Data packet security assessment method and device, equipment, storage medium and product

Abstract

The invention discloses a data packet security assessment method and device, equipment, a storage medium and a product, and relates to the technical field of information security, and the method comprises the steps: obtaining a target data packet; based on the target data packet, determining security parameters through data processing; performing parameter weight calculation based on the security parameter to obtain a data packet security value; and if the data packet security value is greater than a preset threshold, sending the target data packet to the target virtual switch. According to the application, the micro-isolation virtual machine performs security verification on the acquired target data packet based on the data packet security value, and the target data packet passing the verification can be sent to the target virtual switch. In this way, the accuracy of safety performance evaluation of the data packets in the micro-isolation virtual machine can be improved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a data packet security assessment method, device, equipment, storage medium and product. Background Art

[0002] With the rapid development of the digital economy, virtualized network environments are increasingly being used in today's IT (Information Technology) industry. Virtualized network technology improves network flexibility, scalability, and management efficiency by dividing physical network resources into multiple independent virtual networks. In a virtualized network environment, a large amount of traffic data is forwarded through virtual switches and does not pass through firewalls, which makes traditional security protection measures ineffective. The communication traffic between virtual machines becomes uncontrollable, and threats to internal virtual machines cannot be detected or controlled.

[0003] To avoid the above-mentioned security risks, the industry currently usually implements information security control by setting up micro-isolated virtual machines. However, the current data packet security assessment method for micro-isolated virtual machines lacks a comprehensive and complete security assessment strategy, and the accuracy of the security performance assessment of data packets is not high.

[0004] Therefore, how to improve the accuracy of security performance evaluation of data packets in micro-isolated virtual machines is a problem that needs to be solved urgently. Summary of the invention

[0005] The main purpose of this application is to provide a data packet security assessment method, device, equipment, storage medium and product, aiming to solve the technical problem of how to improve the accuracy of security performance assessment of data packets in micro-isolated virtual machines.

[0006] To achieve the above objectives, the present application proposes a data packet security assessment method, which is applied to a micro-isolated virtual machine. The data packet security assessment method includes:

[0007] Get the target data packet;

[0008] Based on the target data packet, determining security parameters through data processing;

[0009] Calculate the parameter weight based on the security parameter to obtain the data packet security value;

[0010] If the data packet security value is greater than the preset threshold, the target data packet is sent to the target virtual switch.

[0011] In one embodiment, the step of determining the security parameter by data processing based on the target data packet includes:

[0012] Based on a preset access control policy, obtaining attribute information of the target data packet;

[0013] Performing access permission verification based on the attribute information, and if the access permission verification passes, parsing the target data packet to obtain parsed data;

[0014] Based on the analyzed data, security parameters are determined through information statistics.

[0015] In one embodiment, the step of determining the security parameter through information statistics based on the parsed data includes:

[0016] Based on the parsed data, determine the target link and target node corresponding to the target data packet, wherein the target node includes a source IP node;

[0017] Based on the target nodes, determining device security parameters corresponding to each of the target nodes through information statistics;

[0018] Based on the source IP node, determining the source IP security parameter corresponding to the source IP node through information statistics;

[0019] Based on the source IP node and the target link, a link security parameter corresponding to the target link is determined through information statistics.

[0020] In one embodiment, the step of determining the source IP security parameter corresponding to the source IP node through information statistics based on the source IP node includes:

[0021] Access the pre-acquired traffic logs to obtain historical data packet log data;

[0022] Based on the historical data packet log data, the total number of data packets received within a preset time interval is counted to obtain the total number of data packets received;

[0023] Based on the historical data packet log data and the source IP node, counting the number of data packets sent by the source IP node and received within a preset time interval to obtain the total number of source IP data packets sent;

[0024] Based on the historical data packet log data and the source IP node, counting the number of forwarded data packets in the data packets sent by the source IP node and received within a preset time interval to obtain the total forwarding amount of the source IP data packets;

[0025] The source IP security parameter is obtained by performing calculation based on the total amount of data packets received, the total amount of source IP data packets sent, and the total amount of source IP data packets forwarded.

[0026] In one embodiment, the step of determining the link security parameter corresponding to the target link through information statistics based on the source IP node and the target link includes:

[0027] Access the pre-acquired link log to obtain historical data packet link data;

[0028] Based on the target link data packet, determine a first same-link data packet feature, a second same-link data packet feature, and a third same-link data packet feature, wherein the link corresponding to the first same-link data packet feature is the target link, the link corresponding to the second same-link data packet feature is an extended link constructed based on the target link, and the link corresponding to the third target link data packet feature is a reorganized link constructed based on each node and link direction in the target link;

[0029] Based on the historical data packet link data, the source IP node and the target link, the number of data packets that meet the first same-link data packet characteristics and are received and sent by the source IP node within a preset time interval is counted to obtain the total number of source IP same-link data packets;

[0030] Based on the historical data packet link data and the target link, counting the number of data packets received within a preset time interval that meet the characteristics of the second same-link data packets, to obtain the total number of complete same-link data packets;

[0031] Based on the historical data packet link data and the target link, counting the number of data packets received within a preset time interval that meet the characteristics of the third same-link data packet, to obtain a total number of partial same-link data packets;

[0032] Based on the historical data packet link data and the target link, generating a quantity attribute value of data packets received within a preset time interval and meeting the characteristics of the third same-link data packets;

[0033] The link security parameter is obtained by calculation based on the total amount of source IP same-link data packets, the total amount of complete same-link data packets, the total amount of partial same-link data packets and the quantity attribute value.

[0034] In one embodiment, after the step of calculating parameter weights based on the security parameters to obtain a data packet security value, the following steps are included:

[0035] If the data packet security value is less than or equal to a preset threshold, upon receiving a data packet security confirmation instruction input by a user, the target data packet is sent to the target virtual switch.

[0036] In addition, to achieve the above purpose, the present application also proposes a data packet security assessment device, which is applied to a micro-isolated virtual machine, and the data packet security assessment device includes:

[0037] A data receiving module, used for acquiring a target data packet;

[0038] A data processing module, used for determining security parameters through data processing based on the target data packet;

[0039] A parameter calculation module, used to calculate parameter weights based on the security parameters to obtain a data packet security value;

[0040] The data packet forwarding module is used to send the target data packet to the target virtual switch if the data packet security value is greater than a preset threshold.

[0041] In addition, to achieve the above-mentioned purpose, the present application also proposes a data packet security assessment device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the data packet security assessment method described above.

[0042] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the data packet security assessment method described above are implemented.

[0043] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps of the data packet security assessment method described above are implemented.

[0044] The present application provides a data packet security assessment method, which first obtains a target data packet; based on the target data packet, determines security parameters through data processing; performs parameter weight calculation based on the security parameters to obtain a data packet security value; if the data packet security value is greater than a preset threshold, the target data packet is sent to the target virtual switch. The present application obtains the target data packet by first routing the target data packet to a micro-isolated virtual machine corresponding to the target virtual switch, and then performs security verification on the target data packet through the data packet security value. Only the verified target data packet can be sent to the target virtual switch. In this way, the accuracy of the security performance assessment of data packets in micro-isolated virtual machines can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0046] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0047] Figure 1 A flowchart of the first embodiment of the method for data packet security assessment of the present application is provided;

[0048] Figure 2 A flowchart of the second embodiment of the method for data packet security assessment of the present application is provided;

[0049] Figure 3 A flowchart of the third embodiment of the method for data packet security assessment of the present application is provided;

[0050] Figure 4 A flowchart of the fourth embodiment of the method for data packet security assessment of the present application is provided;

[0051] Figure 5 This is a schematic diagram of the module structure of the data packet security assessment device according to an embodiment of the present application;

[0052] Figure 6 A schematic diagram of the device structure of the hardware operating environment involved in the data packet security assessment method of the embodiment of the present application.

[0053] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0054] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0055] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0056] The main solution of the embodiment of the present application is: obtain the target data packet; determine the security parameters through data processing based on the target data packet; calculate the parameter weights based on the security parameters to obtain the data packet security value; if the data packet security value is greater than a preset threshold, send the target data packet to the target virtual switch.

[0057] At present, the industry usually implements information security control by setting up micro-isolated virtual machines. However, the current data packet security assessment method for micro-isolated virtual machines lacks a comprehensive and complete security assessment strategy, and the accuracy of the security performance assessment of data packets is not high.

[0058] The present application obtains the target data packet by first routing the target data packet to the micro-isolated virtual machine corresponding to the target virtual switch, and then performs double security verification on the target data packet based on the access control policy and the data packet security value through the micro-isolated virtual machine. Only the verified target data packet can be sent to the target virtual switch. In this way, the accuracy of the security performance evaluation of the data packet in the micro-isolated virtual machine can be improved.

[0059] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, a data packet security assessment system, etc. The following takes the data packet security assessment system as an example to illustrate this embodiment and the following embodiments.

[0060] Based on this, the present application embodiment provides a data packet security assessment method, referring to Figure 1 , Figure 1 This is a flowchart of the first embodiment of the data packet security assessment method of the present application.

[0061] In this embodiment, the data packet security assessment method includes steps S10 to S30:

[0062] Step S10, obtaining a target data packet;

[0063] It should be noted that the data packet security assessment method proposed in this application is applied to the scenario of security performance assessment of a large amount of data in a virtual data environment. The data packet is sent by the sender and received by the object to which the data packet is to be sent. The sending object here can be a target virtual switch in the virtual data environment related business. Therefore, the destination IP address of the target data packet is the IP address of the target virtual switch corresponding to the micro-isolated virtual machine. In this embodiment, a micro-isolated virtual switch is set between the sender and the sending object. Each virtual switch corresponds to a micro-isolated virtual machine. The data packet sent to the target virtual switch needs to be routed to the micro-isolated virtual machine first. Only after the data packet meets the access control policy and the data security is determined based on the security value of the data packet, the data is sent to the virtual machine, otherwise the data is not sent. Therefore, this embodiment realizes data security protection of the virtual machine.

[0064] Step S20, determining security parameters through data processing based on the target data packet;

[0065] Before determining the security parameters, it is necessary to verify the access rights of the target data packet based on the preset access control policy, and only if the access rights are passed, can the security parameters be determined based on the target data packet through data processing. Among them, the access control policy can be set according to user needs or actual business needs, and the access control policy is configured in the micro-isolated virtual machine. In addition, the access control policy is used to limit what kind of data can access the virtual switch. Specifically, the present application compares the target data packet with the preset access control policy to verify whether the data packet has access rights. The access control policy can be a set of rules that specifies which types of data packets can pass and which need to be intercepted or checked.

[0066] For example, the access control policy may include a whitelist, which includes IP addresses that can access the virtual switch. For another example, the access control policy may also include a blacklist, access rules (such as network protocols), and the like.

[0067] After the access authority is approved, the present embodiment determines the security parameters through data processing based on the target data packet, wherein the security parameters can represent the data security level when the data packet passes through each node or link.

[0068] Step S30, performing parameter weight calculation based on the security parameter to obtain a data packet security value;

[0069] When the access right verification is passed, the micro-isolated virtual machine performs security processing on the data packet. If the processing result is safe, it is sent to the virtual machine. If the processing result is unsafe, it is discarded and an abnormal warning is sent. In this embodiment, the basis for the security processing of the data packet by the micro-isolated virtual machine is the data packet security value. The data packet security value is generated by the micro-isolated virtual machine after evaluating the security value of the data packet according to the device security level of all nodes on the data packet transmission link, the processing of the data packet sent by the source IP by each node, and the processing of the data packet by the transmission link. Specifically, after the micro-isolated virtual machine performs a security assessment, a data packet security value will be obtained, which can be a score indicating the security level of the data packet. It can be understood that by performing a security assessment on the data packet, the forgery and tampering of the data packet can be effectively detected and prevented, and the reliability of network communication can be improved. In this embodiment, it is also necessary to formulate a preset security value calculation formula, and the security value calculation formula can be combined with multiple security parameters to perform parameter weight calculation to obtain the security value of the data packet. The security value calculation formula can involve security level weight allocation, rule matching, anomaly detection, etc.

[0070] Step S40: If the data packet security value is greater than a preset threshold, the target data packet is sent to the target virtual switch.

[0071] It should be noted that if the data packet security value is greater than the preset threshold, that is, it is considered safe, then the target data packet is sent to the target virtual switch. The target data packet can continue to be transmitted in the network or be passed to the target virtual switch. Only safe data packets will be sent to the target virtual switch, thereby reducing network congestion and bandwidth consumption, thereby optimizing network performance.

[0072] In the present embodiment, the target data packet is obtained; based on the target data packet, security parameters are determined through data processing; parameter weights are calculated based on the security parameters to obtain a data packet security value; if the data packet security value is greater than a preset threshold, the target data packet is sent to the target virtual switch. The present application obtains the target data packet by first routing the target data packet to the micro-isolated virtual machine corresponding to the target virtual switch, and then performs a double security verification on the target data packet based on the access control policy and the data packet security value through the micro-isolated virtual machine. Only the verified target data packet can be sent to the target virtual switch. In this way, the accuracy of the security performance evaluation of the data packet in the micro-isolated virtual machine can be improved.

[0073] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can be referred to the above introduction, and will not be repeated in the following. Figure 2 , Figure 2 This is a flow chart of the second embodiment of the data packet security assessment method of the present application; Figure 2 As shown, the step of determining the security parameter by data processing based on the target data packet may include steps S201 to S204:

[0074] Step S201, based on a preset access control policy, obtaining attribute information of the target data packet;

[0075] It should be noted that this embodiment ensures that the access to the data packet is legal through the access control policy, that is, using the preset access control policy to check whether the target data packet has the appropriate permission to be accessed. The attribute information of the target data packet may include attribute information such as the source IP address, the destination IP address, the port number, the protocol type, and the user identity. Specifically, the step of obtaining the attribute information of the target data packet may include: extracting the source IP address, the network protocol, the source port, and other attribute information in the target data packet through tools such as Wireshark (network packet capture).

[0076] Step S202, performing access permission verification based on the attribute information, and if the access permission verification passes, parsing the target data packet to obtain parsed data;

[0077] It should be noted that this embodiment uses the obtained attribute information to verify the access rights of the target data packet. If the verification is passed, it means that the data packet can continue to be processed, otherwise it will be rejected or blocked. After passing the access rights verification, this embodiment further parses the target data packet. The parsed data may include the specific content of the data packet, such as header information, payload and other data.

[0078] Step S203: Based on the parsed data, determine security parameters through information statistics.

[0079] It should be noted that security parameters may include content characteristics, behavior patterns, embedded commands or scripts, and whether malicious code is contained in a data packet. Methods for determining security parameters through information statistics based on parsed data usually include in-depth analysis of the parsed data to understand its patterns and statistical distribution laws.

[0080] In the present embodiment, the attribute information of the target data packet is obtained based on a preset access control policy; access rights are verified based on the attribute information, and if the access rights are verified, the target data packet is parsed to obtain parsed data; security parameters are determined based on the parsed data through information statistics; and the security value of the data packet is obtained by evaluation based on the security parameters and a preset security value calculation formula. Through the above scheme, the present embodiment ensures the legitimacy and security of the data packet through multiple verification and parsing processes to prevent malicious attacks, data leakage or other security threats.

[0081] Based on the second embodiment of the present application, in the third embodiment of the present application, the same or similar contents as those in the above-mentioned second embodiment can refer to the above introduction, and will not be repeated in the following. Figure 3 , Figure 3 Schematic diagram of the flow of the third embodiment of the data packet security assessment method of the present application; Figure 3 As shown,

[0082] The step of determining the security parameter through information statistics based on the parsed data may include steps S2031 to S2034:

[0083] Step S2031, based on the parsed data, determining the target link and target node corresponding to the target data packet, wherein the target node includes a source IP node;

[0084] In this embodiment, after obtaining the parsed data, it is necessary to determine the target link and target node corresponding to the target data packet, wherein the target node includes the source IP node; the target link is the link of the target data packet when it is transmitted to the target virtual switch, and the target node is all nodes on the target link except the target virtual switch. In addition, it should be noted that the target node can be determined by programs such as traceroute. The source IP node is the node corresponding to the device that sends the data packet.

[0085] Step S2032, based on the target nodes, determining the device security parameters corresponding to each of the target nodes through information statistics;

[0086] It should be noted that the device security parameters are obtained based on a comprehensive assessment of the device by the security protection software of the device. For example, the current security level of the device is detected by the firewall and other security protection software running on the device; or, the firewall and other security protection software running on the device periodically detects the security status of the device, obtains the value of the most recent detection through information statistics, and uses it as the device security parameter. The acquisition method of the device security parameters corresponding to the target node includes: method one, sending a security level acquisition request to the target node through the micro-isolation virtual machine, and the target node returns the node device security parameters based on the request; method two, the device security parameters can be first reported to the preset summary node through the target node periodically, and then reported to the micro-isolation virtual machine through the summary node.

[0087] Step S2033, based on the source IP node, determining the source IP security parameter corresponding to the source IP node through information statistics;

[0088] It should be noted that the source IP security parameter represents the security level of the device (source IP node) that sends the data packet.

[0089] Step S2034: Based on the source IP node and the target link, determine the link security parameter corresponding to the target link through information statistics.

[0090] It should be noted that the link security parameter represents the security level of the target link.

[0091] In this embodiment, security parameters can be divided from the data layer where the data packet is transmitted from the source IP node to the target virtual switch, that is, the security parameters may include device security parameters, source IP security parameters, and link security parameters. The device security parameters characterize the security level of the relevant device itself during the transmission of the data packet, the source IP security parameters characterize the security level of the device (source IP node) of the sender of the target data packet, and the link security parameters characterize the security level of the target link. This embodiment evaluates the security of the data from two levels, data generation and data transmission, by determining the security parameters. The data is only transmitted when it is finally evaluated to be secure, thus avoiding the security risks caused by the situation where the data packet meets the access control policy but is not secure, thereby improving the accuracy of the security performance evaluation of the data packet in the micro-isolated virtual machine.

[0092] It should be noted that the execution order of steps S2032 to S2034 is not specifically limited in this embodiment, that is, the order of determining the device security parameters, source IP security parameters, and link security parameters is not limited. Taking step S2032 as an example, step S2032 can be executed before step S2033 and step S2034, can be executed between step S2033 and step S2034, and can be executed after step S2033 and step S2034. In addition, the security parameters can also include only one or more of the device security parameters, source IP security parameters, and link security parameters. In the specific implementation process, the appropriate security parameters can be selected according to actual needs.

[0093] In a feasible implementation manner, based on the source IP node, determining the source IP security parameter corresponding to the source IP node through information statistics, step S2033 may include steps A1 to A5:

[0094] Step A1, accessing the pre-acquired traffic log to obtain historical data packet log data;

[0095] It should be noted that the traffic log is a log file that records network data transmission, and specifically includes various information about network traffic, such as source IP address, destination IP address, port number, transmission protocol, data packet size, timestamp, etc. This embodiment obtains historical data packet log data by accessing the content of the relevant statistical downlink data packets in the traffic log, wherein the historical data packet log data includes relevant information about all data packets received by the micro-isolated virtual machine.

[0096] Step A2, based on the historical data packet log data, counting the total number of data packets received within a preset time interval to obtain the total number of data packets received;

[0097] Specifically, this embodiment counts the number of all data packets received within a preset time interval based on the historical data packet log, thereby obtaining the total number of data packets received. The number of data packets may be the number of times or the amount of data. The time interval may be set according to actual conditions during the specific implementation process, and this embodiment does not limit this.

[0098] Step A3, based on the historical data packet log data and the source IP node, counting the number of data packets sent by the source IP node and received within a preset time interval to obtain the total number of source IP data packets sent;

[0099] Specifically, this embodiment is based on historical data packet logs, and counts the number of data packets sent from the source IP node to the micro-isolated virtual machine within the same time interval to obtain the total number of source IP data packets sent.

[0100] Step A4, based on the historical data packet log data and the source IP node, counting the number of forwarded data packets in the data packets sent by the source IP node and received within a preset time interval to obtain the total forwarding amount of the source IP data packets;

[0101] It should be noted that if the destination IP address of the data packet sent by the source IP node is not the target node, the target node will forward it according to the preset routing policy. Therefore, this embodiment can determine the forwarding data packets that need to be forwarded on each target node through the micro-isolation virtual machine, and count their number to obtain the total forwarding amount of the source IP data packet;

[0102] Step A5, calculating based on the total amount of data packets received, the total amount of source IP data packets sent and the total amount of source IP data packets forwarded, to obtain the source IP security parameters.

[0103] It should be noted that this embodiment evaluates the security level of the device (source IP node) sending the target data packet based on the total amount of data packets received, the total amount of source IP data packets sent, and the total amount of source IP data packets forwarded. The specific calculation method can be determined according to actual needs. In addition, this embodiment does not limit the execution order of steps A2 to A4, and the above steps A2 to A4 can be combined by oneself in the specific implementation process.

[0104] In another feasible implementation manner, based on the source IP node and the target link, determining the link security parameter corresponding to the target link through information statistics, step S2034 may include steps B1 to B7:

[0105] Step B1, accessing the pre-acquired link log to obtain historical data packet link data;

[0106] It should be noted that the link log records the link data in the data packets received by the micro-isolated virtual machine, that is, the historical data packet link data. The historical data packet link data includes all network nodes from the sending node to the receiving node, as well as the link direction.

[0107] Step B2, based on the target link data packet, determining the first same-link data packet feature, the second same-link data packet feature and the third same-link data packet feature, wherein the link corresponding to the first same-link data packet feature is the target link, the link corresponding to the second same-link data packet feature is an extended link constructed based on the target link, and the link corresponding to the third target link data packet feature is a reorganized link constructed based on each node and link direction in the target link;

[0108] It should be noted that since links have directionality, link A and link B are considered the same only if they have the same direction and the same nodes. For example, link A: IP1 (node ​​1) -> IP2 (node ​​2) -> virtual switch, link B: IP2-> IP1-> virtual switch, although the nodes are the same, they are not considered the same if the directions are different. Therefore, this embodiment determines the first same-link data packet feature, the second same-link data packet feature and the third same-link data packet feature based on the above rules. The link corresponding to the first same-link data packet feature is the target link, then the link corresponding to the first same-link data packet feature can only be IP1->IP2->virtual switch, the link corresponding to the second same-link data packet feature is an extended link built based on the target link, for example, the target link is IP1->IP2->virtual switch, then the link corresponding to the second same-link data packet feature can be: IP0 (node ​​0)->IP1->IP2->virtual switch; the link corresponding to the third target link data packet feature is a reorganized link built based on each node and link direction in the target link, for example, the target link is IP1->IP2->virtual switch, then the link corresponding to the third same-link data packet feature can be: IP1->IP2->IP3->virtual switch.

[0109] Step B3, based on the historical data packet link data, the source IP node and the target link, counting the number of data packets that meet the first same-link data packet characteristics and are sent by the source IP node within a preset time interval, to obtain the total number of source IP same-link data packets;

[0110] It should be noted that this embodiment performs link comparison based on historical data packet link data, source IP nodes and target links to count the number of data packets received from the source IP node within a preset time interval and that meet the characteristics of the first same-link data packets, and uses the counted number of data packets as the total number of source IP same-link data packets.

[0111] Step B4, based on the historical data packet link data and the target link, counting the number of data packets received within a preset time interval that meet the characteristics of the second same-link data packets, to obtain the total number of complete same-link data packets;

[0112] It should be noted that this embodiment performs link comparison based on historical data packet link data and the target link to count the number of data packets received within a preset time interval that meet the characteristics of the second same-link data packet, and uses the counted number of data packets as the total number of complete same-link data packets.

[0113] Step B5, based on the historical data packet link data and the target link, counting the number of data packets received within a preset time interval that meet the characteristics of the third same-link data packet, to obtain the total number of partial same-link data packets;

[0114] It should be noted that this embodiment performs link comparison based on historical data packet link data and the target link to count the number of data packets received within a preset time interval that meet the characteristics of the third same-link data packet, and uses the number of data packets counted as the total number of partial same-link data packets;

[0115] Step B6, based on the historical data packet link data and the target link, generating a quantity attribute value of data packets received within a preset time interval and meeting the characteristics of the third same-link data packets;

[0116] It should be noted that the quantity attribute value is the number of nodes that are the same as the target link in the link of the data packets that meet the third same-link data packet characteristics received by the micro-isolated virtual machine within the preset time interval. For example, the target link is IP1->IP2->virtual switch, and the link of the data packets that meet the third same-link data packet characteristics received by the micro-isolated virtual machine within the preset time interval is IP1->IP2->IP3->virtual switch, then the number of nodes that are the same in the two links is 3, that is, the quantity attribute value is 3.

[0117] Step B7, calculate based on the total number of source IP same-link data packets, the total number of complete same-link data packets, the total number of partial same-link data packets and the quantity attribute value to obtain the link security parameter.

[0118] It should be noted that this embodiment evaluates the security of the transmission link based on the total number of source IP same-link data packets, the total number of complete same-link data packets, the total number of partial same-link data packets and the quantity attribute value. The specific calculation method can be determined according to actual needs. In addition, this embodiment does not limit the execution order of steps B3 to B8, and the above steps B3 to B8 can be combined by yourself during the specific implementation process.

[0119] The above are only two feasible implementations provided by this embodiment. This embodiment does not specifically limit the specific implementations of step S2033 and step S2034.

[0120] Exemplarily, in order to help understand the implementation process of the data packet security assessment method obtained by combining this embodiment with the above-mentioned embodiment 2, as another feasible implementation mode, the step of performing parameter weight calculation based on the security parameter to obtain the data packet security value in this embodiment may include:

[0121] Parameter weight calculation is performed based on the device security parameter, the source IP security parameter, the link security parameter and a preset security value calculation formula to obtain the data packet security value.

[0122] It should be noted that, according to the above steps S2031 to S2034, steps A1 to A5 and steps B1 to B7, the device security parameter is recorded as S1, the source IP security parameter is recorded as S2, the link security parameter is recorded as S3, and the total number of data packets received is recorded as n all , the total amount of source IP data packets sent is recorded as The total amount of source IP data packets forwarded is recorded as The total number of source IP packets on the same link is recorded as The total number of complete packets on the same link is recorded as The total amount of data packets in the same link is recorded as The value of the quantity attribute is denoted by x.

[0123] The device security parameter S1 is obtained by the node device security parameter S of each target node. IP Obtained through calculation, the calculation formula is as follows:

[0124]

[0125] Among them, max{S IP} is the maximum value of the node device security parameters corresponding to all target nodes. The min{S IP} is the minimum value of the node device security parameter corresponding to all target nodes. The avg{S IP} is the average value of the node device security parameters corresponding to all target nodes. S1 represents the average security level of all target nodes in the link. The larger the value, the safer it is.

[0126] The formula for calculating the source IP security parameter S2 is as follows:

[0127]

[0128] Among them, n all is the total number of packets received, The total amount of source IP packets sent. The total amount of source IP packets forwarded.

[0129] The formula for calculating the link security parameter denoted as S3 is as follows:

[0130]

[0131] in, is the total number of packets with the same link as the source IP, is the total number of complete packets on the same link, is the total number of data packets on the same link, and x is the quantity attribute value.

[0132] Therefore, combining formula (1), formula (2), and formula (3), the formula for calculating the data packet security value x is as follows:

[0133] S=S1+S2+S3 (4)

[0134] It should be noted that the above examples are only used to assist in understanding the present application and do not constitute a limitation on the data packet security assessment method of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0135] This embodiment adopts the above scheme, specifically by determining the target link and target node corresponding to the target data packet based on the parsed data, wherein the target node includes the source IP node; based on the target node, determining the device security parameters corresponding to each of the target nodes; based on the source IP node, determining the source IP security parameters corresponding to the source IP node; based on the source IP node and the target link, determining the link security parameters corresponding to the target link. This embodiment evaluates the security value of the data packet according to the device security level of all nodes on the data packet transmission link, the processing of the data packet sent by the source IP by each node, and the processing of the data packet by the transmission link, and then evaluates the security of the data from the two levels of data generation and data transmission, ensuring the accurate evaluation of the security level of the data packet.

[0136] Based on the first embodiment of the present application, in the fourth embodiment of the present application, the same or similar contents as those in the first embodiment can be referred to the above description, and will not be described in detail later. Figure 4 , Figure 4 This is a flow chart of the fourth embodiment of the data packet security assessment method of the present application; Figure 4 As shown, after the step of calculating the parameter weight based on the security parameter to obtain the data packet security value, step S50 may be included:

[0137] Step S50: If the data packet security value is less than or equal to a preset threshold, upon receiving a data packet security confirmation instruction input by a user, the target data packet is sent to the target virtual switch.

[0138] Specifically, the present embodiment first compares the security value of the target data packet with a preset security threshold. If the security value is less than or equal to the preset threshold, the data packet is considered to be risky. If the security value is lower than the preset threshold, the system will generate a suspected risk warning message, which may include information about the source, content, risk type, etc. of the data packet. Finally, the present embodiment sends the generated suspected risk warning message to the client so that the client can receive it in time and make a corresponding response.

[0139] It should be noted that the preset threshold may be an empirical value or a value obtained through sample data analysis, such as performing big data analysis on a large amount of sample data labeled safe and unsafe to obtain a threshold suitable for the network environment.

[0140] Specifically, if the data packet security value is not greater than the preset threshold, it is considered that there is a risk. However, since it meets the access control policy, it will be left in the micro-isolated virtual machine and wait for the client to send a secondary security confirmation instruction based on the risk warning information under the preset response time conditions. The user is asked to confirm whether to forward it to the virtual switch. If the user disagrees or does not confirm within a period of time, it will not be forwarded.

[0141] In this embodiment, a data packet security assessment method based on micro-isolation is provided, and each virtual switch corresponds to a micro-isolated virtual machine. The data packet of the virtual machine is first routed to the micro-isolated virtual machine. The data packet is sent to the virtual machine only after it meets the access control policy and the data security is determined based on the security value of the data packet. Otherwise, the data is not sent. In this way, data security protection in a virtual data environment can be achieved, and the accuracy of the micro-isolated virtual machine's assessment of data packet security performance can be improved.

[0142] It should be noted that the above embodiments can be reasonably combined and implemented according to actual conditions, and this embodiment will not be described in detail.

[0143] This application also provides a data packet security assessment device, which is used in micro-isolation virtual machines. Please refer to Figure 5 , the data packet security assessment device comprises:

[0144] A data receiving module 10 is used to obtain a target data packet;

[0145] A data processing module 20, configured to determine security parameters through data processing based on the target data packet;

[0146] A parameter calculation module 30, configured to calculate parameter weights based on the security parameters to obtain a data packet security value;

[0147] The data packet forwarding module 40 is configured to send the target data packet to the target virtual switch if the data packet security value is greater than a preset threshold.

[0148] Optionally, the data processing module 20 is further used for:

[0149] Based on a preset access control policy, obtaining attribute information of the target data packet;

[0150] Performing access permission verification based on the attribute information, and if the access permission verification passes, parsing the target data packet to obtain parsed data;

[0151] Based on the analyzed data, security parameters are determined through information statistics.

[0152] Optionally, the data processing module 20 is further used for:

[0153] Based on the parsed data, determine the target link and target node corresponding to the target data packet, wherein the target node includes a source IP node;

[0154] Based on the target nodes, determining device security parameters corresponding to each of the target nodes through information statistics;

[0155] Based on the source IP node, determining the source IP security parameter corresponding to the source IP node through information statistics;

[0156] Based on the source IP node and the target link, a link security parameter corresponding to the target link is determined through information statistics.

[0157] Optionally, the data processing module 20 is further used for:

[0158] Access the pre-acquired traffic logs to obtain historical data packet log data;

[0159] Based on the historical data packet log data, the total number of data packets received within a preset time interval is counted to obtain the total number of data packets received;

[0160] Based on the historical data packet log data and the source IP node, counting the number of data packets sent by the source IP node and received within a preset time interval to obtain the total number of source IP data packets sent;

[0161] Based on the historical data packet log data and the source IP node, counting the number of forwarded data packets in the data packets sent by the source IP node and received within a preset time interval to obtain the total forwarding amount of the source IP data packets;

[0162] The source IP security parameter is obtained by performing calculation based on the total amount of data packets received, the total amount of source IP data packets sent, and the total amount of source IP data packets forwarded.

[0163] Optionally, the data processing module 20 is further used for:

[0164] Access the pre-acquired link log to obtain historical data packet link data;

[0165] Based on the target link data packet, determine a first same-link data packet feature, a second same-link data packet feature, and a third same-link data packet feature, wherein the link corresponding to the first same-link data packet feature is the target link, the link corresponding to the second same-link data packet feature is an extended link constructed based on the target link, and the link corresponding to the third target link data packet feature is a reorganized link constructed based on each node and link direction in the target link;

[0166] Based on the historical data packet link data, the source IP node and the target link, the number of data packets that meet the first same-link data packet characteristics and are received and sent by the source IP node within a preset time interval is counted to obtain the total number of source IP same-link data packets;

[0167] Based on the historical data packet link data and the target link, counting the number of data packets received within a preset time interval that meet the characteristics of the second same-link data packets, to obtain the total number of complete same-link data packets;

[0168] Based on the historical data packet link data and the target link, counting the number of data packets received within a preset time interval that meet the characteristics of the third same-link data packet, to obtain a total number of partial same-link data packets;

[0169] Based on the historical data packet link data and the target link, generating a quantity attribute value of data packets received within a preset time interval and meeting the characteristics of the third same-link data packet;

[0170] The link security parameter is obtained by calculation based on the total amount of source IP same-link data packets, the total amount of complete same-link data packets, the total amount of partial same-link data packets and the quantity attribute value.

[0171] Optionally, the data packet forwarding module 40 is further configured to:

[0172] If the data packet security value is less than or equal to a preset threshold, upon receiving a data packet security confirmation instruction input by a user, the target data packet is sent to the target virtual switch.

[0173] The data packet security assessment device provided by the present application adopts the data packet security assessment method in the above embodiment, which can solve the technical problem of how to improve the accuracy of the security performance assessment of data packets in micro-isolated virtual machines. Compared with the prior art, the beneficial effects of the data packet security assessment device provided by the present application are the same as the beneficial effects of the data packet security assessment method provided by the above embodiment, and the other technical features in the data packet security assessment device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0174] The present application provides a data packet security assessment device, which includes: at least one processor; and a memory connected to the at least one processor in communication; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the data packet security assessment method in the above-mentioned embodiment 1.

[0175] Reference below Figure 6 , which shows a schematic diagram of the structure of a data packet security assessment device suitable for implementing the embodiment of the present application. The data packet security assessment device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 6 The data packet security assessment device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0176] like Figure 6As shown, the data packet security assessment device may include a processing device 1001 (e.g., a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the data packet security assessment device are also stored. The processing device 1001, ROM1002, and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 may allow the data packet security assessment device to communicate with other devices wirelessly or by wire to exchange data. Although the figure shows a data packet security assessment device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems may be implemented or have instead.

[0177] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0178] The data packet security assessment device provided by the present application adopts the data packet security assessment method in the above embodiment, which can solve the technical problem of how to improve the accuracy of the security performance assessment of data packets in micro-isolated virtual machines. Compared with the prior art, the beneficial effects of the data packet security assessment device provided by the present application are the same as the beneficial effects of the data packet security assessment method provided by the above embodiment, and the other technical features in the data packet security assessment device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0179] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0180] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0181] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the data packet security assessment method in the above-mentioned embodiment.

[0182] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0183] The computer-readable storage medium may be included in the data packet security assessment device; or may exist independently without being assembled into the data packet security assessment device.

[0184] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by the data packet security assessment device, the data packet security assessment device:

[0185] Get the target data packet;

[0186] Based on the target data packet, determining security parameters through data processing;

[0187] Calculate the parameter weight based on the security parameter to obtain the data packet security value;

[0188] If the data packet security value is greater than a preset threshold, the target data packet is sent to the target virtual switch.

[0189] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0190] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0191] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0192] The readable storage medium provided in the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned data packet security assessment method, and can solve the technical problem of how to improve the accuracy of the security performance assessment of data packets in micro-isolated virtual machines. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in the present application are the same as the beneficial effects of the data packet security assessment method provided in the above-mentioned embodiment, and will not be repeated here.

[0193] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned data packet security assessment method when executed by a processor.

[0194] The computer program product provided by the present application can solve the technical problem of how to improve the accuracy of the security performance evaluation of data packets in micro-isolated virtual machines. Compared with the prior art, the beneficial effects of the computer program product provided by the present application are the same as the beneficial effects of the data packet security evaluation method provided by the above embodiment, which will not be repeated here.

[0195] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A data packet security assessment method, characterized in that: Applied to a micro-isolated virtual machine, the method includes: Get the target data packet; Based on the target data packet, determining security parameters through data processing; Calculate the parameter weight based on the security parameter to obtain the data packet security value; If the data packet security value is greater than a preset threshold, the target data packet is sent to the target virtual switch.

2. The method according to claim 1, characterized in that The step of determining the security parameter by data processing based on the target data packet comprises: Based on a preset access control policy, obtaining attribute information of the target data packet; Performing access permission verification based on the attribute information, and if the access permission verification passes, parsing the target data packet to obtain parsed data; Based on the analyzed data, security parameters are determined through information statistics.

3. The method according to claim 2, characterized in that The step of determining the security parameter through information statistics based on the parsed data includes: Based on the parsed data, determine the target link and target node corresponding to the target data packet, wherein the target node includes a source IP node; Based on the target nodes, determining device security parameters corresponding to each of the target nodes through information statistics; Based on the source IP node, determining the source IP security parameter corresponding to the source IP node through information statistics; Based on the source IP node and the target link, a link security parameter corresponding to the target link is determined through information statistics.

4. The method according to claim 3, characterized in that The step of determining the source IP security parameter corresponding to the source IP node through information statistics based on the source IP node comprises: Access the pre-acquired traffic logs to obtain historical data packet log data; Based on the historical data packet log data, the total number of data packets received within a preset time interval is counted to obtain the total number of data packets received; Based on the historical data packet log data and the source IP node, counting the number of data packets sent by the source IP node and received within a preset time interval to obtain the total number of source IP data packets sent; Based on the historical data packet log data and the source IP node, counting the number of forwarded data packets in the data packets sent by the source IP node and received within a preset time interval to obtain the total forwarding amount of the source IP data packets; The source IP security parameter is obtained by performing calculation based on the total amount of data packets received, the total amount of source IP data packets sent, and the total amount of source IP data packets forwarded.

5. The method according to claim 3, characterized in that The step of determining the link security parameter corresponding to the target link through information statistics based on the source IP node and the target link comprises: Access the pre-acquired link log to obtain historical data packet link data; Based on the target link data packet, determine a first same-link data packet feature, a second same-link data packet feature, and a third same-link data packet feature, wherein the link corresponding to the first same-link data packet feature is the target link, the link corresponding to the second same-link data packet feature is an extended link constructed based on the target link, and the link corresponding to the third target link data packet feature is a reorganized link constructed based on each node and link direction in the target link; Based on the historical data packet link data, the source IP node and the target link, the number of data packets that meet the first same-link data packet characteristics and are received and sent by the source IP node within a preset time interval is counted to obtain the total number of source IP same-link data packets; Based on the historical data packet link data and the target link, counting the number of data packets received within a preset time interval that meet the characteristics of the second same-link data packets, to obtain the total number of complete same-link data packets; Based on the historical data packet link data and the target link, counting the number of data packets received within a preset time interval that meet the characteristics of the third same-link data packet, to obtain a total number of partial same-link data packets; Based on the historical data packet link data and the target link, generating a quantity attribute value of data packets received within a preset time interval and meeting the characteristics of the third same-link data packets; The link security parameter is obtained by calculation based on the total amount of source IP same-link data packets, the total amount of complete same-link data packets, the total amount of partial same-link data packets and the quantity attribute value.

6. The method according to claim 1, characterized in that After the step of calculating parameter weights based on the security parameters to obtain a data packet security value, the method further comprises: If the data packet security value is less than or equal to a preset threshold, upon receiving a data packet security confirmation instruction input by a user, the target data packet is sent to the target virtual switch.

7. A data packet security assessment device, applied to a micro-isolated virtual machine, characterized in that: The data packet security assessment device comprises: A data receiving module, used for acquiring a target data packet; A data processing module, used for determining security parameters through data processing based on the target data packet; A parameter calculation module, used to calculate parameter weights based on the security parameters to obtain a data packet security value; The data packet forwarding module is used to send the target data packet to the target virtual switch if the data packet security value is greater than a preset threshold.

8. A data packet security assessment device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the data packet security assessment method according to any one of claims 1 to 6.

9. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the data packet security assessment method according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the data packet security assessment method according to any one of claims 1 to 6 are implemented.

Images