Comprehensive security situation monitoring method for communication network equipment

Abstract

The present invention discloses a comprehensive security situation monitoring method for communication network equipment, which relates to the field of communication technology. The method includes: obtaining interface information of communication network equipment, establishing a docking channel for multi-dimensional situation monitoring, and generating a time series data set, including a device data set, a network traffic data set, and a communication link data set. Calling a feature extraction module to extract features from the time series data set to form a device feature set, a traffic feature set, and a communication feature set. Establishing a time window, performing sliding correlation analysis with the feature set as the matching center, and generating a first security situation warning result. At the same time, using the feature set to perform behavioral pattern correlation analysis, a second security situation warning result is obtained. Finally, combining the two to achieve comprehensive security situation monitoring. Thereby achieving the technical effect of comprehensive security monitoring, improving the ability to identify unknown threats and the level of equipment security monitoring.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a method for all-round security situation monitoring of communication network equipment. Background Art

[0002] With the rapid development of communication networks, the security of network equipment has become a key factor in ensuring information transmission and network stability. Traditional security monitoring methods mainly rely on single-dimensional data analysis, such as device log monitoring and traffic analysis. Usually, they can only identify known attack patterns and are difficult to deal with complex and changing network threats. In addition, traditional methods are insufficient in real-time and intelligence, making it difficult to quickly respond to potential security threats.

[0003] In summary, the existing technologies have technical problems such as incomplete monitoring dimensions, poor unknown threat identification capabilities, and impact on device security. Summary of the invention

[0004] The present invention provides a comprehensive security situation monitoring method for communication network equipment to solve the technical problems in the prior art of incomplete monitoring dimensions, poor unknown threat identification capability, and impact on equipment security, and achieve the technical effect of comprehensive security monitoring, improving unknown threat identification capability and equipment security monitoring level.

[0005] The present invention provides a method for monitoring the security status of a communication network device, comprising:

[0006] Obtain device interface information of the communication network device, establish a docking channel for the communication network device based on the device interface information, use the docking channel to perform multi-dimensional situation monitoring of the communication network device, and establish a time series data set, which includes a device data set, a network traffic data set, and a communication link data set.

[0007] The feature extraction module is called to extract features from the time series data set, and the device feature set, traffic feature set, and communication feature set are established.

[0008] A time window is established, wherein the time window is constructed with the device feature set, the traffic feature set, and the communication feature set as the matching center.

[0009] A window sliding correlation analysis is performed through the characteristic time nodes of the device feature set, traffic feature set, and communication feature set and the corresponding time windows to establish the first security situation warning result.

[0010] Use device feature sets, traffic feature sets, and communication feature sets to perform behavioral pattern correlation analysis and establish a second security situation warning result.

[0011] All-round security situation monitoring is carried out based on the first security situation warning results and the second security situation warning results.

[0012] In a feasible implementation, the establishing of the time window, wherein the time window is constructed with the device feature set, the traffic feature set, and the communication feature set as the matching center, further includes:

[0013] Perform central time point analysis on the device feature set, traffic feature set, and communication feature set to establish feature time nodes.

[0014] The device feature strength value of the device feature set corresponding to the feature time node is obtained, and a mapping device time window is created based on the device feature strength value and the feature time node.

[0015] The flow characteristic intensity value of the flow characteristic set corresponding to the characteristic time node is obtained, and a mapping flow time window is created based on the flow characteristic intensity value and the characteristic time node.

[0016] A communication feature strength value of a communication feature set corresponding to a feature time node is obtained, and a mapping communication time window is created based on the communication feature strength value and the feature time node.

[0017] The time window is established with the device time window, traffic time window and communication time window.

[0018] In a feasible implementation, the establishing the time window further includes:

[0019] A global periodic behavior capture is performed on the time series data set, wherein the global periodic behavior capture includes periodic pattern capture and periodic anomaly capture.

[0020] Create a periodic global time window based on the global periodic behavior capture results.

[0021] Configure a cumulative effect identification network, perform cumulative evaluation of the time series data set based on the cumulative effect identification network, and establish a cumulative evaluation result.

[0022] Create a cumulative global time window with the cumulative evaluation results.

[0023] Use the periodic global time window and the cumulative global time window to establish the time window.

[0024] In a feasible implementation, the window sliding correlation analysis is performed through the characteristic time nodes of the device feature set, the traffic feature set, and the communication feature set and the corresponding time windows to establish the first security situation warning result, and further includes:

[0025] After the device feature set, traffic feature set, and communication feature set are time-series aligned, any feature in the device feature set, traffic feature set, and communication feature set is used as the matching center, and the time window corresponding to the matching center is called.

[0026] The feature set search range corresponding to the non-matching center is determined according to the time window, and the association analysis is performed based on the matching center within the search range to establish the association analysis result.

[0027] After the matching center traverses the device feature set, traffic feature set, and communication feature set, the first security situation warning result is established based on all the correlation analysis results.

[0028] In a feasible implementation, performing association analysis based on matching centers within the search range and establishing association analysis results further includes:

[0029] A sliding step size is configured, and based on the sliding step size, feature search and extraction are performed on the feature set corresponding to the non-matching center within the search range to establish a feature search and extraction result.

[0030] Correlation analysis is used to conduct correlation analysis on the matching center and feature search and extraction results to establish association analysis results.

[0031] In a feasible implementation, the use of the device feature set, the traffic feature set, and the communication feature set to perform behavior pattern correlation analysis to establish a second security situation warning result also includes:

[0032] Model normal behavior patterns of communication network equipment and configure a normal behavior pattern database.

[0033] Use the normal behavior pattern database to perform baseline behavior analysis on the device feature set, traffic feature set, and communication feature set to establish the first behavior warning result.

[0034] A behavior sequence association is established, and based on the behavior sequence association, behavior sequence authentication of the device feature set, the traffic feature set, and the communication feature set is performed to establish a second behavior warning result.

[0035] A second security situation warning result is established based on the first behavior warning result and the second behavior warning result.

[0036] In a feasible implementation, the first security situation warning result and the second security situation warning result are used to perform all-round security situation monitoring, including:

[0037] A danger warning signal is generated based on the first safety situation warning result and the second safety situation warning result, and the danger warning signal carries a danger level identifier.

[0038] Based on the danger level, the threat evolution is traced back, the path change from attack source to target is established, and the impact level of sub-devices is established.

[0039] The path changes and impact levels of the attack source-target are used to generate a real-time threat evolution graph, and the danger warning signals and real-time threat evolution graph are visualized.

[0040] In a feasible implementation, the first security situation warning result and the second security situation warning result are used to perform all-round security situation monitoring, and further include:

[0041] Generate a cut-off isolation response instruction based on the hazard level.

[0042] After the impact level is called based on the cut-off isolation response instruction, path cut-off management is performed based on the real-time threat evolution graph.

[0043] The present invention discloses a comprehensive security situation monitoring method for communication network equipment, including: obtaining interface information of communication network equipment, and constructing a docking channel of the equipment according to the information. The docking channel is used to perform multi-dimensional situation monitoring on the communication network equipment to generate a time series data set, which includes a device data set, a network flow data set and a communication link data set. A feature extraction module is called to extract features from the time series data set, thereby forming a device feature set, a flow feature set and a communication feature set. Next, a time window is established, with the device feature set, the flow feature set and the communication feature set as the center of matching. By analyzing the feature time nodes of the device feature set, the flow feature set and the communication feature set and their corresponding time windows, a window sliding correlation analysis is performed to generate a first security situation warning result. The device feature set, the flow feature set and the communication feature set are used to perform a behavior pattern correlation analysis, thereby obtaining a second security situation warning result. Finally, the first and second security situation warning results are combined to implement comprehensive security situation monitoring. The comprehensive security situation monitoring method for communication network equipment disclosed by the present invention solves the technical problems of incomplete monitoring dimensions, poor unknown threat identification capability and impact on equipment safety, and achieves the technical effects of comprehensive security monitoring, improving unknown threat identification capability and equipment security monitoring level. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 A schematic diagram of a flow chart of a method for all-round security situation monitoring of communication network equipment according to the present invention;

[0045] Figure 2 A schematic diagram of a process for establishing a time window in the method for all-round security situation monitoring of communication network equipment of the present invention. DETAILED DESCRIPTION

[0046] The technical solution provided in the embodiments of the present invention is to solve the technical problems of the prior art such as incomplete monitoring dimensions, poor unknown threat identification capability, and impact on device security. The overall idea adopted is as follows:

[0047] First, the device interface information of the communication network device is obtained, and a docking channel for the communication network device is established based on the information; then, the docking channel is used to perform multi-dimensional situation monitoring on the communication network device to generate a time series data set, which includes a device data set, a network traffic data set and a communication link data set; then, the feature extraction module is called to extract features from the time series data set to establish a device feature set, a traffic feature set and a communication feature set; then, a time window is established, and a window is constructed with the device feature set, the traffic feature set and the communication feature set as the matching center; then, a window sliding correlation analysis is performed through the feature time nodes of the device feature set, the traffic feature set and the communication feature set and the corresponding time window to generate a first security situation warning result; finally, the device feature set, the traffic feature set and the communication feature set are used to perform behavioral pattern correlation analysis to establish a second security situation warning result, and the two are combined to perform all-round security situation monitoring.

[0048] The above technical solution will be described in detail below in conjunction with the accompanying drawings and specific implementation methods of the specification to better understand the above technical solution. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments of the present invention. It should be understood that the present invention is not limited to the example embodiments used only to explain the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. In addition, it should be noted that, for the convenience of description, only the parts related to the present invention are shown in the drawings, rather than all of them.

[0049] Embodiment 1

[0050] Figure 1 The present invention is a flow chart of a method for monitoring the omnidirectional security situation of a communication network device, wherein the method comprises:

[0051] Obtain device interface information of the communication network device, establish a docking channel for the communication network device based on the device interface information, use the docking channel to perform multi-dimensional situation monitoring of the communication network device, and establish a time series data set, which includes a device data set, a network traffic data set, and a communication link data set.

[0052] Specifically, first, through the device interface of the communication network device, a data interaction channel with the communication network device is established based on the corresponding device interface information, as the above-mentioned docking channel, which is used to realize command interaction and data transmission with the communication network device, and then perform multi-dimensional situation monitoring of the communication network device to obtain a time series data set.

[0053] Specifically, based on the preset collection frequency, the device data of multiple dimensions of the communication network equipment is collected in real time through the docking channel. The time series data set obtained by multi-dimensional situation monitoring provides a comprehensive display of device information, including, for example, real-time monitoring of important indicators such as CPU usage, memory usage, swap area usage, and disk usage. It helps users quickly understand the performance status of the device.

[0054] Optionally, obtain device interface information of the communication network device, including the type of device (such as router, switch, firewall, etc.), device interface type, number of interfaces, rate, protocol type (such as Ethernet, Fiber), status (enabled / disabled), etc.

[0055] Specifically, the data set structure for establishing a time series data set includes: device data set, network traffic data set, and communication link data set. Among them, the device data set is used to record the status and performance indicators of the communication network equipment (such as CPU usage, memory usage, etc.); the network traffic data set is used to monitor the traffic in and out of the communication network equipment, such as traffic rate, packet loss and other information; the communication link data set describes the status of the network link on which the communication network equipment depends, including bandwidth utilization, latency, etc.

[0056] The above-mentioned real-time collection of multi-dimensional data has achieved comprehensive monitoring and management of communication network equipment. At the same time, the established time series data set also provides a comprehensive data foundation for subsequent data analysis, trend prediction and security situation identification.

[0057] The feature extraction module is called to extract features from the time series data set, and the device feature set, traffic feature set, and communication feature set are established.

[0058] Specifically, feature extraction of the time series data set is performed through the feature extraction module to obtain the device feature set, traffic feature set, and communication feature set corresponding to the device data set, network traffic data set, and communication link data set, respectively.

[0059] Exemplarily, the device feature set includes features related to the device operating status, such as average CPU utilization, peak memory usage, failure rate, temperature changes, etc.; the network traffic data set involves traffic change trends, traffic fluctuation characteristics, packet loss rate, peak traffic time, etc.; the communication link data set contains extracted link performance characteristics such as bandwidth utilization, delay characteristics, jitter, etc.

[0060] Optionally, the feature extraction module performs feature extraction on the time series data set, including extracting statistical information such as mean, variance, and peak value to characterize the basic distribution of the data; uses FFT to perform frequency analysis on the time series data to identify periodic changes and high-frequency interference; and identifies sudden changes or abnormal peaks in device or link data through outlier analysis.

[0061] Through the above-mentioned feature extraction module, key features are extracted from time series data. The extracted feature set greatly reduces the complexity of the data, provides a more efficient data foundation for real-time monitoring and analysis, and helps to accurately capture the status changes of equipment, traffic, and communication links.

[0062] A time window is established, wherein the time window is constructed with the device feature set, the traffic feature set, and the communication feature set as the matching center.

[0063] Specifically, the time window is a sliding window in the sliding window analysis. The time window is constructed based on the device feature set, traffic feature set, and communication feature set. It is used to aggregate feature data within a period of time for unified analysis, ensuring that the data covered by the window covers key data points when the subsequent window sliding correlation analysis is performed, thereby ensuring that data changes can be captured and analyzed more effectively in the future.

[0064] In some embodiments, Figure 2 As shown, the time window is established, and the time window is constructed with the device feature set, the traffic feature set, and the communication feature set as the matching center, and also includes:

[0065] Perform central time point analysis on the device feature set, traffic feature set, and communication feature set to establish feature time nodes. Obtain the device feature strength value of the device feature set corresponding to the feature time node, and create a mapping device time window based on the device feature strength value and the feature time node. Obtain the traffic feature strength value of the traffic feature set corresponding to the feature time node, and create a mapping traffic time window based on the traffic feature strength value and the feature time node. Obtain the communication feature strength value of the communication feature set corresponding to the feature time node, and create a mapping communication time window based on the communication feature strength value and the feature time node. Establish a time window with the device time window, traffic time window, and communication time window.

[0066] Specifically, first, the central time point analysis is performed for the device feature set, traffic feature set, and communication feature set to identify the change center of each feature set data. The change center is the most representative or most obvious time point in the data set, corresponding to multiple feature time nodes, which respectively reflect the state changes of the device, traffic, or communication features. Among them, the central time point can be the collection time point with the most frequent feature fluctuations or the largest features in the device feature set, traffic feature set, and communication feature set. Through the central time point analysis, the key change moments of the device, traffic, and communication status can be accurately located, which helps to take timely response measures.

[0067] For example, statistics are collected on various indicators in the device feature set (such as CPU utilization, memory usage, temperature, etc.), and the mean, maximum, minimum, etc. of each indicator are identified, and the peak time point of the device working status is found as the central time point; the volatility of the device feature set is analyzed, and the time point with large fluctuations is identified as the central time point, such as the time point when the device load changes sharply. Detect abnormal values ​​of the device feature set, such as the time point of excessively high CPU utilization or abnormal temperature rise, as the central time point.

[0068] Specifically, for each feature time node, obtain the device feature strength value in the corresponding device feature set. The device feature strength value refers to the performance parameter value of the device at that time node (such as CPU utilization peak, memory usage peak, temperature surge, etc.). The larger the device feature strength value, the larger the corresponding mapping device time window, ensuring that the trend of the device feature strength can be fully reflected.

[0069] Specifically, based on the same method and principle as the above-mentioned creation of the mapping device time window, the traffic feature strength value in the traffic feature set corresponding to each characteristic time node is obtained, such as the characteristic values ​​of traffic rate, traffic fluctuation frequency, packet loss rate, etc. The communication feature strength value in the communication feature set corresponding to the characteristic time node is obtained, such as link bandwidth utilization, delay, jitter, packet loss rate, etc. Then, based on the size of the traffic feature strength value and the communication feature strength value, the mapping traffic time window and the mapping communication time window are correspondingly determined.

[0070] Furthermore, the device time window, the traffic time window and the communication time window are aggregated to generate the final time window. Optionally, the aggregation method includes taking the intersection, union, least common multiple window of the device time window, the traffic time window and the communication time window, or retaining the time window of each feature data set. The specific aggregation strategy is determined based on the monitoring requirements and monitoring computing power of the application scenario.

[0071] By aligning the time windows of multi-dimensional feature sets, the status of devices, traffic, and communication links can accurately reflect the overall status of device operation, while facilitating rapid identification of anomalies and optimizing response speed.

[0072] In some embodiments, the establishing the time window further includes:

[0073] The time series data set is subjected to global periodic behavior capture, wherein the global periodic behavior capture includes periodic pattern capture and periodic anomaly capture. A periodic global time window is created according to the global periodic behavior capture result. A cumulative effect recognition network is configured, and a cumulative evaluation of the time series data set is performed based on the cumulative effect recognition network to establish a cumulative evaluation result. A cumulative global time window is created based on the cumulative evaluation result. A time window is established using the periodic global time window and the cumulative global time window.

[0074] Specifically, establishing a time window also includes identifying periodic patterns and periodic anomalies in the time series data set to establish the long-term behavior pattern of the target communication network equipment. Among them, periodic pattern capture is achieved by performing periodic pattern recognition on the time series data set (equipment, traffic and communication link data) through time series analysis methods (such as Fourier transform, moving average, and period detection algorithm). By identifying repeated behavior patterns, a periodic understanding of the normal working state can be established.

[0075] Specifically, based on the detected periodic pattern, the abnormal time point deviating from the periodic pattern is identified, the sudden abnormality in the periodic pattern is detected, and the periodic abnormality is captured. The periodic abnormality capture result reflects the occurrence point of the periodic abnormality.

[0076] Further, according to the results of periodic pattern capture, the periodic behavior is combined with the abnormal behavior, and the periodic data and abnormal information are integrated to construct a periodic global time window, so that it reflects the overall situation of normal mode and abnormal deviation. Preferably, the periodic global time window contains at least one complete periodic pattern cycle and one complete periodic abnormal cycle.

[0077] Specifically, a cumulative effect recognition network is configured, which is used to detect cumulative effects from long-term data, such as potential faults caused by gradual performance degradation or frequent small anomalies. Optionally, the cumulative effect recognition network is built based on neural network models such as LSTM (Long Short-Term Memory Network) and GRU (Gated Recurrent Unit). By learning and identifying the cumulative changes in the time series dimension in the time series data set, the corresponding cumulative evaluation results are obtained, including the intensity, trend direction and potential impact of the cumulative effect, thereby providing a basis for the judgment of potential hidden dangers.

[0078] Optionally, a cumulative global time window is constructed based on the cumulative evaluation results. The cumulative global time window can be set as a long-term window to capture the gradually accumulated effects and trend changes. The density of the data in the window and the window span are flexibly adjusted according to the strength of the cumulative effect in the cumulative evaluation results. For example, the stronger the cumulative effect, the longer the corresponding cumulative global time window, so as to better focus on the trend changes in the long period of time.

[0079] Furthermore, the periodic global time window and the cumulative global time window are integrated to form a complete time window, which has both periodic and cumulative analysis dimensions. Among them, the periodic global time window is used to manage and monitor periodic behaviors and quickly identify periodic anomalies; the cumulative global time window is used to monitor cumulative effects and help to warn potential failures in advance.

[0080] Through the above method steps, the acquired time window can dynamically adapt to the changes in time series data, reflect the global status and trend of the device in real time, and improve the flexibility and adaptability of monitoring.

[0081] A window sliding correlation analysis is performed through the characteristic time nodes of the device feature set, traffic feature set, and communication feature set and the corresponding time windows to establish the first security situation warning result.

[0082] In some embodiments, the window sliding correlation analysis is performed through the characteristic time nodes of the device feature set, the traffic feature set, and the communication feature set and the corresponding time windows to establish the first security situation warning result, including:

[0083] After the device feature set, traffic feature set, and communication feature set are time-series aligned, any feature in the device feature set, traffic feature set, and communication feature set is used as the matching center, and the time window corresponding to the matching center is called. The feature set search range corresponding to the non-matching center is determined according to the time window, and correlation analysis is performed based on the matching center within the search range to establish the correlation analysis result. After the matching center traversal of the device feature set, traffic feature set, and communication feature set is performed, the first security situation warning result is established based on all the correlation analysis results.

[0084] Specifically, first, interpolation methods, alignment algorithms and other methods are used to align the data of the device feature set, traffic feature set, and communication feature set in time series, so that the time nodes and data accuracy of multiple feature sets are consistent, thereby ensuring that the data of the device feature set, traffic feature set, and communication feature set at the same time point can be accurately compared, which is convenient for subsequent window sliding and correlation analysis. Then, any feature in the aligned device feature set, traffic feature set, and communication feature set is selected as the matching center, which is the benchmark for subsequent analysis, such as using the "peak period" in the traffic feature as the matching center.

[0085] Furthermore, the time window corresponding to the matching center is called, and the key data features in the window are captured with the time node of the matching center as the center. For example, if the "peak period" of the traffic feature set is the matching center, the corresponding time window of the traffic feature set can be called and used as the feature set search range of the traffic state.

[0086] Specifically, within the feature set search range of the non-matching center, based on the feature data of the matching center, the method of performing association analysis includes correlation analysis (such as Pearson correlation coefficient), coordinated change analysis, causal analysis, etc. Exemplarily, when the traffic peak period of the traffic feature set is the matching center, it can be analyzed whether the CPU utilization in the device feature set and the link bandwidth change of the communication feature set are associated with the traffic peak.

[0087] Specifically, the output association analysis results include correlation coefficients, causal relationships, co-variation characteristics, etc., which indicate the strength and trend of the relationship between matching center features and non-matching center features.

[0088] Furthermore, the device feature set, traffic feature set and communication feature set are set as matching centers in turn, and the above-mentioned time window call, search range definition and association analysis process are repeated to ensure that each feature set is used as a benchmark for association analysis, and the association analysis results of multiple feature sets are obtained. Then, the association analysis results of all feature sets are integrated to form a comprehensive data set.

[0089] Specifically, a first security situation warning result is established, including a bidirectional correlation analysis result between corresponding fusion features. For example, for the correlation between traffic peak and CPU occupancy features, the correlation analysis result with the traffic peak as the matching center is the forward correlation analysis result, and the correlation analysis result with the CPU occupancy as the matching center is the reverse correlation analysis result. The average of the forward correlation analysis result and the reverse correlation analysis result is taken as the correlation analysis result between the traffic peak and CPU occupancy features.

[0090] Further, based on the correlation analysis results, a first security situation warning result is generated, such as abnormality, risk index, change trend, etc. The first security situation warning result is used to determine whether the current device has potential risks or abnormal conditions. Exemplarily, the fused correlation analysis results are used as a weight set, and the feature values ​​of the device feature set, the traffic feature set, and the communication feature set are weighted to obtain the first security situation trend of multiple feature indicators, which are output as the first security situation warning result.

[0091] The above method steps can capture the complex relationship between devices, traffic and communication links through multi-dimensional feature set correlation analysis, and effectively detect abnormal situations. The matching center traversal mechanism ensures that the data of all key feature sets are fully analyzed, thereby improving the accuracy of security situation warning.

[0092] In some implementations, performing association analysis based on matching centers within the search range and establishing association analysis results further includes:

[0093] Configure the sliding step length, perform feature search and extraction on the feature set corresponding to the non-matching center within the search range based on the sliding step length, and establish the feature search and extraction result. Perform correlation analysis on the matching center and the feature search and extraction result using correlation analysis, and establish the correlation analysis result.

[0094] Specifically, the sliding step is the extraction step for neighborhood feature extraction based on the matching center. In other words, the sliding step defines the search range for each feature search and extraction of the feature set corresponding to the non-matching center within the search range. The longer the sliding step, the larger the search range for each feature search and extraction, and the more efficient the association analysis results can be obtained, but the corresponding analysis completeness and coverage are lower.

[0095] Optionally, a correlation analysis is performed between the feature search extraction results and the matching centers based on statistical methods (such as Pearson's correlation coefficient) to identify the association between the features.

[0096] Use device feature sets, traffic feature sets, and communication feature sets to perform behavioral pattern correlation analysis and establish a second security situation warning result.

[0097] Specifically, the second security situation warning result includes behavioral analysis and behavioral pattern authentication of the device feature set, traffic feature set, and communication feature set, so as to determine whether the behavior of the communication network equipment in terms of device characteristics, traffic characteristics, and communication characteristics meets expectations.

[0098] In some embodiments, the use of the device feature set, the traffic feature set, and the communication feature set to perform a behavior pattern correlation analysis to establish a second security situation warning result includes:

[0099] Model the normal behavior pattern of the communication network equipment and configure the normal behavior pattern database. Use the normal behavior pattern database to perform baseline behavior analysis on the device feature set, traffic feature set, and communication feature set to establish a first behavior warning result. Establish a behavior sequence association, perform behavior sequence authentication on the device feature set, traffic feature set, and communication feature set based on the behavior sequence association, and establish a second behavior warning result. Establish a second security situation warning result based on the first behavior warning result and the second behavior warning result.

[0100] Specifically, based on the historical operation records of the target communication network equipment, normal operation records are extracted and a normal behavior pattern database containing equipment, traffic and communication characteristics is established. The normal behavior pattern database defines the normal behavior standards of the communication network equipment in order to identify abnormal behavior patterns.

[0101] Exemplarily, first, key features are extracted from the device feature set, traffic feature set and communication feature set, such as the device's CPU utilization, traffic rate, link delay, etc.; then, a clustering algorithm (such as K-means, DBSCAN) is used to classify the feature data, and the normal behavior patterns under different working conditions are clustered into several categories; finally, the feature data of each cluster center and the range of the cluster cluster are stored in the normal behavior pattern database to form a typical normal behavior pattern set for baseline comparison.

[0102] Specifically, the normal behavior pattern database is used as the baseline behavior of the communication network device, and the device feature set, traffic feature set, and communication feature set are compared with the baseline behavior, and the difference between the real-time feature data and the baseline behavior pattern is calculated, including the degree of deviation, frequency, number of abnormal points, etc., to achieve baseline behavior analysis and obtain the first behavior warning result. Exemplarily, the first behavior warning result is a weighted evaluation value of the difference between the real-time feature data and the baseline behavior pattern, and the first behavior warning result quantitatively characterizes the degree of abnormal behavior of the device feature set, traffic feature set, and communication feature set corresponding to the time series data set.

[0103] Specifically, based on historical operation records, the event sequences in the device features, traffic features, and communication features are identified, such as a sudden increase in CPU utilization, a sudden increase in traffic, an increase in link delay, etc., and the time series association relationship between different events is established to find the typical event pattern combination as the behavior sequence association. Then, the behavior sequences of the matching device feature set, traffic feature set, and communication feature set are associated with the behavior sequence, and the sequence segments that cannot be matched in the behavior sequences of the matching device feature set, traffic feature set, and communication feature set are identified as the second behavior warning result. The second behavior warning result represents the part of the current behavior sequence that does not match the normal behavior pattern. For example, if the traffic rate increases, but the CPU occupancy rate and temperature decrease, then the communication network equipment may be in an abnormal situation.

[0104] Furthermore, based on the feature fusion method, the first behavior warning result based on the baseline deviation and the second behavior warning result based on the behavior sequence anomaly are integrated to obtain a second security situation warning result, which is used to represent the overall behavior situation of the communication network device.

[0105] All-round security situation monitoring is carried out based on the first security situation warning results and the second security situation warning results.

[0106] In some embodiments, the first security situation warning result and the second security situation warning result are used to perform all-round security situation monitoring, including:

[0107] The first security situation warning result and the second security situation warning result are used to generate a danger warning signal, which carries a danger level identifier. Threat evolution is traced back based on the danger level, the path change from the attack source to the target is established, and the impact level of the sub-device is established. The path change from the attack source to the target and the impact level are used to generate a real-time threat evolution diagram, and the danger warning signal and the real-time threat evolution diagram are visualized.

[0108] Specifically, based on the danger warning identification strategy of the target communication network equipment, the danger warning signal with the danger level mark is obtained by combining the first safety situation warning result and the second safety situation warning result. Among them, the danger warning identification strategy of the target communication network equipment is a danger warning identification standard preset for the target scenario, which can be based on historical warning records or determined by professional technicians.

[0109] Specifically, based on the danger warning signal, the site, device name, device type, slot, port number, data type, alarm status and processing method corresponding to the threat are called, and combined with the network topology and data flow, the potential attack path is traced, and the direction and mode of threat diffusion are analyzed, so as to determine the possible propagation path and the impact of the affected sub-devices. Among them, the impact level of each sub-device is determined based on the functional criticality of each sub-device, the possibility of being attacked, and the correlation between devices.

[0110] Furthermore, the path changes from the attack source to the target are mapped to the threat evolution diagram, thereby showing the main and secondary paths of threat spread. The threat evolution diagram marks the impact level of each node and distinguishes the severity of the threat with different colors or icons, realizing real-time threat visualization, helping relevant personnel to intuitively understand the current security situation, the propagation path of the attack, the currently threatened devices and key nodes, so as to quickly take targeted protection measures to prevent the threat from spreading to the core network area.

[0111] In some implementations, performing all-round security situation monitoring based on the first security situation warning result and the second security situation warning result also includes:

[0112] Generate a cut-off isolation response instruction based on the danger level. After calling the impact level based on the cut-off isolation response instruction, perform path cut-off management based on the real-time threat evolution diagram.

[0113] Specifically, according to the threat danger level currently detected, a cutoff and isolation response instruction is generated to quickly isolate the threat when the risk increases. Different danger levels correspond to different cutoff and isolation strategies. For example, partial cutoff can be performed for "high risk" and full isolation can be performed for "serious risk", so as to minimize equipment damage while maintaining equipment functionality as much as possible.

[0114] Specifically, the cut-off isolation response instruction includes the threatened node and the link that needs to be cut off and isolated, and is used to disconnect the physical connection or network logical link on the affected path to perform isolation.

[0115] Preferably, the cut-off isolation response instruction selectively cuts off non-critical devices with less impact, while isolating high-risk path nodes. For core devices or key nodes with high impact levels, the cut-off isolation is only performed when necessary to prevent the cut-off operation from affecting the key functions of the device.

[0116] Optionally, after executing the cut-off operation, confirm whether the cut-off is successful and whether the isolation path is stable by real-time monitoring of the path status; and conduct feedback security situation monitoring on the equipment after the cut-off operation, update the threat evolution diagram, hazard level and impact range, and ensure the effectiveness of handling abnormal security situation of the equipment.

[0117] In summary, the comprehensive security situation monitoring method for communication network equipment provided by the present invention has the following technical effects:

[0118] By obtaining the interface information of the communication network equipment and building the docking channel of the equipment based on this information. The docking channel is used to perform multi-dimensional situation monitoring on the communication network equipment to generate a time series data set, which includes a device data set, a network traffic data set and a communication link data set. The feature extraction module is called to extract features from the time series data set to form a device feature set, a traffic feature set and a communication feature set. Next, a time window is established, with the device feature set, the traffic feature set and the communication feature set as the matching center. By analyzing the feature time nodes of the device feature set, the traffic feature set and the communication feature set and their corresponding time windows, a window sliding correlation analysis is performed to generate the first security situation warning result. The device feature set, the traffic feature set and the communication feature set are used to perform behavioral pattern correlation analysis to obtain the second security situation warning result. Finally, comprehensive security situation monitoring is implemented by combining the first and second security situation warning results. Thus, the technical effect of comprehensive security monitoring, improving the ability to identify unknown threats and the level of equipment security monitoring is achieved.

[0119] It should be understood that the embodiments disclosed in the present invention and the above description can enable those skilled in the art to use the present invention to implement the present invention. At the same time, the present invention is not limited to the above-mentioned embodiments. It should be understood that those skilled in the art can still modify the technical solutions recorded in the above-mentioned embodiments, or replace some of the technical features therein by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention.

Claims

1. A comprehensive security situation monitoring method for communication network equipment, characterized in that: The method comprises: Acquire device interface information of the communication network device, establish a docking channel for the communication network device based on the device interface information, use the docking channel to perform multi-dimensional situation monitoring on the communication network device, and establish a time series data set, wherein the time series data set includes a device data set, a network traffic data set, and a communication link data set; Call the feature extraction module to extract features from the time series data set and establish a device feature set, a traffic feature set, and a communication feature set; Establishing a time window, wherein the time window is constructed with a device feature set, a traffic feature set, and a communication feature set as a matching center; Perform window sliding correlation analysis through the characteristic time nodes of the device feature set, traffic feature set, and communication feature set and the corresponding time windows to establish the first security situation warning result; Use device feature sets, traffic feature sets, and communication feature sets to perform behavioral pattern correlation analysis and establish a second security situation warning result; Conduct all-round security situation monitoring based on the first security situation warning results and the second security situation warning results; The establishing of the time window, wherein the time window is constructed with the device feature set, the traffic feature set, and the communication feature set as the matching center, includes: Perform central time point analysis on device feature sets, traffic feature sets, and communication feature sets to establish feature time nodes; Obtain a device feature strength value of a device feature set corresponding to a feature time node, and create a mapping device time window based on the device feature strength value and the feature time node; Obtaining a flow characteristic intensity value of a flow characteristic set corresponding to a characteristic time node, and creating a mapping flow time window based on the flow characteristic intensity value and the characteristic time node; Acquire a communication feature strength value of a communication feature set corresponding to a feature time node, and create a mapping communication time window based on the communication feature strength value and the feature time node; Establish time windows with device time windows, traffic time windows, and communication time windows; Wherein, the establishing time window further includes: Performing global periodic behavior capture on the time series data set, wherein the global periodic behavior capture includes periodic pattern capture and periodic anomaly capture; Create a periodic global time window based on the global periodic behavior capture results; Configure a cumulative effect identification network, perform cumulative evaluation of the time series data set based on the cumulative effect identification network, and establish cumulative evaluation results, including: the cumulative effect identification network is built based on a neural network model, and the cumulative changes in the time series dimension of the time series data set are learned and identified to obtain the corresponding cumulative evaluation results, including the intensity, trend direction and potential impact of the cumulative effect; Create a cumulative global time window with the cumulative evaluation results; Use the periodic global time window and the cumulative global time window to establish the time window.

2. The all-round security situation monitoring method of communication network equipment according to claim 1, characterized in that: The step of performing window sliding correlation analysis through the characteristic time nodes of the device feature set, the traffic feature set, and the communication feature set and the corresponding time windows to establish a first security situation warning result also includes: After the device feature set, traffic feature set, and communication feature set are time-series aligned, any feature in the device feature set, traffic feature set, and communication feature set is used as the matching center, and the time window corresponding to the matching center is called; Determine the feature set search range corresponding to the non-matching center according to the time window, and perform association analysis based on the matching center within the search range to establish the association analysis result; After matching the device feature set, traffic feature set, and communication feature set, a first security situation warning result is established based on all the correlation analysis results.

3. The all-round security situation monitoring method of communication network equipment according to claim 2, characterized in that: The performing association analysis based on the matching center within the search range and establishing the association analysis result also includes: Configure a sliding step length, perform feature search and extraction on a feature set corresponding to a non-matching center within a search range based on the sliding step length, and establish a feature search and extraction result; Correlation analysis is used to conduct correlation analysis on the matching center and feature search and extraction results to establish association analysis results.

4. The method for monitoring the omnidirectional security situation of a communication network device according to claim 1, characterized in that: The use of the device feature set, the traffic feature set, and the communication feature set to perform a behavior pattern correlation analysis to establish a second security situation warning result also includes: Model the normal behavior patterns of communication network equipment and configure a normal behavior pattern database; Use the normal behavior pattern database to perform baseline behavior analysis on the device feature set, traffic feature set, and communication feature set to establish the first behavior warning result; Establishing a behavior sequence association, performing behavior sequence authentication of a device feature set, a traffic feature set, and a communication feature set based on the behavior sequence association, and establishing a second behavior warning result; A second security situation warning result is established based on the first behavior warning result and the second behavior warning result.

5. The method for monitoring the omnidirectional security situation of a communication network device according to claim 1, characterized in that: The first security situation warning results and the second security situation warning results are used to conduct all-round security situation monitoring, including: Generating a danger warning signal with a danger level mark based on the first safety situation warning result and the second safety situation warning result; Based on the danger level, the threat evolution is traced back to establish the attack source-target path change and the impact level of the sub-device; The path changes and impact levels of the attack source-target are used to generate a real-time threat evolution graph, and the danger warning signals and real-time threat evolution graph are visualized.

6. The method for monitoring the omnidirectional security situation of a communication network device according to claim 5, characterized in that: The first security situation warning result and the second security situation warning result are used to conduct all-round security situation monitoring, which also includes: Generate a cut-off isolation response instruction based on the danger level; After the impact level is called based on the cut-off isolation response instruction, path cut-off management is performed based on the real-time threat evolution graph.

Images