Network security early warning method and system based on edge intelligent data center

Abstract

The present invention discloses a network security early warning method and system based on an edge intelligent data center, relates to the technical field of network security early warning, and comprises the following steps: real-time monitoring of security-related data of an edge intelligent data center; extracting data features of the security-related data; performing multi-level threat detection on the security-related data based on the data features to detect whether there is network attack behavior; and performing security early warning on the network attack behavior based on the detection results. The present invention is used to solve the problems that the existing network security early warning technology is not comprehensive enough in applicability and the network security assessment is too subjective, which leads to the problem that the network security early warning results are prone to misjudgment.

Description

Technical Field

[0001] The present invention relates to the field of network security early warning technology, and specifically to a network security early warning method and system based on an edge intelligent data center. Background Art

[0002] Network security early warning technology refers to the process of monitoring network activities, detecting abnormal behaviors and analyzing security event data, aiming to identify possible network security threats and attack behaviors in advance, and promptly issuing alarms to notify relevant personnel or systems so that necessary countermeasures can be taken to protect network systems and data security. These technologies usually include real-time monitoring of network traffic, log analysis, abnormal behavior detection, and threat intelligence analysis to detect security risks such as network attacks, malware propagation, and data leakage, and provide early warning information to help organizations respond to and prevent potential security threats in a timely manner. Network security early warning technology plays a vital role in maintaining network security and protecting information assets.

[0003] Network security warning involves a wide range and needs to be tested from multiple angles, such as network traffic, security logs, access records, and error reports. In the security detection of network traffic, since attacking network traffic is the most basic and direct means of attack, the security protection of network traffic is particularly important. The security detection of network traffic is often performed by observing whether the network traffic suddenly increases or by manual judgment. However, for different edge intelligent data centers, the judgment criteria are different, and it is difficult to use a unified standard to judge them. When not under network attack, the network traffic may also increase significantly. At the same time, manual judgment is too subjective, so the network security warning results are prone to misjudgment. For example, in the patent application with publication number CN113411302A, a "network security warning method and device for local area network equipment" is disclosed. The solution does not specifically explain how to judge whether the terminal device has a network security risk, and the security operation and maintenance personnel use the security warning interface to monitor the security of different terminal devices. The assessment of network security is too subjective. The existing network security warning technology still has the problems of insufficient applicability and excessive subjective network security assessment, which leads to the problem that the network security warning results are prone to misjudgment. Summary of the invention

[0004] The present invention aims to solve at least one of the technical problems in the prior art to a certain extent, by performing real-time monitoring of security-related data of an edge intelligent data center, extracting data features of the security-related data, and performing primary threat detection on network traffic based on traffic features. If the primary threat detection cannot achieve accurate judgment, secondary threat detection is performed on the network traffic. If the secondary threat detection cannot achieve accurate judgment, deep threat detection is performed on the network traffic, and security warnings are issued for network attack behaviors based on the detection results, so as to solve the problems that the existing network security warning technology is not comprehensive enough in applicability and the network security assessment is too subjective, which leads to the problem that the network security warning results are prone to misjudgment.

[0005] To achieve the above objectives, in a first aspect, the present application provides a network security early warning method based on an edge intelligent data center, comprising the following steps:

[0006] Real-time monitoring of security-related data in edge intelligent data centers;

[0007] Extract data features of security-related data;

[0008] Perform multi-level threat detection on security-related data based on data features to detect whether there is network attack behavior;

[0009] Provide security warnings for network attack behaviors based on detection results.

[0010] Furthermore, the security-related data includes network traffic and access numbers. The network traffic is the amount of data transmitted on the edge intelligent data center at a certain moment, and the access number is the number of visitors received by the edge intelligent data center at a certain moment. The access number corresponds to the network traffic.

[0011] Furthermore, extracting data features of security-related data includes the following sub-steps:

[0012] For network traffic, a traffic change trend graph is constructed with time and network traffic as the X-axis and Y-axis, and the changes in network traffic within the first recording period are continuously recorded;

[0013] Filling coordinates into the traffic change trend graph based on the network traffic and the recorded time, marking the coordinates in the traffic change trend graph as traffic coordinates;

[0014] Adjacent flow coordinates are connected by line segments, and the line segments used for connection are named flow change trend line segments. The broken line composed of the flow change trend line segments is the flow feature.

[0015] Furthermore, based on data features, multi-level threat detection is performed on security-related data to detect whether there is a network attack behavior, including the following sub-steps:

[0016] Perform primary threat detection on network traffic based on traffic characteristics;

[0017] If the primary threat detection cannot achieve accurate judgment, the network traffic will be subjected to secondary threat detection;

[0018] If the second-level threat detection cannot achieve accurate judgment, deep threat detection will be performed on the network traffic.

[0019] Furthermore, primary threat detection of network traffic based on traffic characteristics includes the following sub-steps:

[0020] Obtain historical traffic characteristics and real-time traffic characteristics, mark them as historical traffic characteristics and real-time traffic characteristics respectively, mark the historical traffic characteristics with abnormal traffic in the historical records as abnormal traffic characteristics, and mark the remaining historical traffic characteristics as normal traffic characteristics;

[0021] The abnormal flow characteristics are numbered and marked with TA n Indicates, where n is a non-zero natural number and n is the serial number of TA. n Perform linear regression on the flow coordinates in the graph to obtain the slope of the regression function, which is marked as the abnormal trend slope; number the normal flow characteristics and use the symbol TN i Indicates, where i is a non-zero natural number and i is the serial number of TN; for TN i Perform linear regression on the flow coordinates in , obtain the slope of the regression function, and mark it as the normal trend slope;

[0022] Obtain the minimum value in the abnormal trend slope and the maximum value in the normal trend slope, and mark them as the abnormal trend lower limit and the normal trend upper limit respectively; compare the abnormal trend lower limit with the normal trend upper limit, if the abnormal trend lower limit is less than or equal to the normal trend upper limit, output a secondary detection signal, if the abnormal trend lower limit is greater than the normal trend upper limit, output a single detection signal;

[0023] If a single detection signal is output, the average value of the lower limit of the abnormal trend and the lower limit of the normal trend is calculated and marked as the abnormal flow threshold. The slope of the linear regression function of the flow coordinates in the real-time flow characteristics is analyzed to obtain the real-time trend slope. The real-time trend slope is compared with the abnormal flow threshold. If the real-time trend slope is greater than or equal to the abnormal flow threshold, an abnormal flow signal is output, otherwise a normal flow signal is output.

[0024] If a secondary detection signal is output, secondary threat detection is performed.

[0025] Furthermore, if the primary threat detection cannot achieve accurate judgment, the secondary threat detection of network traffic includes the following sub-steps:

[0026] Get TAn The slope of the flow change trend line segment is marked as the abnormal slope. The abnormal slopes are numbered from left to right in the order of the flow change trend line segment and are represented by the symbol SA(n,m), where m is a non-zero natural number and (n,m) is the sequence number of SA. SA(n,m) represents TA n The abnormal slope of the mth flow change trend line segment in , for any TA n ,calculate , mark the calculation result as the average slope of abnormal trend, and max() is the maximum value operator;

[0027] Get TN i The slope of the flow change trend line segment is marked as the normal slope. The normal slopes are numbered from left to right in the order of the flow change trend line segment and are represented by the symbol SN(i,j), where j is a non-zero natural number and (i,j) is the sequence number of SN. SN(i,j) represents TN i The normal slope of the jth flow change trend line segment in , for any TN i ,calculate , label the calculated result as the normal trend average slope;

[0028] Find the minimum value of the average slope of the abnormal trend and the maximum value of the average slope of the normal trend, mark them as the average minimum slope of the abnormal trend and the average maximum slope of the normal trend respectively, compare the average minimum slope of the abnormal trend with the average maximum slope of the normal trend, if the average minimum slope of the abnormal trend is less than or equal to the average maximum slope of the normal trend, output a deep detection signal, otherwise output a secondary detection execution signal;

[0029] If a secondary detection execution signal is output, the average value of the average minimum slope of the abnormal trend and the average maximum slope of the normal trend is calculated, marked as the trend average threshold, and the average value of the slope of the flow change trend line segment in the real-time flow characteristics is analyzed, marked as the real-time average slope, and the real-time average slope is compared with the trend average threshold. If the real-time average slope is less than the trend average slope, a normal flow signal is output, otherwise a flow abnormality signal is output;

[0030] If a deep detection signal is output, deep threat detection is performed on the network traffic.

[0031] Furthermore, if the secondary threat detection cannot achieve accurate judgment, the deep threat detection of network traffic includes the following sub-steps:

[0032] Each flow coordinate in the flow history feature corresponds to a number of visits. For the flow history feature, the average value of the number of visits is calculated and marked as the access history feature. The access history feature corresponding to the abnormal flow feature is marked as the abnormal access feature, and the access history feature corresponding to the normal flow feature is marked as the normal access feature.

[0033] A plane rectangular coordinate system is established with the access anomaly feature as the horizontal axis and the average slope of the abnormal trend as the vertical axis, which is named as the abnormal access trend comparison chart. The access anomaly feature corresponding to the traffic anomaly feature and the coordinate points formed by the average slope of the abnormal trend are entered into the abnormal access trend comparison chart;

[0034] A plane rectangular coordinate system is established with the normal access feature as the horizontal axis and the normal trend average slope as the vertical axis, which is named the normal access trend comparison chart. The normal access feature corresponding to the normal traffic feature and the coordinate points formed by the normal trend average slope are entered into the normal access trend comparison chart;

[0035] Analyze the abnormal access trend comparison chart and the normal access trend comparison chart to detect whether there is any network attack behavior.

[0036] Further, analyzing the abnormal access trend comparison chart and the normal access trend comparison chart to detect whether there is a network attack behavior includes the following sub-steps:

[0037] For each value of the access history feature, obtain the minimum value in the abnormal access trend comparison chart and the maximum value in the normal access trend comparison chart, and calculate their average value to obtain the segmented traffic threshold;

[0038] A plane rectangular coordinate system is established with the access history feature as the X-axis and the segmented traffic threshold as the Y-axis, named the segmented threshold reference diagram, and the access history feature and the corresponding segmented traffic threshold are entered into the segmented threshold reference diagram;

[0039] Perform polynomial regression on the piecewise threshold reference graph, and name the function obtained by regression as the piecewise threshold equation;

[0040] Obtain the number of visits to the real-time traffic feature and calculate the average value, mark it as the real-time visit feature, substitute the real-time visit feature into the piecewise threshold equation, and solve it to obtain the real-time traffic anomaly threshold;

[0041] The real-time average slope is compared with the real-time abnormal flow threshold. If the real-time average slope is less than the real-time abnormal flow threshold, a normal flow signal is output; otherwise, a abnormal flow signal is output.

[0042] Furthermore, the security warning of network attack behavior based on the detection results includes the following sub-steps:

[0043] Receive abnormal flow signals and normal flow signals in real time;

[0044] If an abnormal traffic signal is received, a security warning will be sent to the security center of the edge intelligent data center.

[0045] In a second aspect, the present application provides a network security early warning system based on an edge intelligent data center, including a data monitoring module, a feature extraction module, a threat monitoring module and a security early warning module; the data monitoring module, the feature extraction module and the security early warning module are respectively connected to the threat monitoring module data;

[0046] The data monitoring module is used to monitor the security-related data of the edge intelligent data center in real time;

[0047] The feature extraction module is used to extract data features of security-related data;

[0048] The threat monitoring module is used to perform multi-level threat detection on security-related data based on data features to detect whether there is a network attack behavior;

[0049] The security warning module is used to issue security warnings to network attack behaviors based on the detection results.

[0050] Beneficial effects of the present invention: The present invention monitors the security-related data of the edge intelligent data center in real time, extracts the data features of the security-related data, and performs primary threat detection on the network traffic based on the traffic features. If the primary threat detection cannot achieve accurate judgment, secondary threat detection is performed on the network traffic. The advantage is that the change of the network traffic of an edge intelligent data center is usually stable within a fluctuation range, which can be analyzed based on historical traffic features. However, if there is an intersection between the abnormal traffic features and the normal traffic features, it means that this method cannot accurately identify the network attacks carried out by using the network traffic within the intersection. Therefore, another dimensional analysis is required, namely, secondary threat detection. The network security is detected by multi-dimensional verification, which improves the accuracy and effectiveness of network security early warning.

[0051] The present invention performs deep threat detection on network traffic when the secondary threat detection cannot achieve accurate judgment, and issues security warnings for network attack behaviors based on the detection results. The advantage is that the secondary threat detection can usually detect network attacks at the network traffic level of most edge intelligent data centers, but for a smaller number of edge intelligent data centers, the population density in the area where they are located fluctuates greatly, resulting in large fluctuations in the number of visits to the edge intelligent data centers, and the judgment of the sudden and substantial increase in network traffic is also closely related to the number of visits. If the number of visits is large, the network traffic will also increase significantly. Therefore, further analysis is required to combine the network traffic with the number of visits. Through the three methods of primary threat detection, secondary threat detection and deep threat detection, different threat detection methods are executed for different edge intelligent data centers. The more primary the detection method, the less resources it consumes during detection, and the shorter the detection time is, while the deeper the detection method, the more resources it consumes during detection, and the longer the detection time is. This method can select the most appropriate detection method according to the specific data of the edge intelligent data center to more comprehensively evaluate network security, thereby improving the accuracy and comprehensiveness of network security warnings. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 is a functional block diagram of the system of the present invention;

[0053] Figure 2 It is a schematic diagram of a flow rate variation trend diagram of the present invention;

[0054] Figure 3 It is a schematic diagram of the flow rate change trend line segment of the present invention;

[0055] Figure 4 A schematic diagram of an abnormal access trend comparison chart of the present invention;

[0056] Figure 5 A schematic diagram of the segmented threshold value of the present invention with reference to FIG;

[0057] Figure 6 The figure is a flow chart of the steps of the method of the present invention. DETAILED DESCRIPTION

[0058] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0059] Example 1, please refer to Figure 1As shown, the present application provides a network security early warning system based on an edge intelligent data center, including a data monitoring module, a feature extraction module, a threat monitoring module and a security early warning module; the data monitoring module, the feature extraction module and the security early warning module are respectively connected to the threat monitoring module data;

[0060] The data monitoring module is used to monitor the security-related data of the edge intelligent data center in real time; the security-related data includes network traffic and access quantity. The network traffic is the amount of data transmitted on the edge intelligent data center at a certain moment, and the access quantity is the number of visitors received by the edge intelligent data center at a certain moment. The access quantity corresponds to the network traffic;

[0061] In actual applications, the recording format of safety-related data is shown in Table 1 below:

[0062] Table 1 Partial data of safety related data

[0063]

[0064] Among them, network traffic and number of visits are recorded once per second.

[0065] The feature extraction module is used to extract data features of security-related data;

[0066] The feature extraction module is configured with feature extraction strategies, which include:

[0067] See also Figure 2 As shown, for network traffic, a traffic change trend graph is constructed with time and network traffic as the X-axis and Y-axis, and the changes in network traffic in the first recording period are continuously recorded;

[0068] Filling coordinates into the traffic change trend graph based on the network traffic and the recorded time, marking the coordinates in the traffic change trend graph as traffic coordinates;

[0069] See also Figure 3 As shown, adjacent flow coordinates are connected by line segments, and the line segments used for connection are named flow change trend line segments. The broken line composed of the flow change trend line segments is the flow feature;

[0070] In practical applications, the time is the recording time in Table 1, and the first recording period is set to 30s. For example, if the current time is 2024-3-6 13:26:39, the network traffic between 2024-3-6 13:26:09 and 2024-3-6 13:26:39 is obtained and a traffic change trend chart is constructed, such as Figure 2 As shown, Figure 2The X-axis in the example uses 1 to 30 to represent time, which is convenient for subsequent analysis. At the same time, for the time period in the example, the access characteristics analyzed later are to obtain the average number of accesses between 2024-3-6 13:26:09 and 2024-3-6 13:26:39, and obtain the average value for Figure 2 The access characteristics of Figure 3 The flow change trend line segments between the flow coordinates are displayed.

[0071] The threat monitoring module is used to perform multi-level threat detection on security-related data based on data features to detect whether there is a network attack behavior; the threat monitoring module includes a primary threat detection unit, a secondary threat detection unit, and a deep threat detection unit;

[0072] The primary threat detection unit is used to perform primary threat detection on network traffic based on traffic characteristics;

[0073] The primary threat detection module is configured with a primary threat detection strategy, which includes:

[0074] Obtain historical traffic characteristics and real-time traffic characteristics, mark them as historical traffic characteristics and real-time traffic characteristics respectively, mark the historical traffic characteristics with abnormal traffic in the historical records as abnormal traffic characteristics, and mark the remaining historical traffic characteristics as normal traffic characteristics;

[0075] In actual applications, since the changes in network traffic within 30 seconds are monitored, a new traffic feature can be obtained every second, so there are a large number of historical traffic features. It is not convenient to show them in detail in this embodiment. With the historical data within one year as a reference, 31536000 traffic features can be obtained and numbered. Although the amount of data is too much, it is only used to determine the threat detection method when the network traffic security warning is executed for the first time. If it is determined to use primary threat detection, the traffic anomaly threshold is used for subsequent judgment. The same is true for secondary threat detection and deep threat detection. The selection of threat detection method can be re-executed once a month; among the 31536000 traffic features, the number of abnormal traffic features is 137842, and the number of normal traffic features is 31398158;

[0076] The abnormal flow characteristics are numbered and marked with TA n Indicates, where n is a non-zero natural number and n is the serial number of TA. n Perform linear regression on the flow coordinates in the graph to obtain the slope of the regression function, which is marked as the abnormal trend slope; number the normal flow characteristics and use the symbol TN i Indicates, where i is a non-zero natural number and i is the serial number of TN; for TN iPerform linear regression on the flow coordinates in , obtain the slope of the regression function, and mark it as the normal trend slope;

[0077] In practical applications, the number is obtained by TA n , 1≤n≤137842, and the numbers are obtained by TN i , 1≤i≤31398158, each TA n and TN i Each of them corresponds to a traffic change trend graph. Linear regression can be performed on the traffic coordinates to obtain the abnormal trend slope and the normal trend slope. When performing linear regression on the traffic coordinates, the X-axis uses 1 to 30 to represent the recording time. The abnormal trend slope and the normal trend slope obtained in the linear regression can effectively reveal the overall change trend of the network traffic within 30 seconds. If the network traffic increases suddenly, the larger the growth value, the larger the slope. The fluctuation range of the slope when the network traffic increases is distinguished by the abnormal trend slope and the normal trend slope, so as to judge whether there is an abnormal sudden increase in the network traffic.

[0078] Obtain the minimum value in the abnormal trend slope and the maximum value in the normal trend slope, and mark them as the abnormal trend lower limit and the normal trend upper limit respectively; compare the abnormal trend lower limit with the normal trend upper limit, if the abnormal trend lower limit is less than or equal to the normal trend upper limit, output a secondary detection signal, if the abnormal trend lower limit is greater than the normal trend upper limit, output a single detection signal;

[0079] If a single detection signal is output, the average value of the lower limit of the abnormal trend and the lower limit of the normal trend is calculated and marked as the abnormal flow threshold. The slope of the linear regression function of the flow coordinates in the real-time flow characteristics is analyzed to obtain the real-time trend slope. The real-time trend slope is compared with the abnormal flow threshold. If the real-time trend slope is greater than or equal to the abnormal flow threshold, an abnormal flow signal is output, otherwise a normal flow signal is output.

[0080] If a secondary detection signal is output, secondary threat detection is performed;

[0081] In actual applications, the upper limit of the normal trend is 2.5653, and the lower limit of the abnormal trend is 1.9686. By comparison, it is found that the lower limit of the abnormal trend is less than the upper limit of the normal trend, and a secondary detection signal is output. When the lower limit of the abnormal trend is less than the upper limit of the normal trend, it means that there is an intersection [1.9686, 2.5653] between the slope of the abnormal trend and the slope of the normal trend. If the real-time trend slope obtained by analysis is between the intersections, it is impossible to accurately determine whether the network traffic has increased abnormally at this time, so secondary threat detection is required; if there is no intersection between the slope of the abnormal trend and the slope of the normal trend, that is, a single detection signal is output, at this time, the real-time trend slope is greater than or equal to the traffic abnormality threshold, which means that the real-time trend slope is biased towards the abnormal trend slope, and the network traffic at this time has increased abnormally. The real-time trend slope is less than the traffic abnormality threshold, which means that the real-time trend slope is biased towards the normal trend slope, and the network traffic at this time does not have abnormal growth;

[0082] The secondary threat detection unit is used to perform secondary threat detection on network traffic;

[0083] The secondary threat detection module is configured with a secondary threat detection strategy, which includes:

[0084] Get TA n The slope of the flow change trend line segment is marked as the abnormal slope. The abnormal slopes are numbered from left to right in the order of the flow change trend line segment and are represented by the symbol SA(n,m), where m is a non-zero natural number and (n,m) is the sequence number of SA. SA(n,m) represents TA n The abnormal slope of the mth flow change trend line segment in , for any TA n ,calculate , mark the calculation result as the average slope of abnormal trend, and max() is the maximum value operator;

[0085] Get TN i The slope of the flow change trend line segment is marked as the normal slope. The normal slopes are numbered from left to right in the order of the flow change trend line segment and are represented by the symbol SN(i,j), where j is a non-zero natural number and (i,j) is the sequence number of SN. SN(i,j) represents TN i The normal slope of the jth flow change trend line segment in , for any TN i ,calculate , label the calculated result as the normal trend average slope;

[0086] Find the minimum value of the average slope of the abnormal trend and the maximum value of the average slope of the normal trend, mark them as the average minimum slope of the abnormal trend and the average maximum slope of the normal trend respectively, compare the average minimum slope of the abnormal trend with the average maximum slope of the normal trend, if the average minimum slope of the abnormal trend is less than or equal to the average maximum slope of the normal trend, output a deep detection signal, otherwise output a secondary detection execution signal;

[0087] If a secondary detection execution signal is output, the average value of the average minimum slope of the abnormal trend and the average maximum slope of the normal trend is calculated, marked as the trend average threshold, and the average value of the slope of the flow change trend line segment in the real-time flow characteristics is analyzed, marked as the real-time average slope, and the real-time average slope is compared with the trend average threshold. If the real-time average slope is less than the trend average slope, a normal flow signal is output, otherwise a flow abnormality signal is output;

[0088] If a deep detection signal is output, deep threat detection is performed on the network traffic;

[0089] In practical applications, Figure 2 For example, Figure 2 Corresponding to TA1, there are 30 flow coordinates, which are connected to obtain 29 flow change trend segments, thereby obtaining SA(1,1) to SA(1,29), 1≤m≤29, and the average slope of the abnormal trend is calculated to be approximately 2.1034, and the calculation result is retained to four decimal places; the average slope of the normal trend is similar, and no specific display is given in this embodiment; the average minimum slope of the abnormal trend and the average maximum slope of the normal trend are obtained to be 2.0567 and 2.4689 respectively. By comparison, the average minimum slope of the abnormal trend is less than the average maximum slope of the normal trend, and a deep detection signal is output to perform deep threat detection;

[0090] The Deep Threat Detection Unit is used to perform deep threat detection on network traffic.

[0091] The deep threat detection module is configured with a deep threat detection policy, which includes:

[0092] Each traffic coordinate in the traffic history feature corresponds to a visit number. For the traffic history feature, the average of the visit numbers is calculated and marked as the visit history feature. The visit history feature corresponding to the abnormal traffic feature is marked as the abnormal visit feature, and the visit history feature corresponding to the normal traffic feature is marked as the normal visit feature.

[0093] See also Figure 4 As shown, a plane rectangular coordinate system is established with the access abnormality feature as the horizontal axis and the average slope of the abnormal trend as the vertical axis, which is named as the abnormal access trend comparison chart. The access abnormality feature corresponding to the traffic abnormality feature and the coordinate points formed by the average slope of the abnormal trend are entered into the abnormal access trend comparison chart;

[0094] A plane rectangular coordinate system is established with the normal access feature as the horizontal axis and the normal trend average slope as the vertical axis, which is named the normal access trend comparison chart. The normal access feature corresponding to the normal traffic feature and the coordinate points formed by the normal trend average slope are entered into the normal access trend comparison chart;

[0095] In practical applications, the access history feature is the access feature obtained by calculating the average value of the number of accesses within 30 seconds. Since the analysis process of the abnormal access trend comparison chart is the same as that of the normal access trend comparison chart, this embodiment only uses an example to illustrate the abnormal access trend comparison chart. The abnormal access trend comparison chart is constructed as follows: Figure 4 As shown;

[0096] Analyze the abnormal access trend comparison chart and the normal access trend comparison chart to detect whether there is a network attack behavior;

[0097] For each value of the access history feature, obtain the minimum value in the abnormal access trend comparison chart and the maximum value in the normal access trend comparison chart, and calculate their average value to obtain the segmented traffic threshold;

[0098] In practical applications, for example, in both the abnormal access trend comparison chart and the normal access trend comparison chart, there are coordinate points at X=3.2. Then, the minimum value of the Y-axis value in the abnormal access trend comparison chart when X=3.2 is obtained, and the maximum value of the Y-axis value in the normal access trend comparison chart when X=3.2 is obtained. The average value is calculated to obtain the segmented traffic threshold. In this embodiment, the segmented traffic threshold when X=3.2 is 2.3944, and the segmented traffic threshold retains four decimal places. A coordinate point (3.2, 2.3944) in the segmented threshold reference is obtained. Similarly, the segmented traffic threshold for each X value is obtained;

[0099] See also Figure 5 As shown, a plane rectangular coordinate system is established with the access history feature as the X-axis and the segmented traffic threshold as the Y-axis, named as the segmented threshold reference diagram, and the access history feature and the corresponding segmented traffic threshold are entered into the segmented threshold reference diagram;

[0100] Perform polynomial regression on the piecewise threshold reference graph, and name the function obtained by regression as the piecewise threshold equation;

[0101] Obtain the number of visits to the real-time traffic feature and calculate the average value, mark it as the real-time visit feature, substitute the real-time visit feature into the piecewise threshold equation, and solve it to obtain the real-time traffic anomaly threshold;

[0102] The real-time average slope is compared with the real-time abnormal flow threshold. If the real-time average slope is less than the real-time abnormal flow threshold, a normal flow signal is output; otherwise, a abnormal flow signal is output;

[0103] In practical applications, the segmented threshold is constructed with reference to the following figure: Figure 5 As shown in Figure 2, the segmented threshold equation obtained by polynomial regression is ST=0.004×AF 2 +0.0401×AF+2.3127, where AF is the access history feature and ST is the segmented traffic threshold. The access real-time feature is calculated to be 9. Substitute AF=9 into the segmented threshold equation and solve for the real-time abnormal traffic threshold of 2.8119. If the real-time average slope at this time is greater than or equal to 2.8119, it means that there is an attack risk in the network traffic and timely warning is required.

[0104] The security warning module is used to issue security warnings for network attack behaviors based on detection results;

[0105] The security warning module is configured with security warning strategies, which include:

[0106] Receive abnormal flow signals and normal flow signals in real time;

[0107] If a traffic anomaly signal is received, a security warning is sent to the security center of the edge intelligent data center;

[0108] In actual applications, the role of the threat monitoring module is to determine the threat detection method used by the edge intelligent data center during the first run, and to determine the corresponding threshold. After the determination is completed, the network traffic is monitored in real time, and then the security warning module issues a security warning through the signal output by the threat monitoring module.

[0109] Example 2, please refer to Figure 6 As shown, the present application provides a network security early warning method based on an edge intelligent data center, comprising the following steps:

[0110] Step S1, real-time monitoring of security-related data of the edge intelligent data center; the security-related data includes network traffic and access quantity, the network traffic is the amount of data transmitted on the edge intelligent data center at a certain moment, the access quantity is the number of visitors received by the edge intelligent data center at a certain moment, and the access quantity corresponds to the network traffic;

[0111] Step S2, extracting data features of security-related data; Step S2 includes the following sub-steps:

[0112] Step S201, for network traffic, construct a traffic change trend graph with time and network traffic as the X-axis and Y-axis, and continuously record the changes in network traffic within the first recording period;

[0113] Step S202, filling coordinates into the flow change trend graph based on the network flow and the recorded time, marking the coordinates in the flow change trend graph as flow coordinates;

[0114] Step S203, connecting adjacent flow coordinates by line segments, naming the line segments used for connection as flow change trend line segments, and the broken line composed of the flow change trend line segments is the flow feature;

[0115] Step S3, based on the data features, performs multi-level threat detection on the security-related data to detect whether there is a network attack behavior; Step S3 includes the following sub-steps:

[0116] Step S301, performing primary threat detection on network traffic based on traffic characteristics;

[0117] Step S301 includes the following sub-steps:

[0118] Step S301.1, obtaining historical traffic characteristics and real-time traffic characteristics, marking them as historical traffic characteristics and real-time traffic characteristics respectively, marking the historical traffic characteristics with abnormal traffic in the historical records as abnormal traffic characteristics, and marking the remaining historical traffic characteristics as normal traffic characteristics;

[0119] Step S301.2: Number the abnormal flow characteristics and use the symbol TA n Indicates, where n is a non-zero natural number and n is the serial number of TA. n Perform linear regression on the flow coordinates in the graph to obtain the slope of the regression function, which is marked as the abnormal trend slope; number the normal flow characteristics and use the symbol TN i Indicates, where i is a non-zero natural number and i is the serial number of TN; for TN i Perform linear regression on the flow coordinates in , obtain the slope of the regression function, and mark it as the normal trend slope;

[0120] Step S301.3, obtaining the minimum value of the abnormal trend slope and the maximum value of the normal trend slope, marking them as the abnormal trend lower limit and the normal trend upper limit respectively; comparing the abnormal trend lower limit with the normal trend upper limit, if the abnormal trend lower limit is less than or equal to the normal trend upper limit, outputting a secondary detection signal, if the abnormal trend lower limit is greater than the normal trend upper limit, outputting a single detection signal;

[0121] Step S301.4, if a single detection signal is output, the average value of the lower limit of the abnormal trend and the lower limit of the normal trend is calculated, marked as the flow abnormality threshold, the slope of the linear regression function of the flow coordinate in the real-time flow characteristics is analyzed, and the real-time trend slope is obtained. The real-time trend slope is compared with the flow abnormality threshold. If the real-time trend slope is greater than or equal to the flow abnormality threshold, the flow abnormality signal is output, otherwise the flow normal signal is output;

[0122] Step S301.5, if a secondary detection signal is output, perform secondary threat detection;

[0123] Step S302: If the primary threat detection cannot achieve accurate judgment, perform secondary threat detection on the network traffic;

[0124] Step S302 includes the following sub-steps:

[0125] Step S302.1, obtain TA n The slope of the flow change trend line segment is marked as the abnormal slope. The abnormal slopes are numbered from left to right in the order of the flow change trend line segment and are represented by the symbol SA(n,m), where m is a non-zero natural number and (n,m) is the sequence number of SA. SA(n,m) represents TA n The abnormal slope of the mth flow change trend line segment in , for any TA n ,calculate , mark the calculation result as the average slope of abnormal trend, and max() is the maximum value operator;

[0126] Step S302.2, obtain TN i The slope of the flow change trend line segment is marked as the normal slope. The normal slopes are numbered from left to right in the order of the flow change trend line segment and are represented by the symbol SN(i,j), where j is a non-zero natural number and (i,j) is the sequence number of SN. SN(i,j) represents TN i The normal slope of the jth flow change trend line segment in , for any TN i ,calculate , label the calculated result as the normal trend average slope;

[0127] Step S302.3, find the minimum value of the average slope of the abnormal trend and the maximum value of the average slope of the normal trend, mark them as the average minimum slope of the abnormal trend and the average maximum slope of the normal trend respectively, compare the average minimum slope of the abnormal trend with the average maximum slope of the normal trend, if the average minimum slope of the abnormal trend is less than or equal to the average maximum slope of the normal trend, then output a depth detection signal, otherwise output a secondary detection execution signal;

[0128] Step S302.4, if the secondary detection execution signal is output, the average value of the average minimum slope of the abnormal trend and the average maximum slope of the normal trend is calculated, marked as the trend average threshold, the average value of the slope of the flow change trend line segment in the real-time flow characteristics is analyzed, marked as the real-time average slope, and the real-time average slope is compared with the trend average threshold. If the real-time average slope is less than the trend average slope, a normal flow signal is output, otherwise a flow abnormality signal is output;

[0129] Step S302.5: if a deep detection signal is output, perform deep threat detection on the network traffic;

[0130] Step S303: If the secondary threat detection cannot achieve accurate judgment, perform deep threat detection on the network traffic;

[0131] Step S303 includes the following sub-steps:

[0132] Step S303.1, each flow coordinate in the flow history feature corresponds to a visit number. For the flow history feature, the average value of the visit number is calculated and marked as the visit history feature. The visit history feature corresponding to the abnormal flow feature is marked as the abnormal visit feature, and the visit history feature corresponding to the normal flow feature is marked as the normal visit feature.

[0133] Step S303.2, establish a plane rectangular coordinate system with the access abnormality feature as the horizontal axis and the average slope of the abnormal trend as the vertical axis, named as the abnormal access trend comparison chart, and enter the access abnormality feature corresponding to the traffic abnormality feature and the coordinate points formed by the average slope of the abnormal trend into the abnormal access trend comparison chart;

[0134] Step S303.3, establish a plane rectangular coordinate system with the normal access feature as the horizontal axis and the normal trend average slope as the vertical axis, named as the normal access trend comparison chart, and enter the coordinate points consisting of the normal access feature corresponding to the normal traffic feature and the normal trend average slope into the normal access trend comparison chart;

[0135] Step S303.4, analyzing the abnormal access trend comparison chart and the normal access trend comparison chart to detect whether there is a network attack behavior;

[0136] Step S303.4 includes the following sub-steps:

[0137] Step S303.4.1, for each value of the access history feature, obtain the minimum value in the abnormal access trend comparison chart and the maximum value in the normal access trend comparison chart, and calculate their average value to obtain the segmented traffic threshold;

[0138] Step S303.4.2, establish a plane rectangular coordinate system with the access history feature as the X-axis and the segmented flow threshold as the Y-axis, named as the segmented threshold reference diagram, enter the access history feature and the corresponding segmented flow threshold into the segmented threshold reference diagram;

[0139] Step S303.4.3, performing polynomial regression on the piecewise threshold reference reference, and naming the function obtained by regression as the piecewise threshold equation;

[0140] Step S303.4.4, obtaining the number of visits to the real-time traffic feature and calculating the average value, marking it as the visit real-time feature, substituting the visit real-time feature into the piecewise threshold equation, and solving it to obtain the real-time traffic abnormality threshold;

[0141] Step S303.4.5, compare the real-time average slope with the real-time abnormal flow threshold. If the real-time average slope is less than the real-time abnormal flow threshold, a normal flow signal is output; otherwise, a abnormal flow signal is output;

[0142] Step S4, based on the detection results, a security warning is issued for the network attack behavior; Step S4 includes the following sub-steps:

[0143] Step S401, receiving abnormal flow rate signals and normal flow rate signals in real time;

[0144] Step S402: If a traffic abnormality signal is received, a security warning is sent to the security center of the edge intelligent data center.

[0145] Embodiment 3, the present application provides an electronic device, which may include: a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus. The memory stores computer-readable instructions, and the processor can call the instructions in the memory. When the computer-readable instructions are executed by the processor, the steps in the network security early warning method based on the edge intelligent data center are executed to achieve the following functions: real-time monitoring of security-related data of the edge intelligent data center; extracting data features of security-related data; performing multi-level threat detection on security-related data based on data features to detect whether there is network attack behavior; and providing security early warning for network attack behavior based on the detection results.

[0146] In addition, the logic instructions in the above-mentioned memory can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0147] Embodiment 4, the present application also provides a computer-readable storage medium, the present application provides a storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps in the network security early warning method based on the edge intelligent data center are executed to achieve the following functions: real-time monitoring of security-related data of the edge intelligent data center; extracting data features of security-related data; performing multi-level threat detection on security-related data based on data features to detect whether there is a network attack behavior; and issuing a security early warning for the network attack behavior based on the detection results.

[0148] Through the description of the above implementation methods, the embodiments of the present invention can be provided as methods, systems or computer program products. Based on such an understanding, the above technical solutions can be essentially or partly contributed to the prior art in the form of software products, which can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and include several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0149] In the embodiments provided in the present application, it should be understood that the disclosed system or method can be implemented in other ways. The embodiments described above are merely schematic. For example, the division of modules or units is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules or units can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of systems, modules and units can be electrical, mechanical or other forms.

[0150] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A network security early warning method based on edge intelligent data center, characterized in that: The steps include: Real-time monitoring of security-related data in edge intelligent data centers; Extract data features of security-related data; Perform multi-level threat detection on security-related data based on data features to detect whether there is network attack behavior; Provide security warnings for network attack behaviors based on detection results; Perform multi-level threat detection on security-related data based on data features to detect whether there is a network attack behavior, including the following sub-steps: Perform primary threat detection on network traffic based on traffic characteristics; If the primary threat detection cannot achieve accurate judgment, the network traffic will be subjected to secondary threat detection; If the secondary threat detection cannot achieve accurate judgment, deep threat detection will be performed on the network traffic; Primary threat detection of network traffic based on traffic characteristics includes the following sub-steps: Obtain historical traffic characteristics and real-time traffic characteristics, mark them as historical traffic characteristics and real-time traffic characteristics respectively, mark the historical traffic characteristics with abnormal traffic in the historical records as abnormal traffic characteristics, and mark the remaining historical traffic characteristics as normal traffic characteristics; The abnormal flow characteristics are numbered and marked with TA n Indicates, where n is a non-zero natural number and n is the serial number of TA. n Perform linear regression on the flow coordinates in the graph to obtain the slope of the regression function, which is marked as the abnormal trend slope; number the normal flow characteristics and use the symbol TN i Indicates, where i is a non-zero natural number and i is the serial number of TN; for TN i Perform linear regression on the flow coordinates in , obtain the slope of the regression function, and mark it as the normal trend slope; Obtain the minimum value in the abnormal trend slope and the maximum value in the normal trend slope, and mark them as the abnormal trend lower limit and the normal trend upper limit respectively; compare the abnormal trend lower limit with the normal trend upper limit, if the abnormal trend lower limit is less than or equal to the normal trend upper limit, output a secondary detection signal, if the abnormal trend lower limit is greater than the normal trend upper limit, output a single detection signal; If a single detection signal is output, the average value of the lower limit of the abnormal trend and the lower limit of the normal trend is calculated and marked as the abnormal flow threshold. The slope of the linear regression function of the flow coordinates in the real-time flow characteristics is analyzed to obtain the real-time trend slope. The real-time trend slope is compared with the abnormal flow threshold. If the real-time trend slope is greater than or equal to the abnormal flow threshold, an abnormal flow signal is output, otherwise a normal flow signal is output. If a secondary detection signal is output, secondary threat detection is performed.

2. The network security early warning method based on edge intelligent data center according to claim 1 is characterized in that: The security-related data includes network traffic and access numbers. The network traffic is the amount of data transmitted on the edge intelligent data center at a certain moment, and the access number is the number of visitors received by the edge intelligent data center at a certain moment. The access number corresponds to the network traffic.

3. The network security early warning method based on edge intelligent data center according to claim 2 is characterized in that: Extracting data features of security-related data includes the following sub-steps: For network traffic, a traffic change trend graph is constructed with time and network traffic as the X-axis and Y-axis, and the changes in network traffic within the first recording period are continuously recorded; Filling coordinates into the traffic change trend graph based on the network traffic and the recorded time, marking the coordinates in the traffic change trend graph as traffic coordinates; Adjacent flow coordinates are connected by line segments, and the line segments used for connection are named flow change trend line segments. The broken line composed of the flow change trend line segments is the flow feature.

4. The network security early warning method based on edge intelligent data center according to claim 3 is characterized in that: If the primary threat detection cannot achieve accurate judgment, the secondary threat detection of network traffic includes the following sub-steps: Get TA n The slope of the flow change trend line segment is marked as the abnormal slope. The abnormal slopes are numbered from left to right in the order of the flow change trend line segment and are represented by the symbol SA(n,m), where m is a non-zero natural number and (n,m) is the sequence number of SA. SA(n,m) means TA n The abnormal slope of the mth flow change trend line segment in , for any TA n ,calculate , mark the calculation result as the average slope of abnormal trend, and max() is the maximum value operator; Get TN i The slope of the flow change trend line segment is marked as the normal slope. The normal slopes are numbered from left to right in the order of the flow change trend line segment and are represented by the symbol SN(i,j), where j is a non-zero natural number and (i,j) is the sequence number of SN. SN(i,j) represents TN i The normal slope of the jth flow change trend line segment in , for any TN i ,calculate , label the calculated result as the normal trend average slope; Find the minimum value of the average slope of the abnormal trend and the maximum value of the average slope of the normal trend, mark them as the average minimum slope of the abnormal trend and the average maximum slope of the normal trend respectively, compare the average minimum slope of the abnormal trend with the average maximum slope of the normal trend, if the average minimum slope of the abnormal trend is less than or equal to the average maximum slope of the normal trend, output a deep detection signal, otherwise output a secondary detection execution signal; If a secondary detection execution signal is output, the average value of the average minimum slope of the abnormal trend and the average maximum slope of the normal trend is calculated, marked as the trend average threshold, and the average value of the slope of the flow change trend line segment in the real-time flow characteristics is analyzed, marked as the real-time average slope, and the real-time average slope is compared with the trend average threshold. If the real-time average slope is less than the trend average slope, a normal flow signal is output, otherwise a flow abnormality signal is output; If a deep detection signal is output, deep threat detection is performed on the network traffic.

5. The network security early warning method based on edge intelligent data center according to claim 4 is characterized in that: If the secondary threat detection cannot achieve accurate judgment, the deep threat detection of network traffic includes the following sub-steps: Each flow coordinate in the flow history feature corresponds to a number of visits. For the flow history feature, the average value of the number of visits is calculated and marked as the access history feature. The access history feature corresponding to the abnormal flow feature is marked as the abnormal access feature, and the access history feature corresponding to the normal flow feature is marked as the normal access feature. A plane rectangular coordinate system is established with the access anomaly feature as the horizontal axis and the average slope of the abnormal trend as the vertical axis, which is named as the abnormal access trend comparison chart. The access anomaly feature corresponding to the traffic anomaly feature and the coordinate points formed by the average slope of the abnormal trend are entered into the abnormal access trend comparison chart; A plane rectangular coordinate system is established with the normal access feature as the horizontal axis and the normal trend average slope as the vertical axis, which is named the normal access trend comparison chart. The normal access feature corresponding to the normal traffic feature and the coordinate points formed by the normal trend average slope are entered into the normal access trend comparison chart; Analyze the abnormal access trend comparison chart and the normal access trend comparison chart to detect whether there is any network attack behavior.

6. The network security early warning method based on edge intelligent data center according to claim 5 is characterized in that: Analyzing the abnormal access trend comparison chart and the normal access trend comparison chart to detect whether there is a network attack behavior includes the following sub-steps: For each value of the access history feature, obtain the minimum value in the abnormal access trend comparison chart and the maximum value in the normal access trend comparison chart, and calculate their average value to obtain the segmented traffic threshold; A plane rectangular coordinate system is established with the access history feature as the X-axis and the segmented traffic threshold as the Y-axis, named the segmented threshold reference diagram, and the access history feature and the corresponding segmented traffic threshold are entered into the segmented threshold reference diagram; Perform polynomial regression on the piecewise threshold reference graph, and name the function obtained by regression as the piecewise threshold equation; Obtain the number of visits to the real-time traffic feature and calculate the average value, mark it as the real-time visit feature, substitute the real-time visit feature into the piecewise threshold equation, and solve it to obtain the real-time traffic anomaly threshold; The real-time average slope is compared with the real-time abnormal flow threshold. If the real-time average slope is less than the real-time abnormal flow threshold, a normal flow signal is output; otherwise, a abnormal flow signal is output.

7. The network security early warning method based on edge intelligent data center according to claim 6 is characterized in that: Providing security warnings for network attack behaviors based on detection results includes the following sub-steps: Receive abnormal flow signals and normal flow signals in real time; If an abnormal traffic signal is received, a security warning will be sent to the security center of the edge intelligent data center.

8. A network security early warning system based on an edge intelligent data center, used to implement the network security early warning method based on an edge intelligent data center according to any one of claims 1 to 7, characterized in that: It includes a data monitoring module, a feature extraction module, a threat monitoring module and a security warning module; the data monitoring module, the feature extraction module and the security warning module are respectively connected to the threat monitoring module data; The data monitoring module is used to monitor the security-related data of the edge intelligent data center in real time; The feature extraction module is used to extract data features of security-related data; The threat monitoring module is used to perform multi-level threat detection on security-related data based on data features to detect whether there is a network attack behavior; The security warning module is used to issue security warnings to network attack behaviors based on detection results.

Images