New energy power communication data abnormal flow online safety monitoring system

Abstract

The invention relates to a data on-line monitoring system, belongs to the technical field of flow monitoring, and particularly relates to a new energy power communication data abnormal flow on-line safety monitoring system which comprises a flow on-line safety monitoring system. The traffic online safety monitoring system is characterized by comprising a data packet, a data acquisition module, a data storage module and a user display module, the data acquisition module comprises an original data packet capturing module, a data packet queue module, a stream generation thread module, a stream cache module, a stream export thread module and a configuration file module; according to the invention, the data packet sends the data to the data acquisition module, the data acquisition module sends the data to the data storage module according to the acquired information, and meanwhile, the user display module reads the content in the data storage module and displays the data information in the data packet to the user for viewing according to the demand of the user. A user can conveniently see traffic abnormal condition information; the problem that an existing user cannot see the reason of data traffic abnormity is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of flow monitoring, and in particular to an online safety monitoring system for abnormal flow of new energy power communication data. Background Art

[0002] New energy power communication data traffic refers to the amount of data generated during the generation and transmission of new energy, including but not limited to the operating status data of wind turbines and solar panels, power quality data, environmental monitoring data, etc. As the proportion of new energy in the power system increases, the communication data traffic also increases, which puts higher requirements on the bandwidth and stability of the communication network.

[0003] Nowadays, due to the openness of the Internet, there may be some software that maliciously tamper with data traffic, resulting in a large amount of data traffic access. In order to be able to tamper with data traffic for a longer period of time, malware is usually set up very covertly, making it difficult for users to see the cause of abnormal data traffic. At the same time, it brings high traffic fees; this undoubtedly brings huge troubles and losses to users. Summary of the invention

[0004] In order to solve the above technical problems, the present invention proposes an online security monitoring system for abnormal flow of new energy power communication data. The data packet sends data to the data acquisition module, and the data acquisition sends the data to the data storage module according to the collected information. At the same time, the user display module reads the content in the data storage module and displays the data information in the data packet to the user according to the user's needs, so that the user can see the abnormal flow information conveniently.

[0005] The technical solution to achieve the purpose of the present invention is: a new energy power communication data abnormal flow online safety monitoring system, including a flow online safety monitoring system, the flow online safety monitoring system includes a data packet, a data acquisition module, a data storage module and a user display module;

[0006] The data acquisition module includes capturing original data packets, data packet queues, flow generation threads, flow caches, flow export threads and configuration files;

[0007] The data storage module includes a data collection thread, a data classification thread and a data storage thread;

[0008] The user display module includes a database storage system, a file storage module, a data analysis module and a data display module.

[0009] Preferably, the data packet sends data to the data acquisition module, and the data acquisition sends the data to the data storage module based on the collected information. At the same time, the user display module reads the content in the data storage module and displays the data information in the data packet to the user for viewing.

[0010] Preferably, the configuration file in the data acquisition module is connected with the capture of original data packets, flow generation thread and flow export thread, and the capture of original data packets, data packet queue, flow generation thread, flow cache and flow export thread are connected in sequence.

[0011] Preferably, the data packet sends the data to the data acquisition module, and the configuration file in the data acquisition module groups the data captured by the original data packet, samples the data packets captured by the original data packet, and makes a preliminary judgment on the data packets. If the result is abnormal, an alarm is issued, and if it is normal, it enters the data packet queue, and performs simple analysis and rule matching with the configuration file in turn. Then, these data packets are packaged to form an IPFIX flow after obtaining the required fields, and then queued in the flow cache. Finally, the configuration file is compared and analyzed again with the IPFIX flow to be sent. If it is abnormal, an alarm is issued, and if it is normal, the IPFIX flow is sent to the data storage module; the ultimate goal of the data acquisition module is to form an IPFIX flow and send it to the data storage module in real time, and save it as a flow file in a specific format.

[0012] Preferably, the rules of the flow generation thread are completely defined by the user, provided that the rules of the configuration file are followed, i.e., specific attributes are defined under specific tags, and two steps are required in the process of flow generation, i.e., data packet analysis and rule matching;

[0013] The data packet analysis in the flow generation thread is to analyze the data packet according to the configuration file to generate the original IPFIX flow. The so-called original IPFIX flow refers to the important fields in the data packet header field obtained after analyzing the original data packet. Which fields to obtain is determined by the specific measurement requirements, and can ultimately be achieved by the user through the configuration file;

[0014] The rule matching in the flow generation thread is to determine whether two original IPFIX flows belong to the same IPFIX flow according to the configuration file; if the two original "flows" have exactly the same characters, the two original "flows" are considered to belong to the same flow; the matching process is to traverse all existing flows in the flow cache until a completely matching flow is found. If the last flow matched is not exactly the same, this flow will be put into the flow cache as a new flow.

[0015] Preferably, in the data storage module, a data collection thread, a data classification thread and a data storage thread are connected in sequence.

[0016] Preferably, the data collection thread receives the IPFIX flow data information generated from the data acquisition module, and the data classification module compares and analyzes the received IPFIX flow data information with the existing IPFIX flow data information in the data storage thread, and stores the received IPFIX flow data information in the same classification module according to the result of the comparison and analysis. If there is no identical classification module in the data storage thread, a new classification module is created and the IPFIX flow is stored therein.

[0017] Preferably, the database storage system in the user display module is interconnected with the file storage module and the data analysis module, and the database storage system is connected with the data display module.

[0018] Preferably, the database storage system reads the data information in the data storage module, and then uses the data analysis module to perform data analysis of different methods based on the user's interests and statistical methods. Some statistical results are stored in the file storage module in the form of a data table and updated regularly. The data display module reads the data in the database storage system and displays the data in the file storage module in the form of images.

[0019] Compared with the prior art, the present invention has the following significant advantages:

[0020] First, in the present invention, a data packet sends data to a data acquisition module, and the data acquisition sends the data to a data storage module based on the collected information. At the same time, a user display module reads the content in the data storage module, and displays the data information in the data packet to the user for viewing according to the user's needs, so that the user can see the abnormal flow information conveniently; the problem that existing users cannot see the reasons for the abnormal data flow is solved.

[0021] Second: In the present invention, the configuration file in the data acquisition module groups the data captured by the original data packets, samples the data packets captured by the original data packets, and makes a preliminary judgment on the data packets. If the result is abnormal, an alarm is issued. If it is normal, the data packets enter the data packet queue, and perform simple analysis and rule matching with the configuration file in turn. Then, these data packets are packaged to form an IPFIX flow after obtaining the required fields, and then queued in the flow cache. Finally, the configuration file is compared and analyzed again with the IPFIX flow to be sent. If it is abnormal, an alarm is issued. If it is normal, the IPFIX flow is sent to the data storage module; the ultimate goal of the data acquisition module is to form an IPFIX flow and send it to the data storage module in real time, and save it as a flow file in a specific format to facilitate subsequent storage and search of data packet data.

[0022] Thirdly, in the present invention, the rules of the flow generation thread are completely defined by the user, provided that the rules of the configuration file are followed, that is, specific attributes are defined under specific tags. In the process of flow generation, two steps are required, namely, data packet analysis and rule matching. By analyzing the data packets and matching the rules, it is convenient to store the data packets and update the new types of data packets.

[0023] Fourthly, the present invention reads the data information in the data storage module through the database storage system, and then uses the data analysis module to perform data analysis of different methods according to the user's interests and statistical methods. Some statistical results are stored in the file storage module in the form of a data table and updated regularly. The data display module reads the data in the database storage system and displays the data in the file storage module in the form of an image, so that the user can clearly know the situation of the communication data flow. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The present invention will be further explained below in conjunction with the accompanying drawings and embodiments:

[0025] Figure 1 It is a schematic diagram of the internal structure of the flow online safety monitoring system of the present invention;

[0026] Figure 2 It is a schematic diagram of the internal structure of the data acquisition module of the present invention;

[0027] Figure 3 It is a schematic diagram of the internal structure of the data storage module of the present invention;

[0028] Figure 4 It is a schematic diagram of the internal structure of the user display module of the present invention. DETAILED DESCRIPTION

[0029] The present invention is described in detail below, and the technical solutions in the embodiments of the present invention are clearly and completely described. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0030] The present invention provides an online safety monitoring system for abnormal flow of new energy power communication data through improvement. The technical solution of the present invention is:

[0031] like Figure 1-Figure 4 As shown, a new energy power communication data abnormal flow online safety monitoring system includes a flow online safety monitoring system, and the flow online safety monitoring system includes a data packet, a data acquisition module, a data storage module and a user display module;

[0032] The data packet sends data to the data acquisition module, and the data acquisition sends the data to the data storage module according to the collected information. At the same time, the user display module reads the content in the data storage module and displays the data information in the data packet to the user for viewing, so that the user can see the traffic abnormality information;

[0033] The data acquisition module includes capturing original data packets, data packet queues, flow generation threads, flow caches, flow export threads and configuration files;

[0034] The data storage module includes a data collection thread, a data classification thread and a data storage thread;

[0035] The user display module includes a database storage system, a file storage module, a data analysis module and a data display module.

[0036] The configuration file in the data acquisition module is connected with the capture of original data packets, the flow generation thread and the flow export thread, and the capture of original data packets, the data packet queue, the flow generation thread, the flow cache and the flow export thread are connected in sequence;

[0037] The data packet sends the data to the data acquisition module. The configuration file in the data acquisition module groups the data captured by the original data packet, samples the data packets captured by the original data packet, and makes a preliminary judgment on the data packet. If the result is abnormal, an alarm is issued. If it is normal, it enters the data packet queue, and performs simple analysis and rule matching with the configuration file in turn. Then, these data packets are packaged to form an IPFIX flow after obtaining the required fields, and then queued in the flow cache. Finally, the configuration file is compared and analyzed again with the IPFIX flow to be sent. If it is abnormal, an alarm is issued. If it is normal, the IPFIX flow is sent to the data storage module. The ultimate goal of the data acquisition module is to form an IPFIX flow and send it to the data storage module in real time, and save it as a flow file in a specific format.

[0038] The rules of the flow generation thread are completely defined by the user, provided that the rules of the configuration file are followed, i.e., specific attributes are defined under specific tags, and the flow generation process requires two steps, i.e., packet analysis and rule matching;

[0039] Packet analysis is to analyze the data packets according to the configuration file to generate the original IPFIX flow. The so-called original IPFIX flow refers to the important fields in the data packet header field obtained after analyzing the original data packet. Which fields you want to obtain is determined by the specific measurement requirements, and can ultimately be achieved by the user through the configuration file. For example, for TCP or UDP data packets, we need to obtain the protocol identifier (identifying whether the third-layer protocol is TCP or UDP), source IP address, destination IP address, source port number, destination port number, etc. in each data packet. Therefore, the original IPFIX flows with all the same fields above can be classified into the same flow. After the original IPFIX flow is generated, it will be placed in the flow cache.

[0040] Rule matching is to determine whether two original IPFIX flows belong to the same IPFIX flow according to the configuration file. If the two original "flows" have exactly the same characters, they are considered to belong to the same flow. The matching process is to traverse all existing flows in the flow cache until a completely matching flow is found. If the last flow matched is not exactly the same, this flow will be put into the flow cache as a new flow.

[0041] IPFIX (IP Flow Information Export) is an international standard for network traffic monitoring, developed by the Internet Engineering Task Force (IETF); it allows network devices to export detailed information about network traffic, which can be collected and analyzed by network monitoring tools; IPFIX is based on the concept of "flow", and a network flow is usually uniquely identified by a five-tuple (source IP address, destination IP address, transport layer protocol type, source port, destination port); the IPFIX protocol provides a dynamic data structure that allows the collection system to process data based on the received template, so that even when new data features need to be exported, there is no need to restart the exporter or collector system.

[0042] The data collection thread, the data classification thread and the data storage thread in the data storage module are connected in sequence;

[0043] The data collection thread receives the IPFIX flow data information generated from the data acquisition module, and the data classification module compares and analyzes the received IPFIX flow data information with the existing IPFIX flow data information in the data storage thread, and stores the received IPFIX flow data information in the same classification module according to the comparison and analysis results. If there is no identical classification module in the data storage thread, a new classification module is created to store the IPFIX flow in it;

[0044] The data storage module is mainly used to receive IPFIX flow data and store flow information. It has two main functional modules: receiving module and storage module. The receiving module can receive IPFIX flow data sent from multiple data acquisition modules to achieve distributed network flow measurement; the storage module uses the database to store the received IPFIX flow or the key information after a simple analysis of the IPFIX flow.

[0045] The database storage system in the user display module is connected to the file storage module and the data analysis module, and the database storage system is connected to the data display module;

[0046] The database storage system reads the data information in the data storage module, and then uses the data analysis module to perform data analysis of different methods based on the user's interests and statistical methods. Some statistical results are stored in the file storage module in the form of a data table and updated regularly. The data display module reads the data in the database storage system and displays the data in the file storage module in the form of images, so that the user can clearly understand the communication data traffic situation.

[0047] The data display module is the only part visible to the user, with a friendly data display interface. The main functions of the data display module include two parts: one is data analysis; the other is data display. Data analysis will perform different methods of data analysis according to the user's interests and statistical methods. Some statistical results will be stored in the file storage module in the form of data tables and updated regularly. Data display is a graphical interface that uses various charts to display statistical information in real time. In other words, data analysis provides the data needed for data display.

[0048] The data display module reads the data in the database storage system and displays the analysis results of the IPFIX flow information. The data analysis module is performed according to user needs. Different application requirements will have different methods of analyzing and processing data, and different results will be displayed.

[0049] The specific working method is: the data packet sends the data to the data acquisition module, the configuration file in the data acquisition module groups the data captured by the original data packet, samples the data packets captured by the original data packet, and makes a preliminary judgment on the data packet. If the result is abnormal, an alarm is issued. If it is normal, it enters the data packet queue, and performs simple analysis and rule matching with the configuration file in turn. Then, these data packets are packaged to form an IPFIX flow after obtaining the required fields, and then queued in the flow cache. Finally, the configuration file is compared and analyzed again with the IPFIX flow to be sent. If it is abnormal, an alarm is issued. If it is normal, the IPFIX flow is sent to the data storage module; The ultimate goal of the data acquisition module is to form an IPFIX flow and send it to the data storage module in real time, and save it as a flow file in a specific format; the data collection thread receives the IPFIX flow data information generated from the data acquisition module, and the data classification module compares and analyzes the received IPFIX flow data information with the existing IPFIX flow data information in the data storage thread, and stores the received IPFIX flow data information in the same classification module according to the results of the comparison and analysis. If there is no identical classification module in the data storage thread, a new classification module is created and the IPFIX flow is stored in it. The data storage module is mainly used to receive IPFIX flow data and store flow information. There are two main functional modules: a receiving module and a storage module. The receiving module can receive IPFIX flow data sent from multiple data acquisition modules to achieve distributed network traffic measurement. The storage module uses a database to store the received IPFIX flow or key information after a simple analysis of the IPFIX flow. The database storage system reads the data information in the data storage module, and then uses the data analysis module to perform different data analysis methods on the information read according to the user's interests and statistical methods. Some statistical results will be stored in the file storage module in the form of a data table and updated regularly. The data display module reads the data in the database storage system and displays the results of the analysis of the IPFIX flow information. The data analysis module is based on user needs. Different application requirements will have different methods of analyzing and processing data, and different results will be displayed.

[0050] The technical means disclosed in the solution of the present invention are not limited to the technical means disclosed in the above technical means, but also include technical solutions composed of equivalent replacement of the above technical features. Matters not covered in the present invention belong to the common knowledge of those skilled in the art.

Claims

1. A new energy power communication data abnormal flow online safety monitoring system, including a flow online safety monitoring system, characterized in that: The traffic online safety monitoring system includes a data packet, a data acquisition module, a data storage module and a user display module; The data acquisition module includes capturing original data packets, data packet queues, flow generation threads, flow caches, flow export threads and configuration files; The data storage module includes a data collection thread, a data classification thread and a data storage thread; The user display module includes a database storage system, a file storage module, a data analysis module and a data display module.

2. According to claim 1, a new energy power communication data abnormal flow online safety monitoring system is characterized by: The data packet sends data to the data acquisition module, and the data acquisition sends the data to the data storage module according to the collected information. At the same time, the user display module reads the content in the data storage module and displays the data information in the data packet to the user for viewing.

3. According to claim 1, a new energy power communication data abnormal flow online safety monitoring system is characterized by: The configuration file in the data acquisition module is connected with the capture of original data packets, the flow generation thread and the flow export thread, and the capture of original data packets, the data packet queue, the flow generation thread, the flow cache and the flow export thread are connected in sequence.

4. According to claim 3, a new energy power communication data abnormal flow online safety monitoring system is characterized by: The data packet sends the data to the data acquisition module. The configuration file in the data acquisition module groups the data captured by the original data packet, samples the data packets captured by the original data packet, and makes a preliminary judgment on the data packet. If the result is abnormal, an alarm is issued. If it is normal, it enters the data packet queue, and performs simple analysis and rule matching with the configuration file in turn. Then, these data packets are packaged to form an IPFIX flow after obtaining the required fields, and then queued in the flow cache. Finally, the configuration file is compared and analyzed again with the IPFIX flow to be sent. If it is abnormal, an alarm is issued. If it is normal, the IPFIX flow is sent to the data storage module; The ultimate goal of the data collection module is to form an IPFIX flow and send it to the data storage module in real time and save it as a flow file in a specific format.

5. According to claim 3, a new energy power communication data abnormal flow online safety monitoring system is characterized by: The rules of the flow generation thread are completely defined by the user, provided that the rules of the configuration file are followed, i.e., specific attributes are defined under specific tags, and the flow generation process requires two steps, i.e., packet analysis and rule matching; The data packet analysis in the flow generation thread is to analyze the data packet according to the configuration file to generate the original IPFIX flow. The so-called original IPFIX flow refers to the important fields in the data packet header field obtained after analyzing the original data packet. Which fields to obtain is determined by the specific measurement requirements, and can ultimately be achieved by the user through the configuration file; The rule matching in the flow generation thread is to determine whether two original IPFIX flows belong to the same IPFIX flow according to the configuration file; if the two original "flows" have exactly the same characters, the two original "flows" are considered to belong to the same flow; the matching process is to traverse all existing flows in the flow cache until a completely matching flow is found. If the last flow matched is not exactly the same, this flow will be put into the flow cache as a new flow.

6. According to claim 1, a new energy power communication data abnormal flow online safety monitoring system is characterized by: The data collection thread, the data classification thread and the data storage thread in the data storage module are connected in sequence.

7. According to claim 6, a new energy power communication data abnormal flow online safety monitoring system is characterized by: The data collection thread receives the IPFIX flow data information generated from the data acquisition module, and the data classification module compares and analyzes the received IPFIX flow data information with the existing IPFIX flow data information in the data storage thread, and stores the received IPFIX flow data information in the same classification module according to the result of the comparison and analysis. If there is no identical classification module in the data storage thread, a new classification module is created and the IPFIX flow is stored therein.

8. According to claim 1, a new energy power communication data abnormal flow online safety monitoring system is characterized by: The database storage system in the user display module is connected to the file storage module and the data analysis module, and the database storage system is connected to the data display module.

9. The online safety monitoring system for abnormal flow of new energy power communication data according to claim 8 is characterized by: The database storage system reads the data information in the data storage module, and then uses the data analysis module to perform data analysis of different methods based on the user's interests and statistical methods. Some statistical results are stored in the file storage module in the form of a data table and updated regularly. The data display module reads the data in the database storage system and displays the data in the file storage module in the form of images.

Images