Computer network information security analysis method and system based on big data

Abstract

The invention relates to the technical field of network information security analysis, in particular to a computer network information security analysis method and system based on big data, and the method comprises the following steps: extracting an IP address, a port number and protocol type information from network flow, and creating a firewall rule according to the IP address, the port number and the protocol type information. According to the invention, by introducing data analysis and dynamic firewall rule adjustment, the efficiency and adaptability of network information security are improved. By analyzing the network flow data in real time, extracting the key information such as the IP address, the port number and the protocol type, and creating the firewall rule according to the data, the pertinence and the effectiveness of the firewall strategy are enhanced. The rules are matched and tested in the simulation environment, and the rules are continuously optimized according to the actual flow analysis result, so that each strategy can effectively cope with the current network threat, the occurrence of error interception is reduced, and the interception precision is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network information security analysis, and in particular to a computer network information security analysis method and system based on big data. Background Art

[0002] Cyber ​​information security analysis is a technical field focused on protecting and defending computer networks from unauthorized access and potential cyber attacks. This field includes identifying weaknesses in the network, monitoring possible intrusions, assessing system vulnerabilities, implementing effective defenses, and ensuring the confidentiality, integrity, and availability of data.

[0003] However, existing technologies cannot effectively adapt to the rapid changes in network environments and the emergence of new threats due to their reliance on static rules and lack of real-time data analysis when dealing with network security. The application of fixed rules can easily lead to the misinterpretation of normal traffic or the omission of malicious traffic, especially when facing APT and zero-day attacks. The rigid nature of such security mechanisms makes it impossible for firewalls to update policies in a timely manner to combat emerging threat patterns, increasing the vulnerability of the network. Summary of the invention

[0004] The purpose of the present invention is to solve the shortcomings of the prior art and to propose a computer network information security analysis method and system based on big data.

[0005] In order to achieve the above object, the present invention adopts the following technical solution, a computer network information security analysis method based on big data, comprising the following steps:

[0006] Extracting IP address, port number and protocol type information from network traffic, creating firewall rules based on the IP address, port number and protocol type information; applying the firewall rules to network traffic in a simulated environment, performing a matching test on each rule, calculating a matching success rate, determining whether the rule is valid, and generating a verified firewall rule set;

[0007] Applying the verified firewall rule set to network traffic, checking the IP address, port and protocol type information of the data packet, marking abnormal traffic that does not match the existing rules, recording the frequency and type of abnormal traffic, and generating preliminary traffic anomaly results; adjusting the verified firewall rules in accordance with the preliminary traffic anomaly results, including adjusting the matching range of the IP address and the port number list, and generating an adjusted firewall policy;

[0008] According to the adjusted firewall policy, access restrictions are imposed on IP addresses frequently marked as abnormal, access rights of abnormal IP addresses are modified, implementation time and effects of response measures are recorded, and automatic response operation records are generated; the automatic response operation records are analyzed, the response speed and processing capacity of the firewall are adjusted, and an optimized firewall configuration is generated;

[0009] Collect traffic statistics for the past week and evaluate the interception effect and error interception rate of the optimized firewall configuration.

[0010] Preferably, the steps of obtaining the firewall rules are:

[0011] Monitor and record the data packets flowing through the network in real time, extract the IP address, port number and protocol type of each data packet, and obtain the original feature data set of network traffic;

[0012] Based on the original characteristic data set of the network traffic, analyzing the frequency of occurrence and usage patterns of IP addresses, port numbers and protocol types, evaluating the estimated access patterns and security risks, and forming a preliminary draft firewall rule based on the risk assessment;

[0013] The preliminary draft firewall rules based on risk assessment are standardized to establish firewall rules.

[0014] Preferably, the steps of obtaining the verified firewall rule set are:

[0015] Configure a simulated network environment, deploy firewall rules to the simulated network traffic, monitor the filtering effect of each rule on inbound and outbound data packets, record the number of matches and failures of each rule, and obtain the matching data of each rule;

[0016] Based on the matching data of each rule, the matching success rate of each rule is calculated, and the calculation formula is:

[0017]

[0018] in, Representative The matching success rate of the rules, Representative The number of times the rule was successfully matched. Represents the number of matching failures;

[0019] Based on the matching success rate, the running effect of each rule is evaluated, the rules are screened according to the success rate threshold, the firewall rule set is recompiled and optimized, and a verified firewall rule set is obtained.

[0020] Preferably, the steps for obtaining the preliminary traffic anomaly result are:

[0021] Deploy the verified firewall rule set to the network traffic monitoring, monitor the passing data packets in real time, and check the IP address, port number and protocol type of each data packet, identify the data packets that do not match the rules, and generate an abnormal data packet set;

[0022] Based on the abnormal data packet set, statistical analysis is performed on each type of data packet that does not conform to the rules, the occurrence frequency and protocol type of each abnormal traffic flow are recorded, the characteristics and occurrence mode of the abnormal traffic flow are classified, and the statistical analysis results of the abnormal traffic flow are obtained;

[0023] The abnormal traffic statistical analysis results are used to analyze the potential risks and common time periods of various types of abnormal traffic, and obtain preliminary traffic anomaly results.

[0024] Preferably, the steps of obtaining the adjusted firewall policy are:

[0025] Analyze the preliminary traffic anomaly results, determine the abnormal IP addresses and port numbers, extract the IP and port rule lists that need to be adjusted, and obtain the rule list to be adjusted;

[0026] Based on the list of rules to be adjusted, the matching range of the adjusted IP address and port number is recalculated, and the formula is improved to:

[0027]

[0028] in, is the adjusted matching range, is the current matching range, is a coefficient that is dynamically adjusted according to the frequency of abnormal traffic;

[0029] Based on the adjusted matching range, the firewall policy is updated, the matching rules of the IP address and the port number are redefined, and the adjusted firewall policy is generated.

[0030] Preferably, the steps of obtaining the automatic response operation record are:

[0031] According to the adjusted firewall policy, the IP addresses that are frequently marked as abnormal are detected, and access restrictions are implemented on the abnormal IP addresses to obtain a preliminary restricted IP list;

[0032] Based on the IP list of the preliminary restrictions, the access restriction level calculation is performed for each IP address, and the calculation formula is:

[0033]

[0034] in, Indicates the optimized access restriction level. The abnormal access frequency of the IP address. is the safety threshold set. is the adjustment factor;

[0035] Based on the optimized access restriction level, the access permission settings of each IP are updated, the time and effect of implementing the access restriction are recorded, and the automatic response operation record is obtained.

[0036] Preferably, the steps for obtaining the optimized firewall configuration are:

[0037] Collect the automatic response operation records, identify events with abnormal processing time or abnormal response, and obtain preliminary performance problem results;

[0038] Based on the preliminary performance problem results, analyze the conditions where the problem frequently occurs, including IP address type, access time period, and protocol type, perform cluster analysis on the conditions, determine the factors that affect firewall performance, and obtain a firewall adjustment plan;

[0039] According to the firewall adjustment plan, configuration adjustment is performed, including increasing processing capacity and optimizing rule logic, to obtain an optimized firewall configuration.

[0040] Preferably, the steps to evaluate the interception effect and error interception rate of the optimized firewall configuration are:

[0041] Based on the optimized firewall configuration, collect network traffic data in the past week, the network traffic data includes the timestamp, source IP, destination IP, transmission protocol and interception status of each data packet to form a traffic log data set;

[0042] Based on the traffic log data set, the heterogeneity index of network traffic is calculated using the formula:

[0043]

[0044] in, Represents the heterogeneity index of network traffic, Indicates The proportion of traffic types in the total traffic, Indicates the total number of traffic types, is the base;

[0045] Based on the heterogeneity index, the interception effect and the error interception rate of the firewall configuration are evaluated, and it is analyzed whether the error interception rate is within an acceptable range.

[0046] The present invention provides a computer network information security analysis system, comprising:

[0047] Traffic data capture module, used to extract IP address, port number and protocol type information from network traffic and build firewall rules;

[0048] The rule verification simulation module applies the rule construction data to the network traffic in the simulation environment, performs a matching test on each firewall rule, calculates the matching success rate, verifies each rule, and generates a rule matching result set;

[0049] The rule application monitoring module applies the rule matching result set to the network traffic, checks the IP address, port and protocol type information of each data packet, identifies and marks abnormal traffic that does not match the existing rules, records the frequency and type of abnormal traffic, and generates preliminary traffic anomaly results;

[0050] The rule adjustment and optimization module adjusts the verified firewall rule set in accordance with the preliminary traffic anomaly results, including the modification of the IP address matching range and the port number list, generates the adjusted firewall policy, imposes access restrictions on frequently marked abnormal IP addresses, modifies access rights, records the implementation time and effect of response measures, and generates automatic response operation records;

[0051] The performance evaluation and reporting module analyzes the automatic response operation records, adjusts the firewall's response speed and processing capacity, and evaluates the interception effect and error interception rate of the adjusted firewall policy based on the traffic statistics in the past week.

[0052] Compared with the prior art, the advantages and positive effects of the present invention are:

[0053] The present invention improves the efficiency and adaptability of network information security by introducing data analysis and dynamic firewall rule adjustment. By analyzing network traffic data in real time, extracting key information such as IP address, port number and protocol type, and creating firewall rules based on these data, the pertinence and effectiveness of firewall policies are enhanced. Matching tests are performed on the rules in a simulated environment and the rules are continuously optimized based on the actual traffic analysis results to ensure that each policy can effectively respond to current network threats, reduce the occurrence of erroneous interception, and improve interception accuracy. In addition, through the automatic response mechanism, the policy can be automatically adjusted according to the specific type and frequency of abnormal traffic, and the firewall configuration can be updated in real time, so as to quickly adapt to changing security needs. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 It is a schematic diagram of the steps of the present invention. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0056] See also Figure 1 The present invention provides a technical solution, a computer network information security analysis method based on big data, comprising the following steps:

[0057] Extract IP address, port number and protocol type information from network traffic, and create firewall rules based on IP address, port number and protocol type information; apply firewall rules to network traffic in a simulated environment, perform a match test on each rule, calculate the match success rate, determine whether the rule is valid, and generate a verified firewall rule set;

[0058] Apply the verified firewall rule set to the network traffic, check the IP address, port and protocol type information of the data packet, mark the abnormal traffic that does not match the existing rules, record the frequency and type of abnormal traffic, and generate preliminary traffic anomaly results; adjust the verified firewall rules according to the preliminary traffic anomaly results, including adjusting the matching range of the IP address and the port number list, and generate an adjusted firewall policy;

[0059] According to the adjusted firewall policy, implement access restrictions on IP addresses that are frequently marked as abnormal, modify the access rights of abnormal IP addresses, record the implementation time and effect of response measures, and generate automatic response operation records; analyze automatic response operation records, adjust the response speed and processing capacity of the firewall, and generate optimized firewall configuration;

[0060] Collect traffic statistics for the past week and evaluate the interception effect and error interception rate of the optimized firewall configuration.

[0061] The steps to obtain firewall rules are:

[0062] Monitor and record the data packets flowing through the network in real time, extract the IP address, port number and protocol type of each data packet, and obtain the original feature data set of network traffic;

[0063] Based on the original characteristic data set of network traffic, analyze the frequency and usage patterns of IP addresses, port numbers and protocol types, evaluate the estimated access patterns and security risks, and form a preliminary draft of firewall rules based on risk assessment;

[0064] Standardize the preliminary draft firewall rules based on risk assessment and establish firewall rules.

[0065] Specifically, according to the recorded network interface parameters, the state of the designated network interface is adjusted to the promiscuous mode, and all data packets passing through the interface are continuously captured. For each captured data packet, its header field is retrieved in turn according to the public IP protocol message structure parsing steps, and the IP address information field is read therefrom. Subsequently, the corresponding port number information field is read according to the field position defined in the TCP or UDP header structure, and the protocol type information field is obtained in the same data packet according to the protocol identifier value of the IP header field. The extracted IP address, port number and protocol type information are recorded in the order of the data packet capture time, and the recorded data are sorted in sequence and integrated into a set of feature item sets. Without using complex aggregation or feature transformation processing, this set of feature items is directly summarized to obtain the original feature data set of the network traffic.

[0066] Based on the original characteristic data set of network traffic obtained earlier, the total number of occurrences of each IP address field value is counted, and the statistical results are summarized to form an IP address occurrence frequency record. The same statistical steps are performed for the port number field value, and the frequency statistical processing is also performed on the protocol type field value. The results are respectively formed into a port number occurrence frequency record and a protocol type occurrence frequency record. After completing the statistics of these three types of field values, the average number of occurrences of each type of field value is calculated and the corresponding standard deviation is calculated. The average value plus twice the standard deviation is used as the frequency threshold of this type of field value. The frequency threshold here is determined by referring to the long-term accumulated statistical results in the data set obtained earlier. It is not set out of thin air, but is determined by analyzing the historical data of the same network environment. Through comprehensive statistics and experience, it is concluded that when the frequency of occurrence of any IP address field value exceeds the threshold, the IP address field value is marked as a high-risk source. When the frequency of occurrence of any port number field value or protocol type field value exceeds the threshold, it is also marked as a high-risk source. All field values ​​marked as high-risk sources are sorted into a high-risk field value list, and preliminary access restriction policy entries are established based on the characteristics of the IP addresses in the list, corresponding port filtering policy entries are established based on the characteristics of the port numbers in the list, and protocol filtering policy entries are established based on the characteristics of the protocol types in the list. The above policy entries are simply sorted and classified, and all policy entries are summarized into a preliminary rule set as a preliminary firewall rule draft generated based on risk assessment.

[0067] Select each rule entry in the preliminary draft of firewall rules based on risk assessment obtained above, check whether the IP address field of each entry is in standard dotted decimal format, check whether the port number field is an integer value in the range of 0 to 65535. This value range is based on the port number range specified in the general network standard, check whether the protocol type field is in the protocol name list obtained from the current network standard, if any format or field value that does not meet the requirements is found, correct it, correct the non-standard IP address format to the standard dotted format, correct the port number that is not in the standard port range by directly adjusting it to the expected range, replace the non-standard protocol name with the corresponding standard name in the protocol name list, recombine the rule entries after normalization, and finally establish the firewall rules.

[0068] The steps to obtain the verified firewall rule set are:

[0069] Configure a simulated network environment, deploy firewall rules to the simulated network traffic, monitor the filtering effect of each rule on inbound and outbound data packets, record the number of matches and failures of each rule, and obtain the matching data of each rule;

[0070] Based on the matching data of each rule, the matching success rate of each rule is calculated using the following formula:

[0071]

[0072] in, Representative The matching success rate of the rules, Representative The number of times the rule was successfully matched. Represents the number of matching failures;

[0073] Based on the matching success rate, the running effect of each rule is evaluated, the rules are screened according to the success rate threshold, the firewall rule set is recompiled and optimized, and the verified firewall rule set is obtained.

[0074] Specifically, according to the simulated network environment established in the virtual network simulation tool, the pre-prepared firewall rules are loaded into the network traffic processing unit in sequence, so that the processing unit starts to match the inbound and outbound data packets generated in the simulated environment, and the counting unit is initialized for each rule to record the number of matches and failures of the corresponding rule within a fixed period of time. By starting the data packet capture instruction at the interface position of the virtual network, the data packet is parsed one by one according to the protocol header characteristics to identify which firewall rules it applies to, and the number of matches corresponding to each rule is accumulated by a simple counting method, and each failure record is also accumulated by counting. During this period, there is no need to perform complex conversion or screening on the data, and the quantitative record of the rule matching performance is completed only by intuitive cumulative counting. With the help of periodic statistical instructions, the match and failure values ​​in the counting unit of each rule are read within a fixed time interval, and the read match number and failure number are combined to form rule matching data. Finally, the match and failure records corresponding to all rules are summarized to obtain the matching data of each rule.

[0075] The formula is beneficial in that it quantitatively reflects the matching performance of a specific rule in existing records by utilizing the statistical values ​​of the number of successful matches and the number of failed matches;

[0076] The parameter acquisition step is to apply the deployed firewall rules to a group of 5000 continuously generated data packets in the simulation environment, match them one by one, and count the number of times that they meet the matching conditions of the rule. ;

[0077] The parameter acquisition step is to detect the number of times that the same group of 5000 data packets do not meet the matching conditions of the rule but are mistakenly identified as matching by the rule, and obtain the number of times by counting ;

[0078] Calculation process:

[0079] Bring in parameters: , ;

[0080] Calculate the denominator: ;

[0081] Calculate the score value: ;

[0082] Calculate the percentage: ;

[0083] The result shows that under the current recording conditions, the matching success rate of this rule is 80%. The larger the value, the higher the consistency between the matching condition and the actual network traffic. When the matching success rate reaches or exceeds 80%, it means that the rule meets the requirements under the current conditions. If it is lower than 80%, it means that the rule does not meet the requirements under this condition.

[0084] Based on the obtained matching success rate data, the success rate values ​​of a set of rules are extracted one by one, and the success rate value of each rule is compared with the median success rate obtained from statistics in the same environment in the past 90 days. The median success rate is determined by arranging all the rule matching success rate data in the past 90 days in ascending order and then taking the value in the middle position, thereby forming a clear success rate threshold. After the threshold is determined, the success rate of the current rule is compared with the threshold one by one, and the rules below the threshold are removed from the set. The rules that are equal to or higher than the threshold are re-sorted according to the success rate size, and the re-sorted rule sets are combined together. No additional changes or complex transformations are made to the rules that have passed the screening, and the results are directly output as the final verified firewall rule set.

[0085] The steps to obtain the preliminary traffic anomaly results are as follows:

[0086] Deploy the verified firewall rule set to the network traffic monitoring, monitor the passing data packets in real time, and check the IP address, port number and protocol type of each data packet, identify the data packets that do not match the rules, and generate an abnormal data packet set;

[0087] Based on the abnormal data packet set, statistical analysis is performed on each type of data packet that does not conform to the rules, the occurrence frequency and protocol type of each abnormal traffic are recorded, the characteristics and occurrence mode of the abnormal traffic are classified, and the statistical analysis results of the abnormal traffic are obtained;

[0088] Utilize the abnormal traffic statistical analysis results to analyze the potential risks and frequent time periods of various types of abnormal traffic, and obtain preliminary traffic anomaly results.

[0089] Specifically, according to the verified firewall rule set obtained above, it has been deployed to the specified network traffic monitoring environment. For all data packets passing through the monitoring point, the configured network interface first continuously receives the passing traffic, parses the header fields of each data packet one by one, reads the IP address field according to the public protocol specification, identifies the IP address in numerical form, reads the port number field from the corresponding byte position according to the format definition of the transport layer header, parses the port number into an integer value between 0 and 65535, and checks whether it is in the general port allocation list during the parsing stage. For the protocol type field, refer to the public A common protocol list is used to quantify the protocol name into a comparable value using the integer identification number assigned to each protocol type in the list. Each rule definition contains matching conditions for the IP address, port number, and protocol type. The three field values ​​of the data packet are checked one by one according to the numerical matching mode in the rule to see if they meet the predefined matching criteria. The data packet is recorded in the exception item only when a match fails. If it is found that the combination of the IP address, port number, and protocol type of the data packet fails to match the existing rules, the data packet is directly added to the exception data packet set. Finally, all data packets that do not meet the rule conditions are summarized to obtain the exception data packet set.

[0090] According to the abnormal data packet set obtained above, each type of data packet is selected and its characteristic fields are statistically processed. The classification basis is first determined. For the classification of the IP address field, each address in the IP address list recorded in the historical monitoring is encoded with a unique identification integer, and then the number of times the address appears in the abnormal data packet set is counted. The number is compared with the benchmark reference value established in the early stage. The benchmark reference value is obtained by long-term statistics of regular traffic in the same network environment, that is, the average number of occurrences of each IP address in all normal data packets is measured within a long time window (for example, 30 days), and the average number is taken as the benchmark value. The same method is used for the port number. The rate statistics are performed, and the average number of port occurrences obtained by long-term monitoring is used as a reference. The protocol types are also encoded and counted. Each protocol type corresponds to a fixed integer identifier. The frequency of occurrence of the protocol type is extracted from the abnormal data packet set and compared with the average number of occurrences of the protocol type obtained in the early stage. When any statistical value is higher than the average value obtained previously, it is directly recorded as a type of high-frequency abnormal feature. When the abnormal feature appearing in the statistics is repeated many times, that is, the same protocol type or the same IP address appears frequently in multiple types of abnormal data packets, the feature is marked as a potential dominant abnormal element. All statistically completed abnormal features are integrated together to obtain the abnormal traffic statistical analysis results.

[0091] According to the abnormal traffic statistical analysis results obtained above, the frequency distribution of different types of abnormal traffic in a 24-hour cycle is checked in turn, and a day is divided into several time periods (for example, one interval per hour). The number of occurrences of this type of abnormal traffic is counted in each time period, and the characteristic frequency is compared with the initial monitoring benchmark. When the abnormal traffic frequency in a certain time period exceeds the median calculated by historical data (the median is determined by the sorted median value of the frequency of occurrence of the same type of traffic under stable monitoring conditions in the past), the time period is considered to be a time period where abnormal traffic often occurs. No smoothing or complex calculations are performed on the time period data, and only the time period is recorded as a frequent interval. At the same time, according to the number of occurrences of IP addresses, port numbers, and protocol types involved in the abnormal traffic characteristics, the corresponding numerical level is given as the potential risk value. The potential risk value is obtained by averaging the frequency of abnormal traffic with the same characteristics in a longer time span and weighted calculation. This potential risk value is also expressed in integer form, and the features above the integer threshold are marked as potential risk categories. All potential risk values ​​and frequent time period information are summarized to obtain preliminary traffic anomaly results.

[0092] The steps to obtain the adjusted firewall policy are:

[0093] Analyze the preliminary traffic anomaly results, determine the abnormal IP addresses and port numbers, extract the IP and port rule lists that need to be adjusted, and obtain the rule list to be adjusted;

[0094] Based on the list of rules to be adjusted, recalculate the matching range of the adjusted IP address and port number. The formula is improved to:

[0095]

[0096] in, is the adjusted matching range, is the current matching range, is a coefficient that is dynamically adjusted according to the frequency of abnormal traffic;

[0097] Based on the adjusted matching range, the firewall policy is updated, the matching rules of the IP address and the port number are redefined, and the adjusted firewall policy is generated.

[0098] Specifically, according to the preliminary traffic anomaly results obtained above, the abnormal IP addresses and port numbers listed therein are confirmed one by one, the known IP addresses are encoded in numerical form, and the number of abnormal occurrences of these encoded IP addresses within a fixed period of time is counted. The standard value selected in the statistical process comes from the average number of IP address occurrences under normal conditions for 30 consecutive days. By comparing with the average value, when it is found that the number of occurrences of a certain IP address in the abnormal data is higher than the average value, it is marked as an abnormal target, and only the initially obtained numerical information is used to store it in the record. Similarly, for the port number, the port number is converted into an integer, and the number of occurrences of the port number in the abnormal data is counted, and the number is compared with the average port usage value obtained under 30 days of stable monitoring conditions. The port number higher than the average value is also marked as an abnormal target, and only its basic statistical results are retained. The rule entries corresponding to all IP addresses and port numbers marked as abnormal targets are extracted from the previously existing rule set. In this process, only simple extraction and sorting of the entries are performed. When all marked entries are sorted, these entries are summarized to obtain a list of rules to be adjusted.

[0099] The formula is beneficial because it introduces a dynamic adjustment factor based on the existing matching range. , so that the matching range can be flexibly increased or decreased as the frequency of abnormal traffic changes;

[0100] The parameter acquisition step is to obtain the IP address matching range counted in the previously obtained list of rules to be adjusted. For example, in the 30-day stable network monitoring, the total number of IP addresses in the allowed range is found to be This value is obtained by grouping and counting the number of repeated occurrences of legitimate source IP addresses;

[0101] The parameter acquisition step is to calculate the deviation between the abnormal traffic frequency obtained above and the normal baseline traffic. During the statistical process, it was found that the average number of abnormal visits per day for the IP address corresponding to the matching range was 50 times. The number of abnormal visits in the same range measured recently has risen to 65 times. The difference of 15 is divided by the normal value of 50, and the result is ;

[0102] Calculation process:

[0103] Will , Substituting into the formula:

[0104] When the + sign is used:

[0105]

[0106] When taking the - sign:

[0107]

[0108] The results show that under the same abnormal traffic conditions, the adjusted matching range can vary between 140 and 260. When the calculated result is greater than 200, it means that the matching range is correspondingly expanded, and when it is less than 200, it means that the matching range is appropriately shrunk. Different adjustment directions correspond to dynamic revisions of the rule range.

[0109] According to the adjusted matching range obtained above, the IP address segments and port number ranges specified in the original firewall policy are compared in turn, and the IP address interval parameters in each rule are calculated using the previously calculated If the original allowed range of IP addresses is a fixed value of 200, it will be changed to 260 or 140. The corresponding calculation result is selected according to whether the IP address range needs to be expanded or reduced. The IP address data is not additionally classified, and only the value is updated to the new range. The port number parameter is also based on Adjustments are made to directly update the port number range to the corresponding value. There is no need for complex screening and mapping of the port number data. If it is found that the port number corresponds to an abnormal characteristic value, the shrunk range value is used, otherwise the expanded or maintained range value is used. All updated IP address and port number matching entries are summarized one by one, and the summarized entry list is simply sorted and numbered without additional statistics or conversion of the data, and finally the adjusted firewall policy is obtained.

[0110] The steps to obtain automatic response operation records are as follows:

[0111] According to the adjusted firewall policy, the IP addresses that are frequently marked as abnormal are detected, and access restrictions are implemented on the abnormal IP addresses to obtain a preliminary restricted IP list;

[0112] Based on the preliminary restricted IP list, the access restriction level calculation is implemented for each IP address. The calculation formula is:

[0113]

[0114] in, Indicates the optimized access restriction level. The abnormal access frequency of the IP address. is the safety threshold set. is the adjustment factor;

[0115] Based on the optimized access restriction level, update the access permission settings of each IP, record the time and effect of implementing the access restriction, and obtain automatic response operation records.

[0116] Specifically, according to the adjusted firewall policy obtained above, the identified multiple firewall rules are loaded into the currently running network traffic monitoring program one by one, and the IP addresses that have been confirmed as abnormal features are screened and processed. First, the IP addresses that have appeared repeatedly and are marked as abnormal are extracted from the abnormal data obtained above, and these IP addresses are sorted in the form of numerical codes to ensure that each address corresponds to a unique integer code value. After obtaining these integer codes, the number of abnormal events corresponding to the code is calculated using a fixed period statistical method. The statistical period is selected as 24 hours. The statistical standard is confirmed based on the average number of IP address appearances under normal traffic conditions above. The number of IP address appearances under normal operating conditions in the past 30 days is averaged and used as a reference standard. IP addresses that appear more than twice the reference standard in the abnormal data every day are selected as frequently marked abnormal addresses. The IP address code values ​​that exceed twice the reference standard are added to a temporary list, and access restriction operations are performed on each IP address in the list. The access restriction operation It means that by setting specific entries in the network traffic monitoring program, when the data packet corresponding to the IP address enters the system, the restriction entry is matched first, thereby blocking or delaying its communication request. The restriction level is divided into several integer levels according to the abnormal frequency of the IP address. The setting of the integer level range is based on the abnormal frequency span counted previously. The lowest abnormal frequency is divided into level 1 restriction, the highest is divided into level 5 restriction, and the middle is divided into level 2, 3, and 4 restrictions according to the frequency distribution. Each restriction level corresponds to different access rules. Level 1 restriction represents basic flow restriction, level 2 restriction represents delayed processing, level 3 restriction represents multiple mandatory reviews, level 4 restriction represents complete blocking in a small range, and level 5 restriction represents global blocking. This integer grading method avoids the use of ambiguous terms, and realizes automatic resolution with a unified integer identifier within the system. After the grading is completed, all restricted IP addresses and their corresponding restriction levels are uniformly summarized and recorded in the internal data structure. No additional screening or complex calculation is performed. Only the IP addresses and restriction information that have completed the grading are summarized and counted to obtain a preliminary restricted IP list.

[0117] The formula is useful because it takes the abnormal access frequency , safety threshold and adjustment factor Integrate into the same calculation process, so that the final access restriction level not only considers the total amount of abnormal access, but also dynamically balances it relative to the security standard;

[0118] The parameter acquisition step is to obtain the abnormal access count corresponding to each IP address in the preliminary restricted IP list obtained above, set the statistical period to 24 hours, and record the abnormal access count within the period through the data monitoring program. In this example, the abnormal access count for a certain IP address is ;

[0119] The steps to obtain the parameters are as follows: based on the long-term monitoring of the normal network environment in the early stage, the average daily abnormal access times of all IP addresses are counted within 30 days, and the median value is found from a large amount of data as the security threshold. In this example, the median value is obtained by analyzing the distribution of the average abnormal access data within 30 days. ;

[0120] The steps to obtain the parameters are to compare a set of historical data, quantify the volatility of the current abnormal access frequency and the past benchmark data into a multiplier factor, and refer to the existing experience, choose to set C to 2.0 times the increment when the abnormal access frequency increases 8 times compared with the base value. In this example, and , indicating that the current abnormal frequency is 8 times the basic value, so ;

[0121] Calculation process:

[0122] Bring in parameters , , :

[0123] First calculate : ;

[0124] It is about 4.394449;

[0125] The molecular part is , the denominator is ;

[0126] ;

[0127] Then multiply by :

[0128] ;

[0129] The result shows that when the abnormal access frequency of the IP address is 80, the calculated optimized access restriction level is approximately 0.8788898. The larger the value, the stronger the restriction. When the value is close to 1, it means it is close to the highest restriction level. When it is greater than 1, it means that more stringent restrictions are needed. When it is less than 0.5, it means that the restrictions are relatively loose. Based on this result, the restriction levels of multiple consecutive IP addresses can be further quantified and summarized into integer intervals for final access permission settings.

[0130] According to the optimized access restriction level obtained above, the restriction level value of each IP address is mapped to the corresponding access permission setting table. When the access permission setting table is disassembled, the IP address and the corresponding restriction level value are recorded in pairs. Each IP address is assigned to the corresponding permission group through the internally defined integer level division range (such as 0 to 0.5 for low restriction level, 0.5 to 1 for medium restriction level, and greater than 1 for high restriction level). No secondary complex processing is performed on the IP address and the restriction value. Only the restriction level value is directly used for access decision. For IP addresses at low restriction levels, basic access rules are executed. For IP addresses at medium restriction levels, their data packets are filtered with stricter filtering rules. For IP addresses at high restriction levels, strict restriction measures are directly adopted. After classification is achieved through this integer interval method, the permission status of each IP and the current restricted time period data are integrated and recorded. In this process, no new complex calculations or screening standards are introduced. Only simple comparison and grouping are performed on the previously calculated values. Finally, all updated IP access permission settings and corresponding restriction implementation time points, as well as data changes recorded when restrictions are triggered, are summarized to obtain automatic response operation records.

[0131] The steps to obtain the optimized firewall configuration are:

[0132] Collect automatic response operation records, identify events with abnormal processing time or response, and obtain preliminary performance problem results;

[0133] Based on the preliminary performance problem results, analyze the conditions where the problem frequently occurs, including IP address type, access time period, and protocol type, perform cluster analysis on the conditions, determine the factors that affect firewall performance, and obtain firewall adjustment plans;

[0134] According to the firewall adjustment plan, configuration adjustments are made, including increasing processing capabilities and optimizing rule logic, to obtain an optimized firewall configuration.

[0135] Specifically, according to the automatic response operation records obtained above, the event processing start time and end time indicated in each record are converted into numerical time intervals, and the historical processing time within 30 consecutive days is selected from these values ​​as a reference basis. The historical data are statistically analyzed to obtain the average processing time and standard deviation. The average processing time m is taken as the center, and the value of m plus twice the standard deviation is taken as the processing time abnormality threshold. The threshold is calculated by the processing time of similar events in a large number of historical records. On this basis, the processing time of each event in the record is compared one by one. When it is found that the processing time of an event exceeds this threshold, the event is marked as a processing time abnormal event. No other complex calculations are performed on the original data of the event, and only the marking information is retained for subsequent analysis. For the recognition process of response abnormality, the response output time point and the input request time point in the automatic response operation record are differentially calculated to obtain the response. The normal response delay time data for 30 consecutive days are statistically analyzed, and the average response delay time and standard deviation are also calculated. The value of the average response delay time plus twice the standard deviation is used as the response abnormality threshold. When the response delay time of an event exceeds this threshold, it is a response abnormality event, and the event is marked as a response abnormality event. During this period, the data is not aggregated or mapped. Only the original data is used to calculate the time difference and compared with the threshold. All marked abnormal events are summarized without distinguishing between processing time abnormalities and response abnormalities. All are recorded in the same data structure without adding new fields and codes. Only integers are used to identify the serial numbers of these abnormal events. When the summary is completed, all abnormal events are simply sorted and classified, and arranged in chronological order. These abnormal events are not cross-compared with other external data. Only a list of abnormal events is obtained after the marking process is completed, and the list is used as the preliminary performance problem result.

[0136] Based on the preliminary performance problem results obtained above, a set of events marked as abnormal are extracted. For these abnormal events, the IP addresses involved are digitized, and the IP address string is decomposed into four groups of integers in standard dotted decimal format. Each group of integers is directly recorded as a parameter without performing geographic location mapping or complex parsing on the IP address. Only its numerical characteristics are retained. For the access time period records, the integer hour segments of the 24-hour system are directly used to divide the hours corresponding to the time when the abnormal event occurred are extracted as the access time period parameters. For example, the specific timestamp of the event trigger is read from the record, and then the hour value in the timestamp is used as the access time period parameter. The extraction of the protocol type is based on the protocol type number list compiled above. Each protocol type is assigned a unique integer identifier in the initialization phase. By comparing the protocol field in the event record with the list, the corresponding integer identifier is directly read without secondary conversion. These three types of parameters (IP address integer group , access time period integer value, protocol type integer identifier) ​​into a parameter vector set, extract the parameter vector for all abnormal events one by one, summarize all vectors to form a parameter matrix, and perform a clustering process on this parameter matrix. The clustering process refers to the hierarchical clustering steps used in the previous analysis, and calculates the distance of the event parameter matrix according to the numerical characteristics of IP address, access time period, and protocol type. The average distance is selected as the metric. When the average distance is lower than the median distance threshold obtained by observing the distribution of 30-day historical data, these events are classified into one group. No dynamic adjustment or feedback correction is performed on the clustering parameters. The grouping result is obtained only in one clustering process. The characteristic parameters that appear frequently in these groups are directly recorded, and no additional weight correction is performed on the parameter values. The values ​​are kept as they are. After all clustering is completed, the parameter items with frequent features are extracted from each category as a list of factors affecting firewall performance, and then these factor lists are integrated into a firewall adjustment plan.

[0137] According to the firewall adjustment plan obtained above, select the clearly listed configuration adjustment items from the plan, and concretize "increasing processing capacity" as an integer count expansion of the existing processing units, such as increasing the number of originally deployed processing threads from 200 to 300. Do not use percentage increments or fuzzy descriptions, but directly use integers to increase the processing thread value, and record the startup parameters of these threads in the corresponding configuration file. For "optimizing rule logic", rearrange the original fixed order matching rule list according to the rule triggering frequency, and simply sort the rules in ascending order by reading the rule triggering count information obtained above, so that the least triggered rules are at the end of the list, and do not trigger the rules. The semantics itself is changed, and only the matching order of rules is adjusted to shorten the matching path of common rules. No new rules are added or existing rules are deleted. The sorted rule set replaces the original rule set. This process only involves simple integer sorting and list reorganization operations, without complex mapping or aggregation steps. The final processing thread number increment and the optimized rule list are combined and written into the internal structure. No hierarchical management or additional indexes are used. Only the updated configuration parameters are arranged in a fixed order in the configuration data structure. After recording the data structure, these parameters can be called in subsequent actual deployments to implement new firewall configurations, thereby obtaining optimized firewall configurations.

[0138] The steps to evaluate the interception effect and false interception rate of the optimized firewall configuration are:

[0139] Based on the optimized firewall configuration, network traffic data from the past week is collected. The network traffic data includes the timestamp, source IP, destination IP, transmission protocol, and interception status of each data packet to form a traffic log data set.

[0140] Based on the traffic log data set, the heterogeneity index of network traffic is calculated using the formula:

[0141]

[0142] in, Represents the heterogeneity index of network traffic, Indicates The proportion of traffic types in the total traffic, Indicates the total number of traffic types, is the base;

[0143] Based on the heterogeneity index, the interception effect and error interception rate of the firewall configuration are evaluated, and the error interception rate is analyzed whether it is within the acceptable range.

[0144] Specifically, according to the optimized firewall configuration obtained above, it has been running stably for a week, and the actual traffic passing through the network interface in the past week has been continuously monitored. The timestamp of each data packet is read as numerical time series data, and four integer parameters are obtained by parsing the dotted decimal addresses of the source IP and the destination IP. The corresponding integer identifier of the transmission protocol is obtained from the pre-established protocol comparison table, and the interception status of each data packet is represented by the integer 0 to indicate not intercepted and 1 to indicate intercepted. A complete record is formed by integrating the above timestamp, source IP, destination IP, protocol identifier, and interception status. No complex aggregation and feature transformation are performed on the record data. All records are arranged continuously according to the time sequence of the data packets. All captured data packets within a week are converted and summarized one by one. If an abnormal data packet cannot be parsed into an integer protocol identifier during the statistical process, the protocol type defined in the protocol list is referred to and an integer is assigned by trying to match the protocol keyword. When a protocol keyword is consistent with the predefined list, the corresponding integer identifier is directly assigned. If it still cannot be matched, it is recorded as a separate special protocol code and is not filtered. Only its integer identifier is recorded in the data set. There is no additional refinement of the source IP and the target IP. Only the integer parameters directly parsed are used and stored together with the protocol identifier. After completing the processing of the entire week's data, no difference analysis or outlier removal is performed. All converted record data are directly summarized to obtain a traffic log data set.

[0145] The benefit of the formula is that it converts the complexity of network traffic type distribution into a measurable heterogeneity index by quantitatively calculating the proportion of different traffic types;

[0146] The steps for obtaining the parameters are as follows: classify and count the types of all data packets from the previously obtained traffic log data set. The type distinction standard is formed by combining the pre-defined protocol identifier and the transmission direction (for example, from intranet to extranet, from extranet to intranet) and other integer parameters. The number of all data packets with the same parameter combination is divided by the total number of data packets to obtain the proportion of the corresponding traffic type. For example, after statistics, it is determined that there are The proportion of Class 1 traffic is , Category 2 , Category 3 , Category 4 ;

[0147] The steps for obtaining the parameters are as follows: select the logarithmic base b by statistically analyzing long-term network data, and refer to the commonly used information entropy calculation standard during this execution process to select the base As the base for logarithmic calculations;

[0148] Calculation process:

[0149] Substituting the parameters into the formula:

[0150] ;

[0151] Calculate each term:

[0152] , Then the first item is ;

[0153] , Then the second item is ;

[0154] , Then the third item is ;

[0155] , Then item 4 is ;

[0156] Add all the terms together:

[0157] ;

[0158] The result shows that the heterogeneity index of the current network traffic in the past week is about 1.68. The larger the value, the more balanced and diverse the distribution of traffic types. If this value is higher than 2, it means that the traffic types are very balanced and diverse. If it is less than 1, it means that the traffic types are relatively concentrated and single. The traffic distribution characteristics under the current firewall configuration can be judged by comparing with the established reference range.

[0159] According to the heterogeneity index result obtained above, the index is compared with the historical reference range, the interception status data is counted, and the ratio of the number of intercepted data packets to the total number of data packets is calculated. The ratio corresponds to the evaluation parameter of the error interception rate. The error interception rate is compared with the previous benchmark value under normal traffic. When the benchmark value comes from the median of 30 days of stable environment monitoring data, the current error interception rate is counted day by day and compared with the median. If the error interception rate value of a certain day exceeds the reference value corresponding to the median, twice the median is the preset maximum allowable value. Days that exceed the twice value will be marked, and the false interception rate of each day will be compared numerically during the entire one-week monitoring cycle. No complex modeling or prediction will be performed on the false interception rate results. Only integer comparison will be used to determine whether it exceeds twice the median value. The number of days with the excess number in the week will be counted. If it exceeds for multiple consecutive days, the cumulative value of the corresponding days will be counted without averaging or weighting. After all the data is counted, the final days with the false interception rate out of bounds will be summarized without additional merging or regrouping. Only the final statistical value will be simply recorded to obtain the actual performance of the false interception rate under this configuration.

[0160] The above are only preferred embodiments of the present invention and are not intended to limit the present invention in other forms. Any technician familiar with the profession may use the technical contents disclosed above to change or modify them into equivalent embodiments with equivalent changes and apply them to other fields. However, any simple modification, equivalent change and modification made to the above embodiments based on the technical essence of the present invention without departing from the technical solution of the present invention still falls within the protection scope of the technical solution of the present invention.

Claims

1. A computer network information security analysis method based on big data, characterized in that: The following steps are involved: Extracting IP address, port number and protocol type information from network traffic, creating firewall rules based on the IP address, port number and protocol type information; applying the firewall rules to network traffic in a simulated environment, performing a matching test on each rule, calculating a matching success rate, determining whether the rule is valid, and generating a verified firewall rule set; Apply the verified firewall rule set to network traffic, check the IP address, port and protocol type information of the data packet, mark abnormal traffic that does not match the existing rules, record the frequency and type of abnormal traffic, and generate preliminary traffic anomaly results; Adjusting the verified firewall rules in accordance with the preliminary traffic anomaly results, including adjusting the matching range of IP addresses and the port number list, and generating an adjusted firewall policy; According to the adjusted firewall policy, access restrictions are imposed on IP addresses frequently marked as abnormal, access rights of abnormal IP addresses are modified, implementation time and effects of response measures are recorded, and automatic response operation records are generated; the automatic response operation records are analyzed, the response speed and processing capacity of the firewall are adjusted, and an optimized firewall configuration is generated; Collect traffic statistics for the past week and evaluate the interception effect and error interception rate of the optimized firewall configuration.

2. The computer network information security analysis method based on big data according to claim 1 is characterized in that: The steps for obtaining the firewall rules are as follows: Monitor and record the data packets flowing through the network in real time, extract the IP address, port number and protocol type of each data packet, and obtain the original feature data set of network traffic; Based on the original characteristic data set of the network traffic, analyzing the frequency of occurrence and usage patterns of IP addresses, port numbers and protocol types, evaluating the estimated access patterns and security risks, and forming a preliminary draft firewall rule based on the risk assessment; The preliminary draft firewall rules based on risk assessment are standardized to establish firewall rules.

3. The computer network information security analysis method based on big data according to claim 1 is characterized in that: The steps for obtaining the verified firewall rule set are: Configure a simulated network environment, deploy firewall rules to the simulated network traffic, monitor the filtering effect of each rule on inbound and outbound data packets, record the number of matches and failures of each rule, and obtain the matching data of each rule; Based on the matching data of each rule, the matching success rate of each rule is calculated, and the calculation formula is: in, Representative The matching success rate of the rules, Representative The number of times the rule was successfully matched. Represents the number of matching failures; Based on the matching success rate, the running effect of each rule is evaluated, the rules are screened according to the success rate threshold, the firewall rule set is recompiled and optimized, and a verified firewall rule set is obtained.

4. The computer network information security analysis method based on big data according to claim 1 is characterized in that: The steps for obtaining the preliminary traffic anomaly result are: Deploy the verified firewall rule set to the network traffic monitoring, monitor the passing data packets in real time, and check the IP address, port number and protocol type of each data packet, identify the data packets that do not match the rules, and generate an abnormal data packet set; Based on the abnormal data packet set, statistical analysis is performed on each type of data packet that does not conform to the rules, the occurrence frequency and protocol type of each abnormal traffic flow are recorded, the characteristics and occurrence mode of the abnormal traffic flow are classified, and the statistical analysis results of the abnormal traffic flow are obtained; The abnormal traffic statistical analysis results are used to analyze the potential risks and common time periods of various types of abnormal traffic, and obtain preliminary traffic anomaly results.

5. The computer network information security analysis method based on big data according to claim 1 is characterized in that: The steps for obtaining the adjusted firewall policy are: Analyze the preliminary traffic anomaly results, determine the abnormal IP addresses and port numbers, extract the IP and port rule lists that need to be adjusted, and obtain the rule list to be adjusted; Based on the list of rules to be adjusted, the matching range of the adjusted IP address and port number is recalculated, and the formula is improved to: in, is the adjusted matching range, is the current matching range, is a coefficient that is dynamically adjusted according to the frequency of abnormal traffic; Based on the adjusted matching range, the firewall policy is updated, the matching rules of the IP address and the port number are redefined, and the adjusted firewall policy is generated.

6. The computer network information security analysis method based on big data according to claim 1 is characterized in that: The steps for obtaining the automatic response operation record are: According to the adjusted firewall policy, the IP addresses that are frequently marked as abnormal are detected, and access restrictions are implemented on the abnormal IP addresses to obtain a preliminary restricted IP list; Based on the IP list of the preliminary restrictions, the access restriction level calculation is performed for each IP address, and the calculation formula is: in, Indicates the optimized access restriction level. The abnormal access frequency of the IP address. is the safety threshold set. is the adjustment factor; Based on the optimized access restriction level, the access permission settings of each IP are updated, the time and effect of implementing the access restriction are recorded, and the automatic response operation record is obtained.

7. The computer network information security analysis method based on big data according to claim 1 is characterized in that: The steps for obtaining the optimized firewall configuration are: Collect the automatic response operation records, identify events with abnormal processing time or abnormal response, and obtain preliminary performance problem results; Based on the preliminary performance problem results, analyze the conditions where the problem frequently occurs, including IP address type, access time period, and protocol type, perform cluster analysis on the conditions, determine the factors that affect firewall performance, and obtain a firewall adjustment plan; According to the firewall adjustment plan, configuration adjustment is performed, including increasing processing capacity and optimizing rule logic, to obtain an optimized firewall configuration.

8. The computer network information security analysis method based on big data according to claim 1 is characterized in that: The steps to evaluate the interception effect and false interception rate of the optimized firewall configuration are: Based on the optimized firewall configuration, collect network traffic data in the past week, the network traffic data includes the timestamp, source IP, destination IP, transmission protocol and interception status of each data packet to form a traffic log data set; Based on the traffic log data set, the heterogeneity index of network traffic is calculated using the formula: in, Represents the heterogeneity index of network traffic, Indicates The proportion of traffic types in the total traffic, Indicates the total number of traffic types, is the base; Based on the heterogeneity index, the interception effect and the error interception rate of the firewall configuration are evaluated, and it is analyzed whether the error interception rate is within an acceptable range.

9. A computer network information security analysis system according to the computer network information security analysis method based on big data according to any one of claims 1 to 8, characterized in that: include: Traffic data capture module, used to extract IP address, port number and protocol type information from network traffic and build firewall rules; The rule verification simulation module applies the rule construction data to the network traffic in the simulation environment, performs a matching test on each firewall rule, calculates the matching success rate, verifies each rule, and generates a rule matching result set; The rule application monitoring module applies the rule matching result set to the network traffic, checks the IP address, port and protocol type information of each data packet, identifies and marks abnormal traffic that does not match the existing rules, records the frequency and type of abnormal traffic, and generates preliminary traffic anomaly results; The rule adjustment and optimization module adjusts the verified firewall rule set in accordance with the preliminary traffic anomaly results, including the modification of the IP address matching range and the port number list, generates the adjusted firewall policy, imposes access restrictions on frequently marked abnormal IP addresses, modifies access rights, records the implementation time and effect of response measures, and generates automatic response operation records; The performance evaluation and reporting module analyzes the automatic response operation records, adjusts the firewall's response speed and processing capacity, and evaluates the interception effect and error interception rate of the adjusted firewall policy based on the traffic statistics in the past week.

Images