A network security risk control system based on traffic identification

Abstract

This invention relates to the field of network security technology and discloses a network security risk control system based on traffic identification, including a traffic identification module, a data analysis module, a behavior identification module, a threat detection module, a threat blocking module, a real-time alarm module, a rule building module, and a data recording module. The traffic identification module is used to perform real-time analysis and monitoring of network data flows, checking the size, frequency, and protocol of the data. The data analysis module is used to perform source and destination analysis on the content identified by the traffic identification module to identify abnormal or potential attack patterns. This invention uses a rule building module to collect historical abnormal log data and combines it with predefined rule information to gradually generate rule matching and network security identification mechanisms that are more suitable for the current operating environment, thus enabling more accurate identification of abnormal user traffic behavior.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and more specifically to a network security risk control system based on traffic identification. Background Art

[0002] Traffic refers to the amount of access data to a website, and is used to describe indicators such as the number of users visiting a website and the number of pages viewed by users. Commonly used statistical indicators include the number of independent users of the website, the total number of users, the number of page views, the number of page views per user, the average length of time users stay on the website, etc.

[0003] A security situation awareness system based on industrial control network traffic (publication number CN117938512A) is now disclosed, including an operating system, which is respectively connected to a data integration module, a traffic analysis module, an anomaly detection module, an intelligence integration module, a security management module, a visualization module, an adaptive module, a security compliance module and a system maintenance module. The technology disclosed in this patent does not solve the problem of identifying abnormal user status, how to formulate identification and matching rules after self-learning, and the specific steps of matching user traffic characteristics with formulated rules. It is also difficult to efficiently and accurately identify abnormal user traffic status. Summary of the invention

[0004] The main technical problem solved by the present invention is to provide a network security risk control system based on traffic identification, which solves the problems in the above-mentioned background technology.

[0005] To solve the above technical problems, according to one aspect of the present invention, more specifically, a network security risk control system based on traffic identification includes a traffic identification module, a data analysis module, a behavior identification module, a threat detection module, a threat blocking module, a real-time alarm module, a rule construction module and a data recording module;

[0006] The traffic identification module is used to analyze and monitor the network data flow in real time and check the size, frequency and protocol of the data;

[0007] The data analysis module is used to perform source analysis and destination analysis on the content identified by the traffic identification module to identify abnormal or potential attack patterns;

[0008] The behavior recognition module is used to recognize typical patterns of traffic and detect activities that do not conform to normal behavior patterns;

[0009] The threat detection module is used to detect threats or abnormal activities in the data flow;

[0010] The threat blocking module is used to block the IP addresses of traffic flows with threats or abnormal activities and close related network ports;

[0011] The real-time alarm module is used to respond to threats or abnormal activities in real time and issue alarms so that network administrators can take prompt actions to deal with potential security incidents;

[0012] The rule building module is based on predefined security rules and learns the data recorded in the data recording module to build network security rules that are more in line with the actual situation;

[0013] The data recording module is used to record logs, alarms and configuration changes in data traffic.

[0014] Furthermore, the traffic identification module specifically includes an identity identification module, a traffic feature analysis module and a data packet analysis module;

[0015] The identity recognition module is used to identify and verify the identity of network users or devices, and authorize users to access specific resources based on user login information and device identifiers;

[0016] The traffic feature analysis module is used to analyze the characteristics of the traffic, including the size, frequency, protocol type and delay of the data packet;

[0017] The data packet analysis module is used to analyze the header information and payload transmitted in the traffic and identify the nature and purpose of the communication.

[0018] Furthermore, the behavior recognition module specifically includes a threat detection module, an anomaly detection module and a pattern recognition module;

[0019] The threat detection module is used to detect and identify various security threats, including internal and external intrusions, denial of service attacks, and data leaks;

[0020] The anomaly detection module is used to identify abnormal behaviors that are inconsistent with normal behavior patterns, including those involving unauthorized access, abnormal data transmission, and the spread of malware;

[0021] The pattern recognition module is used to recognize the user's login pattern, data transmission frequency, access time and location.

[0022] Furthermore, the pattern recognition module analyzes the characteristic cardinality of the abnormal state of the accessing user by collecting the address of the accessing user, the frequency of the user's access, the size of the access traffic, and the delay of the data, which are:

[0023]

[0024] Among them, G represents the characteristic cardinality of the user's abnormal state, a represents the frequency of user access, c represents the traffic volume of the user's access, and m represents the data delay time of the user's access; and there are:

[0025]

[0026] Where u represents the correlation between the frequency, size, and delay time of the user's access traffic.

[0027] Furthermore, the rule construction module specifically includes a rule execution module, a rule definition module and a data collection module;

[0028] The rule execution module is used to perform matching learning according to pre-defined rules, execution log data recorded by the data recording module, and data analyzed by the data analysis module, so as to formulate network security that conforms to the actual network environment;

[0029] The rule definition module is used to formulate and manage a series of network security rules, which describe the triggering conditions and response actions of specific events or conditions;

[0030] The data acquisition module is used to collect the data recorded in the data analysis module and the data recording module.

[0031] Furthermore, the rule execution module collects data packets of abnormal status logs and data information of alarm status in the data recording module, and formulates trigger conditions according to pre-defined rules, including:

[0032]

[0033] Among them, H represents the matching condition of the rule specified by the rule building module, a0 represents the frequency of abnormal user access in the log, c0 represents the traffic size of abnormal user access in the log, and m0 represents the data delay time of abnormal user access in the log; and there are:

[0034]

[0035] In the formula, P represents the matching condition cardinality of the pre-defined rules, and s represents the influence factor of the condition cardinality of the pre-defined rules on the collected data.

[0036] Furthermore, the threat detection module specifically includes an event matching module, a behavior analysis module and a funnel scanning module;

[0037] The event matching module is used to check the rules learned and constructed by the rule construction module with the identified traffic characteristics to determine whether the network security conditions are triggered;

[0038] The behavior analysis module is used to monitor and analyze network traffic, system logs and user behavior to identify possible abnormal activities or signs of attacks;

[0039] The vulnerability scanning module is used to regularly scan systems and applications to identify possible security vulnerabilities and configuration errors.

[0040] Furthermore, the event matching module matches the rule information constructed by the rule construction module with the feature cardinality extracted by the behavior recognition module, and has:

[0041]

[0042] In the formula, K represents the matching degree between the collected user traffic characteristics and the constructed rules by the event matching module;

[0043] When 0<K≤1, the traffic characteristics of the user collected this time meet the rules for network security identification.

[0044] Furthermore, the threat blocking module specifically includes a real-time response module and an access control module;

[0045] The real-time response module is used to respond to the administrator of network security anomalies and threats;

[0046] The access control module is used to restrict access to users with data anomalies and threats.

[0047] The beneficial effects of the network security risk control system based on traffic identification of the present invention are:

[0048] 1. The present invention collects historical abnormal log data through a rule building module, and combines pre-defined rule information to gradually generate a rule matching and network security identification mechanism that is more in line with the operating environment, so that abnormal behavior of user traffic can be identified more accurately.

[0049] 2. The present invention extracts the characteristics of user traffic, and the event matching module matches the characteristics with the formulated security rules, so as to efficiently and accurately identify the user's behavior and determine whether the user's access traffic is in an abnormal state. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The present invention is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0051] Figure 1 It is a schematic diagram of the structure of the present invention. DETAILED DESCRIPTION

[0052] The present invention will be described in detail below with reference to the accompanying drawings and in combination with embodiments. It should be noted that the embodiments and features in the embodiments of the present application can be combined with each other without conflict.

[0053] like Figure 1 As shown, according to one aspect of the present invention, a network security risk control system based on traffic identification is provided, including a traffic identification module, a data analysis module, a behavior identification module, a threat detection module, a threat blocking module, a real-time alarm module, a rule construction module and a data recording module; the traffic identification module is used to perform real-time analysis and monitoring of network data flows, and check the size, frequency and protocol of the data; the data analysis module is used to perform source analysis and destination analysis on the content identified by the traffic identification module to identify abnormal or potential attack patterns; the behavior identification module is used to identify typical patterns of traffic and detect activities that do not conform to normal behavior patterns. Through the work of the behavior identification module, the user's access traffic characteristics can be extracted to facilitate the subsequent modules to perform identification and matching work.

[0054] The threat detection module is used to detect threats or abnormal activities in data flows; the threat blocking module is used to block IP addresses of traffic flows with threats or abnormal activities and close related network ports; the real-time alarm module is used to respond to threats or abnormal activities in real time and issue alarms so that network administrators can take quick action to deal with potential security incidents; the rule construction module is based on pre-defined security rules and learns the data recorded in the data recording module to build network security rules that are more in line with the actual situation; the data recording module is used to record logs, alarms and configuration changes in data traffic, collect historical abnormal log data through the rule construction module, and combine pre-defined rule information to gradually generate rule matching and network security identification mechanisms that are more in line with the operating environment, so that abnormal behaviors of user traffic can be more accurately identified. .

[0055] In this embodiment, the traffic identification module specifically includes an identity identification module, a traffic feature analysis module and a data packet analysis module; the identity identification module is used to identify and verify the identity of a network user or device, and authorize the user to access specific resources based on user login information and device identifier; the traffic feature analysis module is used to analyze the characteristics of the traffic, including the size, frequency, protocol type and delay of the data packet; the data packet analysis module is used to analyze the header information and payload transmitted in the traffic, and identify the nature and purpose of the communication.

[0056] In this embodiment, the behavior recognition module specifically includes a threat detection module, an anomaly detection module and a pattern recognition module; the threat detection module is used to detect and identify various security threats, including internal and external intrusions, denial of service attacks and data leakage; the anomaly detection module is used to identify abnormal behaviors that do not conform to normal behavior patterns, including unauthorized access, abnormal data transmission and the spread of malware; the pattern recognition module is used to identify the user's login mode, the frequency of data transmission, the time and location of access. The pattern recognition module analyzes the characteristic cardinality of the abnormal state of the accessing user by collecting the address of the accessing user, the frequency of the user's access, the size of the access traffic and the delay of the data, including:

[0057]

[0058] Among them, G represents the characteristic cardinality of the user's abnormal state, a represents the frequency of user access, c represents the traffic volume of the user's access, and m represents the data delay time of the user's access; and there are:

[0059]

[0060] Where u represents the correlation between the frequency, size, and delay time of the user's access traffic.

[0061] When collecting the traffic characteristics of users, the user's access frequency a=28, the traffic size of each user's access c=0.3, and the data delay time of the user's access m=2.4, we have:

[0062]

[0063] At this point, we have:

[0064]

[0065] Then the feature cardinality G of the user traffic feature extraction this time is 12.3.

[0066] In this embodiment, the rule construction module specifically includes a rule execution module, a rule definition module and a data acquisition module; the rule execution module is used to match and learn according to the pre-defined rules and the execution log data recorded by the data recording module and the data analyzed by the data analysis module to formulate network security that conforms to the actual network environment; the rule definition module is used to formulate and manage a series of network security rules, which describe the trigger conditions and response actions of specific events or conditions; the data acquisition module is used to collect the data recorded in the data analysis module and the data recording module. The rule execution module collects the data packets of the abnormal status log and the data information of the alarm status in the data recording module, and formulates the trigger conditions according to the pre-defined rules, including:

[0067]

[0068] Among them, H represents the matching condition of the rule specified by the rule building module, a0 represents the frequency of abnormal user access in the log, c0 represents the traffic size of abnormal user access in the log, and m0 represents the data delay time of abnormal user access in the log; and there are:

[0069]

[0070] In the formula, P represents the matching condition cardinality of the pre-defined rules, and s represents the influence factor of the condition cardinality of the pre-defined rules on the collected data.

[0071] By collecting data on abnormal access in the log, that is, the frequency of abnormal user access in the log is a0=37, the traffic size of abnormal user access in the log is c0=0.03, and the data delay time of abnormal user access in the log is m0=4.2. The matching condition cardinality of the pre-defined rule is P=6.8, and we have:

[0072]

[0073] And there are:

[0074]

[0075] Then the matching condition of the rules learned and constructed at this time is H=0.02.

[0076] In this embodiment, the threat detection module specifically includes an event matching module, a behavior analysis module, and a funnel scanning module; the event matching module is used to check the rules learned and constructed by the rule construction module with the identified traffic features to determine whether the network security conditions are triggered; the behavior analysis module is used to monitor and analyze network traffic, system logs, and user behaviors to identify possible abnormal activities or signs of attacks; the vulnerability scanning module is used to regularly scan the system and application programs to identify possible security vulnerabilities and configuration errors. The event matching module matches the rule information constructed by the rule construction module with the feature base extracted by the behavior recognition module, including:

[0077]

[0078] Where K represents the degree of matching between the collected user traffic characteristics and the constructed rules by the event matching module; when 0<K≤1, the traffic characteristics of the user collected this time meet the rules identified by network security.

[0079] From the above values, we can know that:

[0080]

[0081] From the above calculation, we can know that K does not satisfy 0<K≤1, that is, the traffic characteristics of the collected users do not meet the rules for network security identification, that is, the user access is normal. Otherwise, it will be blocked by the threat blocking module and respond to the administrator. The threat blocking module specifically includes a real-time response module and an access control module; the real-time response module is used to respond to the administrator for network security anomalies and threats; the access control module is used to restrict access to users with data anomalies and threats.

[0082] Of course, the above description is not a limitation of the present invention, and the present invention is not limited to the above examples. Changes, modifications, additions or substitutions made by ordinary technicians in this technical field within the essential scope of the present invention also fall within the protection scope of the present invention.

Claims

1. A network security risk control system based on traffic identification, characterized in that: It includes traffic identification module, data analysis module, behavior identification module, threat detection module, threat blocking module, real-time alarm module, rule building module and data recording module; The traffic identification module is used to analyze and monitor the network data flow in real time and check the size, frequency and protocol of the data; The data analysis module is used to perform source analysis and destination analysis on the content identified by the traffic identification module to identify abnormal or potential attack patterns; The behavior recognition module is used to identify typical patterns of traffic and detect activities that do not conform to normal behavior patterns; The threat detection module is used to detect threats or abnormal activities in the data flow; The threat blocking module is used to block IP addresses of traffic flows with threats or abnormal activities and close related network ports; The real-time alarm module is used to respond to threats or abnormal activities in real time and issue alarms so that network administrators can take prompt actions to deal with potential security incidents; The rule building module is based on predefined security rules and learns the data recorded in the data recording module to build network security rules that are more in line with the actual situation; The data recording module is used to record logs, alarms and configuration changes in data traffic; The behavior recognition module specifically includes a threat detection module, an anomaly detection module and a pattern recognition module; The pattern recognition module analyzes the characteristic cardinality of the abnormal state of the accessing user by collecting the address of the accessing user, the frequency of the user's access, the size of the access traffic and the delay of the data, which are: Among them, G represents the characteristic cardinality of the user's abnormal state, Indicates the frequency of user access. Indicates the traffic size of the user access. Indicates the delay time of data accessed by the user; and: In the formula, Indicates the correlation between the frequency, size, and latency of user access traffic; The rule construction module specifically includes a rule execution module, a rule definition module and a data collection module; The rule execution module is used to perform matching learning according to pre-defined rules, execution log data recorded by the data recording module, and data analyzed by the data analysis module, so as to formulate network security that conforms to the actual network environment; The rule definition module is used to formulate and manage a series of network security rules, which describe the triggering conditions and response actions of specific events or conditions; The data acquisition module is used to collect the data recorded in the data analysis module and the data recording module; The rule execution module collects data packets of abnormal status logs and data information of alarm status in the data recording module, and formulates trigger conditions according to pre-defined rules, including: Among them, H represents the matching condition of the rule specified by the rule building module, Indicates the frequency of abnormal user access in the log. Indicates the traffic size of abnormal users in the log. Indicates the data delay time of abnormal user access in the log; and there are: In the formula, Indicates the matching condition base of the pre-defined rules. Indicates the influence factor of the condition cardinality of the pre-defined rules on the collected data; The threat detection module specifically includes an event matching module, a behavior analysis module and a vulnerability scanning module; The event matching module is used to check the rules learned and constructed by the rule construction module with the identified traffic characteristics to determine whether the network security conditions are triggered; The behavior analysis module is used to monitor and analyze network traffic, system logs and user behavior to identify possible abnormal activities or signs of attacks; The vulnerability scanning module is used to regularly scan systems and applications to identify possible security vulnerabilities and configuration errors; The event matching module matches the rule information constructed by the rule construction module with the feature cardinality extracted by the behavior recognition module, and has: In the formula, K represents the matching degree between the collected user traffic characteristics and the constructed rules by the event matching module; when , then the traffic characteristics of the user collected this time meet the rules for network security identification.

2. The network security risk control system based on traffic identification according to claim 1 is characterized by: The flow identification module specifically includes an identity identification module, a flow characteristic analysis module and a data packet analysis module; The identity recognition module is used to identify and verify the identity of network users or devices, and authorize users to access specific resources based on user login information and device identifiers; The traffic feature analysis module is used to analyze the characteristics of the traffic, including the size, frequency, protocol type and delay of the data packet; The data packet analysis module is used to analyze the header information and payload transmitted in the traffic and identify the nature and purpose of the communication.

3. The network security risk control system based on traffic identification according to claim 1 is characterized by: The threat detection module is used to detect and identify various security threats, including internal and external intrusions, denial of service attacks, and data leaks; The anomaly detection module is used to identify abnormal behaviors that are inconsistent with normal behavior patterns, including those involving unauthorized access, abnormal data transmission, and the spread of malware; The pattern recognition module is used to recognize the user's login pattern, frequency of data transmission, and time and location of access.

4. The network security risk control system based on traffic identification according to claim 1 is characterized by: The threat blocking module specifically includes a real-time response module and an access control module; The real-time response module is used to respond to the administrator of network security anomalies and threats; The access control module is used to restrict access to users with data anomalies and threats.

Images