Dynamic monitoring method and device for network security, medium and product

Abstract

The invention relates to the technical field of network security, in particular to a dynamic monitoring method and device for network security, a medium and a product, and the method comprises the steps: carrying out key data extraction based on a network data packet, determining key flow information, carrying out flow monitoring analysis based on the key flow information, and determining a first monitoring result. Then, key data extraction is carried out based on the multi-source log data, behavior analysis is carried out on key behavior information by utilizing the behavior analysis model, and a second monitoring result is determined; meanwhile, information matching is carried out based on the key flow information, the key behavior information and the threat intelligence information, and a third monitoring result is determined. And finally, integrating the first monitoring result, the second monitoring result and the third monitoring result to obtain a network security monitoring result. A network security dynamic monitoring method combining flow monitoring, behavior monitoring and threat intelligence monitoring is adopted, a multi-layer and multi-dimensional defense system is formed, and the real-time performance and the dynamic performance of defense are improved.

Description

Technical Field

[0001] The present application relates to the technical field of network security, and in particular to a method, device, medium and product for dynamic monitoring of network security. Background Art

[0002] With the rapid development of the Internet, network security issues have become increasingly prominent and have become an important factor affecting social stability and economic development. The means of network attacks are constantly upgrading, and the attack methods are becoming increasingly complex and changeable, which has brought huge challenges to the security protection of network systems.

[0003] Traditional network security protection methods mainly rely on static defense measures such as firewalls and intrusion detection systems. These measures can only defend against known threats and are difficult to deal with the evolving network attack methods. Moreover, traditional network security protection methods can only detect and respond after the attack, lacking real-time and dynamic performance.

[0004] Therefore, how to provide a dynamic monitoring method for network security to improve the dynamic nature of monitoring is an urgent problem to be solved by those skilled in the art. Summary of the invention

[0005] The purpose of this application is to provide a method, device, medium and product for dynamic monitoring of network security, which are used to solve at least one of the above technical problems.

[0006] The above invention objectives of the present application are achieved through the following technical solutions: In a first aspect, the present application provides a method for dynamic monitoring of network security, which adopts the following technical solution: A dynamic monitoring method for network security, comprising: Using a flow monitoring device to obtain network data packets in real time, and extracting key data based on the network data packets to determine key flow information, wherein the key flow information includes: data packet information, flow statistics information, and flow distribution trend information; Performing flow monitoring and analysis based on the key flow information to determine a first monitoring result; Acquire multi-source log data and a behavior analysis model, extract key data based on the multi-source log data, and determine key behavior information, wherein the key behavior information includes: user identity information, behavior time information, behavior type information, behavior result information, geographic location information, device information, security-related information, and session information; Performing behavior analysis on the key behavior information using a behavior analysis model to determine a second monitoring result; Acquire threat intelligence information, perform information matching based on the key traffic information, the key behavior information, and the threat intelligence information, and determine a third monitoring result; The first monitoring result, the second monitoring result and the third monitoring result are integrated to obtain a network security monitoring result.

[0007] By adopting the above technical solution, the network data packets are obtained in real time using the flow monitoring equipment, key data are extracted based on the network data packets, key flow information is determined, and flow monitoring and analysis are performed based on the key flow information to determine the first monitoring result. Then, key data is extracted based on multi-source log data to determine key behavior information, and behavior analysis is performed on the key behavior information using the behavior analysis model to determine the second monitoring result. At the same time, information matching is performed based on key flow information, key behavior information and threat intelligence information to determine the third monitoring result. Finally, the network security monitoring result is obtained by combining the first monitoring result, the second monitoring result and the third monitoring result. The network security dynamic monitoring method combining flow monitoring, behavior monitoring and threat intelligence monitoring is adopted to form a multi-level and multi-dimensional defense system, which can timely detect and respond to abnormal behaviors and network attacks, and improve the real-time and dynamic nature of defense.

[0008] In a preferred example, the present application may be further configured as follows: after the network security monitoring result is obtained by integrating the first monitoring result, the second monitoring result and the third monitoring result, the following further includes: Prioritize the abnormal results in the network security monitoring results to determine a security abnormality sequence; Selecting protective measures based on each target abnormal result in the security abnormality sequence to determine a protective measure sequence; Perform network security protection according to the sequence of protection measures described, and in the process of performing network security protection, continuously monitor the network environment to ensure the effectiveness of the protection operations.

[0009] In a preferred example, the present application may be further configured as follows: performing flow monitoring and analysis based on the key flow information to determine a first monitoring result includes: Performing basic information analysis based on the data packet information to determine a basic information analysis result, wherein the basic information analysis includes: IP address analysis and port number analysis; Performing traffic statistics analysis based on the traffic statistics information to determine traffic statistics analysis results, wherein the traffic statistics analysis includes: total volume trend analysis and session connection analysis; Performing a distribution trend analysis based on the traffic distribution trend information to determine a distribution trend analysis result, wherein the distribution trend analysis includes: time distribution analysis and regional distribution analysis; The first monitoring result is determined by comprehensively analyzing the basic information, the traffic statistics and the distribution trend.

[0010] In a preferred example, the present application may be further configured as follows: the use of the behavior analysis model to perform behavior analysis on the key behavior information to determine the second monitoring result includes: Feature extraction is performed based on the key behavior information to obtain key behavior features, wherein the key behavior features include: user ID, user authority level, behavior frequency, operation type, operation result, impact range, geographic location, sensitive operation, and session duration; The key behavior feature is input into the behavior analysis model, the behavior analysis model is controlled to perform behavior analysis, and a second monitoring result is determined.

[0011] In a preferred example, the present application may be further configured as follows: the method for determining the threat intelligence information includes: Acquire multi-dimensional intelligence from multiple data sources, wherein the multiple data sources include: internal data sources, external data sources, and public data sources; Intelligence verification is performed based on the multi-dimensional intelligence, and the intelligence data that passes the verification is recorded as threat intelligence information and stored in the threat intelligence library.

[0012] In a preferred example, the present application can be further configured as follows: When the detection reaches the security scanning cycle, the scanning requirement is obtained, and the scanning tool and scanning parameters are determined based on the scanning requirement, wherein the scanning requirement includes: the network area to be scanned, the device type to be scanned, and the service port to be scanned; The scanning parameters are sent to the scanning tool for parameter configuration, and the scanning tool is controlled to perform a security scan to obtain a scanning result.

[0013] In a second aspect, the present application provides an electronic device, which adopts the following technical solution: at least one processor; Memory; At least one application, wherein the at least one application is stored in a memory and configured to be executed by at least one processor, and the at least one application is configured to: execute the above-mentioned dynamic monitoring method for network security.

[0014] In a third aspect, the present application provides a computer-readable storage medium, which adopts the following technical solution: A computer-readable storage medium stores a computer program, which, when executed in a computer, causes the computer to execute the above-mentioned dynamic monitoring method for network security.

[0015] In a fourth aspect, the present application provides a computer program product, which adopts the following technical solution: A computer program product includes a computer program, and when the computer program is executed by a processor, the computer program implements the above-mentioned dynamic monitoring method for network security.

[0016] In summary, the present application includes at least one of the following beneficial technical effects: Use traffic monitoring equipment to obtain network data packets in real time, extract key data based on network data packets, determine key traffic information, and perform traffic monitoring and analysis based on key traffic information to determine the first monitoring result. Then, extract key data based on multi-source log data to determine key behavior information, and use the behavior analysis model to perform behavior analysis on key behavior information to determine the second monitoring result. At the same time, information matching is performed based on key traffic information, key behavior information and threat intelligence information to determine the third monitoring result. Finally, the network security monitoring result is obtained by combining the first monitoring result, the second monitoring result and the third monitoring result. The network security dynamic monitoring method that combines traffic monitoring, behavior monitoring and threat intelligence monitoring has formed a multi-level and multi-dimensional defense system to timely detect and respond to abnormal behaviors and network attacks, and improve the real-time and dynamic nature of defense.

[0017] Prioritize the abnormal results in the network security monitoring results and determine the security abnormality sequence. By prioritizing the abnormal results, it can be ensured that the security abnormalities that pose the greatest threat to network security or have the widest impact are handled first. Targeted handling methods can significantly improve the efficiency of emergency response and reduce the impact of security incidents on enterprise operations. Select protective measures based on each target abnormal result in the security abnormality sequence, determine the protective measures sequence, and select specific protective measures for each target abnormal result, so that the protection operation is more accurate and effective. Targeted protection strategies can better respond to different types of network threats and improve the overall security protection level. Then, perform network security protection according to the protective measures sequence, and continuously monitor the network environment during the execution of network security protection to ensure the effectiveness of the protection operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 It is a flowchart of a method for dynamic monitoring of network security according to one embodiment of the present application; Figure 2 It is a structural schematic diagram of a dynamic monitoring device for network security according to one embodiment of the present application; Figure 3 It is a structural schematic diagram of an electronic device according to one embodiment of the present application. DETAILED DESCRIPTION

[0019] The following combination Figures 1 to 3 This application is described in further detail.

[0020] This specific embodiment is merely an explanation of the present application and is not a limitation of the present application. After reading this specification, a person skilled in the art may make non-creative modifications to the present embodiment as needed, but such modifications are protected by the patent law as long as they are within the scope of the present application.

[0021] In order to make the purpose, technical scheme and advantages of the embodiment of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described in conjunction with the drawings in the embodiment of the present application. Obviously, the described embodiment is a part of the embodiment of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application. It should be noted that in the optional embodiments of the present application, the object information and other related data involved, when the embodiments in the present application are applied to specific products or technologies, need to obtain the permission or consent of the object, and the collection, use and processing of the relevant data need to comply with the relevant laws, regulations and standards of the relevant countries and regions. In other words, if the data related to the object is involved in the embodiment of the present application, it needs to be obtained through the authorization and consent of the object, the authorization and consent of the relevant departments, and in accordance with the relevant laws, regulations and standards of the country and region. If personal information is involved in the embodiment, the acquisition of all personal information needs to obtain the consent of the individual. If sensitive information is involved, the separate consent of the information subject needs to be obtained, and the embodiment also needs to be implemented with the authorization and consent of the object.

[0022] In addition, the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article, unless otherwise specified, generally means that the associated objects before and after are in an "or" relationship.

[0023] The embodiments of the present application are further described in detail below in conjunction with the drawings in the specification.

[0024] The embodiment of the present application provides a method for dynamic monitoring of network security, which is performed by an electronic device, which can be a server or a terminal device, wherein the server can be an independent physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services. The terminal device can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc., but is not limited thereto. The terminal device and the server can be directly or indirectly connected via wired or wireless communication, which is not limited in the embodiment of the present application. Figure 1 As shown, the method includes step S101, step S102 and step S103, wherein: Step S101: Use the traffic monitoring device to obtain network data packets in real time, and extract key data based on the network data packets to determine key traffic information, where the key traffic information includes: data packet information, traffic statistics information, and traffic distribution trend information; perform traffic monitoring and analysis based on the key traffic information to determine the first monitoring result.

[0025] For the embodiment of the present application, the flow monitoring device is deployed on the key nodes of the network, for example, the mirror port of the core switch, router or firewall, so as to capture comprehensive network flow data. The network data packet is the basic unit of network communication, including key information such as source address, destination address, data content, etc. When the flow monitoring device is deployed in the network, the flow monitoring device will monitor and capture all data packets flowing through the device. The network data packet may come from different protocols (such as TCP, UDP, ICMP, etc.) and carry various types of data (such as web page content, email, file transfer, etc.). Then, based on the network data packet, key data extraction is performed to determine the key flow information. The key flow information refers to the key data extracted from the captured network data packet for analyzing and monitoring the network status. The key flow information includes: data packet information, flow statistics information, and flow distribution trend information, wherein the data packet information includes but is not limited to: source IP address, destination IP address, port number, protocol type, etc.; flow statistics information includes but is not limited to: data packet size, transmission rate, total flow, etc.; flow distribution trend information includes but is not limited to: flow distribution, flow trend.

[0026] Then, based on the key traffic information, traffic monitoring and analysis is performed to determine the first monitoring result. By performing traffic monitoring and analysis on the key traffic information, abnormal traffic patterns and behavior characteristics can be accurately identified, thereby improving the accuracy of traffic monitoring. There are many ways to monitor and analyze traffic. In one feasible way, basic information analysis is performed based on data packet information to determine the basic information analysis result, wherein the basic information analysis includes: IP address analysis and port number analysis; traffic statistical analysis is performed based on traffic statistical information to determine the traffic statistical analysis result, wherein the traffic statistical analysis includes: total volume trend analysis and session connection analysis; distribution trend analysis is performed based on traffic distribution trend information to determine the distribution trend analysis result, wherein the distribution trend analysis includes: time distribution analysis and regional distribution analysis; the basic information analysis result, traffic statistical analysis result and distribution trend analysis result are combined to determine the first monitoring result, wherein the first monitoring result includes: normal traffic monitoring and abnormal traffic monitoring.

[0027] Step S102: Obtain multi-source log data and a behavior analysis model, extract key data based on the multi-source log data, and determine key behavior information, where the key behavior information includes: user identity information, behavior time information, behavior type information, behavior result information, geographic location information, device information, security-related information, and session information; use the behavior analysis model to perform behavior analysis on the key behavior information to determine the second monitoring result.

[0028] For the embodiments of the present application, multi-source log data and behavior analysis models are obtained. The multi-source log data is composed of log files from multiple data sources, including but not limited to: system logs, application logs, user behavior logs, etc.; the behavior analysis model is obtained by training a machine learning algorithm based on historical user behavior data. When training the model, the training set includes normal behavior data and abnormal behavior data, and the trained behavior analysis model is deployed in a network environment to facilitate real-time monitoring of multi-source log data collected in real time.

[0029] Specifically, key data is extracted based on multi-source log data to determine key behavior information, which plays a vital role in understanding user behavior, network system status and potential abnormal activities. Key behavior information includes: user identity information, behavior time information, behavior type information, behavior result information, geographic location information, device information, security-related information and session information, wherein user identity information includes: user ID, user name, user role, user authority level, etc.; behavior time information includes: timestamp, behavior duration, behavior frequency, etc.; behavior type information includes: operation type, access resources, etc.; behavior result information includes: operation result, response time, impact range, etc.; geographic location information includes: IP address, geographic location, etc.; device information includes: device type, operating system, browser information, etc.; security-related information includes: number of login attempts, access mode, sensitive operations, etc.; session information includes: session ID, session duration and session activity, etc. After that, the behavior analysis model is used to analyze the key behavior information to determine the second monitoring result. There are many ways to analyze behavior, which are not limited in the embodiments of this application. In one feasible manner, feature extraction is performed based on key behavior information to obtain key behavior features, wherein the key behavior features include: user ID, user authority level, behavior frequency, operation type, operation result, impact range, geographic location, sensitive operation, and session duration; the key behavior features are input into a behavior analysis model, and the behavior analysis model is controlled to perform behavior analysis to determine a second monitoring result, wherein the second monitoring result includes: behavior monitoring abnormality and behavior monitoring normal.

[0030] Step S103: Acquire threat intelligence information, perform information matching based on key traffic information, key behavior information and threat intelligence information, and determine the third monitoring result; combine the first monitoring result, the second monitoring result and the third monitoring result to obtain the network security monitoring result.

[0031] For the embodiments of the present application, threat intelligence information is obtained, and information matching is performed based on key traffic information, key behavior information and threat intelligence information to determine the third monitoring result, wherein information matching for threats can quickly discover known and potential threats. There are many ways to obtain threat intelligence information. In one feasible way, multi-dimensional intelligence is obtained from multiple data sources, wherein the multiple data sources include: internal data sources, external data sources, and public data sources; intelligence verification is performed based on multi-dimensional intelligence, and the verified intelligence data is recorded as threat intelligence information and stored in a threat intelligence library. It helps electronic devices to obtain threat intelligence information in a timely and accurate manner. Threat intelligence information generally includes: attacker's means, goals, known attack codes, traffic threat characteristics, behavioral threat characteristics and other information items, wherein traffic threat characteristics are used to characterize the abnormal characteristics of network traffic when there is a threat, and behavioral threat characteristics are used to characterize the abnormal characteristics of user behavior when there is a threat. Then, using the automatic matching algorithm, the key flow information and key behavior information are compared with the threat intelligence information to find matching items of known threats. When there is a successfully matched data item, the third monitoring result is determined to be an abnormal threat intelligence monitoring; otherwise, the third monitoring result is determined to be normal threat intelligence monitoring. Finally, the network security monitoring result is obtained by combining the first monitoring result, the second monitoring result and the third monitoring result. That is, when any monitoring result is abnormal, the network security monitoring result is determined to be a network security abnormality, and the type and abnormal data corresponding to the network security abnormality are screened out and recorded as an abnormal result, so that relevant technical personnel can quickly locate the root cause of the problem and take targeted defense measures, thereby improving the sensitivity and response speed of security monitoring. Through the above technical solution, a network security dynamic monitoring method combining flow monitoring, behavior monitoring and threat intelligence monitoring is adopted to form a multi-level and multi-dimensional defense system, which can timely discover and respond to abnormal behaviors and network attacks, and improve the real-time and dynamic nature of defense.

[0032] It can be seen that in the embodiment of the present application, a flow monitoring device is used to obtain network data packets in real time, key data is extracted based on the network data packets, key flow information is determined, and flow monitoring and analysis is performed based on the key flow information to determine the first monitoring result. Then, key data is extracted based on multi-source log data to determine key behavior information, and behavior analysis is performed on the key behavior information using a behavior analysis model to determine the second monitoring result. At the same time, information matching is performed based on key flow information, key behavior information and threat intelligence information to determine the third monitoring result. Finally, the network security monitoring result is obtained by combining the first monitoring result, the second monitoring result and the third monitoring result. A network security dynamic monitoring method combining flow monitoring, behavior monitoring and threat intelligence monitoring is adopted to form a multi-level and multi-dimensional defense system, which can detect and respond to abnormal behaviors and network attacks in a timely manner, and improve the real-time and dynamic nature of defense.

[0033] Further, in order to reduce the impact of security incidents on enterprise operations and improve the overall security protection level, in the embodiment of the present application, after the first monitoring result, the second monitoring result and the third monitoring result are integrated to obtain the network security monitoring result, the following is also included: Prioritize abnormal results in network security monitoring results and determine the security abnormality sequence; Select protective measures based on each target abnormal result in the security abnormality sequence and determine the protective measures sequence; Perform network security protection according to the sequence of protection measures, and continuously monitor the network environment during the process of network security protection to ensure the effectiveness of the protection operations.

[0034] For the embodiment of the present application, the abnormal results in the network security monitoring results record the types and abnormal data corresponding to the network security abnormalities. Therefore, a risk assessment is performed based on each abnormal result in the network security monitoring results to determine the abnormal score corresponding to each abnormal result. That is, the threat probability and the degree of impact are comprehensively considered in the risk assessment process, and the priority is sorted from high to low according to the size of the abnormal score corresponding to each abnormal result to determine the security abnormality sequence. By prioritizing the abnormal results, it can be ensured that the security abnormalities that pose the greatest threat to network security or have the widest impact are handled first. Targeted processing methods can significantly improve the efficiency of emergency response and reduce the impact of security incidents on business operations.

[0035] Then, based on each target abnormal result in the security abnormal sequence, protective measures are selected to determine the protective measures sequence, that is, the correspondence between abnormal results and protective measures is pre-stored in the electronic device, so that protective measures corresponding to the abnormal results can be quickly and accurately screened out. In a feasible way, when the target abnormal result is a flow abnormality, network isolation measures are taken to prevent it from further spreading or causing greater damage; when the target abnormal result is an access abnormality in the behavior abnormality, the access control strategy is strengthened to restrict unauthorized access and operations, including strengthening identity authentication, implementing the principle of least privilege, etc.; when the target abnormal result is abnormal access to sensitive data in the behavior abnormality, the sensitive data is encrypted to ensure that even if the data is intercepted during transmission or storage, it cannot be easily decrypted; when the target abnormal result is a threat, an intrusion detection and defense system is deployed to monitor network traffic and behavior patterns in real time, and to promptly detect and prevent potential network attacks. Selecting specific protective measures for each target abnormal result makes the protection operation more accurate and effective, and the targeted protection strategy can better deal with different types of network threats and improve the overall security protection level.

[0036] Furthermore, network security protection should be implemented according to the sequence of protection measures, and in the process of implementing network security protection, a continuous network environment monitoring mechanism should be established, and professional network security monitoring tools and technologies should be used to monitor various activities and events in the network environment in real time. After the implementation of the protection measures, the protection effect should be evaluated, that is, by comparing the network security status before and after the implementation, analyzing the number and type of security incidents, etc. The evaluation results should clearly reflect the effectiveness of the protection measures, including whether the security threats have been successfully prevented and whether the occurrence of security incidents has been reduced. According to the evaluation results, the necessary adjustments and optimizations should be made to the protection measures. If it is found that some protection measures are not effective or have loopholes, they should be repaired or replaced in a timely manner; at the same time, according to the changes in the network environment and security threats, the monitoring and protection strategies should be dynamically adjusted to ensure the timeliness and effectiveness of network security protection.

[0037] It can be seen that in the embodiment of the present application, priority sorting is performed based on the abnormal results in the network security monitoring results, and a security abnormality sequence is determined. By prioritizing the abnormal results, it can be ensured that the security abnormalities that pose the greatest threat to network security or have the widest impact are handled first. Targeted processing methods can significantly improve the efficiency of emergency response and reduce the impact of security incidents on business operations. Based on each target abnormal result in the security abnormality sequence, protective measures are selected, and a protective measures sequence is determined. Specific protective measures are selected for each target abnormal result, making the protection operation more accurate and effective. Targeted protection strategies can better respond to different types of network threats and improve the overall security protection level. Then, network security protection is performed according to the protective measures sequence, and in the process of performing network security protection, the network environment is continuously monitored to ensure the effectiveness of the protection operation.

[0038] Further, in order to improve the comprehensiveness and accuracy of the first monitoring result, in an embodiment of the present application, flow monitoring and analysis is performed based on key flow information to determine the first monitoring result, including: Perform basic information analysis based on the data packet information to determine the basic information analysis results, wherein the basic information analysis includes: IP address analysis and port number analysis; Performing traffic statistics analysis based on traffic statistics information to determine traffic statistics analysis results, wherein the traffic statistics analysis includes: total volume trend analysis and session connection analysis; Performing distribution trend analysis based on the traffic distribution trend information to determine the distribution trend analysis result, wherein the distribution trend analysis includes: time distribution analysis and regional distribution analysis; The first monitoring result is determined by combining the basic information analysis results, traffic statistics analysis results and distribution trend analysis results.

[0039] For the embodiment of the present application, in the process of performing traffic monitoring and analysis, analysis is performed from three dimensions: basic information analysis, traffic statistics analysis, and distribution trend analysis, so as to improve the comprehensiveness and accuracy of the first monitoring result. Specifically, basic information analysis is performed based on data packet information to determine the basic information analysis result, wherein the basic information analysis includes: IP address analysis and port number analysis. For IP address analysis, the source IP address and the destination IP address in the data packet information are checked to identify whether there are abnormal or suspicious IP addresses, such as blacklist IPs, IPs that frequently initiate connections, etc. When there are abnormal or suspicious IP addresses, the basic information analysis result is determined to include an abnormal IP address; otherwise, the basic information analysis result is determined to include a normal IP address. For port number analysis, the port number used in the data packet information is checked to determine whether it is a commonly used port or a port related to a known vulnerability, and whether there is an illegal or abnormal port scanning behavior. When there are illegal or abnormal ports, the basic information analysis result is determined to include an abnormal port number; otherwise, the basic information analysis result is determined to include a normal port number.

[0040] Then, based on the traffic statistics information, traffic statistics analysis is performed to determine the traffic statistics analysis results, wherein the traffic statistics analysis includes: total volume trend analysis and session connection analysis. For total volume trend analysis, based on the total volume of network traffic and the traffic change trend in the traffic statistics information, by comparing historical data with real-time data, it is identified whether there is an abnormal traffic surge or sudden decrease in the total volume of network traffic. If so, it is determined that the traffic statistics analysis results include the total volume abnormality; otherwise, it is determined that the traffic statistics analysis results include the total volume normality. For session connection analysis, the duration, number of data packets, byte size, etc. of the network session are analyzed to identify long-term or high-traffic sessions, which represent potential network attacks or data leaks. At the same time, the status of the network connection is checked, such as connection establishment, data exchange, connection termination, etc., to identify whether there is abnormal connection behavior, such as illegal connection, connection timeout, etc.; if there is an abnormal session or abnormal connection behavior, it is determined that the traffic statistics analysis results include the session connection abnormality; otherwise, it is determined that the traffic statistics analysis results include the session connection normality.

[0041] At the same time, a distribution trend analysis is performed based on the traffic distribution trend information to determine the distribution trend analysis result, wherein the distribution trend analysis includes: time distribution analysis and regional distribution analysis. For time distribution analysis, the distribution of network traffic in different time periods is analyzed to identify whether there is high traffic or abnormal traffic pattern during non-working hours, which is helpful to discover potential malicious behaviors, such as DDoS attacks at night. If there is high traffic or abnormal traffic during non-working hours, the distribution trend analysis result is determined to include time distribution anomaly; otherwise, the distribution trend analysis result is determined to include time distribution anomaly. For regional distribution analysis, combined with the regional source information of network traffic, the regional distribution of network traffic is analyzed to identify whether there is traffic from special regions. Traffic from special regions indicates the existence of potential external attacks or data leakage, wherein the scope of special regions is pre-set and stored in electronic devices by relevant technical personnel according to the needs of network security protection. If there is traffic from special regions, the distribution trend analysis result is determined to include regional distribution anomaly; otherwise, the distribution trend analysis result is determined to include normal regional distribution. Finally, the first monitoring result is determined by combining the basic information analysis results, traffic statistics analysis results and distribution trend analysis results. By analyzing basic information, traffic statistics, and distribution trends simultaneously, it is possible to comprehensively cover all aspects of network security monitoring and ensure that no important information is missed. Detailed analysis within each dimension makes the first monitoring results more in-depth, which helps to discover deep-seated problems hidden in key traffic information.

[0042] It can be seen that in the embodiment of the present application, basic information analysis is performed based on the data packet information to determine the basic information analysis results, wherein the basic information analysis includes: IP address analysis and port number analysis; at the same time, traffic statistical analysis is performed based on the traffic statistical information to determine the traffic statistical analysis results, wherein the traffic statistical analysis includes: total trend analysis and session connection analysis. And, distribution trend analysis is performed based on the traffic distribution trend information to determine the distribution trend analysis results, wherein the distribution trend analysis includes: time distribution analysis and geographical distribution analysis. Finally, the basic information analysis results, traffic statistical analysis results and distribution trend analysis results are comprehensively considered to determine the first monitoring result. In the process of performing traffic monitoring and analysis, analysis is performed from three dimensions: basic information analysis, traffic statistical analysis and distribution trend analysis, so as to improve the comprehensiveness and accuracy of the first monitoring result.

[0043] Furthermore, in order to more accurately identify potential security risk behaviors, in an embodiment of the present application, a behavior analysis model is used to perform behavior analysis on key behavior information to determine a second monitoring result, including: Feature extraction is performed based on key behavior information to obtain key behavior features, where key behavior features include: user ID, user authority level, behavior frequency, operation type, operation result, impact range, geographic location, sensitive operation, and session duration; The key behavior characteristics are input into the behavior analysis model, the behavior analysis model is controlled to perform behavior analysis, and the second monitoring result is determined.

[0044] For the embodiments of the present application, feature extraction based on key behavior information, especially features including sensitive operations, user authority levels, etc., helps to more accurately identify potential security risk behaviors. At the same time, by performing feature extraction, the behavior analysis model can more accurately judge the normality or abnormality of user behavior, thereby improving the accuracy of the second monitoring result.

[0045] Specifically, feature extraction is performed based on key behavior information to obtain key behavior features, where the key behavior features include: user ID, user authority level, behavior frequency, operation type, operation result, impact range, geographic location, sensitive operation, and session duration. Feature extraction is used to extract features useful for behavior analysis from key behavior information. User ID is used to identify the user identity; user authority level is determined based on user role or configuration information, reflecting the user's authority level to access resources; behavior frequency counts the number of times a user performs a specific operation within a certain period of time; operation type classifies user operations, such as login, query, modification, deletion, etc.; operation result records whether the operation is successful or not, as well as possible error codes or descriptions; impact range assesses the impact of the operation on the system or data, which may need to be inferred in combination with system logic; geographic location determines the user's geographic location based on the user's IP address or device information; sensitive operations are operations that may have a significant impact on system security or data integrity, such as accessing sensitive data, executing high-risk commands, etc.; session duration records the length of time from user login to logout (or timeout). After that, the extracted behavior features need to be processed in multiple dimensions, including but not limited to: digitization and normalization. Among them, digitization is used to encode or convert non-numerical features into numerical form for model processing; normalization is used to normalize or standardize numerical features to eliminate the influence of different dimensions. Then, the key behavior features are input into the behavior analysis model, and the behavior analysis model is controlled to perform behavior analysis to determine the second monitoring result.

[0046] It can be seen that in the embodiment of the present application, feature extraction is performed based on key behavior information to obtain key behavior features, which helps to more accurately identify potential security risk behaviors, and input the key behavior features into the behavior analysis model to control the behavior analysis model to perform behavior analysis and determine the second monitoring result.

[0047] Furthermore, in order to reduce information blind spots and improve the comprehensiveness of intelligence, in the embodiment of the present application, the method for determining threat intelligence information includes: Acquire multi-dimensional intelligence from multiple data sources, where multiple data sources include: internal data sources, external data sources, and public data sources; Intelligence verification is performed based on multi-dimensional intelligence, and the verified intelligence data is recorded as threat intelligence information and stored in the threat intelligence library.

[0048] For the embodiments of the present application, multi-dimensional intelligence is obtained from multiple data sources, including: internal data sources, external data sources, and public data sources, wherein the intelligence obtained from the internal data source can be log data generated by the enterprise's internal network, terminals, and deployed security devices; the intelligence obtained from the external data source can be threat intelligence data published by subscribed security vendors and industry organizations, including malware samples, IP blacklists, domain name blacklists, etc.; the intelligence obtained from the public data source can be threat information collected from public channels such as news websites, blogs, forums, and social networks. The intelligence data obtained from the comprehensive multiple data sources is called multi-dimensional intelligence, and diversified data sources help reduce information blind spots and improve the comprehensiveness of intelligence.

[0049] Intelligence verification is performed based on multi-dimensional intelligence, and the verified intelligence data is recorded as threat intelligence information and stored in the threat intelligence library. Intelligence verification is used to ensure the accuracy, timeliness and reliability of multi-dimensional intelligence. For the information in the threat intelligence library, a regular update mechanism is established to ensure the timeliness of the threat intelligence library, track the latest security incidents and vulnerability information, and supplement and update the threat intelligence library in a timely manner.

[0050] It can be seen that in the embodiment of the present application, multi-dimensional intelligence is obtained from multiple data sources, where the multiple data sources include: internal data sources, external data sources, and public data sources. Diversified data sources help reduce information blind spots and improve the comprehensiveness of intelligence. Then, intelligence verification is performed based on multi-dimensional intelligence, and the verified intelligence data is recorded as threat intelligence information and stored in the threat intelligence library.

[0051] Furthermore, in order to enhance the comprehensiveness and depth of security monitoring, in the embodiment of the present application, it also includes: When the detection reaches the security scanning cycle, the scanning requirements are obtained, and the scanning tools and scanning parameters are determined based on the scanning requirements, wherein the scanning requirements include: the network area to be scanned, the device type to be scanned, and the service port to be scanned; The scanning parameters are sent to the scanning tool for parameter configuration, and the scanning tool is controlled to perform a security scan to obtain the scanning results.

[0052] For the embodiments of the present application, based on the network security dynamic monitoring method that combines traffic monitoring, behavior monitoring and threat intelligence monitoring, combined with security scanning to perform dynamic monitoring of network security, it is possible to go deep into the system and discover potential and hidden security risks, thereby enhancing the comprehensiveness and depth of security monitoring.

[0053] Specifically, when the detection reaches the security scanning cycle, the scanning requirements are obtained, wherein the scanning requirements include: the network area to be scanned, the device type to be scanned, and the service port to be scanned. Then, based on the scanning requirements, the scanning tools and scanning parameters are determined. For the selection of scanning tools, common scanning tools include Nmap, Nessus, OpenVAS, etc. These tools can be commercial software, open source tools, or custom-developed scripts. At the same time, according to the network area to be scanned, the device type to be scanned, and the service port to be scanned in the scanning requirements, the scanning parameters are determined, wherein the scanning parameters include but are not limited to: scanning range, scanning depth, scanning speed, scanning strategy, etc. The scanning range is used to clarify which IP addresses or subnets the scan will cover; the scanning depth determines how deep the scan will go, whether it is only a port scan or a more in-depth service detection and vulnerability scan; the scanning speed is adjusted according to the network bandwidth and the importance of the scanning target to avoid excessive impact on the network; the scanning strategy is determined according to the needs of the security team and the risk assessment results. Then, the scanning parameters are sent to the scanning tool for parameter configuration, and the scanning tool is controlled to perform security scanning. During the security scan, the scanning tool sends multiple detection packets to the target, analyzes the target's security status based on the target's response, and obtains the scan results, which include but are not limited to: host information, port information, vulnerability information, risk assessment information, etc.

[0054] It can be seen that in the embodiment of the present application, when the detection reaches the security scanning cycle, the scanning requirements are obtained, and the scanning tool and scanning parameters are determined based on the scanning requirements. Then, the scanning parameters are sent to the scanning tool for parameter configuration, and the scanning tool is controlled to perform a security scan to obtain the scanning results. Combining the security scanning method with dynamic monitoring of network security can go deep into the system to discover potential and hidden security risks, thereby enhancing the comprehensiveness and depth of security monitoring.

[0055] The above embodiment introduces a method for dynamic monitoring of network security from the perspective of method flow, and the following embodiment introduces a device for dynamic monitoring of network security from the perspective of a virtual module or a virtual unit. For details, please refer to the following embodiment.

[0056] The present application embodiment provides a dynamic monitoring device for network security, such as Figure 2 As shown, the dynamic monitoring device for network security may specifically include: The flow monitoring and analysis module 210 is used to obtain network data packets in real time using the flow monitoring device, and extract key data based on the network data packets to determine key flow information, wherein the key flow information includes: data packet information, flow statistics information, and flow distribution trend information; based on the key flow information, flow monitoring and analysis are performed to determine a first monitoring result; The behavior analysis module 220 is used to obtain multi-source log data and a behavior analysis model, extract key data based on the multi-source log data, and determine key behavior information, wherein the key behavior information includes: user identity information, behavior time information, behavior type information, behavior result information, geographic location information, device information, security-related information, and session information; perform behavior analysis on the key behavior information using the behavior analysis model to determine a second monitoring result; The threat intelligence matching module 230 is used to obtain threat intelligence information, perform information matching based on key traffic information, key behavior information and threat intelligence information, and determine the third monitoring result; and obtain the network security monitoring result by combining the first monitoring result, the second monitoring result and the third monitoring result.

[0057] For the embodiment of the present application, a flow monitoring device is used to obtain network data packets in real time, key data is extracted based on the network data packets, key flow information is determined, and flow monitoring and analysis is performed based on the key flow information to determine the first monitoring result. Then, key data is extracted based on multi-source log data to determine key behavior information, and behavior analysis is performed on the key behavior information using a behavior analysis model to determine the second monitoring result. At the same time, information matching is performed based on key flow information, key behavior information and threat intelligence information to determine the third monitoring result. Finally, the network security monitoring result is obtained by combining the first monitoring result, the second monitoring result and the third monitoring result. A network security dynamic monitoring method combining flow monitoring, behavior monitoring and threat intelligence monitoring is adopted to form a multi-level and multi-dimensional defense system, which can detect and respond to abnormal behavior and network attacks in a timely manner, and improve the real-time and dynamic nature of defense.

[0058] In a possible implementation of the embodiment of the present application, the dynamic monitoring device for network security further includes: A security protection module is used to prioritize abnormal results in network security monitoring results and determine a security abnormality sequence; Select protective measures based on each target abnormal result in the security abnormality sequence and determine the protective measures sequence; Perform network security protection according to the sequence of protection measures, and continuously monitor the network environment during the process of network security protection to ensure the effectiveness of the protection operations.

[0059] In a possible implementation of the embodiment of the present application, when the traffic monitoring and analysis module 210 performs traffic monitoring and analysis based on key traffic information to determine the first monitoring result, it is used to: Perform basic information analysis based on the data packet information to determine the basic information analysis results, wherein the basic information analysis includes: IP address analysis and port number analysis; Performing traffic statistics analysis based on traffic statistics information to determine traffic statistics analysis results, wherein the traffic statistics analysis includes: total volume trend analysis and session connection analysis; Performing distribution trend analysis based on the traffic distribution trend information to determine the distribution trend analysis result, wherein the distribution trend analysis includes: time distribution analysis and regional distribution analysis; The first monitoring result is determined by combining the basic information analysis results, traffic statistics analysis results and distribution trend analysis results.

[0060] In a possible implementation of the embodiment of the present application, when the behavior analysis module 220 performs behavior analysis on key behavior information using a behavior analysis model to determine the second monitoring result, it is used to: Feature extraction is performed based on key behavior information to obtain key behavior features, where key behavior features include: user ID, user authority level, behavior frequency, operation type, operation result, impact range, geographic location, sensitive operation, and session duration; The key behavior characteristics are input into the behavior analysis model, the behavior analysis model is controlled to perform behavior analysis, and the second monitoring result is determined.

[0061] In a possible implementation of the embodiment of the present application, the dynamic monitoring device for network security further includes: A threat intelligence determination module is used to obtain multi-dimensional intelligence from multiple data sources, where the multiple data sources include: internal data sources, external data sources, and public data sources; Intelligence verification is performed based on multi-dimensional intelligence, and the verified intelligence data is recorded as threat intelligence information and stored in the threat intelligence library.

[0062] In a possible implementation of the embodiment of the present application, the dynamic monitoring device for network security further includes: The security scanning module is used to obtain scanning requirements when the detection reaches the security scanning cycle, and determine the scanning tool and scanning parameters based on the scanning requirements, wherein the scanning requirements include: the network area to be scanned, the device type to be scanned, and the service port to be scanned; The scanning parameters are sent to the scanning tool for parameter configuration, and the scanning tool is controlled to perform a security scan to obtain the scanning results.

[0063] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the dynamic monitoring device for network security described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0064] An electronic device is provided in an embodiment of the present application, such as Figure 3 As shown, Figure 3 The electronic device 300 shown includes: a processor 301 and a memory 303. The processor 301 and the memory 303 are connected, such as through a bus 302. Optionally, the electronic device 300 may also include a transceiver 304. It should be noted that in actual applications, the transceiver 304 is not limited to one, and the structure of the electronic device 300 does not constitute a limitation on the embodiments of the present application.

[0065] The processor 301 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. The processor 301 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0066] The bus 302 may include a path to transmit information between the above components. The bus 302 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus 302 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 Only one thick line is used in the diagram, but it does not mean that there is only one bus or only one type of bus.

[0067] The memory 303 may be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0068] The memory 303 is used to store the application code for executing the solution of the present application, and the execution is controlled by the processor 301. The processor 301 is used to execute the application code stored in the memory 303 to implement the contents shown in the above method embodiment.

[0069] The electronic devices include, but are not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), and fixed terminals such as digital TVs, desktop computers, etc. It can also be a server, etc. Figure 3 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0070] An embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer-readable storage medium is run on a computer, the computer can execute the corresponding content in the aforementioned method embodiment.

[0071] The embodiment of the present application provides a computer program product, which includes a computer program, which implements the method in any of the above embodiments when executed by a processor. Compared with the related art, the embodiment of the present application uses a flow monitoring device to obtain network data packets in real time, extracts key data based on the network data packets, determines key flow information, and performs flow monitoring and analysis based on the key flow information to determine the first monitoring result. Then, key data extraction is performed based on multi-source log data to determine key behavior information, and behavior analysis is performed on the key behavior information using a behavior analysis model to determine the second monitoring result. At the same time, information matching is performed based on key flow information, key behavior information and threat intelligence information to determine the third monitoring result. Finally, the first monitoring result, the second monitoring result and the third monitoring result are combined to obtain the network security monitoring result. A network security dynamic monitoring method combining flow monitoring, behavior monitoring and threat intelligence monitoring is adopted to form a multi-level and multi-dimensional defense system, which can timely discover and respond to abnormal behaviors and network attacks, and improve the real-time and dynamic nature of defense.

[0072] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0073] The above are only some implementation methods of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A dynamic monitoring method for network security, characterized in that: include: Using a flow monitoring device to obtain network data packets in real time, and extracting key data based on the network data packets to determine key flow information, wherein the key flow information includes: data packet information, flow statistics information, and flow distribution trend information; Performing flow monitoring and analysis based on the key flow information to determine a first monitoring result; Acquire multi-source log data and a behavior analysis model, extract key data based on the multi-source log data, and determine key behavior information, wherein the key behavior information includes: user identity information, behavior time information, behavior type information, behavior result information, geographic location information, device information, security-related information, and session information; Performing behavior analysis on the key behavior information using a behavior analysis model to determine a second monitoring result; Acquire threat intelligence information, perform information matching based on the key traffic information, the key behavior information, and the threat intelligence information, and determine a third monitoring result; The first monitoring result, the second monitoring result and the third monitoring result are integrated to obtain a network security monitoring result.

2. The method for dynamic monitoring of network security according to claim 1, characterized in that: After obtaining the network security monitoring result by integrating the first monitoring result, the second monitoring result and the third monitoring result, the method further includes: Prioritize the abnormal results in the network security monitoring results to determine a security abnormality sequence; Selecting protective measures based on each target abnormal result in the security abnormality sequence to determine a protective measure sequence; Perform network security protection according to the sequence of protection measures described, and in the process of performing network security protection, continuously monitor the network environment to ensure the effectiveness of the protection operations.

3. The method for dynamic monitoring of network security according to claim 1, characterized in that: The performing flow monitoring and analysis based on the key flow information to determine a first monitoring result includes: Performing basic information analysis based on the data packet information to determine a basic information analysis result, wherein the basic information analysis includes: IP address analysis and port number analysis; Performing traffic statistics analysis based on the traffic statistics information to determine traffic statistics analysis results, wherein the traffic statistics analysis includes: total volume trend analysis and session connection analysis; Performing a distribution trend analysis based on the traffic distribution trend information to determine a distribution trend analysis result, wherein the distribution trend analysis includes: time distribution analysis and regional distribution analysis; The first monitoring result is determined by comprehensively analyzing the basic information, the traffic statistics and the distribution trend.

4. The method for dynamic monitoring of network security according to claim 1, characterized in that: The using the behavior analysis model to perform behavior analysis on the key behavior information to determine the second monitoring result includes: Feature extraction is performed based on the key behavior information to obtain key behavior features, wherein the key behavior features include: user ID, user authority level, behavior frequency, operation type, operation result, impact range, geographic location, sensitive operation, and session duration; The key behavior feature is input into the behavior analysis model, the behavior analysis model is controlled to perform behavior analysis, and a second monitoring result is determined.

5. The method for dynamic monitoring of network security according to claim 1, characterized in that: The method for determining the threat intelligence information includes: Acquire multi-dimensional intelligence from multiple data sources, wherein the multiple data sources include: internal data sources, external data sources, and public data sources; Intelligence verification is performed based on the multi-dimensional intelligence, and the intelligence data that passes the verification is recorded as threat intelligence information and stored in the threat intelligence library.

6. The method for dynamic monitoring of network security according to claim 1, characterized in that: Also includes: When the detection reaches the security scanning cycle, the scanning requirement is obtained, and the scanning tool and scanning parameters are determined based on the scanning requirement, wherein the scanning requirement includes: the network area to be scanned, the device type to be scanned, and the service port to be scanned; The scanning parameters are sent to the scanning tool for parameter configuration, and the scanning tool is controlled to perform a security scan to obtain a scanning result.

7. An electronic device, characterized in that: include: at least one processor; Memory; At least one application, wherein the at least one application is stored in a memory and configured to be executed by at least one processor, and the at least one application is configured to: execute the dynamic monitoring method for network security according to any one of claims 1 to 6.

8. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed in a computer, the computer is caused to execute the dynamic monitoring method for network security according to any one of claims 1 to 6.

9. A computer program product, characterized in that The method comprises a computer program, wherein the computer program is executed by a processor to implement the dynamic monitoring method for network security according to any one of claims 1 to 6.

Images