A method and system for realizing unified threat management in heterogeneous networks

Abstract

The present invention discloses a method and system for realizing unified threat management in a heterogeneous network, and relates to the technical field of unified threat management, including calculating the real-time traffic anomaly coefficient and historical threat risk coefficient of each network or device, and calculating the network risk coefficient of each network or device; parsing the header of a data packet entering the unified threat management, identifying abnormal data packets, counting the number of abnormal data packets per unit time of each network or device, and deeply analyzing the content of the abnormal data packets, and counting the number of malicious data packets per unit time of each network or device; calculating the real-time carrying capacity of the unified threat management according to the real-time average traffic and the number of abnormal data packets of all networks or devices, issuing a data communication restriction warning, calculating the communication risk index of each network or device, and limiting the communication of the corresponding network or device. The communication of high-risk networks or devices can be automatically restricted to prevent malicious traffic from spreading in the network.

Description

Technical Field

[0001] The present invention relates to the technical field of unified threat management, and in particular to a method and system for implementing unified threat management in a heterogeneous network. Background Art

[0002] With the rapid development of information technology, network structures are becoming increasingly complex, and heterogeneous networks have become an important part of modern communications and information processing. Heterogeneous networks, that is, network systems composed of multiple different types of network protocols, devices and systems, such as IPv4, IPv6, MPLS, etc., are widely used in various scenarios due to their flexibility and scalability. However, this diversity also brings unprecedented security challenges. Traditional network security protection methods, such as firewalls and intrusion detection systems, are mostly based on a single protocol or device design, and it is difficult to achieve effective unified threat management (UTM) in a heterogeneous network environment. Specifically, different protocols and devices in heterogeneous networks have different security characteristics and requirements. The traditional single-point protection method cannot fully cover all potential security threats, resulting in a significant reduction in the protection effect. In addition, with the continuous upgrading and evolution of network attack methods, network security threats are becoming increasingly complex and diverse. Attackers can take advantage of weaknesses such as protocol differences and device vulnerabilities in heterogeneous networks to launch cross-protocol and cross-device compound attacks, further exacerbating the difficulty of protection.

[0003] In the Chinese invention application with application publication number CN101827083A, a method and system for realizing unified threat management in a heterogeneous network is disclosed, including performing protocol matching identification on the data packets flowing into the UTM, determining the actual protocol type of each data packet; diverting each data packet according to the actual protocol type of the data packet; filtering the diverted data packets according to the actual protocol type corresponding to the diversion; performing UTM proxy on the filtered data packets and sending the data packets. The system includes: a protocol analysis module, a protocol diversion module, a filtering module, and a UTM function module.

[0004] In the above invention application, a complete set of analysis, diversion, filtering, protocol conversion, UTM agent, and protocol restoration mechanism is proposed, so a single-device UTM prevention method for heterogeneous networks can be implemented. However, when a heterogeneous network is attacked, network traffic tends to increase rapidly. Relying only on analysis, diversion, and filtering will cause the UTM to be unable to withstand the huge amount of data and consume a large amount of CPU, memory, and storage resources. When the amount of data exceeds the processing capacity of the device, these resources will be quickly exhausted, resulting in a sharp decline in device performance. The performance decline will directly lead to a slower processing speed of the UTM for data, an increase in the response time for user requests and traffic processing, and an impact on user experience and network efficiency.

[0005] To this end, the present invention provides a method and system for implementing unified threat management in a heterogeneous network. Summary of the invention

[0006] 1. Technical issues to be resolved

[0007] In view of the deficiencies in the prior art, the present invention provides a method and system for realizing unified threat management in a heterogeneous network. The present invention comprehensively and objectively evaluates the overall risk level of the network or equipment, formulates more targeted security protection measures and emergency plans, and automatically or manually limits the communication of high-risk networks or equipment, which helps to reduce potential security threats, prevent malicious traffic from spreading in the network, and protect the normal operation of critical resources and services. At the same time, limiting non-critical or high-risk communications can also help the UTM system better manage its resources, ensuring that priority services are provided for more important communications when resources are limited, thereby solving the technical problems recorded in the background technology.

[0008] (II) Technical solution

[0009] To achieve the above objectives, the present invention is implemented through the following technical solutions: A method for implementing unified threat management in a heterogeneous network, comprising the following steps:

[0010] Calculate the real-time traffic anomaly coefficient for each network or device and historical threat risk factors , and based on the real-time traffic anomaly coefficient and historical threat risk factors Calculate the network risk factor for each network or device ;

[0011] Parse the headers of packets entering unified threat management, identify abnormal packets, and count the number of abnormal packets per unit time for each network or device , and conduct in-depth analysis of the contents of abnormal data packets to identify whether the data packets contain known malicious content. If so, the communication of the data packet is intercepted, and the number of malicious data packets per unit time for each network or device is counted ;

[0012] Real-time average traffic based on all networks or devices and the number of abnormal packets , calculate the real-time carrying capacity Scl of unified threat management, issue data communication restriction warnings, and calculate the communication risk index of each network or device , restrict the communication of the corresponding network or device.

[0013] Furthermore, use network traffic monitoring tools (such as Wireshark, sFlow, NetFlow, etc.) to obtain the historical average traffic per unit time for each network or device in the heterogeneous network. and real-time average flow , calculate the real-time traffic anomaly coefficient of each network :

[0014]

[0015] Here, i represents the number of each network or device in the heterogeneous network.

[0016] Heterogeneous Network (HetNet) is an integrated network system composed of a variety of different network technologies and devices. Through various standards and protocols, different types of network devices can communicate and interact with each other to achieve data transmission and sharing.

[0017] Furthermore, the historical threat frequency of each network or device is extracted from the log information. , Threat Impact Time The number of other networks affected by the threat , calculate the historical threat risk factor for each network or device :

[0018]

[0019] in, Indicates the historical threat frequency for all networks or devices The mean of Indicates the threat impact time for all networks or devices The mean of Indicates the number of other networks affected by threats to all networks or devices The mean of .

[0020] Furthermore, obtain the real-time traffic anomaly coefficient of each network or device and historical threat risk factors , calculate the network risk factor for each network or device :

[0021]

[0022] The corresponding network risk factor for each network or device The calculation formula is as above.

[0023] Furthermore, the header of the data packet entering the unified threat management is parsed to obtain the source IP address, destination IP address, port number, sequence number and protocol type of the data packet. The source IP address format, source IP address range, destination IP address format, destination IP address range, port number range, sequence number range and protocol type range are verified using an online verification tool. If any verification anomaly exists, the current data packet is marked as an abnormal data packet, and the number of abnormal data packets per unit time for each network or device is counted. .

[0024] Unified Threat Management (UTM) is an information security term that refers to a single security solution that provides multiple security functions at a single point in the network, usually a separate security device. This device integrates multiple security features to form a unified management platform to deal with increasingly complex and diverse network threats.

[0025] Furthermore, deep packet inspection is used to conduct in-depth analysis of the contents of abnormal data packets, and compare them with known malicious code libraries and virus signature libraries to identify whether the data packets contain known malicious content. If so, the communication of the data packet is intercepted, and the number of malicious data packets per unit time for each network or device is counted. .

[0026] Furthermore, the maximum communication flow Zt and the maximum number of deep analysis packets Zf of unified threat management per unit time are tested by network performance testing tools, based on the real-time average flow of all networks or devices. and the number of abnormal packets , calculate and obtain the real-time carrying capacity Scl of unified threat management:

[0027]

[0028] If the real-time carrying capacity Scl is greater than 1, a data communication restriction warning is issued.

[0029] Furthermore, if the real-time load capacity Scl is not greater than 1, obtain the network risk coefficient of each network or device , real-time carrying capacity Scl and maximum number of deep analysis packets Zf, calculate the number of normal packets that need to be sampled for deep analysis in addition to abnormal packets per unit time for each network or device :

[0030]

[0031] The number of normal data packets that need to be sampled and analyzed in depth in addition to abnormal data packets per unit time for each network or device The calculation formula is as above.

[0032] Furthermore, after receiving the data communication restriction warning, the number of abnormal data packets per unit time for each network or device is obtained. , Number of malicious packets and network risk factor , calculate the communication risk index for each network or device :

[0033]

[0034] Each network or device is classified according to the communication risk index After sorting from large to small, the communication of the networks or devices ranked first is restricted in turn, and threat communication warnings of the corresponding networks or devices are issued externally until the real-time carrying capacity Scl is no more than 1.

[0035] A system for implementing unified threat management in a heterogeneous network, comprising:

[0036] Network risk assessment module, which calculates the real-time traffic anomaly coefficient of each network or device and historical threat risk factors , and based on the real-time traffic anomaly coefficient and historical threat risk factors Calculate the network risk factor for each network or device ;

[0037] The packet risk interception module parses the headers of packets entering the unified threat management, identifies abnormal packets, and counts the number of abnormal packets per unit time for each network or device , and conduct in-depth analysis of the contents of abnormal data packets to identify whether the data packets contain known malicious content. If so, the communication of the data packet is intercepted, and the number of malicious data packets per unit time for each network or device is counted ;

[0038] Data communication restriction module, based on the real-time average traffic of all networks or devices and the number of abnormal packets , calculate the real-time carrying capacity Scl of unified threat management, issue data communication restriction warnings, and calculate the communication risk index of each network or device , restrict the communication of the corresponding network or device.

[0039] (III) Beneficial effects

[0040] The present invention provides a method and system for realizing unified threat management in a heterogeneous network, which has the following beneficial effects:

[0041] 1. Calculate the real-time traffic anomaly coefficient for each network or device and historical threat risk factors , and based on the real-time traffic anomaly coefficient and historical threat risk factors Calculate the network risk factor for each network or device , can comprehensively and objectively assess the overall risk level of the network or equipment, formulate more targeted security protection measures and emergency plans, improve the security and reliability of the network, more reasonably allocate security resources and budgets, and ensure that resources are used most effectively.

[0042] 2. Parse the header of the data packet entering the unified threat management, identify abnormal data packets, and count the number of abnormal data packets per unit time for each network or device , and conduct in-depth analysis of the contents of abnormal data packets to identify whether the data packets contain known malicious content. If so, the communication of the data packet is intercepted, and the number of malicious data packets per unit time for each network or device is counted , which can effectively prevent the spread of network attacks such as malware, viruses, and ransomware, thereby enhancing network security.

[0043] 3. Based on the real-time average traffic of all networks or devices and the number of abnormal packets , calculate the real-time carrying capacity Scl of unified threat management, issue data communication restriction warnings, and calculate the communication risk index of each network or device , limit the communication of the corresponding network or device. According to the level of communication risk index, the UTM system can automatically or manually limit the communication of high-risk networks or devices, which helps to reduce potential security threats, prevent malicious traffic from spreading in the network, and protect the normal operation of key resources and services. At the same time, limiting non-critical or high-risk communications can also help the UTM system better manage its resources and ensure that priority services are provided for more important communications when resources are limited. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 A schematic diagram of a method for realizing unified threat management in a heterogeneous network according to the present invention;

[0045] Figure 2 The present invention is a schematic diagram of the system structure for realizing unified threat management in a heterogeneous network. DETAILED DESCRIPTION

[0046] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] See also Figure 1 The present invention provides a method for realizing unified threat management in a heterogeneous network, comprising the following steps:

[0048] Step 1: Calculate the real-time traffic anomaly coefficient for each network or device and historical threat risk factors , and based on the real-time traffic anomaly coefficient and historical threat risk factors Calculate the network risk factor for each network or device .

[0049] The step 1 includes the following contents:

[0050] Step 101: Use network traffic monitoring tools (such as Wireshark, sFlow, NetFlow, etc.) to obtain the historical average traffic per unit time for each network or device in the heterogeneous network. and real-time average flow , calculate the real-time traffic anomaly coefficient of each network :

[0051]

[0052] Here, i represents the number of each network or device in the heterogeneous network.

[0053] Heterogeneous Network (HetNet) is an integrated network system composed of a variety of different network technologies and devices. Through various standards and protocols, different types of network devices can communicate and interact with each other to achieve data transmission and sharing.

[0054] Step 102: Extract the historical threat frequency of each network or device from the log information , Threat Impact Time The number of other networks affected by the threat , calculate the historical threat risk factor for each network or device :

[0055]

[0056] in, Indicates the historical threat frequency for all networks or devices The mean of Indicates the threat impact time for all networks or devices The mean of Indicates the number of other networks affected by threats to all networks or devices The mean of .

[0057] Step 103: Obtain the real-time traffic anomaly coefficient of each network or device and historical threat risk factors , calculate the network risk factor for each network or device :

[0058]

[0059] The corresponding network risk factor for each network or device The calculation formula is as above.

[0060] When using, combine the contents in steps 101 to 103:

[0061] Calculate the real-time traffic anomaly coefficient for each network or device and historical threat risk factors , and based on the real-time traffic anomaly coefficient and historical threat risk factors Calculate the network risk factor for each network or device , can comprehensively and objectively assess the overall risk level of the network or equipment, formulate more targeted security protection measures and emergency plans, improve the security and reliability of the network, more reasonably allocate security resources and budgets, and ensure that resources are used most effectively.

[0062] Step 2: Parse the header of the data packet entering the unified threat management, identify abnormal data packets, and count the number of abnormal data packets per unit time for each network or device , and conduct in-depth analysis of the contents of abnormal data packets to identify whether the data packets contain known malicious content. If so, the communication of the data packet is intercepted, and the number of malicious data packets per unit time for each network or device is counted .

[0063] The step 2 includes the following contents:

[0064] Step 201: Parse the header of the data packet entering the unified threat management (UTM) to obtain the source IP address, destination IP address, port number, sequence number and protocol type of the data packet. Use the online verification tool to verify the source IP address format, source IP address range, destination IP address format, destination IP address range, port number range, sequence number range and protocol type range. If any verification is abnormal, mark the current data packet as an abnormal data packet and count the number of abnormal data packets per unit time for each network or device. .

[0065] Unified Threat Management (UTM) is an information security term that refers to a single security solution that provides multiple security functions at a single point in the network, usually a separate security device. This device integrates multiple security features to form a unified management platform to deal with increasingly complex and diverse network threats.

[0066] Step 202: Use deep packet inspection (DPI) to conduct in-depth analysis on the contents of abnormal data packets, compare them with known malicious code libraries, virus signature libraries, etc., identify whether the data packets contain known malicious content, and if so, intercept the communication of the data packets, and count the number of malicious data packets per unit time for each network or device. .

[0067] When using, combine the contents in steps 201 and 202:

[0068] Parse the headers of packets entering unified threat management, identify abnormal packets, and count the number of abnormal packets per unit time for each network or device , and conduct in-depth analysis of the contents of abnormal data packets to identify whether the data packets contain known malicious content. If so, the communication of the data packet is intercepted, and the number of malicious data packets per unit time for each network or device is counted , which can effectively prevent the spread of network attacks such as malware, viruses, and ransomware, thereby enhancing network security.

[0069] Step 3: Based on the real-time average traffic of all networks or devices and the number of abnormal packets , calculate the real-time carrying capacity Scl of unified threat management, issue data communication restriction warnings, and calculate the communication risk index of each network or device , restrict the communication of the corresponding network or device.

[0070] The step three includes the following contents:

[0071] Step 301: Use network performance testing tools (IxChariot, Spirent TestCenter, etc.) to test the maximum communication flow Zt and the maximum number of deep analysis packets Zf of the unified threat management (UTM) per unit time, based on the real-time average flow of all networks or devices. and the number of abnormal packets , calculate the real-time carrying capacity Scl of unified threat management (UTM):

[0072]

[0073] If the real-time carrying capacity Scl is greater than 1, a data communication restriction warning is issued.

[0074] Step 302: If the real-time load capacity Scl is not greater than 1, obtain the network risk coefficient of each network or device. , real-time carrying capacity Scl and maximum number of deep analysis packets Zf, calculate the number of normal packets that need to be sampled for deep analysis in addition to abnormal packets per unit time for each network or device :

[0075]

[0076] The number of normal data packets that need to be sampled and analyzed in depth in addition to abnormal data packets per unit time for each network or device The calculation formula is as above.

[0077] Step 303: After receiving the data communication restriction warning, obtain the number of abnormal data packets per unit time for each network or device , Number of malicious packets and network risk factor , calculate the communication risk index for each network or device :

[0078]

[0079] Each network or device is classified according to the communication risk index After sorting from large to small, the communication of the networks or devices ranked first is restricted in turn, and threat communication warnings of the corresponding networks or devices are issued externally until the real-time carrying capacity Scl is no more than 1.

[0080] When using, combine the contents in steps 301 to 303:

[0081] Real-time average traffic based on all networks or devices and the number of abnormal packets , calculate the real-time carrying capacity Scl of unified threat management, issue data communication restriction warnings, and calculate the communication risk index of each network or device , limit the communication of the corresponding network or device. According to the level of communication risk index, the UTM system can automatically or manually limit the communication of high-risk networks or devices, which helps to reduce potential security threats, prevent malicious traffic from spreading in the network, and protect the normal operation of key resources and services. At the same time, limiting non-critical or high-risk communications can also help the UTM system better manage its resources and ensure that priority services are provided for more important communications when resources are limited.

[0082] See also Figure 2 The present invention provides a unified threat management system in a heterogeneous network, comprising:

[0083] Network risk assessment module, which calculates the real-time traffic anomaly coefficient of each network or device and historical threat risk factors , and based on the real-time traffic anomaly coefficient and historical threat risk factors Calculate the network risk factor for each network or device .

[0084] The packet risk interception module parses the headers of packets entering the unified threat management, identifies abnormal packets, and counts the number of abnormal packets per unit time for each network or device , and conduct in-depth analysis of the contents of abnormal data packets to identify whether the data packets contain known malicious content. If so, the communication of the data packet is intercepted, and the number of malicious data packets per unit time for each network or device is counted .

[0085] Data communication restriction module, based on the real-time average traffic of all networks or devices and the number of abnormal packets , calculate the real-time carrying capacity Scl of unified threat management, issue data communication restriction warnings, and calculate the communication risk index of each network or device , restrict the communication of the corresponding network or device.

[0086] The above embodiments may be implemented in whole or in part by software, hardware, firmware or any other combination thereof. When implemented using software, the above embodiments may be implemented in whole or in part in the form of a computer program product. A person of ordinary skill in the art may appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein may be implemented in electronic hardware, or in a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution.

[0087] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0088] The above description is only a specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application.

Claims

1. A method for implementing unified threat management in a heterogeneous network, characterized in that: The steps include: Calculate the real-time traffic anomaly coefficient Ly for each network or device i and historical threat risk factor Lf i , and based on the real-time flow anomaly coefficient Ly i and historical threat risk factor Lf i Calculate the network risk factor Fw for each network or device i ; Use network traffic monitoring tools to obtain the historical average traffic La per unit time for each network or device in the heterogeneous network i and real-time average flow Sa i , calculate the real-time traffic anomaly coefficient Ly of each network i : Where i represents the number of each network or device in the heterogeneous network; Extract the historical threat frequency Wp of each network or device from the log information i 、Threat impact time Wy i And the number of other networks affected by the threat Ws i , calculate the historical threat risk factor Lf for each network or device i : in, Represents the historical threat frequency Wp of all networks or devices i The mean of Indicates the threat impact time Wy for all networks or devices i The mean of Indicates the number of other networks affected by threats to all networks or devices Ws i The mean of Get the real-time traffic anomaly coefficient Ly for each network or device i and historical threat risk factor Lf i , calculate the network risk factor Fw for each network or device i : Parse the header of the data packet entering the unified threat management, identify abnormal data packets, and count the number of abnormal data packets per unit time for each network or device. i , and conduct in-depth analysis on the contents of abnormal data packets to identify whether the data packets contain known malicious content. If so, the communication of the data packets is intercepted, and the number of malicious data packets per unit time for each network or device is counted. i ; Based on the real-time average traffic of all networks or devices Sa i And the number of abnormal packets By i , calculate the real-time carrying capacity Scl of unified threat management, issue data communication restriction warnings, and calculate the communication risk index Tx for each network or device i , restrict the communication of the corresponding network or device; The maximum communication flow Zt and the maximum number of deep analysis packets Zf per unit time of unified threat management are tested by network performance testing tools, and the real-time average flow Sa of all networks or devices is calculated. i And the number of abnormal packets By i , calculate and obtain the real-time carrying capacity Scl of unified threat management: If the real-time carrying capacity Scl is greater than 1, a data communication restriction warning is issued externally; After receiving the data communication restriction warning, obtain the number of abnormal data packets per unit time for each network or device. i , the number of malicious data packets Ey i and network risk factor Fw i , calculate the communication risk index Tx for each network or device i : Tx i =(By i +Ey i )*Fw i Each network or device is classified according to the communication risk index Tx i After sorting from large to small, the communication of the networks or devices ranked first is restricted in turn, and threat communication warnings of the corresponding networks or devices are issued externally until the real-time carrying capacity Scl is no more than 1.

2. The method for implementing unified threat management in a heterogeneous network according to claim 1, characterized in that: Parse the header of the data packet entering the unified threat management to obtain the source IP address, destination IP address, port number, sequence number and protocol type of the data packet. Use the online verification tool to verify the source IP address format, source IP address range, destination IP address format, destination IP address range, port number range, sequence number range and protocol type range. If any verification is abnormal, mark the current data packet as an abnormal data packet and count the number of abnormal data packets per unit time for each network or device. i .

3. The method for implementing unified threat management in a heterogeneous network according to claim 2, characterized in that: Use deep packet inspection to analyze the contents of abnormal data packets in depth, compare them with known malicious code libraries and virus signature libraries, identify whether the data packets contain known malicious content, and if so, intercept the communication of the data packets, and count the number of malicious data packets per unit time for each network or device. i .

4. The method for implementing unified threat management in a heterogeneous network according to claim 1, characterized in that: If the real-time load capacity Scl is not greater than 1, obtain the network risk factor Fw for each network or device i , real-time carrying capacity Scl and maximum number of deep analysis packets Zf, calculate the number of normal packets Cf that need to be sampled for deep analysis in addition to abnormal packets per unit time for each network or device i : The number of normal data packets that need to be sampled and analyzed in depth in addition to abnormal data packets per unit time for each network or device Cf i The calculation formula is as above.

5. A system for implementing unified threat management in a heterogeneous network, used to implement the method according to any one of claims 1 to 4, characterized in that: include: Network risk assessment module, calculates the real-time traffic anomaly coefficient Ly for each network or device i and historical threat risk factor Lf i , and based on the real-time flow anomaly coefficient Ly i and historical threat risk factor Lf i Calculate the network risk factor Fw for each network or device i ; The packet risk interception module analyzes the header of the packet entering the unified threat management, identifies abnormal packets, and counts the number of abnormal packets per unit time for each network or device. i , and conduct in-depth analysis on the contents of abnormal data packets to identify whether the data packets contain known malicious content. If so, the communication of the data packets is intercepted, and the number of malicious data packets per unit time for each network or device is counted. i ; Data communication restriction module, based on the real-time average traffic Sa of all networks or devices i And the number of abnormal packets By i , calculate the real-time carrying capacity Scl of unified threat management, issue data communication restriction warnings, and calculate the communication risk index Tx for each network or device i , restrict the communication of the corresponding network or device.

Images