Security protection method for convergence and distribution equipment based on data intelligence

Abstract

The invention discloses a security protection method for convergence and distribution equipment based on data intelligence, relates to the technical field of security protection of the convergence and distribution equipment, and solves the technical problem that in the prior art, multi-service execution security analysis cannot be carried out on the convergence and distribution equipment, so that the traffic control security is reduced, in particular to service security analysis. Safety analysis is performed on equipment operation services in the operation process of the convergence and distribution equipment, monitoring control is performed on the operation services of the convergence and distribution equipment, and safety analysis is performed on service execution according to service requirements, so that potential safety hazards existing in service execution are avoided, and the operation safety of the convergence and distribution equipment is reduced; and the security reduction of other security execution services is also influenced.

Description

Technical Field

[0001] The present invention relates to the technical field of security protection for convergence and diversion equipment, and in particular to a security protection method for convergence and diversion equipment based on data intelligence. Background Art

[0002] Traffic aggregation and diversion equipment is a key device in network communications. Traffic aggregation can aggregate different types of data traffic from multiple input ports and integrate data from different sources, such as traffic from multiple network links, different servers or devices. Traffic diversion can divert the aggregated traffic according to specific rules and distribute it to different destinations. Data filtering and processing has data filtering functions, which can filter traffic according to preset rules and remove unnecessary or malicious traffic.

[0003] The patent with announcement number CN114826630A discloses a traffic processing method and a protection device in a protection device, which belongs to the field of network technology; this application combines a dedicated security chip with a CPU, and the dedicated security chip and the CPU work together to defend against attacks; the dedicated security chip is responsible for forwarding traffic related to IP addresses with no attack risks, while the CPU is responsible for forwarding traffic related to IP addresses with attack risks, thereby achieving complete attack detection and defense during the forwarding processing process.

[0004] In the prior art, first of all, it is not possible to perform physical security analysis and network security analysis on the convergence and diversion equipment, and it is impossible to ensure the operating stability of the convergence and diversion equipment itself, so that the traffic cannot be controlled more comprehensively. In addition, it is impossible to perform operating system analysis on the convergence and diversion equipment, so that system vulnerabilities cannot be monitored and controlled in time, resulting in deviations in traffic control. In addition, it is impossible to perform multi-service execution security analysis on the convergence and diversion equipment, resulting in a decrease in the security of traffic control, which indirectly reduces the protection efficiency of the convergence and diversion equipment.

[0005] In view of the above technical defects, a solution is now proposed. Summary of the invention

[0006] The purpose of the present invention is to solve the above-mentioned problems and to propose a data intelligence-based security protection method for convergence and diversion equipment.

[0007] The purpose of the present invention can be achieved through the following technical solutions:

[0008] A security protection method for convergence and diversion equipment based on data intelligence, the specific steps of the security protection method are as follows:

[0009] Step 1: Physical security analysis: Conduct physical security analysis on the convergence and diversion equipment, test the hardware performance of the convergence and diversion equipment and the environment where the equipment hardware is located, and infer whether the operation efficiency of the convergence and diversion equipment is qualified through these two aspects;

[0010] Step 2: Network security analysis: Conduct a security analysis on the network operation of the convergence and diversion devices. After completing the physical security analysis, the system conducts a network operation analysis on the convergence and diversion devices. Based on the network security analysis of the convergence and diversion devices, it is inferred whether the network security is qualified, and network security protection is performed if the network security analysis is unqualified.

[0011] Step 3: System safety analysis: Conduct an operation safety analysis on the running system where the convergence and diversion equipment is located, and infer whether the system safety of the convergence and diversion equipment is qualified through the operation safety analysis of the running system;

[0012] Step 4: Business security analysis: conduct a security analysis on the business running on the equipment during the operation of the convergence and distribution equipment, monitor and control the business running on the convergence and distribution equipment, and conduct a security analysis on the business execution according to business needs.

[0013] As a preferred embodiment of the present invention, the physical security analysis process in step 1 is as follows:

[0014] Mark the convergence and diversion device as a protection subject, and obtain the performance detection information and environmental detection information of the protection subject. If the performance detection information exceeds the speed numerical ratio threshold, or the environmental detection information exceeds the time numerical ratio threshold, it is inferred that the physical safety analysis of the protection subject is abnormal; if the performance detection information does not exceed the speed numerical ratio threshold, and the environmental detection information does not exceed the time numerical ratio threshold, it is inferred that the physical safety analysis of the protection subject is normal.

[0015] As a preferred embodiment of the present invention, the performance detection information and the environmental detection information are respectively the numerical ratio of the rising speed of the floating span of electrical parameters of the equipment itself during the operation of the protection body to the delayed decrease speed of the execution time of the protection body task after the electrical parameters float, and the numerical ratio of the control time of the floating value of the environmental parameters during the operation of the protection body to the constant time of the flow control speed of the protection body without floating after the environmental parameters float.

[0016] As a preferred implementation of the present invention, the network security analysis process in step 2 is as follows:

[0017] After completing the physical security analysis, the login fault tolerance data and monitoring delay data of the protection subject are obtained. If the login fault tolerance data exceeds the replacement frequency peak threshold, or the monitoring delay data exceeds the time deviation value threshold, it is inferred that there is a network security risk when the protection subject accesses the access end; if the login fault tolerance data does not exceed the replacement frequency peak threshold, and the monitoring delay data does not exceed the time deviation value threshold, it is inferred that there is no network security risk when the protection subject accesses the access end.

[0018] As a preferred implementation mode of the present invention, the login fault tolerance data and the monitoring delay data are respectively the peak value of the access mode change frequency before the access mode of the access end successfully matches the access control policy when the access end accesses the protection subject, and the time deviation value between the corresponding traffic in and out time of the firewall of the subject itself and the in and out traffic monitoring control time after the access end accesses the access subject.

[0019] As a preferred implementation of the present invention, the system safety analysis process in step 3 is as follows:

[0020] The system duration impact parameter and system flow control impact parameter are obtained. If the system duration impact parameter exceeds the non-overlapping duration threshold, or the system flow control impact parameter exceeds the mean deviation value threshold, it is inferred that there is a system control vulnerability in the running system where the protection subject is located; if the system duration impact parameter does not exceed the non-overlapping duration threshold, and the system flow control impact parameter does not exceed the mean deviation value threshold, it is inferred that there is no system control vulnerability in the running system where the protection subject is located.

[0021] As a preferred implementation mode of the present invention, the system duration influencing parameter and the system flow control influencing parameter are respectively the non-overlapping duration of the fixed execution duration of the task execution cycle and the system warning duration when the access terminal flow control is recorded in the task execution log in the running system where the protection subject is located, and the mean deviation value of the maximum control span of the access terminal flow in the running system emergency plan when the task execution in the running system where the protection subject is located is abnormal.

[0022] As a preferred implementation of the present invention, the business security analysis process in step 4 is as follows:

[0023] The business security isolation parameters and business security control parameters of the protection subject are obtained. If the business security isolation parameters do not exceed the average proportion threshold of the time period, or the business security control parameters exceed the average threshold of the flow control floating span, it is inferred that the security analysis of the protection subject when executing multiple businesses is abnormal; if the business security isolation parameters exceed the average proportion threshold of the time period, and the business security control parameters do not exceed the average threshold of the flow control floating span, it is inferred that the security analysis of the protection subject when executing multiple businesses is normal.

[0024] As a preferred implementation mode of the present invention, the business security isolation parameter and the business security control parameter are respectively the average proportion of the traffic isolation period and the multi-business traffic control period when the protection subject performs multi-business traffic control, and the average value of the traffic control floating span of the business executed at the same time when any business executes traffic control abnormally when the protection subject performs multi-business traffic control.

[0025] Compared with the prior art, the present invention has the following beneficial effects:

[0026] 1. In the present invention, physical security analysis is performed on the convergence and diversion equipment, and the hardware performance of the convergence and diversion equipment and the environment where the equipment hardware is located are tested. Whether the operation efficiency of the convergence and diversion equipment is qualified is inferred from two aspects, thereby improving the safety protection efficiency of the convergence and diversion equipment, avoiding the hardware anomaly of the convergence and diversion equipment causing the equipment itself to reduce its operation efficiency and affect the safety of the equipment operation, and performing regulation when analyzing the anomaly to ensure the operation stability and safety of the convergence and diversion equipment when the equipment is running;

[0027] Perform security analysis on the network operation of the convergence and diversion devices. After completing the physical security analysis, this system performs network operation analysis on the convergence and diversion devices. It infers whether the network security is qualified based on the network security analysis of the convergence and diversion devices, and performs network security protection when the network security analysis is unqualified, so as to ensure the security of the convergence and diversion devices' operating environment and improve the efficiency of security protection of the convergence and diversion devices.

[0028] 2. In the present invention, an operation safety analysis is performed on the operation system where the convergence and diversion device is located. The operation safety analysis of the operation system is used to infer whether the system safety of the convergence and diversion device is qualified, so as to ensure that the operation system can ensure the operation stability of the convergence and diversion device during flow control, and avoid the operation system being unable to provide a safe operation environment for the convergence and diversion device, which may easily cause the convergence and diversion device to be unable to accurately perform flow diversion control, thereby reducing the operation stability and operation efficiency of the convergence and diversion device;

[0029] During the operation of the convergence and diversion equipment, a security analysis of the equipment's operating services is performed, the running services of the convergence and diversion equipment are monitored and controlled, and a security analysis of business execution is performed according to business needs to avoid security risks in business execution, which reduces the operating security of the convergence and diversion equipment and also affects the security of other securely executed businesses. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to facilitate understanding by those skilled in the art, the present invention is further described below with reference to the accompanying drawings.

[0031] Figure 1 A flow chart of the overall method of the present invention;

[0032] Figure 2This is a flow chart of the method for physical security analysis of the present invention. DETAILED DESCRIPTION

[0033] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0034] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present invention. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0035] See also Figure 1 - Figure 2 As shown, a security protection method for convergence and diversion devices based on data intelligence is provided. The specific steps of the security protection method are as follows:

[0036] Step 1: Physical security analysis: Conduct physical security analysis on the convergence and diversion equipment, test the hardware performance of the convergence and diversion equipment and the environment where the equipment hardware is located. Infer whether the convergence and diversion equipment is operating efficiently from these two aspects, thereby improving the safety protection efficiency of the convergence and diversion equipment, and preventing the convergence and diversion equipment hardware abnormalities from causing the equipment itself to have lower operating efficiency and affect the equipment operation safety. When analyzing the abnormalities, make adjustments and controls to ensure the operation stability and safety of the convergence and diversion equipment when it is running.

[0037] Step 2: Network security analysis: Conduct a security analysis on the network operation of the convergence and diversion devices. After completing the physical security analysis, the system conducts a network operation analysis on the convergence and diversion devices. It infers whether the network security is qualified based on the network security analysis of the convergence and diversion devices, and performs network security protection when the network security analysis is unqualified, so as to ensure the security of the convergence and diversion device operation environment and improve the security protection efficiency of the convergence and diversion devices.

[0038] Step 3: System safety analysis: Conduct an operation safety analysis on the operation system where the convergence and diversion equipment is located. Through the operation safety analysis of the operation system, it is inferred whether the system safety of the convergence and diversion equipment is qualified, and ensure that the operation system can ensure the operation stability of the convergence and diversion equipment during flow control, so as to avoid the operation system being unable to provide a safe operation environment for the convergence and diversion equipment, which may cause the convergence and diversion equipment to be unable to accurately perform flow control, thereby reducing the operation stability and efficiency of the convergence and diversion equipment;

[0039] Step 4: Business security analysis: conduct a security analysis on the business running on the equipment during the operation of the convergence and diversion equipment. Monitor and control the business running on the convergence and diversion equipment, and conduct a security analysis on the business execution according to business needs to avoid the execution of the business. The security risks will reduce the operation security of the convergence and diversion equipment, and also affect the security of other secure execution businesses.

[0040] Step 1 The physical security analysis process is as follows:

[0041] Mark the convergence and diversion device as the protection subject, and obtain the numerical ratio of the rising speed of the floating span of the device's own electrical parameters during the operation of the protection subject and the delayed falling speed of the protection subject task execution time after the electrical parameters float, where the electrical parameters are represented by parameters such as the current and voltage passing through the device when the protection subject is running; obtain the numerical ratio of the time consumed for the floating numerical control of the environmental parameters during the operation of the protection subject and the non-floating constant time of the flow control speed of the protection subject after the environmental parameters float, where the numerical ratio only compares the numerical values ​​when the two data units are not unified, without considering the problem of inconsistent units, and only counts the impact of the floating numerical values;

[0042] The speed ratio of the equipment's own electrical parameter floating span rising speed during the protection subject operation to the delay falling speed of the protection subject task execution time after the electrical parameter floating, and the value ratio of the environmental parameter floating value control time during the protection subject operation to the non-floating constant time of the protection subject flow control speed after the environmental parameter floating are respectively the performance detection information and the environmental detection information, and are compared with the speed value ratio threshold and the time value ratio threshold respectively:

[0043] If the speed ratio of the rising speed of the floating span of the electrical parameters of the equipment itself during the operation of the protection subject to the delayed falling speed of the task execution time of the protection subject after the floating of the electrical parameters exceeds the speed value ratio threshold, or the time consumption of the floating numerical control of the environmental parameters during the operation of the protection subject to the constant time of the flow control speed of the protection subject without floating after the floating of the environmental parameters exceeds the time consumption value ratio threshold, it is inferred that the physical safety analysis of the protection subject is abnormal, and a physical risk signal is generated and sent to the administrator terminal. After receiving the physical risk signal, the administrator terminal adjusts the operating environment of the protection subject;

[0044] If the speed ratio of the rising speed of the floating span of the electrical parameters of the equipment itself during the operation of the protection subject to the delayed falling speed of the task execution time of the protection subject after the floating of the electrical parameters does not exceed the speed value ratio threshold, and the time consumption of the floating numerical control of the environmental parameters during the operation of the protection subject to the constant time of the flow control speed of the protection subject after the floating of the environmental parameters does not exceed the time consumption value ratio threshold, it is inferred that the physical security analysis of the protection subject is normal, and a physical security signal is generated and sent to the administrator terminal;

[0045] Step 2: The network security analysis process is as follows:

[0046] After completing the physical security analysis, conduct a network security analysis on the protection subject, obtain the peak value of the access mode change frequency before the access mode of the access end successfully matches the access control policy when the access end accesses the protection subject, and obtain the time deviation value between the inbound and outbound traffic monitoring and control time and the corresponding traffic inbound and outbound traffic time of the firewall of the subject itself after the access end accesses the access subject, and mark the peak value of the access mode change frequency before the access mode of the access end successfully matches the access control policy when the access end accesses the protection subject, and the time deviation value between the inbound and outbound traffic monitoring and control time of the firewall of the subject itself after the access end accesses the access subject as login fault tolerance data and monitoring delay data, and compare them with the change frequency peak threshold and time deviation value threshold respectively: the access mode is represented by login mode, access protocol, etc., and the access control policy is the corresponding set login mode or access protocol, etc.;

[0047] If the peak value of the access mode change frequency before the access mode of the access end successfully matches the access control policy when the access end accesses the protection subject exceeds the peak value threshold of the access mode change frequency, or the time deviation value between the corresponding traffic inflow and outflow time of the firewall of the subject itself and the inflow and outflow traffic monitoring control time after the access end accesses the access subject exceeds the time deviation value threshold, it is inferred that there is a network security risk when the protection subject accesses the access end, and a network risk signal is generated and sent to the administrator terminal. After receiving the network risk signal, the administrator terminal performs security regulation before and after the access end of the protection subject accesses to ensure whether the identity information of the access end matches the authorization scope, and at the same time, whether the traffic monitoring during the operation of the protection subject is reasonable and timely regulated;

[0048] If the access mode change frequency peak value does not exceed the change frequency peak threshold value before the access mode of the access end successfully matches the access control policy when the access end accesses the protection subject, and the time deviation value between the inbound and outbound traffic corresponding to the firewall of the subject itself and the inbound and outbound traffic monitoring control time after the access end accesses the access subject does not exceed the time deviation value threshold value, it is inferred that there is no network security risk when the protection subject accesses the access end, and a network security signal is generated and sent to the administrator terminal;

[0049] Step 3: The system safety analysis process is as follows:

[0050] The non-overlapping duration of the fixed execution duration of the task execution cycle during access end traffic control and the system warning duration recorded in the task execution log in the running system where the protection subject is located is obtained, and at the same time, the mean deviation value of the maximum control span of each access end traffic in the running system emergency plan when the task execution in the running system where the protection subject is located is obtained, and the non-overlapping duration of the fixed execution duration of the task execution cycle during access end traffic control and the system warning duration recorded in the task execution log in the running system where the protection subject is located, and the mean deviation value of the maximum control span of each access end traffic in the running system emergency plan when the task execution in the running system where the protection subject is located is marked as the system duration influencing parameter and the system flow control influencing parameter, and are compared with the non-overlapping duration threshold and the mean deviation threshold respectively:

[0051] If the non-overlapping time between the fixed execution time of the task execution cycle and the system warning time during the access terminal traffic control recorded in the task execution log in the running system where the protection subject is located exceeds the non-overlapping time threshold, or the mean deviation value of the maximum control span of each access terminal traffic in the running system emergency plan when the task execution in the running system where the protection subject is located is abnormal exceeds the mean deviation value threshold, it is inferred that there is a system control vulnerability in the running system where the protection subject is located, and a system security abnormality signal is generated and sent to the administrator terminal. After receiving the system security abnormality signal, the administrator terminal performs overall debugging and control on the running system of the protection subject;

[0052] If the non-overlapping time between the fixed execution time of the task execution cycle and the system warning time during access terminal traffic control recorded in the task execution log in the running system where the protection subject is located does not exceed the non-overlapping time threshold, and the mean deviation value of the maximum control span of each access terminal traffic in the running system emergency plan when the task execution in the running system where the protection subject is located is abnormal does not exceed the mean deviation value threshold, it is inferred that there is no system control vulnerability in the running system where the protection subject is located, and a system safety normal signal is generated and sent to the administrator terminal;

[0053] The business security analysis process in step 4 is as follows:

[0054] The average proportion of the traffic isolation period and the multi-service traffic control period when the protection subject performs multi-service traffic control is obtained, and the average value of the traffic control floating span when any service performs traffic control abnormally when the protection subject performs multi-service traffic control is obtained. The average proportion of the traffic isolation period and the multi-service traffic control period when the protection subject performs multi-service traffic control and the average value of the traffic control floating span when any service performs traffic control abnormally when the protection subject performs multi-service traffic control are marked as service security isolation parameters and service security control parameters, respectively, and compared with the time period average proportion threshold and the traffic control floating span average threshold, respectively:

[0055] If the average proportion of the traffic isolation period and the multi-service traffic control period when the protection subject performs multi-service traffic control does not exceed the average period proportion threshold, or if the average of the traffic control floating spans of the services executed at the same time when any service performs traffic control abnormally when the protection subject performs multi-service traffic control exceeds the average of the traffic control floating span threshold, it is inferred that the security analysis of the multi-service execution of the protection subject is abnormal, and a service security abnormality signal is generated and sent to the administrator terminal. After receiving the service security abnormality signal, the administrator terminal adjusts the service execution strategy of the protection subject and continuously supervises the service execution process;

[0056] If the average proportion of the traffic isolation period and the multi-service traffic control period when the protection subject performs multi-service traffic control exceeds the average period proportion threshold, and the average of the traffic control floating span of the service executed at the same time when any service performs traffic control abnormality when the protection subject performs multi-service traffic control does not exceed the average of the traffic control floating span threshold, it is inferred that the security analysis of the multi-service execution of the protection subject is normal, and a business security normal signal is generated and sent to the administrator terminal;

[0057] When the present invention is in use, a physical security analysis is performed on the convergence and diversion equipment, and the hardware performance of the convergence and diversion equipment and the environment in which the equipment hardware is located are detected, and whether the operation efficiency of the convergence and diversion equipment is qualified is inferred from two aspects; a network security analysis is performed on the network operation of the convergence and diversion equipment. After completing the physical security analysis, the system performs a network operation analysis on the convergence and diversion equipment, and infers whether the network security is qualified based on the network security analysis of the convergence and diversion equipment operation, and performs network security protection when the network security analysis is unqualified; a system security analysis is performed on the operation security analysis of the operation system where the convergence and diversion equipment is located, and whether the system security of the convergence and diversion equipment is qualified is inferred through the operation security analysis of the operation system; a business security analysis is performed on the equipment operation business during the operation of the convergence and diversion equipment, and the operation business of the convergence and diversion equipment is monitored and controlled, and a security analysis is performed on the business execution according to business needs.

[0058] The preferred embodiments of the present invention disclosed above are only used to help explain the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to only specific implementation methods. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A data intelligence-based convergence and diversion device security protection method, characterized in that: The specific safety protection steps are as follows: Step 1: Physical security analysis: Conduct physical security analysis on the convergence and diversion equipment, test the hardware performance of the convergence and diversion equipment and the environment where the equipment hardware is located, and infer whether the operation efficiency of the convergence and diversion equipment is qualified through these two aspects; Step 2: Network security analysis: Conduct a security analysis on the network operation of the convergence and diversion devices. After completing the physical security analysis, the system conducts a network operation analysis on the convergence and diversion devices. Based on the network security analysis of the convergence and diversion devices, it is inferred whether the network security is qualified, and network security protection is performed if the network security analysis is unqualified. Step 3: System safety analysis: Conduct an operation safety analysis on the running system where the convergence and diversion equipment is located, and infer whether the system safety of the convergence and diversion equipment is qualified through the operation safety analysis of the running system; Step 4: Business security analysis: conduct a security analysis on the business running on the equipment during the operation of the convergence and distribution equipment, monitor and control the business running on the convergence and distribution equipment, and conduct a security analysis on the business execution according to business needs.

2. According to a data intelligence-based security protection method for convergence and diversion equipment according to claim 1, it is characterized in that: Step 1 The physical security analysis process is as follows: Mark the convergence and diversion device as a protection subject, obtain the performance detection information and environment detection information of the protection subject, and if the performance detection information exceeds the speed value ratio threshold, or the environment detection information exceeds the time value ratio threshold, it is inferred that the physical security analysis of the protection subject is abnormal; If the performance detection information does not exceed the speed value ratio threshold, and the environment detection information does not exceed the time value ratio threshold, it is inferred that the physical security analysis of the protection subject is normal.

3. A data intelligence-based convergence and diversion device security protection method according to claim 2, characterized in that: The performance detection information and environmental detection information are respectively the numerical ratio of the rising speed of the floating span of the electrical parameters of the equipment itself during the operation of the protection body to the speed of the delayed decrease speed of the protection body task execution time after the electrical parameters float, and the numerical ratio of the control time of the environmental parameter floating value during the operation of the protection body to the constant time of the flow control speed of the protection body without floating after the environmental parameters float.

4. According to a data intelligence-based security protection method for convergence and diversion equipment according to claim 1, it is characterized in that: Step 2: The network security analysis process is as follows: After completing the physical security analysis, the login fault tolerance data and monitoring delay data of the protection subject are obtained. If the login fault tolerance data exceeds the replacement frequency peak threshold, or the monitoring delay data exceeds the time deviation value threshold, it is inferred that there is a network security risk when the protection subject accesses the access end; if the login fault tolerance data does not exceed the replacement frequency peak threshold, and the monitoring delay data does not exceed the time deviation value threshold, it is inferred that there is no network security risk when the protection subject accesses the access end.

5. A data intelligence-based convergence and diversion device security protection method according to claim 4, characterized in that: The login fault tolerance data and monitoring delay data are respectively the peak frequency of access mode change before the access mode of the access end successfully matches the access control policy when the access end accesses the protection subject, and the time deviation value between the corresponding traffic in and out time of the firewall of the subject itself and the in and out traffic monitoring control time after the access end accesses the access subject.

6. A data intelligence-based convergence and diversion device security protection method according to claim 1, characterized in that: Step 3 The system safety analysis process is as follows: The system duration impact parameter and system flow control impact parameter are obtained. If the system duration impact parameter exceeds the non-overlapping duration threshold, or the system flow control impact parameter exceeds the mean deviation value threshold, it is inferred that there is a system control vulnerability in the running system where the protection subject is located; if the system duration impact parameter does not exceed the non-overlapping duration threshold, and the system flow control impact parameter does not exceed the mean deviation value threshold, it is inferred that there is no system control vulnerability in the running system where the protection subject is located.

7. A data intelligence-based convergence and diversion device security protection method according to claim 6, characterized in that: The system duration influencing parameters and the system flow control influencing parameters are respectively the non-overlapping duration of the fixed execution duration of the task execution cycle and the system warning duration when the access end flow control is recorded in the task execution log in the running system where the protection subject is located, and the mean deviation value of the maximum control span of each access end flow in the running system emergency plan when the task execution in the running system where the protection subject is located is abnormal.

8. The data intelligence-based security protection method for convergence and diversion equipment according to claim 1 is characterized in that: The business security analysis process in step 4 is as follows: The business security isolation parameters and business security control parameters of the protection subject are obtained. If the business security isolation parameters do not exceed the average proportion threshold of the time period, or the business security control parameters exceed the average threshold of the flow control floating span, it is inferred that the security analysis of the protection subject is abnormal when executing multiple businesses; If the business security isolation parameter exceeds the average proportion threshold of the time period, and the business security control parameter does not exceed the flow control floating span mean threshold, it is inferred that the security analysis of the protection subject is normal when executing multiple businesses.

9. A data intelligence-based convergence and diversion device security protection method according to claim 8, characterized in that: The business security isolation parameters and business security control parameters are respectively the average proportion of the traffic isolation period and the multi-business traffic control period when the protection subject performs multi-business traffic control, and the average value of the traffic control floating span of the business executed at the same time when any business executes traffic control abnormally when the protection subject performs multi-business traffic control.

Images