5G-based network security monitoring system

Abstract

A 5G-based network security monitoring system comprises a monitoring center, and the monitoring center is in communication connection with a data acquisition module, a data storage module, a data processing module, a data analysis module and a security response module. The data acquisition module is in communication connection with each distributed node device in the network security monitoring system, and the data processing module compares a preset network flow trend curve in an acquisition period in each node with a real-time network trend curve to obtain an abnormal data flow. Obtaining the frequency density of the abnormal data flow of each node and the abnormal participation degree of each node; acquiring attack data stream characteristics and node safety coefficients of the nodes; the data analysis module establishes a 5G exclusive slice at each node and sets a security policy for the 5G exclusive slice; and the safety response module carries out safety processing on abnormal annular locking of the 5G exclusive slice. Network attacks in a complex scene can be effectively filtered through abnormal annular locking processing of the 5G exclusive slice.

Description

Technical Field

[0001] The present invention relates to the technical field of network security monitoring, and specifically to a 5G-based network security monitoring system. Background Art

[0002] As cyber attacks become more complex and covert, the traditional security system that focuses on "protection" faces great challenges. How to ensure that network data is not affected by security threats when individuals and companies with commercial secrets operate on the Internet is an issue that needs to be considered. At present, more and more applications and businesses are running on the Internet, and their dependence on the network is increasing.

[0003] On the other hand, the network has many nodes, a large scale, numerous devices and resources, and new businesses are emerging in an endless stream. The macro-management level lacks control over the global network performance, traffic distribution, security status, etc. The micro-operation and maintenance level lacks the ability to save, retrieve and analyze the original network data, and cannot quickly locate network attacks, and cannot obtain the severity of the terminal's network security.

[0004] Therefore, the technical problem that urgently needs to be solved is: how to conduct intelligent analysis of the collected information, accurately obtain abnormal terminal information, and evaluate the severity of the terminal's network security. Summary of the invention

[0005] In order to solve the above technical problems, the purpose of the present invention is to provide a 5G-based network security monitoring system.

[0006] The object of the present invention can be achieved by the following technical solutions: A 5G-based network security monitoring system, comprising a monitoring center, characterized in that the monitoring center is communicatively connected with a data acquisition module, a data storage module, a data processing module, a data analysis module and a security response module; The data acquisition module is connected to each distributed node device in the network security monitoring system through 5G communication, and is used to collect data information transmitted through the link between each node, and at the same time set a collection cycle and mark the collection time of the data information; wherein the data information includes data flow size, data flow type and network environment parameters; The data storage module is used to communicate with the data acquisition module and send data information to multiple databases for storage according to different node devices; The data processing module is used to compare the preset network traffic trend curve within the collection period of each node with the real-time network trend curve to obtain abnormal data flow, and obtain the frequency density of abnormal data flow occurring within the collection period of each node device; at the same time, obtain the abnormal participation of each node in which other nodes send data flow to the node when abnormal data flow occurs within the collection period; and obtain the attack data flow characteristics and node safety factor of each node; The data analysis module establishes a 5G exclusive slice at each node and sets a security policy for the 5G exclusive slice; wherein the 5G exclusive slice generates a 5G exclusive slice abnormal ring lock according to the attack data flow characteristics of the node, and the data analysis module selects a group of trusted nodes as intermediate nodes according to the node safety factor; The security response module is used to securely handle abnormal ring locking of 5G exclusive slices.

[0007] Furthermore, the process of storing the data information sent by the data acquisition module by the data storage module includes: It is connected to the data acquisition module 5G communication, and is provided with a real-time database and an offline database; the real-time database includes multiple distributed real-time databases, and the offline database includes multiple distributed offline databases. The data information collected in the current acquisition cycle is sent to different distributed real-time databases for storage according to different node devices. When the real-time database detects new data information in the next acquisition cycle, the data information collected in the multiple distributed real-time databases in the current acquisition cycle is sent to different distributed offline databases for storage, and marked as historical data.

[0008] Furthermore, the process of the data processing module comparing the preset network traffic trend curve within each node collection period with the real-time network trend curve includes: A multiple linear regression model under the current network environment parameters is established based on the historical data of the offline database, and the data information predicted by the multiple linear regression model is converted into a network traffic trend curve that changes over time, and it is marked as a preset network traffic trend curve; at the same time, real-time data information transmitted through the link between each node device is obtained, and each indicator data in the real-time data information of different node devices is converted into a network traffic trend curve that changes over time; The network traffic trend curve is compared with the preset network traffic trend curve. If the network traffic trend curve is within the range of the preset network traffic trend curve, it indicates that the network traffic trend curve is normal. If the network traffic trend curve is not within the range of the preset network traffic trend curve, it indicates that there is an abnormality in the network traffic trend curve. The characteristic data in the time period when the network traffic trend curve is not within the range of the preset network traffic trend curve is marked as abnormal trend characteristic data, and the abnormal trend characteristic data in the network traffic trend curve is obtained.

[0009] Furthermore, the process of the data processing module acquiring the frequency density of abnormal data flows occurring during the acquisition period of each node device includes: Obtain the number of occurrences of abnormal trend feature data of each node device within the collection cycle and the time span of the collection cycle, set the minimum abnormal occurrence threshold, first compare the number of occurrences of abnormal trend feature data with the minimum abnormal occurrence threshold, when the number of occurrences of abnormal trend feature data is greater than or equal to the minimum abnormal occurrence threshold, obtain the frequency density of the abnormal data stream according to the number of occurrences of abnormal trend feature data and the time span of the collection cycle.

[0010] Furthermore, the process of the data processing module obtaining the abnormal participation of other nodes in sending data streams to the node when an abnormal data stream occurs in the node during the collection period includes: When each node generates an abnormal data flow during the collection period, the number of data transmissions from other nodes that transmit data information to the node is obtained, and it is marked as the number of abnormal participation times. The abnormal participation degree of each node is obtained based on the total number of data transmissions of all nodes during the collection period and the abnormal participation times of each node.

[0011] Furthermore, the process of the data processing module acquiring the attack data flow characteristics and node safety factor of each node includes: According to the frequency density and abnormal participation of the abnormal data flow of each node, the attack data flow characteristics of each node and the node safety factor are obtained.

[0012] Furthermore, the data analysis module establishes a 5G exclusive slice at each node, and performs data analysis and processing according to the security policy of the 5G exclusive slice of the node, including: Each node establishes a 5G exclusive slice, and sets four links between the 5G exclusive slices of each node, namely, an input link, an output link, a notification link, and an operation link. When an attack data flow feature appears in the 5G exclusive slice of the node, the attack data flow feature is sent to other 5G exclusive slices through the notification link, and the local security policy is updated according to the data information fed back by other 5G exclusive slices through the notification link; the local security policy includes that the 5G exclusive slice will disconnect the input link and the output link from other 5G exclusive slices that do not have the same attack data flow feature, and will connect the input link and the output link with other 5G exclusive slices that have the same attack data flow feature, so as to form an abnormal ring lock of the 5G exclusive slice; When the 5G exclusive slice completes the abnormal ring closure, the data analysis module selects the node with the highest security factor among the nodes that are not attacked by the attack data flow as the intermediate node, and forwards the data pre-processed by the 5G exclusive slice in the abnormal ring closure to the intermediate node for transmission.

[0013] Furthermore, the process of the security response module for securely handling abnormal ring locking of the 5G dedicated slice includes: The security response module sets the security response priority for each node by sorting it from large to small according to the number of 5G exclusive slices locked in each ring and the node safety factor, and repairs and upgrades the defense of the nodes that have suffered network attacks through the operation link in sequence according to the priority.

[0014] Compared with the prior art, the beneficial effects of the present invention are as follows: most network security protections in the prior art monitor the periodic characteristics and high-flow pulse characteristics of data traffic, which are effective for traditional denial of service attack methods, but cannot effectively monitor slow distributed denial of service attacks. The present invention can greatly reduce or even eliminate the degree of harm of slow distributed denial of service attacks in existing network attacks by obtaining the frequency density of abnormal data flows occurring during the collection cycle of each node device and the abnormal participation degree of each node.

[0015] On the other hand, existing detection methods focus on detecting isolated abnormal nodes and cannot effectively defend against cooperative abnormal nodes. The present invention establishes a 5G exclusive slice at each node, and combines the input link, output link, notification link and operation link of the 5G exclusive slice with the 5G exclusive slice abnormal ring locking mechanism to effectively deal with the intrusion of multiple malicious nodes into network security through cooperation. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 This is a schematic diagram of a 5G-based network security monitoring system according to an embodiment of the present application. DETAILED DESCRIPTION

[0017] The following is a clear and complete description of the technical solutions in the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0018] like Figure 1 As shown, a 5G-based network security monitoring system includes a monitoring center, characterized in that the monitoring center is communicatively connected to a data acquisition module, a data storage module, a data processing module, a data analysis module and a security response module; The data acquisition module is connected to each distributed node device in the network security monitoring system through 5G communication, and is used to collect data information transmitted through the link between each node, and at the same time set a collection cycle and mark the collection time of the data information; wherein the data information includes data flow size, data flow type and network environment parameters; The data storage module is used to communicate with the data acquisition module and send data information to multiple databases for storage according to different node devices; The data processing module is used to compare the preset network traffic trend curve within the collection period of each node with the real-time network trend curve to obtain abnormal data flow, and obtain the frequency density of abnormal data flow occurring within the collection period of each node device; at the same time, obtain the abnormal participation of each node in which other nodes send data flow to the node when abnormal data flow occurs within the collection period; and obtain the attack data flow characteristics and node safety factor of each node; The data analysis module establishes a 5G exclusive slice at each node and sets a security policy for the 5G exclusive slice; wherein the 5G exclusive slice generates a 5G exclusive slice abnormal ring lock according to the attack data flow characteristics of the node, and the data analysis module selects a group of trusted nodes as intermediate nodes according to the node safety factor; The security response module is used to securely handle abnormal ring locking of 5G exclusive slices.

[0019] It should be further explained that, in a specific implementation process, the process of the data storage module storing the data information sent by the data acquisition module includes: It is connected to the data acquisition module 5G communication, and is provided with a real-time database and an offline database; the real-time database includes multiple distributed real-time databases, and the offline database includes multiple distributed offline databases. The data information collected in the current acquisition cycle is sent to different distributed real-time databases for storage according to different node devices. When the real-time database detects new data information in the next acquisition cycle, the data information collected in the multiple distributed real-time databases in the current acquisition cycle is sent to different distributed offline databases for storage, and marked as historical data.

[0020] It should be further explained that, in the specific implementation process, the process in which the data processing module compares the preset network traffic trend curve within each node collection period with the real-time network trend curve includes: A multiple linear regression model under the current network environment parameters is established based on the historical data of the offline database, and the data information predicted by the multiple linear regression model is converted into a network traffic trend curve that changes over time, and it is marked as a preset network traffic trend curve; at the same time, real-time data information transmitted through the link between each node device is obtained, and each indicator data in the real-time data information of different node devices is converted into a network traffic trend curve that changes over time; The hypothesis function used in the multiple linear regression model is

[0021] in is the preset network traffic value; x1 is the traffic size; x2 is the data traffic type; x3 is the network environment parameter; w1 is the weight value of the traffic size; w2 is the weight value of the data traffic type; w3 is the weight value of the network environment parameter; The network traffic trend curve is compared with the preset network traffic trend curve. If the network traffic trend curve is within the range of the preset network traffic trend curve, it indicates that the network traffic trend curve is normal. If the network traffic trend curve is not within the range of the preset network traffic trend curve, it indicates that there is an abnormality in the network traffic trend curve. The characteristic data in the time period when the network traffic trend curve is not within the range of the preset network traffic trend curve is marked as abnormal trend characteristic data, and the abnormal trend characteristic data in the network traffic trend curve is obtained.

[0022] It should be further explained that, in a specific implementation process, the process in which the data processing module obtains the frequency density of abnormal data flows occurring during the acquisition cycle of each node device includes: Obtain the number of occurrences of abnormal trend feature data for each node device during the collection cycle and the time span of the acquisition cycle , set the minimum number of abnormal occurrences threshold , firstly, the number of occurrences of abnormal trend feature data Minimum anomaly occurrence threshold When the abnormal trend characteristic data appears, Greater than or equal to the minimum anomaly occurrence threshold When the number of occurrences of abnormal trend characteristic data is The time span of the collection cycle Get the frequency density of abnormal data stream .

[0023] It should be further explained that, in the specific implementation process, the frequency density calculation method of the abnormal data flow is:

[0024] in, Indicates the frequency density of abnormal data streams; represents the number of occurrences of normal trend feature data, and i represents the type of abnormal trend feature data; Indicates the number of each node; Indicates the time span of the abnormal trend feature data collection period; It should be further explained that, in a specific implementation process, the process in which the data processing module obtains the abnormal participation of other nodes in sending data streams to the node when an abnormal data stream occurs at the node during the collection period includes: When each node generates an abnormal data flow during the collection period, the number of data transmissions from other nodes that transmit data information to the node is obtained, and it is marked as the number of abnormal participation times. The abnormal participation degree of each node is obtained based on the total number of data transmissions of all nodes during the collection period and the abnormal participation times of each node.

[0025] It should be further explained that, in the specific implementation process, the calculation method of abnormal participation of each node is:

[0026] in, Indicates the abnormal participation of the node; Indicates the number of abnormal participations of the node; Indicates the total number of data transmissions of all nodes; Indicates the number of each node; It should be further explained that, in the specific implementation process, the process of the data processing module obtaining the attack data flow characteristics and node safety factor of each node includes: According to the frequency density and abnormal participation of the abnormal data flow of each node, the attack data flow characteristics of each node and the node safety factor are obtained.

[0027] It should be further explained that, in the specific implementation process, the calculation method of the node safety factor of each node is:

[0028] in, Represents the node safety factor of the I-th node device; It is represented as the frequency density of the i-th abnormal data flow in the current collection period of the i-th node device; Indicates the abnormal participation of the I-th node device in the current collection cycle; It is represented as the weight value of the frequency density of the ith abnormal data flow in the current collection period of the ith node device; It is represented as the weight value of the abnormal participation of the I-th node device in the current collection cycle; Indicates the number of each node; i indicates the type of abnormal trend characteristic data; It should be further explained that, in the specific implementation process, the data analysis module establishes a 5G exclusive slice at each node, and performs data analysis and processing according to the security policy of the 5G exclusive slice of the node, including: Each node establishes a 5G exclusive slice, and sets four links between the 5G exclusive slices of each node, namely, an input link, an output link, a notification link, and an operation link. When an attack data flow feature appears in the 5G exclusive slice of the node, the attack data flow feature is sent to other 5G exclusive slices through the notification link, and the local security policy is updated according to the data information fed back by other 5G exclusive slices through the notification link; the local security policy includes that the 5G exclusive slice will disconnect the input link and the output link from other 5G exclusive slices that do not have the same attack data flow feature, and will connect the input link and the output link with other 5G exclusive slices that have the same attack data flow feature, so as to form an abnormal ring lock of the 5G exclusive slice; When the 5G exclusive slice completes the abnormal ring closure, the data analysis module selects the node with the highest security factor among the nodes that are not attacked by the attack data flow as the intermediate node, and forwards the data pre-processed by the 5G exclusive slice in the abnormal ring closure to the intermediate node for transmission.

[0029] It should be further explained that, in the specific implementation process, the process of the security response module for securely handling the abnormal ring locking of the 5G exclusive slice includes: The security response module sets the security response priority for each node by sorting it from large to small according to the number of 5G exclusive slices locked in each ring and the node safety factor, and repairs and upgrades the defense of the nodes that have suffered network attacks through the operation link in sequence according to the priority.

[0030] It should be further explained that, in the specific implementation process, the security response priority calculation method of each node is:

[0031] in, Represents the node safety factor of the I-th node device; It is represented by the number of 5G dedicated slices in the Xth 5G dedicated slice abnormal ring lock where the Ith node device is located; Represents the node safety factor of the I-th node device; It is represented as the weight value of the number of 5G dedicated slices in the Xth 5G dedicated slice abnormal ring block where the Ith node device is located; It is represented as the weight value of the node safety factor of the I-th node device; Indicates the number of each node; Indicates the number of abnormal ring blocking of each 5G exclusive slice.

[0032] The above embodiments are only used to illustrate the technical method of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. A 5G-based network security monitoring system, comprising a monitoring center, characterized in that: The monitoring center is communicatively connected with a data acquisition module, a data storage module, a data processing module, a data analysis module and a security response module; The data acquisition module is connected to each distributed node device in the network security monitoring system through 5G communication, and is used to collect data information transmitted through the link between each node, and at the same time set a collection cycle and mark the collection time of the data information; wherein the data information includes data flow size, data flow type and network environment parameters; The data storage module is used to communicate with the data acquisition module and send data information to multiple databases for storage according to different node devices; The data processing module is used to compare the preset network traffic trend curve within the collection period of each node with the real-time network trend curve to obtain abnormal data flow, and obtain the frequency density of abnormal data flow occurring within the collection period of each node device; at the same time, obtain the abnormal participation of each node in which other nodes send data flow to the node when abnormal data flow occurs within the collection period; and obtain the attack data flow characteristics and node safety factor of each node; The data analysis module establishes a 5G exclusive slice at each node and sets a security policy for the 5G exclusive slice; wherein the 5G exclusive slice generates a 5G exclusive slice abnormal ring lock according to the attack data flow characteristics of the node, and the data analysis module selects a group of trusted nodes as intermediate nodes according to the node safety factor; The security response module is used to securely handle abnormal ring locking of 5G exclusive slices.

2. A 5G-based network security monitoring system according to claim 1, characterized in that: The process of storing the data information sent by the data acquisition module in the data storage module includes: It is connected to the data acquisition module 5G communication, and is provided with a real-time database and an offline database; the real-time database includes multiple distributed real-time databases, and the offline database includes multiple distributed offline databases. The data information collected in the current acquisition cycle is sent to different distributed real-time databases for storage according to different node devices. When the real-time database detects new data information in the next acquisition cycle, the data information collected in the multiple distributed real-time databases in the current acquisition cycle is sent to different distributed offline databases for storage, and marked as historical data.

3. A 5G-based network security monitoring system according to claim 2, characterized in that: The process of comparing the preset network traffic trend curve within each node collection period with the real-time network trend curve by the data processing module includes: A multiple linear regression model under the current network environment parameters is established based on the historical data of the offline database, and the data information predicted by the multiple linear regression model is converted into a network traffic trend curve that changes over time, and it is marked as a preset network traffic trend curve; at the same time, real-time data information transmitted through the link between each node device is obtained, and each indicator data in the real-time data information of different node devices is converted into a network traffic trend curve that changes over time; The network traffic trend curve is compared with the preset network traffic trend curve. If the network traffic trend curve is within the range of the preset network traffic trend curve, it indicates that the network traffic trend curve is normal. If the network traffic trend curve is not within the range of the preset network traffic trend curve, it indicates that there is an abnormality in the network traffic trend curve. The characteristic data in the time period when the network traffic trend curve is not within the range of the preset network traffic trend curve is marked as abnormal trend characteristic data, and the abnormal trend characteristic data in the network traffic trend curve is obtained.

4. A 5G-based network security monitoring system according to claim 3, characterized in that: The process of the data processing module obtaining the frequency density of abnormal data streams occurring in the acquisition cycle of each node device includes: Obtain the number of occurrences of abnormal trend feature data of each node device within the collection cycle and the time span of the collection cycle, set the minimum abnormal occurrence threshold, first compare the number of occurrences of abnormal trend feature data with the minimum abnormal occurrence threshold, when the number of occurrences of abnormal trend feature data is greater than or equal to the minimum abnormal occurrence threshold, obtain the frequency density of the abnormal data stream according to the number of occurrences of abnormal trend feature data and the time span of the collection cycle.

5. A 5G-based network security monitoring system according to claim 4, characterized in that: The process of the data processing module obtaining the abnormal participation degree of other nodes in sending data streams to the node when an abnormal data stream occurs in the node during the collection period includes: When each node generates an abnormal data flow during the collection period, the number of data transmissions from other nodes that transmit data information to the node is obtained, and it is marked as the number of abnormal participation times. The abnormal participation degree of each node is obtained based on the total number of data transmissions of all nodes during the collection period and the abnormal participation times of each node.

6. A 5G-based network security monitoring system according to claim 5, characterized in that: The process of the data processing module obtaining the attack data flow characteristics and node safety coefficient of each node includes: According to the frequency density and abnormal participation of the abnormal data flow of each node, the attack data flow characteristics of each node and the node safety factor are obtained.

7. A 5G-based network security monitoring system according to claim 6, characterized in that: The data analysis module establishes a 5G exclusive slice at each node, and performs data analysis and processing according to the security policy of the 5G exclusive slice of the node, including: Each node establishes a 5G exclusive slice, and sets four links between the 5G exclusive slices of each node, namely, an input link, an output link, a notification link, and an operation link. When an attack data flow feature appears in the 5G exclusive slice of the node, the attack data flow feature is sent to other 5G exclusive slices through the notification link, and the local security policy is updated according to the data information fed back by other 5G exclusive slices through the notification link; the local security policy includes that the 5G exclusive slice will disconnect the input link and the output link from other 5G exclusive slices that do not have the same attack data flow feature, and will connect the input link and the output link with other 5G exclusive slices that have the same attack data flow feature, so as to form an abnormal ring lock of the 5G exclusive slice; When the 5G exclusive slice completes the abnormal ring closure, the data analysis module selects the node with the highest security factor among the nodes that are not attacked by the attack data flow as the intermediate node, and forwards the data pre-processed by the 5G exclusive slice in the abnormal ring closure to the intermediate node for transmission.

8. A 5G-based network security monitoring system according to claim 7, characterized in that: The process of the security response module for securely handling abnormal ring blocking of 5G dedicated slices includes: The security response module sets the security response priority for each node by sorting it from large to small according to the number of 5G exclusive slices locked in each ring and the node safety factor, and repairs and upgrades the defense of the nodes that have suffered network attacks through the operation link in sequence according to the priority.

Images