with the accompanying drawings.

[0059] Embodiment 1:

[0060] The present invention proposes a data security transmission method based on computer network, please refer to Figure 1 , which shows a flowchart of a method for secure data transmission based on a computer network provided by an embodiment of the present invention, the method comprising:

[0061] Step S1: Obtain network traffic data of the application layer of the computer network at each moment within a preset time period and size data of all traffic packets corresponding to the network traffic data; the last moment within the preset time period is the current moment; and the moment within the preset time period is recorded as the analysis moment.

[0062] During the network data transmission process, there may be malicious traffic data caused by attackers, which will cause problems such as loss of normal traffic data and data transmission delay. In order to solve the above problems, the transmission control protocol dynamically adjusts the congestion window according to the loss and delay of traffic packets in the transmission channel. However, the dynamic adjustment of the congestion window is generally performed after packet loss and network delay. Before the congestion window is adjusted, there will still be packet loss and network delay problems. This solution performs malicious traffic analysis before the network traffic enters the transmission channel and adjusts the congestion window in real time, thereby solving the problems of packet loss and network delay.

[0063] Specifically, the Wireshark tool is used to collect network traffic data of the application layer of the computer network at each moment in a preset time period, as well as the size data of all traffic packets corresponding to the network traffic data; wherein a single traffic packet is the basic unit constituting network traffic, that is, each network traffic data corresponds to multiple traffic packets. The last moment in the preset time period is the current moment.

[0064] It should be noted that the duration of the preset time period in this embodiment is an empirical value of 30 days; the sampling frequency of network traffic data is 10 times per second, that is, the time interval between adjacent moments is 0.1 second, and the implementer can set it according to the specific situation.

[0065] Step S2: Obtain reference traffic data at the analysis time; obtain the traffic maliciousness value at the analysis time based on the discrete degree of all reference traffic data at the analysis time and the complexity of the size data of all traffic packets corresponding to the reference traffic data, the difference between the network traffic data at the analysis time and its reference traffic data, and the difference between the reference traffic data at the analysis time and the network traffic data at the time before the analysis time.

[0066] Since the network traffic data at the time of analysis is highly correlated with the network traffic data closer to it, and has a greater impact on the malicious traffic analysis at the time of analysis, the network traffic data at the preset adjacent time period before the analysis time is used as the reference traffic data at the analysis time. The reference traffic data is the network traffic data with a shorter interval to the analysis time.

[0067] It should be noted that the duration of the preset adjacent time period is much shorter than the duration of the preset time period. In this embodiment, the duration of the preset adjacent time period is set to an empirical value of 60 seconds, which can be set by the implementer according to the specific situation. There is no reference flow data at the analysis time of 60 seconds starting from the preset time period, and no subsequent analysis is performed.

[0068] See also Figure 2 , which shows a flow chart of the steps of a method for obtaining a malicious value of traffic at an analysis time provided by an embodiment of the present invention, the method comprising:

[0069] Step S210: Obtain the maliciousness level value at the analysis time according to the discrete degree and change trend of all reference traffic data at the analysis time, and the difference between the network traffic data at the analysis time and its reference traffic data.

[0070] When an attacker attacks network data, he will create a large amount of malicious traffic data to affect the transmission of normal traffic data, causing a sudden surge in network traffic, resulting in a large fluctuation range of network traffic data and a traffic peak. However, under normal circumstances, the fluctuation range of network traffic data is small. The difference between the network traffic data at the time of analysis and its reference traffic data is analyzed, and the malicious traffic information is analyzed based on the neighboring network traffic data. The malicious situation of the network traffic is analyzed in combination with the discrete degree and change trend of the reference traffic data at the time of analysis to obtain the malicious degree value.

[0071] Preferably, in some possible implementation methods of this embodiment, the method for obtaining the maliciousness level value includes: obtaining the average difference of all reference traffic data at the analysis time, recorded as the traffic discrete value at the analysis time; arranging all reference traffic data at the analysis time in time sequence to obtain the reference traffic sequence at the analysis time; setting the local trend value corresponding to the two reference traffic data according to the positive or negative situation of the difference between any two adjacent reference traffic data in the reference traffic sequence; taking the cumulative sum of the local trend values ​​of all two adjacent reference traffic data in the reference traffic sequence as the overall trend value at the analysis time; taking the absolute value of the difference between the network traffic data at the analysis time and the mode of all its reference traffic data as the reference difference value at the analysis time; obtaining the maliciousness level value at the analysis time according to the traffic discrete value, the overall trend value and the reference difference value. Among them, the calculation method of the average difference is a common mathematical formula, which will not be repeated here.

[0072] The traffic discrete value reflects the discrete degree of the reference traffic data at the analysis time; if the traffic discrete value is larger, the fluctuation range of the network traffic data adjacent to the analysis time is larger, and the network traffic data at the analysis time is more affected by malicious traffic.

[0073] Since attackers will create a large amount of malicious traffic data when attacking network data, causing a sudden surge in traffic and resulting in a traffic peak, the positive and negative difference between any two adjacent reference traffic data in the reference traffic sequence reflects the local change trend of the network traffic data, and the local trend value is set to obtain the overall trend value.

[0074] Preferably, the method for setting the local trend value in the present embodiment is: select any two adjacent reference flow data from the reference flow sequence as example flow data, and record the difference between the latter and the previous example flow data as the flow difference between the two example flow data; when the flow difference is greater than the constant 0, the local trend value of the two example flow data is set to a preset positive number; when the flow difference is equal to the constant 0, the local trend value of the two example flow data is set to the constant 0; when the flow difference is less than the constant 0, the local trend value of the two example flow data is set to a preset negative number; the absolute value of the preset positive number is equal to the preset negative number.

[0075] When the traffic difference is greater than the constant 0, the network traffic at the corresponding moments of the two sample traffic data shows an increasing trend, which has a positive effect on the analysis of the interference of malicious traffic at the analysis time, and the local trend value is set to a positive number; when the traffic difference is equal to the constant 0, the network traffic at the corresponding moments of the two sample traffic data changes smoothly, and there is basically no malicious traffic interference, and the local trend value is set to the constant 0; when the traffic difference is less than the constant 0, the network traffic at the corresponding moments of the two sample traffic data shows a decreasing trend, which has a negative effect on the analysis of the interference of malicious traffic at the analysis time, and the local trend value is set to a negative number.

[0076] In this embodiment, the growth trend and the decreasing trend of network traffic have the same effect on the malicious traffic interference analysis, so the absolute value of the preset positive number is equal to the preset negative number; the preset positive number takes the empirical value 1, and the preset negative number takes the empirical value -1, and the implementer can set it according to the specific situation.

[0077] The overall trend value is obtained by comprehensively considering the overall trend of the reference traffic data at the analysis time; when the overall trend value is larger, the more obvious the surge in network traffic at the adjacent time before the analysis time is, and the network traffic data at the analysis time is more affected by malicious traffic.

[0078] The mode of all reference traffic data at the analysis time reflects the normal traffic level, and the reference difference value presents the difference between the network traffic data at the analysis time and the normal traffic level; when the reference difference is larger, the difference between the network traffic data at the analysis time and the normal network traffic is larger, and the network traffic data at the analysis time is more affected by malicious traffic.

[0079] In summary, the traffic discrete value, the overall trend value and the reference difference value are all positively correlated with the maliciousness value. In this embodiment, the product of the traffic discrete value, the overall trend value and the reference difference value at the analysis time is used as the maliciousness value at the analysis time. The greater the maliciousness value, the greater the degree to which the network traffic data at the analysis time is affected by malicious traffic.

[0080] In the embodiment of the present invention, the correlation between the traffic discrete value, the overall trend value and the reference difference value and the malicious degree value can also be constructed through other basic mathematical operations, which are not limited or elaborated here.

[0081] Step S220: Obtain the possible malicious value at the analysis time based on the complexity of the size data of all traffic packets corresponding to all reference traffic data at the analysis time, and the difference between the reference traffic data at the analysis time and the network traffic data at the time before the analysis time.

[0082] Because the data carried by malicious traffic is inconsistent with the data carried by normal traffic, the possibility of malicious traffic is analyzed by the type of traffic packets, and the size of traffic packets is used to measure the type of traffic packets. Therefore, the complexity of the size data of all traffic packets corresponding to the reference traffic data at the time of analysis reflects the possibility of malicious traffic. At the same time, since the reason for the surge in traffic data may be malicious traffic or the increase in the number of normal visitors, and the surge in traffic data caused by malicious traffic is relatively random, the possibility of malicious traffic is measured by the difference between the reference traffic data at the time of analysis and the network traffic data at the time before the analysis. The above two factors are combined for analysis to improve the accuracy of judging the possibility of malicious traffic.

[0083] Preferably, in some possible implementation methods of this embodiment, the method for obtaining the possible malicious value includes: obtaining the information entropy of the size data of all traffic packets corresponding to all reference traffic data at the analysis time, recorded as the traffic complexity value at the analysis time; dividing the preset time period into different periods; selecting the maximum value of the network traffic data at all times in each period as the target traffic data of each period; performing anomaly detection on the target traffic data of all periods in the time period between the start time of the preset time period and the analysis time, and obtaining the normal traffic data at the analysis time; calculating the mean of the absolute value of the difference between the maximum value of all reference traffic data at the analysis time and the normal traffic data, as the normal difference value at the analysis time; obtaining the possible malicious value at the analysis time according to the traffic complexity value and the normal difference value. Among them, the method for calculating the information entropy is a well-known technology for those skilled in the art, and will not be repeated here.

[0084] Malicious traffic may contain abnormally large or small traffic packets, and the size of traffic packets has a large fluctuation range; while normal traffic usually has a certain regularity, and the size of traffic packets fluctuates within a relatively narrow range; therefore, the possibility of malicious traffic at the time of analysis can be judged by the complexity of the size data of all traffic packets corresponding to the reference traffic data at the time of analysis. The larger the traffic complexity value, the greater the possibility that the size data of all traffic packets corresponding to the reference traffic data at the time of analysis has a large fluctuation range, and the greater the possibility of malicious traffic at the time of analysis.

[0085] The life pattern of people makes the network traffic data of different days close, so the preset time period is evenly divided into different cycles. In this embodiment, the duration of the cycle is an empirical value of 24 hours, and the implementer can set it according to the specific situation.

[0086] The target traffic data of each cycle represents the peak value of the network traffic data in each cycle; since the reason for the surge in traffic data may be malicious traffic or the increase in the number of normal visitors, and since the number of visitors is usually a fixed group of people and the increase in network traffic caused by malicious traffic is relatively random, the local anomaly factor algorithm can be used to identify normal traffic data. Among them, the local anomaly factor algorithm is a well-known technology for those skilled in the art and will not be described in detail here.

[0087] It should be noted that, in this embodiment, for the target traffic data of all cycles in the time period between the start time of the preset time period and the analysis time, the LOF value of each target traffic data is obtained using the local anomaly factor algorithm, and the target traffic data corresponding to the LOF value less than the constant 1 is recorded as normal traffic data; the peak value of normal traffic data is caused by the increase in the number of normal visitors. If the normal difference value is larger, the peak value of the reference traffic data at the analysis time is higher than the normal peak value in history, indicating that the reference traffic data at the analysis time has a greater degree of surge, and the possibility of malicious traffic at the analysis time is greater.

[0088] In summary, the traffic complexity value and the normal difference value are both positively correlated with the malicious possibility value. In this embodiment, the product of the traffic complexity value and the normal difference value at the analysis time is used as the malicious possibility value at the analysis time. The larger the malicious possibility value, the greater the possibility of malicious traffic in the network traffic data at the analysis time.

[0089] Step S230: Obtain the traffic maliciousness value at the time of analysis based on the maliciousness degree value and the maliciousness possibility value.

[0090] The larger the maliciousness level value, the greater the degree to which the network traffic data at the time of analysis is affected by malicious traffic; the larger the maliciousness possibility value, the greater the possibility of malicious traffic appearing in the network traffic data at the time of analysis. Therefore, the maliciousness level value and the maliciousness possibility value are both positively correlated with the traffic maliciousness value. In this embodiment, the product of the maliciousness level value and the maliciousness possibility value at the time of analysis is normalized to obtain the traffic maliciousness value at the time of analysis.

[0091] It should be noted that in this embodiment, the Norm function is used for normalization processing. In this embodiment, other normalization methods may also be selected, such as function conversion, Sigmoid function and other normalization methods, which are not limited here.

[0092] Step S3: Select a reference time period according to the fluctuation of network traffic data at a preset time period; obtain the network attack rate at the current time according to the traffic maliciousness value at the current time and the time within the reference time period.

[0093] When attacking a network, attackers may choose to attack during a period of time when network traffic is low to reduce the chance of being detected and responded to; less normal traffic makes malicious traffic more conspicuous, thereby increasing the possibility of successful intrusion, so attackers will choose an appropriate time period to attack. Attackers may attack the network continuously for multiple days, or they may attack intermittently at the same time period every day. Therefore, the fluctuation of network traffic data selects a reference time period.

[0094] Preferably, in some possible implementation methods of the present embodiment, the method for obtaining the reference time period includes: establishing a two-dimensional coordinate system with time as the horizontal axis and network traffic data as the vertical axis, marking the network traffic data at all times within the preset time period in the two-dimensional coordinate system to obtain the coordinate points of the corresponding network traffic data; performing curve fitting on all coordinate points in the two-dimensional coordinate system to obtain a traffic curve segment; obtaining the time intervals between the corresponding moments of all inflection points of the traffic curve segment and the current moment, and selecting the corresponding moment of the inflection point with the smallest time interval as the marking moment; recording the time period between the marking moment and the current moment as the marking time period; recording the period in which the current moment is located as the marking period, and selecting the time period at the same position as the marking time period in the marking period from the remaining periods within the preset time period except the marking period as the reference time period.

[0095] It should be noted that this embodiment uses the least squares method to perform curve fitting on the coordinate points in the two-dimensional coordinate system; the least squares method is a well-known technology for those skilled in the art and will not be described in detail here. The inflection point is the point where the curve trend changes, and the inflection point of the traffic curve segment is the position where the fluctuation trend of the network traffic data changes; the time period between the corresponding moment of the inflection point closest to the current moment and the current moment, that is, the time period of the marked time period, has the same fluctuation trend of the network traffic data. In order to analyze the probability of the network traffic data being attacked at the current moment, the marked time period is used as a benchmark to obtain the time period in the history that is at the same position as the marked time period, that is, the reference time period.

[0096] As an example, if the marked time period is the last hour of the marking cycle, the last hour of the remaining periods in the preset time period except the marking cycle is used as the reference time period.

[0097] The attacker's attack on the network may be continuous or intermittent for several days. In either case, the more times the network is attacked in the reference time period in the historical time, the greater the possibility of being attacked by the attacker in the marked time period. The malicious traffic value at the moment in the reference time period measures the number of attacks in the reference time period, and is analyzed in combination with the malicious traffic value at the current moment to obtain the probability of the network data being attacked by the attacker at the current moment, that is, the network attack rate.

[0098] Preferably, in some possible implementation methods of the present embodiment, the method for obtaining the network attack rate includes: recording the moment corresponding to the traffic malicious value greater than the preset malicious threshold in each reference time period as the suspected malicious moment of each reference time period; judging whether the total number of consecutive suspected malicious moments in each reference time period is greater than the preset number threshold, if so, setting the malicious parameter of each reference time period to a first preset value, if not, setting the malicious parameter of each reference time period to a second preset value; the first preset value is greater than the second preset value; performing a negative correlation mapping on the total number of cycles between the current moment and the cycle in which each reference time period is located, and obtaining a data credibility index for each reference time period; taking the product of the malicious parameter of each reference time period and the data credibility index as the number of local attacks for each reference time period; calculating the cumulative sum of the number of local attacks of all reference time periods within the preset time period, and recording it as the comprehensive number of attacks at the current moment; obtaining the network attack rate at the current moment based on the traffic malicious value and the comprehensive number of attacks at the current moment.

[0099] The network is usually attacked by a continuous behavior within a period of time, that is, it is in an attacked state at continuous moments. The malicious value of the traffic during the network attack time period is relatively large and continuous. The malicious parameter of the reference time period is set based on this feature. If the total number of consecutive suspected malicious moments in the reference time period is greater than the preset number threshold, it means that there is malicious traffic in the reference time period, and the network is attacked during the reference time period; conversely, there is no network attack in the reference time period, and it cannot provide information for the probability of being attacked at the current moment. Therefore, the first preset value is greater than the second preset value.

[0100] It should be noted that, in this embodiment, the first preset value is the empirical value 1, the second preset value is the empirical value 0; the preset malicious threshold is 0.5; the preset quantity threshold is less than the total number of all moments in each cycle, and the preset quantity threshold is the empirical value 100. The implementer can set it according to the specific situation.

[0101] Malicious parameters present the number of network attacks in the reference time period in the historical time. If the number of network attacks in the reference time period in the preset time period is greater, it means that the reference time period in a cycle is more likely to be the attack time period selected by the attacker, and the probability of being attacked by the network at the current moment is greater. The total number of cycles between the current moment and each reference time period reflects the time interval between the current moment and each reference time period; if the time interval between the current moment and each reference time period is smaller, the credibility of the relevant information of the reference time period is higher, and the reference degree is greater, then it is necessary to negatively correlate the total number of cycles between the current moment and each reference time period to obtain the data credibility indicator.

[0102] In order to improve the accuracy of the probability of being attacked by the network at the current moment, the data credibility index of the reference time period is used to adjust the number of local attacks to obtain the comprehensive number of attacks at the current moment; and combined with the traffic malicious value at the current moment for analysis, the traffic malicious value at the current moment directly reflects the probability of the network being attacked at the current moment, thereby improving the accuracy of the network attack rate.

[0103] In a specific implementation of this embodiment, the network attack rate is expressed by the formula:

[0104]

[0105] In the formula, is the network attack rate at the current moment; is the malicious value of traffic at the current moment; N is the total number of reference time periods in the historical time period; The total number of cycles between the nth reference time period in the historical time period and the current time period; It is the data credibility indicator of the nth reference time period in the historical time period; is the malicious parameter of the nth reference time period in the historical time period; is the number of local attacks in the nth reference time period within the historical time period; is the number of comprehensive attacks at the current moment; exp is an exponential function with the natural constant e as the base. The larger it is, the greater the probability that the network will be attacked at the current moment.

[0106] Step S4: Transmitting data on the computer network according to the congestion window adjusted by the network attack rate.

[0107] The greater the network attack rate at the current moment, the smaller the congestion window should be adjusted to reduce the loss of normal traffic. The congestion window adjustment method is: negatively correlate and normalize the network attack rate to obtain the adjustment weight at the current moment; use the adjustment weight to weight the preset congestion window scale to obtain the optimal congestion window scale at the current moment.

[0108] The optimal congestion window size at the current moment is expressed as:

[0109]

[0110] In the formula, is the optimal congestion window size at the current moment; is the network attack rate at the current moment; T is the preset congestion window size, which takes an empirical value of 100 and can be set by the implementer according to the specific situation; is the adjustment weight at the current moment; Norm is the normalization method.

[0111] By adaptively adjusting the congestion window according to the current network attack rate, the congestion window with the optimal congestion window size is obtained in real time. The congestion window is used to transmit network traffic data of the computer network, which can effectively reduce the impact of malicious traffic on network data transmission and reduce the probability of packet loss and network delay during data transmission.

[0112] So far, the present invention is completed.

[0113] Embodiment 2:

[0114] The present invention proposes a data security transmission system based on computer network, please refer to Figure 3 , which shows a system structure diagram of a data security transmission system based on a computer network provided by an embodiment of the present invention, the system comprising:

[0115] The data acquisition module 510 is used to obtain the network flow data of the application layer of the computer network at each moment within a preset time period and the size data of all flow packets corresponding to the network flow data; the last moment within the preset time period is the current moment; and the moment within the preset time period is recorded as the analysis moment;

[0116] Traffic maliciousness analysis module 520, used to obtain reference traffic data at the analysis time; obtain the traffic maliciousness value at the analysis time according to the discrete degree of all reference traffic data at the analysis time and the complexity of the size data of all traffic packets corresponding to the reference traffic data, the difference between the network traffic data at the analysis time and its reference traffic data, and the difference between the reference traffic data at the analysis time and the network traffic data at the time before the analysis time;

[0117] The network attack analysis module 530 is used to select a reference time period according to the fluctuation of network traffic data at a preset time period; and obtain the network attack rate at the current time according to the traffic maliciousness value at the current time and the time within the reference time period;

[0118] The congestion window adjustment module 540 is used to transmit data on the computer network according to the congestion window adjusted by the network attack rate.

[0119] It should be noted that: the device provided in the above embodiment is only illustrated by the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the computer device is divided into different functional modules to complete all or part of the functions described above. In addition, the data security transmission system based on computer network and the data security transmission method based on computer network provided in the above embodiment belong to the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0120] Embodiment 3:

[0121] Figure 4 A computer device schematic diagram of a data security transmission device based on a computer network provided by an embodiment of the present invention. Figure 4 As shown, the computer device includes: a memory 601, a processor 602, and a computer program 603 stored in the memory 601 and running on the processor 602, wherein when the processor 602 executes the computer program 603, the computer device can execute any one of the computer network-based data security transmission methods introduced above.

[0122] In addition, an embodiment of the present application also protects a device, which may include a memory and a processor, wherein the memory stores executable program code, and the processor is used to call and execute the executable program code to execute a computer network-based data security transmission method provided in an embodiment of the present application.

[0123] In this embodiment, the functional modules of the device can be divided according to the above method example. For example, each functional module can be corresponded, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware. It should be noted that the division of modules in this embodiment is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0124] It should be understood that the device provided in this embodiment is used to execute the above-mentioned computer network-based data security transmission method, and thus can achieve the same effect as the above-mentioned implementation method.

[0125] In the case of an integrated unit, the device may include a processing module and a storage module. When the device is applied to a device, the processing module may be used to control and manage the actions of the device. The storage module may be used to support the device to execute mutual program codes, etc.

[0126] The processing module may be a processor or a controller, which may implement or execute various exemplary logic blocks, modules and circuits included in the disclosure of this application. The processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of digital signal processing (DSP) and a microprocessor, etc. The storage module may be a memory.

[0127] It should be noted that the sequence of the above embodiments of the present invention is only for description and does not represent the advantages and disadvantages of the embodiments. The processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0128] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

[0129] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A data security transmission method based on a computer network, characterized in that: The method includes: Obtain network traffic data of the application layer of the computer network at each moment within a preset time period and size data of all traffic packets corresponding to the network traffic data; the last moment within the preset time period is the current moment; and the moment within the preset time period is recorded as the analysis moment; Obtain reference traffic data at the time of analysis; obtain the traffic maliciousness value at the time of analysis based on the discreteness of all reference traffic data at the time of analysis and the complexity of the size data of all traffic packets corresponding to the reference traffic data, the difference between the network traffic data at the time of analysis and its reference traffic data, and the difference between the reference traffic data at the time of analysis and the network traffic data at the time before the time of analysis; Select a reference time period according to the fluctuation of network traffic data at a preset time period; obtain the network attack rate at the current time according to the traffic malicious value at the current time and the time within the reference time period; Transmitting data on a computer network according to the congestion window adjusted by the network attack rate; The obtaining of the traffic maliciousness value at the time of analysis includes: Obtain the maliciousness level value at the time of analysis based on the discreteness and change trend of all reference traffic data at the time of analysis, and the difference between the network traffic data at the time of analysis and its reference traffic data; Obtain the possible malicious value at the analysis time according to the complexity of the size data of all traffic packets corresponding to all reference traffic data at the analysis time, and the difference between the reference traffic data at the analysis time and the network traffic data at the time before the analysis time; Obtaining a traffic maliciousness value at the analysis time according to the maliciousness degree value and the maliciousness possibility value; The obtaining of the maliciousness level value at the time of analysis includes: Obtain the average difference of all reference flow data at the analysis time, and record it as the flow discrete value at the analysis time; Arrange all reference flow data at the analysis time in time sequence to obtain a reference flow sequence at the analysis time; set local trend values ​​corresponding to the two reference flow data according to the positive or negative difference between any two adjacent reference flow data in the reference flow sequence; and take the cumulative sum of the local trend values ​​of all two adjacent reference flow data in the reference flow sequence as the overall trend value at the analysis time; The absolute value of the difference between the network traffic data at the analysis time and the mode of all its reference traffic data is used as the reference difference value at the analysis time; Obtaining a maliciousness level value at the analysis time according to the traffic discrete value, the overall trend value and the reference difference value; The obtaining of the possible malicious value at the time of analysis includes: Obtain the information entropy of the size data of all traffic packets corresponding to all reference traffic data at the analysis time, and record it as the traffic complexity value at the analysis time; Divide the preset time period into different cycles; select the maximum value of the network traffic data at all times in each cycle as the target traffic data of each cycle; perform anomaly detection on the target traffic data of all cycles in the time period between the start time of the preset time period and the analysis time to obtain the normal traffic data at the analysis time; calculate the average of the absolute values ​​of the differences between the maximum value of all reference traffic data at the analysis time and the normal traffic data as the normal difference value at the analysis time; Obtaining a possible malicious value at the analysis time according to the traffic complexity value and the normal difference value; The step of selecting a reference time period according to fluctuations in network traffic data within a preset time period includes: A two-dimensional coordinate system is established with time as the horizontal axis and network traffic data as the vertical axis, and the network traffic data at all times within a preset time period are marked in the two-dimensional coordinate system to obtain coordinate points corresponding to the network traffic data; Perform curve fitting on all coordinate points in the two-dimensional coordinate system to obtain a flow curve segment; obtain the time intervals between the corresponding moments of all inflection points of the flow curve segment and the current moment, select the corresponding moment of the inflection point with the smallest time interval as the marked moment; record the time period between the marked moment and the current moment as the marked time period; The period at the current moment is recorded as the marking period, and a time period at the same position as the marking time period in the marking period is selected from the remaining periods in the preset time period except the marking period as the reference time period; The obtaining of the current network attack rate includes: The time corresponding to the malicious value of the traffic greater than the preset malicious threshold in each reference time period is recorded as the suspected malicious time in each reference time period; Determine whether the total number of consecutive suspected malicious moments in each reference time period is greater than a preset number threshold, and if so, set the malicious parameter of each reference time period to a first preset value; if not, set the malicious parameter of each reference time period to a second preset value; the first preset value is greater than the second preset value; Negative correlation mapping is performed on the total number of cycles between the current moment and each reference time period to obtain a data credibility index for each reference time period; the product of the malicious parameter and the data credibility index for each reference time period is used as the number of local attacks for each reference time period; the cumulative sum of the number of local attacks for all reference time periods within the preset time period is calculated and recorded as the comprehensive number of attacks at the current moment; Obtaining the network attack rate at the current moment according to the malicious traffic value at the current moment and the comprehensive attack times; The transmitting of data on the computer network according to the congestion window adjusted by the network attack rate comprises: The network attack rate is negatively correlated and normalized to obtain an adjustment weight at the current moment; the preset congestion window scale is weighted by using the adjustment weight to obtain an optimal congestion window scale at the current moment; Data in a computer network is transmitted using a congestion window of an optimal congestion window size.

2. A computer network-based data security transmission method according to claim 1, characterized in that: The step of setting the local trend value corresponding to two reference flow data according to the positive or negative condition of the difference between any two adjacent reference flow data in the reference flow sequence comprises: Select any two adjacent reference flow data from the reference flow sequence as example flow data, and record the difference between the latter and the previous example flow data as the flow difference between the two example flow data; When the flow difference is greater than the constant 0, the local trend values ​​of the two example flow data are set to a preset positive number; When the flow difference is equal to a constant of 0, the local trend values ​​of the two example flow data are set to a constant of 0; When the flow difference is less than the constant 0, the local trend values ​​of the two example flow data are set to a preset negative number; The absolute values ​​of the preset positive number and the preset negative number are equal.

3. A computer network-based data security transmission method according to claim 1, characterized in that: The reference traffic data at the analysis time is the network traffic data at a time within a preset adjacent time period before the analysis time.

4. A data security transmission system based on a computer network, characterized in that: The system includes: A data acquisition module is used to obtain network traffic data of the application layer of the computer network at each moment within a preset time period and size data of all traffic packets corresponding to the network traffic data; the last moment within the preset time period is the current moment; and the moment within the preset time period is recorded as the analysis moment; The traffic maliciousness analysis module is used to obtain reference traffic data at the analysis time; according to the discrete degree of all reference traffic data at the analysis time and the complexity of the size data of all traffic packets corresponding to the reference traffic data, the difference between the network traffic data at the analysis time and its reference traffic data, and the difference between the reference traffic data at the analysis time and the network traffic data at the time before the analysis time, the traffic maliciousness value at the analysis time is obtained; A network attack analysis module is used to select a reference time period according to the fluctuation of network traffic data at a preset time period; and obtain the network attack rate at the current time according to the traffic malicious value at the current time and the time within the reference time period; A congestion window adjustment module, used for transmitting data on a computer network according to the congestion window adjusted by the network attack rate; The obtaining of the traffic maliciousness value at the time of analysis includes: Obtain the maliciousness level value at the time of analysis based on the discreteness and change trend of all reference traffic data at the time of analysis, and the difference between the network traffic data at the time of analysis and its reference traffic data; Obtain the possible malicious value at the analysis time according to the complexity of the size data of all traffic packets corresponding to all reference traffic data at the analysis time, and the difference between the reference traffic data at the analysis time and the network traffic data at the time before the analysis time; Obtaining a traffic maliciousness value at the analysis time according to the maliciousness degree value and the maliciousness possibility value; The obtaining of the maliciousness level value at the time of analysis includes: Obtain the average difference of all reference flow data at the analysis time, and record it as the flow discrete value at the analysis time; Arrange all reference flow data at the analysis time in time sequence to obtain a reference flow sequence at the analysis time; set local trend values ​​corresponding to the two reference flow data according to the positive or negative difference between any two adjacent reference flow data in the reference flow sequence; and take the cumulative sum of the local trend values ​​of all two adjacent reference flow data in the reference flow sequence as the overall trend value at the analysis time; The absolute value of the difference between the network traffic data at the analysis time and the mode of all its reference traffic data is used as the reference difference value at the analysis time; Obtaining a maliciousness level value at the analysis time according to the traffic discrete value, the overall trend value and the reference difference value; The obtaining of the possible malicious value at the time of analysis includes: Obtain the information entropy of the size data of all traffic packets corresponding to all reference traffic data at the analysis time, and record it as the traffic complexity value at the analysis time; Divide the preset time period into different cycles; select the maximum value of the network traffic data at all times in each cycle as the target traffic data of each cycle; perform anomaly detection on the target traffic data of all cycles in the time period between the start time of the preset time period and the analysis time to obtain the normal traffic data at the analysis time; calculate the average of the absolute values ​​of the differences between the maximum value of all reference traffic data at the analysis time and the normal traffic data as the normal difference value at the analysis time; Obtaining a possible malicious value at the analysis time according to the traffic complexity value and the normal difference value; The step of selecting a reference time period according to fluctuations in network traffic data within a preset time period includes: A two-dimensional coordinate system is established with time as the horizontal axis and network traffic data as the vertical axis, and the network traffic data at all times within a preset time period are marked in the two-dimensional coordinate system to obtain coordinate points corresponding to the network traffic data; Perform curve fitting on all coordinate points in the two-dimensional coordinate system to obtain a flow curve segment; obtain the time intervals between the corresponding moments of all inflection points of the flow curve segment and the current moment, select the corresponding moment of the inflection point with the smallest time interval as the marked moment; record the time period between the marked moment and the current moment as the marked time period; The period at the current moment is recorded as the marking period, and a time period at the same position as the marking time period in the marking period is selected from the remaining periods in the preset time period except the marking period as the reference time period; The obtaining of the current network attack rate includes: The time corresponding to the malicious value of the traffic greater than the preset malicious threshold in each reference time period is recorded as the suspected malicious time in each reference time period; Determine whether the total number of consecutive suspected malicious moments in each reference time period is greater than a preset number threshold, and if so, set the malicious parameter of each reference time period to a first preset value; if not, set the malicious parameter of each reference time period to a second preset value; the first preset value is greater than the second preset value; Negative correlation mapping is performed on the total number of cycles between the current moment and each reference time period to obtain a data credibility index for each reference time period; the product of the malicious parameter and the data credibility index for each reference time period is used as the number of local attacks for each reference time period; the cumulative sum of the number of local attacks for all reference time periods within the preset time period is calculated and recorded as the comprehensive number of attacks at the current moment; Obtaining the network attack rate at the current moment according to the malicious traffic value at the current moment and the comprehensive attack times; The transmitting of data on the computer network according to the congestion window adjusted by the network attack rate comprises: The network attack rate is negatively correlated and normalized to obtain an adjustment weight at the current moment; the preset congestion window scale is weighted by using the adjustment weight to obtain an optimal congestion window scale at the current moment; Data in a computer network is transmitted using a congestion window of an optimal congestion window size.

Images