A security inspection method and system for wireless secure communication

Abstract

The present application provides a security inspection method and system for wireless secure communication, which relates to the technical field of wireless network security. The method comprises: obtaining data to be transmitted, recorded as first data; obtaining an IP address of a sender of the first data and an IP address of a receiver; obtaining n network links between two IP addresses; selecting the ith network link as a transmission link for the first data; verifying whether the ith network link is legal, and if so, verifying the two IP addresses; if not, replacing the transmission link; the verification of the two IP addresses refers to: verifying whether the two IP addresses are legal, and if so, transmitting data; if not, issuing an early warning. The present application can improve the reliability of data transmission.

Description

Technical Field

[0001] The present application relates to the technical field of wireless network security, and in particular to a security inspection method and system for wireless secure communications. Background Art

[0002] With the rapid development of information technology, data has become an important asset for modern enterprises and organizations. Efficient, secure and reliable data transmission is essential to ensure business continuity, improve user experience and prevent potential risks. In the process of data transmission, data security is of vital importance. Traditional data transmission methods often lack sufficient security protection measures and are vulnerable to security threats such as malicious attacks, data tampering, and data leakage, resulting in data failing to reach its destination accurately and completely. Summary of the invention

[0003] In order to improve the reliability of data transmission, the present application provides a security inspection method and system for wireless secure communications.

[0004] In a first aspect, the present application provides a method for security inspection of wireless secure communications, which adopts the following technical solution:

[0005] A method for checking the security of wireless secure communications comprises the following steps:

[0006] Data collection: including the first collection and the second collection;

[0007] First acquisition: obtaining data to be transmitted, recorded as first data;

[0008] Second collection: obtain the IP address of the sender of the first data, recorded as the first address; obtain the IP address of the receiver, recorded as the second address; obtain n network links between the first address and the second address;

[0009] Determine a link: select the i-th network link as a transmission link for the first data;

[0010] Legal verification: including the first verification and the second verification;

[0011] First verification: verify whether the i-th network link is legal. If so, execute the second verification step; if not, execute the link replacement step;

[0012] Second check: verify whether the first address and the second address are legal, if yes, execute the data transmission step; if no, execute the early warning step;

[0013] Replace the link: take the jth network link as the new ith network link and execute the link determination step;

[0014] Data transmission: using the i-th network link to transmit the first data;

[0015] Early warning: Send an alarm signal to operation and maintenance personnel.

[0016] By adopting the above technical solution, the present application first verifies the legitimacy of the selected link. When the selected link is illegal, the present solution can automatically change the link and reselect the link, which improves the reliability and stability of data transmission. After that, the legitimacy of the IP addresses of the sender and the receiver is verified. If the IP address is illegal, the early warning mechanism is triggered to promptly notify the operation and maintenance personnel to handle it, so as to timely discover and solve the problem. The double verification method enhances the security of data transmission. By verifying the legitimacy of the two IP addresses, the present application does not require additional configuration even when a new device is connected to the network, thereby improving the flexibility and adaptability of data transmission.

[0017] Optionally, after performing the second verification step and before performing the data transmission step, the method further includes:

[0018] Third collection: the signal strength of the first data is collected at the sender and recorded as the second data;

[0019] Strength judgment: judging whether the second data is greater than a preset threshold, if so, executing a resource allocation step; if not, executing an access prohibition step;

[0020] Prohibit access: prohibit the sender from accessing the network link;

[0021] Resource allocation: including sorting and allocating bandwidth;

[0022] Sorting: Sort the first data according to the descending order of the second data, and record the first data with sequence number k as the kth first data;

[0023] Allocate bandwidth: allocate bandwidth to the kth first data, and the calculation model of the bandwidth is as follows:

[0024] ;

[0025] in, The bandwidth allocated to the kth first data; m is the number of first data being transmitted in the i-th network link; is the signal strength of the kth first data; is the sum of the signal strengths of m first data; is the total bandwidth of the ith network link.

[0026] By adopting the above technical solution, the present application can allocate bandwidth resources according to signal strength. The stronger the signal strength (i.e., the data has a lower loss rate and higher reliability during transmission), the less bandwidth is allocated, i.e., it will not be over-allocated to data that already has good transmission conditions, so that the load of the network link can be balanced; the weaker the signal strength (i.e., the data may face a higher loss rate and lower reliability during transmission), the more bandwidth resources are allocated. By providing more bandwidth, the transmission difficulties caused by insufficient signal strength can be compensated, thereby improving the overall success rate and quality of data transmission. The method of dynamically adjusting bandwidth allocation according to signal strength in the present application not only optimizes the utilization of network resources, but also improves the flexibility and adaptability of data transmission. No matter how the signal strength of the data changes, the present application can make adjustments quickly and accurately, and can more reasonably allocate and effectively utilize network resources.

[0027] Optionally, after performing the first verification step and before performing the link replacement step, the method further includes:

[0028] Get port: Get all port numbers contained in the i-th network link;

[0029] Application location: query the application corresponding to the i-th port number and obtain the log of the application;

[0030] Log analysis: analyze logs and obtain analysis results;

[0031] Result judgment: judging whether the analysis result meets expectations, if so, executing the step of replacing the port; if not, executing the step of marking;

[0032] Replace port: Use the i+1th port number as the new ith port number and execute the application positioning step until the condition for stopping port replacement is met;

[0033] Mark: Mark the security level of the i-th port number as high risk.

[0034] By adopting the above technical solution, the application corresponding to the i-th port number is queried and its log is obtained. By analyzing its log, key information such as the application's running status, access records, and error information can be obtained. The log analysis results help understand the application running on the port and its behavior, and then identify potential security threats and abnormal behaviors. When it is found that a port does not have a security risk (the analysis result is in line with expectations), the i+1th port number will be used as the new i-th port number, and the application positioning step will be re-executed. If not, the marking step will be executed. This step helps reduce the use of ports with security risks and improve the security of network links.

[0035] Optionally, after executing the step of marking and before executing the step of replacing the link, the method further includes:

[0036] Remaining judgment: judge whether the jth network link contains the i-th port number. If so, execute the deletion step; if not, execute the link replacement step;

[0037] Deletion: delete the jth network link;

[0038] Replace link: take the j+1th network link as the new jth network link, and execute the remaining judgment steps until the preset stop link replacement condition is met, and then execute the link replacement step.

[0039] By adopting the above technical solution, the present application determines whether the j-th network link contains the i-th port number that was previously marked as high risk. If it is included, it means that the network link may have security risks or unstable factors, and the network link needs to be deleted. If it is not included, you can continue to consider using this network link for data transmission. After deleting the network link containing the marked port, it is necessary to use the j+1-th network link as the new j-th link and re-execute the remaining judgment steps. This cyclic process helps to check and process the network links containing the marked ports one by one until the preset stop link replacement condition is met (such as all network links have been checked, or a sufficient number of network links without marked ports have been found).

[0040] Optionally, after executing the step of collecting data and before executing the step of determining the link, the method further includes:

[0041] Fourth collection: sending a test packet from the first address to the second address to obtain the network delay time of the i-th network link, which is recorded as the second data;

[0042] Fifth acquisition: sending the same test packet as in the fourth acquisition step from the second address to the first address, obtaining the network delay time of the i-th network link, recorded as the third data;

[0043] Calculate the average value: calculate the average value of the second data and the third data, and record it as the fourth data;

[0044] Data judgment: judge whether the fourth data is less than a preset threshold value, if so, execute the step of determining the link; if not, execute the step of early warning.

[0045] By adopting the above technical solution, a test packet is sent from the first address to the second address, and the network delay time (second data) of the i-th network link is obtained, which helps to understand the data transmission delay time from the first address to the second address. The same test packet as in the fourth acquisition step is sent from the second address to the first address, and the network delay time (third data) of the i-th network link is obtained. This step complements the fourth acquisition. Through bidirectional testing, the delay of the network link can be more comprehensively understood, and the error that may be caused by unidirectional testing can be reduced. By taking the average value (fourth data) of the second data and the third data, the test error can be further reduced and the accuracy of the evaluation result can be improved. At the same time, the average value can also better represent the overall delay of the network link. It is judged whether the fourth data (i.e., the average delay time) is less than the preset threshold. If the average delay time is less than the threshold, it means that the network link performance is good, and the step of determining the link can be continued; if the average delay time is greater than or equal to the threshold, it means that there is a problem with the network link, and the early warning step needs to be performed. The present application can more accurately evaluate the performance and stability of the network link, and can also timely discover and deal with potential problems, thereby improving the reliability and stability of network communication.

[0046] Optionally, after executing the step of calculating the average value and before executing the step of data judgment, the method further includes:

[0047] Sixth collection: collect the historical network delay time when the first address sends data to the second address, and record it as the fifth data; collect the historical network delay time when the second address sends data to the first address, and record it as the sixth data;

[0048] Drawing a histogram: calculating an average value of the fifth data and the sixth data, recording the average value as the seventh data, drawing a histogram based on the seventh data, recording the histogram as a first image, wherein the horizontal axis of the first image is the value of the seventh data, and the vertical axis is the number of the seventh data;

[0049] Distribution judgment: map the fourth data to the first image, obtain a mapping result, and judge whether the mapping result meets expectations. If so, execute the data judgment step; if not, execute the early warning step.

[0050] By adopting the above technical solution, the historical network delay time (fifth data and sixth data) when the first address sends data to the second address and the second address sends data to the first address is collected. It is helpful to understand the long-term performance and trend of the network link. The average value of the fifth data and the sixth data (seventh data) is calculated, and a histogram (first image) is drawn based on the seventh data, which can intuitively show the distribution of the seventh data, which helps to identify the fluctuation range and common delay time of the network link performance. The fourth data (i.e., the average delay time of the bidirectional test) obtained by the current test is mapped to the first image to determine whether it meets expectations. This step evaluates whether the current network link performance is within the normal range by comparing the distribution of the current test data with the historical data. If the mapping result meets expectations (for example, it falls within the main distribution area of ​​the histogram), it means that the network link performance is stable, and the data judgment step can be continued; if the mapping result does not meet expectations (for example, it deviates from the main distribution area of ​​the histogram or exceeds the expected range), it means that the network link performance is abnormal, and the early warning step needs to be performed.

[0051] Optionally, after executing the step of calculating the average value and before executing the step of sixth acquisition, the method further includes:

[0052] Get nodes: Get a network nodes in the i-th network link and the IP address of each network node;

[0053] Calculate the delay: calculate the round-trip and round-trip network delay time when transmitting data between two adjacent network nodes, and calculate the average value of the round-trip and round-trip network delay time, and record the average value of the round-trip and round-trip network delay time as the eighth data.

[0054] By adopting the above technical solution, a network nodes and their IP addresses in the ith network link are obtained. This step provides detailed information on each node in the network link, calculates the round-trip network delay time when transmitting data between two adjacent network nodes, and calculates its average value (eighth data). This step provides delay information for data transmission between network nodes. By calculating the average value, the measurement error can be further reduced and the accuracy of the evaluation result can be improved.

[0055] Optionally, after executing the step of drawing a histogram and before executing the step of determining the distribution, the method further includes:

[0056] Mapping: mapping the eighth data to the first image to obtain the number of network nodes corresponding to each eighth data;

[0057] Dimensionality increase: the histogram is expanded to a spatial coordinate system, and two coordinate axes of the histogram are used as two coordinate axes of the spatial coordinate system, the remaining coordinate axis of the spatial coordinate system represents the number of network nodes, and the expanded histogram is used as a new first image;

[0058] Image judgment: judge whether the new first image meets expectations, if so, execute the distribution judgment step; if not, execute the fourth acquisition step.

[0059] By adopting the above technical solution, the eighth data (i.e., the average round-trip delay time between adjacent nodes) is mapped to the first image, and the number of network nodes corresponding to each eighth data is counted, so that the attenuation of signal strength during data transmission can be seen. The histogram is expanded from a two-dimensional plane to a three-dimensional spatial coordinate system. After the dimension is increased, the remaining coordinate axis in the spatial coordinate system is used to represent the number of network nodes, which helps to understand the performance of the network delay of the entire environment. If the performance indicators displayed by the first image are within an acceptable range and the node distribution is reasonable, the distribution judgment step can be continued; if the performance indicators displayed by the first image are abnormal or the node distribution is unreasonable, the fourth acquisition step needs to be re-executed to obtain more accurate performance data.

[0060] Optionally, after performing the step of image determination and before performing the step of distribution determination, the method further includes:

[0061] Seventh collection: sending multiple test packets from the first address to the second address, obtaining the delay time between each network node in the i-th network link, and using the delay time between every two network nodes as new second data;

[0062] Eighth acquisition: sending the same test packet as in the seventh acquisition step from the second address to the first address, obtaining the delay time between each network node in the i-th network link, and using the delay time between every two network nodes as new third data;

[0063] Recalculate the average value: calculate the average value of the new second data and the new third data, and record it as the new fourth data.

[0064] By adopting the above technical solution, the present application converts the network delay time in the network link to the network delay time between network nodes, which can realize the refined positioning of the delay problem and help to quickly identify which nodes or connections between nodes are the main causes of the delay. By refining the delay time analysis between network nodes, the present application can reveal the performance bottleneck and response time of each node in the network transmission path, which is crucial to help identify network attacks and abnormal behaviors. For example, if the delay time between a certain network node suddenly increases, it may indicate that the node is suffering from a denial of service attack (DoS) or a distributed denial of service attack (DDoS), or there are other forms of network congestion or failure. Converting the network delay time to between network nodes can also help to achieve a more refined network monitoring and early warning mechanism. By continuously monitoring the delay time of each network node, abnormal changes in the network can be discovered and responded to in a timely manner, thereby effectively preventing potential network attacks and data leakage risks.

[0065] In a second aspect, the present application provides a wireless secure communication security inspection system, which adopts the following technical solution:

[0066] A wireless secure communication security inspection system comprising:

[0067] The data acquisition module includes a first acquisition unit and a second acquisition unit;

[0068] A first acquisition unit, used to acquire data to be transmitted, recorded as first data;

[0069] The second collection unit is used to obtain the IP address of the first data sender, recorded as the first address; obtain the IP address of the receiver, recorded as the second address; obtain n network links between the first address and the second address;

[0070] A link determination module is used to select the i-th network link as a transmission link for the first data;

[0071] A legality verification module, comprising a first verification unit and a second verification unit;

[0072] The first verification unit is connected to the link determination module for verifying whether the i-th network link is legal. If it is legal, the second verification unit is triggered; if it is illegal, the link module is replaced;

[0073] The second verification unit is connected to the data acquisition module for verifying whether the first address and the second address are legal. If they are legal, the data module is triggered; if they are illegal, the early warning module is triggered;

[0074] A link replacement module is connected to the first verification unit and the link determination module for using the jth network link as the new ith network link and triggering the link determination module;

[0075] a data transmission module, which is in communication with the first acquisition unit, the link determination module and the second verification unit, and is used to transmit the first data using the i-th network link;

[0076] The early warning module is connected to the second verification unit for sending an alarm signal to the operation and maintenance personnel.

[0077] By adopting the above technical solution, the system obtains the data to be transmitted through the first acquisition unit, and the second acquisition unit obtains the IP address and the optional network link. The link module determines the intelligent selection of the transmission path, and the legal verification module double verifies the legality of the link and the address, and adjusts the transmission path by replacing the link module when necessary. Finally, the data transmission module transmits the data safely. If an illegal address is encountered, the early warning module will issue an alarm in time, thereby improving the overall security and operation and maintenance efficiency.

[0078] In summary, the present application includes at least one of the following beneficial technical effects:

[0079] 1. This application first verifies the legitimacy of the selected link. When the selected link is illegal, this solution can automatically replace the link and reselect the link, which improves the reliability and stability of data transmission. After that, the legitimacy of the sender and receiver's IP addresses is verified. If the IP address is illegal, the early warning mechanism is triggered and the operation and maintenance personnel are notified in time to handle it, so as to find and solve the problem in time. The double verification method enhances the security of data transmission. This application verifies the legitimacy of the two IP addresses, and no additional configuration is required even when a new device is connected to the network, which improves the flexibility and adaptability of data transmission.

[0080] 2. The present application can allocate bandwidth resources according to signal strength. The stronger the signal strength (i.e., the data has a lower loss rate and higher reliability during transmission), the less bandwidth is allocated, i.e., it will not be over-allocated to data that already has good transmission conditions, so that the load of the network link can be balanced; the weaker the signal strength (i.e., the data may face a higher loss rate and lower reliability during transmission), the more bandwidth resources are allocated. By providing more bandwidth, the transmission difficulties caused by insufficient signal strength can be compensated, thereby improving the overall success rate and quality of data transmission. The present application's method of dynamically adjusting bandwidth allocation according to signal strength not only optimizes the utilization of network resources, but also improves the flexibility and adaptability of data transmission. Regardless of how the signal strength of the data changes, the present application can make adjustments quickly and accurately, and can more reasonably allocate and effectively utilize network resources.

[0081] 3. This application maps the eighth data (i.e., the average round-trip delay time between adjacent nodes) to the first image, and counts the number of network nodes corresponding to each eighth data, so that the attenuation of signal strength during data transmission can be seen. The histogram is expanded from a two-dimensional plane to a three-dimensional spatial coordinate system. After the dimension is increased, the remaining coordinate axis in the spatial coordinate system is used to represent the number of network nodes, which helps to understand the performance of the network delay of the entire environment. If the performance indicators displayed by the first image are within an acceptable range and the node distribution is reasonable, the distribution judgment step can be continued; if the performance indicators displayed by the first image are abnormal or the node distribution is unreasonable, the fourth acquisition step needs to be re-executed to obtain more accurate performance data. BRIEF DESCRIPTION OF THE DRAWINGS

[0082] Figure 1 This is a flow chart from S1 data collection to S6 warning in Example 1 of the present application;

[0083] Figure 2 This is a flowchart of the second check from S32 to S5 data transmission in Example 1 of the present application;

[0084] Figure 3 is a flow chart of Example 2 of the present application;

[0085] Figure 4 It is a flowchart of the link from S1 data collection to S2 determination in Example 3 of the present application;

[0086] Figure 5 This is a flowchart of the sixth collection from S15 calculating the average value to S16 in Example 3 of the present application. DETAILED DESCRIPTION

[0087] The following combination Figures 1 to 5 This application is described in further detail.

[0088] Embodiment 1: This embodiment discloses a method for checking the security of wireless secure communication. Figure 1 The method includes: S1 data collection, S2 link determination, S3 legality check, S4 link replacement, S5 data transmission and S6 early warning. First, the data to be transmitted is collected and recorded as the first data. Then, the IP address of the sender and the IP address of the receiver of the first data are extracted. Then, a network link is selected. Then, it is determined whether the network link is legal. If so, the two IP addresses are verified; if not, S4 link replacement is executed. The verification of the two IP addresses is: determining whether the two IP addresses are legal. If so, S5 data transmission is executed; if not, S6 early warning is executed. This embodiment specifically includes the following steps:

[0089] S1 data collection, including S11 first collection and S12 second collection.

[0090] S11 is a first acquisition, in which data to be transmitted is acquired and recorded as first data.

[0091] S12: second collection, determining the sender and receiver of the first data, and obtaining the IP address of the sender of the first data, recorded as the first address; obtaining the IP address of the receiver, recorded as the second address.

[0092] Then, n network links between the first address and the second address are obtained, and these network links include different network paths, operator lines or data center connections, etc.

[0093] S2 determines a link, and selects any one network link from the n links as a transmission link for the first data, and the selected network link is recorded as the i-th network link.

[0094] S3 legality check, including S31 first check and S32 second check.

[0095] S31 is the first check to verify whether the i-th network link is legal. If so, S32 is the second check; if not, S4 is executed to replace the link.

[0096] Verifying whether the i-th network link is legal includes: checking the physical connection status of the network link, confirming whether the network link is authorized for use, and evaluating the security of the network link. If the physical connection status of the network link is intact, the network link is authorized for use, and the network link is secure, it is deemed to be a legal link; otherwise, it is an illegal link.

[0097] S32 is the second check to verify whether the first address and the second address are legal. If yes, S5 is executed for data transmission; if not, S6 is executed for early warning.

[0098] The verification of whether the first address and the second address are legal refers to: checking the validity of the IP address, confirming whether the IP address belongs to the legal network range, and evaluating the security of the IP address. If the IP address is valid, both IP addresses belong to the legal network range and both IP addresses are secure, then they are evaluated as legal. Otherwise, they are evaluated as illegal.

[0099] S4 replaces the link, selects a new link (the jth network link) from the remaining n-1 links as the i-th network link, and re-executes S2 to determine the link.

[0100] This process may be repeated multiple times until a legal network link is found. If there is no legal network link in the end, S6 warning is executed.

[0101] S5 data transmission, using the i-th network link to transmit the first data.

[0102] S6 early warning, sending an alarm signal to operation and maintenance personnel.

[0103] The data collection and transmission process of this embodiment achieves high efficiency, stability and security of data transmission through close cooperation and intelligent operation in multiple stages. At the same time, through the dual guarantee of legal verification and early warning mechanism, potential security issues can be discovered and handled in a timely manner to ensure overall security and operation and maintenance efficiency.

[0104] Reference Figure 2 In other embodiments, after performing the second check in S32 and before performing the data transmission in S5, the method further includes:

[0105] S71 is a third collection, in which the signal strength of the first data is collected at the sending side, and the signal strength of the first data is recorded as the second data.

[0106] S72 strength judgment, judge whether the second data is greater than the preset threshold. If so, it means that the signal strength is strong enough and the reliability of data transmission is high, and then execute S74 resource allocation; if not, it means that the signal strength is insufficient, which may cause data transmission errors or losses, and then execute S73 to prohibit access.

[0107] S73 prohibits access, prohibiting the sender from accessing the network link. This step can reduce the possibility of data with insufficient signal strength being transmitted, help protect network resources, enable network resources to be effectively utilized, and prevent network congestion or performance degradation caused by low-quality data transmission.

[0108] S74 resource allocation, including S741 sorting and S742 bandwidth allocation.

[0109] S741 sorting: sorting the first data in descending order according to the second data (ie, signal strength), and recording the first data with sequence number k as the kth first data.

[0110] S742 allocates bandwidth, allocating bandwidth to the sorted first data (ie, the kth first data) according to the signal strength of the first data.

[0111] The calculation model of the bandwidth is as follows:

[0112] ;

[0113] in, The bandwidth allocated for the kth first data; m is the number of first data being transmitted in the i-th network link; is the signal strength of the kth first data; is the sum of the signal strengths of m first data; is the total bandwidth of the ith network link.

[0114] This embodiment obtains the signal strength of the first data at the sender and determines whether the signal strength is greater than a preset threshold. If so, network bandwidth resources are allocated; if not, the sender is prohibited from accessing the network. This embodiment can prevent data transmission with poor signal strength at the source and improve network resource utilization.

[0115] Example 2: Reference Figure 3 The difference between this embodiment and embodiment 1 is that after executing S31 first check and before executing S4 link replacement, it also includes:

[0116] S81 obtains the port, obtains all the port numbers in the i-th network link. The port number is a key element in network communication, which identifies which applications are connected to the current network link.

[0117] S82 application positioning, querying the application corresponding to the i-th port number, and obtaining the log of the application, which records the operation and behavior of the application in a specific time period.

[0118] S83 log analysis, analyzing the logs and obtaining analysis results. The analysis method includes: abnormal behavior, error logs, performance bottlenecks and other information, which are important indicators for evaluating the health status of network links. By analyzing the logs, the analysis results of whether the current port number has risks (or abnormal behavior) can be obtained.

[0119] S84 result judgment, judging whether the analysis result meets expectations, if so, it means that the port performs well on the current network link and can continue to be used, and then S85 port replacement is executed; if not, it means that the port has security risks or abnormal behavior, and S86 marking is executed.

[0120] S85 replaces the port, takes the i+1th port number as the new ith port number, and re-executes S81 to obtain the port until the condition for stopping port replacement is met. The condition for stopping port replacement can be that all ports in the i-th network link have been traversed, and the analysis results of these port logs are in line with expectations.

[0121] The S86 mark marks the security level of the i-th port number as high risk.

[0122] S87 is the remaining judgment, judging whether the j-th network link contains the i-th port number, if so, executing S88 to delete; if not, executing S89 to replace the link.

[0123] S88 deletion, delete the jth network link with high-risk ports.

[0124] S89 replace link: take the j+1th network link as the new jth network link, and execute the remaining judgment of S87 until the preset stop link replacement condition is met, and then execute S4 to replace the link. The preset stop link replacement condition includes: all network links have been checked, or a sufficient number of network links without marked ports have been found.

[0125] This embodiment analyzes the logs of the ports included in the current network link, and determines whether the link needs to be replaced based on the analysis results, which can more comprehensively evaluate the security and stability of the network link, so that the data transmission process can proceed smoothly.

[0126] Example 3: Reference Figure 4 The difference between this embodiment and embodiment 1 is that after executing S1 data collection and before executing S2 link determination, it also includes:

[0127] S13 fourth collection, sending a test packet from the first address to the second address, obtaining the network delay time of the i-th network link, and when sending the test packet from the first address to the second address, the network delay time of the i-th network link is recorded as the second data.

[0128] S14 is the fifth collection, in which the same test packet as in the fourth collection of S13 is sent from the second address to the first address to obtain the network delay time of the i-th network link. When the test packet is sent from the second address to the first address, the network delay time of the i-th network link is recorded as the third data.

[0129] S15 calculates an average value, obtains an average value of the second data and the third data, and records it as fourth data. By obtaining the average value, possible errors in a single measurement are reduced, and more accurate network delay time data is obtained.

[0130] S16 is a sixth collection, in which a historical network delay time when the first address sends data to the second address is collected and recorded as fifth data.

[0131] Then, the historical network delay time when the second address sends data to the first address is collected and recorded as the sixth data.

[0132] S17 draws a histogram, calculates the average of the fifth data and the sixth data, records it as the seventh data, draws a histogram based on the seventh data, and visualizes the delay time distribution of the network link through the histogram to help identify the trend or anomaly of the delay time change.

[0133] The histogram is recorded as a first image, the horizontal axis of the first image is the value of the seventh data, the vertical axis is the number of the seventh data, and the class interval of the histogram is a preset value.

[0134] The histogram drawn based on the seventh data shows a shape that is high in the middle and gradually decreases on both sides, and the rectangular areas on the left and right sides are approximately symmetrical. If the midpoints of the tops of each rectangle are connected in sequence, the resulting curve almost perfectly fits the mathematical function image of the normal distribution.

[0135] S18 distribution judgment, mapping the fourth data to the first image, obtaining a mapping result, and judging whether the mapping result meets expectations. If so, executing S19 data judgment; if not, executing S6 warning.

[0136] The mapping result meets the expected standard that the fourth data falls within the range of the seventh data average plus or minus one standard deviation.

[0137] S19 data judgment, judging whether the fourth data is less than a preset threshold value, if so, it is considered that the network link performance is good, and S2 is continued to be executed to determine the link; if not, S6 warning is executed.

[0138] After the distribution judgment in S18, this step further judges whether the fourth data is less than a preset threshold, and then determines whether the delay of the current network link can meet the performance requirement.

[0139] Reference Figure 5 In other embodiments, after executing S15 to calculate the average value and before executing S16 for the sixth acquisition, the method further includes:

[0140] S91 obtains nodes, obtains a network nodes in the i-th network link, and the IP address of each network node.

[0141] S92 calculates the delay, calculates the round-trip network delay time when transmitting data between two adjacent network nodes, and calculates the average value of the round-trip network delay time, and records the average value of the round-trip network delay time as the eighth data.

[0142] Then, the sixth acquisition step S16 and the histogram drawing step S17 are performed, and then the following steps are performed:

[0143] S93 mapping, mapping the eighth data to the first image, and obtaining the number of network nodes corresponding to each eighth data.

[0144] This step associates each eighth data (i.e., the average value of the round-trip network delay time) with one or more network nodes in the network link, and counts the number of network nodes corresponding to each delay value. The purpose is to intuitively display the node distribution under different delay values ​​in the network link through visualization means.

[0145] In this embodiment, an eighth data will correspond to the first and last network nodes, that is, an eighth data corresponds to a pair of network nodes. For example, there is a network link including three network nodes: A, B, and C. Through measurement, the network delay time between A and B is 0.5ms, the network delay time between B and C is also 0.5ms, the network delay time between B and A is 0.7ms, and the network delay time between C and B is also 0.7ms. Then the eighth data are all 0.6ms. The network nodes corresponding to the eighth data include: A and B, B and C, that is, 4 network nodes.

[0146] In this embodiment, the essence of the seventh data and the eighth data are the average values ​​of the round-trip network delay time. When the eighth data is mapped into the histogram, the value of the eighth data is actually compared with the value of the horizontal axis of the histogram. When the two are equal, the position of the small rectangle where the eighth data is located in the histogram is obtained.

[0147] S94 upgrades the dimension, expanding the histogram from a two-dimensional plane to a three-dimensional space coordinate system, using the two coordinate axes of the histogram as the two coordinate axes of the space coordinate system, the remaining coordinate axis of the space coordinate system represents the number of network nodes, and using the expanded histogram as a new first image.

[0148] S95 image judgment, judging whether the new first image meets expectations, if so, it means that there is no problem with the current network link, and then S18 distribution judgment is executed; if not, it means that there is a problem with the network link, and it is necessary to re-execute S13 fourth acquisition.

[0149] This embodiment visualizes the delay time of the entire network link into the delay time between every two adjacent network nodes, and then maps it to the first image to obtain the number of network nodes corresponding to each eighth data, and then uses it as a coordinate axis of the spatial coordinate system to expand the histogram to the spatial coordinate system to obtain a new first image. Then, by judging whether the first image meets expectations, it is decided whether to execute S18 distribution judgment or S13 fourth acquisition.

[0150] In other embodiments, after executing S95 image determination and before executing S18 distribution determination, the method further includes:

[0151] S96 seventh collection, sending multiple test packets from the first address to the second address, obtaining the delay time between each network node in the i-th network link, and using the delay time between every two network nodes as new second data.

[0152] S97 eighth collection, sending the same test packet as in S96 seventh collection from the second address to the first address, obtaining the delay time between each network node in the i-th network link, and using the delay time between every two network nodes as new third data.

[0153] S98 recalculates the average value, obtains the average value of the new second data and the new third data, and records it as the new fourth data.

[0154] This embodiment sends test packets from the first address to the second address and from the second address to the first address, respectively, to obtain the delay time between every two network nodes in the i-th network link, which are used as new second data and new third data, respectively; then the average value of the two sets of data is calculated to obtain new fourth data for evaluating the performance of the network link. This embodiment can more accurately evaluate the delay time between each network node in the i-th network link by sending test packets in both directions and recalculating the average value.

[0155] Embodiment 4: This embodiment discloses a wireless secure communication security inspection system, the system comprising:

[0156] The data acquisition module includes a first acquisition unit and a second acquisition unit.

[0157] The first acquisition unit is used to obtain data to be transmitted and record it as first data.

[0158] The second acquisition unit is used to obtain the IP address of the first data sender, recorded as the first address; obtain the IP address of the receiver, recorded as the second address; and obtain n network links between the first address and the second address.

[0159] The link determination module is used to select the i-th network link from the n network links as a transmission link for the first data.

[0160] The legality verification module includes a first verification unit and a second verification unit.

[0161] The first verification unit is connected to the link determination module for verifying whether the i-th network link is legal. If the verification is successful, the second verification unit is triggered to perform the next verification. If the verification fails, the link replacement module is started to find and replace the i-th network link with a new one.

[0162] The second verification unit is connected to the data acquisition module for verifying whether the first address and the second address are legal. If the verification is successful, it indicates that both ends of the data transmission are credible, triggering the data module. If the verification fails, the early warning module is triggered to send an alarm signal to the operation and maintenance personnel, indicating that there is a potential security risk or configuration error.

[0163] The link replacement module is communicatively connected with the first verification unit and the link determination module, and is used to use the jth network link as the new ith network link and trigger the link determination module.

[0164] The data transmission module is communicatively connected with the first acquisition unit, the link determination module and the second verification unit, and is used to transmit the first data from the sender to the receiver using the i-th network link.

[0165] The early warning module is connected to the second verification unit for sending an alarm signal to the operation and maintenance personnel.

[0166] The data acquisition module of this embodiment integrates the first acquisition unit (responsible for acquiring the data to be transmitted) and the second acquisition unit (responsible for acquiring the IP address and network link information), selects the transmission link by determining the link module, and verifies the legitimacy of the transmission path and both ends through the legal verification module (including the first verification unit to verify the legitimacy of the link, and the second verification unit to verify the legitimacy of the IP address). If the verification fails, the replacement of the link module or the early warning module is triggered. Once the verification is passed, the data transmission module uses the selected link to transmit data, and the early warning module is responsible for issuing an alarm to the operation and maintenance personnel under abnormal circumstances.

[0167] The above are all preferred embodiments of the present application, and the protection scope of the present application is not limited thereto. Therefore, any equivalent changes made according to the structure, shape, and principle of the present application should be included in the protection scope of the present application.

Claims

1. A security inspection method for wireless secure communication, characterized in that: include: Data collection: including the first collection and the second collection; First acquisition: obtaining data to be transmitted, recorded as first data; Second collection: obtain the IP address of the sender of the first data, recorded as the first address; obtain the IP address of the receiver, recorded as the second address; obtain n network links between the first address and the second address; Fourth collection: sending a test packet from the first address to the second address to obtain the network delay time of the i-th network link, which is recorded as the second data; Fifth acquisition: sending the same test packet as in the fourth acquisition step from the second address to the first address, obtaining the network delay time of the i-th network link, recorded as the third data; Calculate the average value: calculate the average value of the second data and the third data, and record it as the fourth data; Sixth collection: collect the historical network delay time when the first address sends data to the second address, and record it as the fifth data; collect the historical network delay time when the second address sends data to the first address, and record it as the sixth data; Drawing a histogram: calculating an average value of the fifth data and the sixth data, recording the average value as the seventh data, drawing a histogram based on the seventh data, recording the histogram as a first image, wherein the horizontal axis of the first image is the value of the seventh data, and the vertical axis is the number of the seventh data; Distribution judgment: mapping the fourth data to the first image, obtaining a mapping result, and judging whether the mapping result meets expectations. If so, executing the data judgment step; if not, executing the early warning step; Data determination: determining whether the fourth data is less than a preset threshold, and if so, executing the step of determining the link; If not, then execute the early warning steps; Determine a link: select the i-th network link as a transmission link for the first data; Legal verification: including the first verification and the second verification; First verification: verify whether the i-th network link is legal. If so, execute the second verification step; if not, execute the link replacement step; Second check: verify whether the first address and the second address are legal, if yes, execute the data transmission step; if no, execute the early warning step; Replace the link: take the jth network link as the new ith network link and execute the link determination step; Data transmission: using the i-th network link to transmit the first data; Early warning: Send an alarm signal to operation and maintenance personnel.

2. The method for security inspection of wireless secure communication according to claim 1, characterized in that: After performing the second verification step and before performing the data transmission step, the method further includes: Third collection: the signal strength of the first data is collected at the sender and recorded as the second data; Strength judgment: judging whether the second data is greater than a preset threshold, if so, executing a resource allocation step; if not, executing an access prohibition step; Prohibit access: prohibit the sender from accessing the network link; Resource allocation: including sorting and allocating bandwidth; Sorting: Sort the first data according to the descending order of the second data, and record the first data with sequence number k as the kth first data; Allocate bandwidth: allocate bandwidth to the kth first data, and the calculation model of the bandwidth is as follows: ； in, The bandwidth allocated to the kth first data; m is the number of first data being transmitted in the i-th network link; is the signal strength of the kth first data; is the sum of the signal strengths of m first data; is the total bandwidth of the ith network link.

3. The security inspection method for wireless secure communication according to claim 1 or 2, characterized in that: After performing the first verification step and before performing the link replacement step, the method further includes: Get port: Get all port numbers contained in the i-th network link; Application location: query the application corresponding to the i-th port number and obtain the log of the application; Log analysis: analyze logs and obtain analysis results; Result judgment: judging whether the analysis result meets expectations, if so, executing the step of replacing the port; if not, executing the step of marking; Replace port: Use the i+1th port number as the new ith port number and execute the application positioning step until the condition for stopping port replacement is met; Mark: Mark the security level of the i-th port number as high risk.

4. The method for security inspection of wireless secure communication according to claim 3, characterized in that: After executing the step of marking and before executing the step of replacing the link, the method further includes: Remaining judgment: judge whether the jth network link contains the i-th port number. If so, execute the deletion step; if not, execute the link replacement step; Deletion: delete the jth network link; Replace link: take the j+1th network link as the new jth network link, and execute the remaining judgment steps until the preset stop link replacement condition is met, and then execute the link replacement step.

5. The security inspection method for wireless secure communication according to claim 1, characterized in that: After executing the step of calculating the average value and before executing the step of collecting the sixth value, the method further includes: Get nodes: Get a network nodes in the i-th network link and the IP address of each network node; Calculate the delay: calculate the round-trip and round-trip network delay times when transmitting data between two adjacent network nodes, and calculate the average value of the round-trip and round-trip network delay times, and record the average value of the round-trip and round-trip network delay times as the eighth data.

6. The method for security inspection of wireless secure communication according to claim 5, characterized in that: After executing the step of drawing a histogram and before executing the step of determining the distribution, the method further includes: Mapping: mapping the eighth data to the first image to obtain the number of network nodes corresponding to each eighth data; Dimensionality increase: the histogram is expanded to a spatial coordinate system, two coordinate axes of the histogram are used as two coordinate axes of the spatial coordinate system, the remaining coordinate axis of the spatial coordinate system represents the number of network nodes, and the expanded histogram is used as a new first image; Image judgment: judge whether the new first image meets expectations, if so, execute the distribution judgment step; if not, execute the fourth acquisition step.

7. The method for security inspection of wireless secure communication according to claim 6, characterized in that: After executing the step of image judgment and before executing the step of distribution judgment, the method further includes: Seventh collection: sending multiple test packets from the first address to the second address, obtaining the delay time between each network node in the i-th network link, and using the delay time between every two network nodes as new second data; Eighth acquisition: sending the same test packet as in the seventh acquisition step from the second address to the first address, obtaining the delay time between each network node in the i-th network link, and using the delay time between every two network nodes as new third data; Recalculate the average value: calculate the average value of the new second data and the new third data, and record it as the new fourth data.

8. A wireless secure communication security inspection system, the system being used to execute the method according to any one of claims 1 to 7, characterized in that: include: The data acquisition module includes a first acquisition unit and a second acquisition unit; A first acquisition unit, used to acquire data to be transmitted, recorded as first data; The second collection unit is used to obtain the IP address of the first data sender, recorded as the first address; obtain the IP address of the receiver, recorded as the second address; obtain n network links between the first address and the second address; A link determination module is used to select the i-th network link as a transmission link for the first data; A legality verification module, comprising a first verification unit and a second verification unit; The first verification unit is connected to the link determination module for verifying whether the ith network link is legal. If it is legal, the second verification unit is triggered; if it is illegal, the link module is replaced; A second verification unit is connected to the data acquisition module for verifying whether the first address and the second address are legal, and if so, triggering the data module; If it is illegal, the warning module will be triggered; A link replacement module is connected to the first verification unit and the link determination module for using the jth network link as the new ith network link and triggering the link determination module; a data transmission module, which is in communication with the first acquisition unit, the link determination module and the second verification unit, and is used to transmit the first data using the i-th network link; The early warning module is connected to the second verification unit for sending an alarm signal to the operation and maintenance personnel.

Images