Network partition control and terminal security maintenance method and system

Abstract

The invention relates to the field of network security, in particular to a network partition control and terminal security maintenance method and system, and the method comprises the steps: monitoring to obtain data interaction state information of all gateway nodes in a network, thereby determining a data interaction relationship between all gateway nodes and all terminals accessed in the network, and dividing to obtain a plurality of network sub-regions; performing global sampling based on link characteristics of active data transmission channels in the network sub-regions to obtain a full-path data sample set; based on the attack data flow attribute information in the active data transmission channel, determining attack generation information of the terminal so as to identify an operation thread needing to be managed and controlled in the terminal, and checking and identifying the terminal on a thread level; based on an operation association object of an abnormal operation data flow in an operation thread needing to be controlled in the terminal, safety prevention and control operation is performed on the terminal, attack identification and interception are performed on the terminal, and synchronous safety maintenance of the network and the terminal is realized.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a network partition management and control and terminal security maintenance method and system. Background Art

[0002] The network acts as a data exchange transmission medium between different terminals. The distribution of gateways within the network and other structural conditions will affect the efficiency of data exchange transmission between different terminals and the security of each terminal. If a terminal connected to the network is hijacked and becomes an attack source, the attack source will launch attacks on other terminals connected to it through the network. At the same time, the gateways within the network will also become new attack sources, thereby endangering the security of the entire network. Modern networks are large in scale and complex in structure. If all gateways within the network are checked one by one, it will not be possible to timely and efficiently check the security risks within the network. Instead, it will increase the number of terminals connected to the network that are attacked, reducing the overall security and management efficiency of the network. Existing security inspection methods such as attack identification on the network have problems such as large workload and low efficiency. They cannot accurately identify and intercept attacks on the entire network and the terminals connected to it, and cannot simultaneously provide security protection for the network and terminals. Summary of the invention

[0003] In view of the defects of the prior art, the present invention provides a network partition control and terminal security maintenance method and system, which monitors and obtains the data interaction status information of all gateway nodes in the network, thereby determining the data interaction relationship between all gateway nodes and all terminals connected to the network, thereby dividing the network into several sub-areas, performing network partitioning based on the data interaction behavior between the gateway nodes and the terminals, and accurately associating the terminals with the network partitions; based on the link characteristics of the active data transmission channels in the network sub-areas, global sampling is performed to obtain a full-path data sample set, and the transit data of all gateway nodes in the active data transmission channels is comprehensively extracted; based on the attack data flow attribute information in the active data transmission channel, the attack occurrence information of the terminal is determined, thereby identifying the operating threads that need to be controlled in the terminal, and checking and identifying the terminals at the thread level; based on the operation-related objects of the abnormal operation data flow in the operation thread that needs to be controlled in the terminal, security prevention and control operations are performed on the terminal, and attacks are identified and intercepted on the terminal, so as to achieve synchronous security maintenance of the network and the terminal.

[0004] The present invention provides a network partition management and control and terminal security maintenance method, comprising the following steps: Step S1, monitoring all gateway nodes in the network to obtain data interaction status information of all gateway nodes; based on the data interaction status information, determining the data interaction relationship between all gateway nodes and all terminals accessed in the network; based on the data interaction relationship, dividing the network into a plurality of network sub-areas; Step S2, based on the access locations of all terminals in the network sub-area, identifying the active data transmission channels in the network sub-area; based on the link characteristics of the active data transmission channels, performing global sampling on the active data transmission channels to obtain a full-path data sample set of the active data transmission channels; Step S3, performing time evolution analysis on the full path data sample set to obtain the attack data flow attribute information in the active data transmission channel; based on the attack data flow attribute information, determining the attack occurrence information of the terminal corresponding to the active data transmission channel; based on the attack occurrence information, identifying the operation thread that needs to be controlled in the terminal; Step S4, analyzing the operation data of the operation thread that needs to be controlled, determining the abnormal operation data flow in the operation thread that needs to be controlled; and performing security control operations on the terminal based on the operation-related objects of the abnormal operation data flow in the terminal.

[0005] In one embodiment disclosed in the present application, in the step S1, all gateway nodes in the network are monitored to obtain data interaction status information of all gateway nodes; based on the data interaction status information, the data interaction relationship between all gateway nodes and all terminals accessed in the network is determined; based on the data interaction relationship, the network is divided into a number of network sub-areas, including: Based on the network distances between all gateway nodes in the network, the distribution density information of all gateway nodes in the network is obtained; based on the distribution density information, all gateway nodes are divided into a number of gateway node groups; based on the number of gateway nodes included in each gateway node group, all gateway nodes included in each gateway node group are monitored in turn and cycle to obtain the transmission target address change information of the uplink data / downlink data of all gateway nodes, which is used as the data interaction state information; Based on the transmission target address change information of the uplink data / downlink data, the data interaction frequency between each gateway node and all terminals connected to the network is determined, so as to determine the data interaction occurrence probability information between all gateway nodes and all terminals connected to the network, and use this as the data interaction relationship; based on the data interaction occurrence probability information, the network is divided into several network sub-areas; wherein all gateway nodes in each network sub-area can interact with the same terminal for data.

[0006] In one embodiment disclosed in the present application, in step S2, based on the access locations of all terminals in the network sub-area, active data transmission channels in the network sub-area are identified; based on the link characteristics of the active data transmission channels, the active data transmission channels are globally sampled to obtain a full path data sample set of the active data transmission channels, including: Based on the respective access gateway location addresses of all the terminals in the network sub-area, all channels through which all the terminals in all the network sub-areas can perform data transmission are determined; based on the respective data transmission rate change information of all the channels, active data transmission channels in the network sub-area are identified from all the channels; Based on the data transfer traffic of all gateway nodes under the active data transmission channel, all gateway nodes under the active data transmission channel are differentiated and sampled to obtain the transfer data samples of all gateway nodes under the active data transmission channel; based on the data transmission order of all gateway nodes under the active data transmission channel, the transfer data samples of all gateway nodes are sorted and integrated to obtain the full path data sample set of the active data transmission channel.

[0007] In one embodiment disclosed in the present application, in the step S3, the full path data sample set is subjected to a time evolution analysis to obtain the attack data flow attribute information in the active data transmission channel; based on the attack data flow attribute information, the attack occurrence information of the terminal corresponding to the active data transmission channel is determined; based on the attack occurrence information, the operation thread that needs to be controlled in the terminal is identified, including: Performing time evolution analysis on the transfer data samples of all gateway nodes under the active data transmission channel contained in the full path data sample set, obtaining the attack data flow change information during the data transfer process of each gateway node under the active data transmission channel, and using this as the attack data flow attribute information in the active data transmission channel; Based on the attack data flow change information, determine the occurrence time information and the occurrence thread position information when the terminal corresponding to the active data transmission channel is in the attack data volume receiving limit state; based on the occurrence time information and the occurrence thread position information, identify the operation thread that needs to be controlled in the terminal.

[0008] In one embodiment disclosed in the present application, in the step S4, the operation data of the operation thread that needs to be controlled is analyzed to determine the abnormal operation data flow in the operation thread that needs to be controlled; based on the operation-related object of the abnormal operation data flow in the terminal, the security control operation is performed on the terminal, including: Performing an operation data component analysis on the operation thread that needs to be controlled to determine the operation data code attribute information in the operation thread that needs to be controlled; and determining the abnormal operation data flow in the operation thread that needs to be controlled based on the operation data code attribute information; Based on the work tasks associated with the abnormal operation data flow in the terminal, all the applications associated with the running process of the abnormal operation data flow in the terminal are determined, so as to perform attack and intrusion isolation or abnormal operation data flow shielding on all the associated applications.

[0009] The present invention also provides a network partition management and control and terminal security maintenance system, including: The gateway node monitoring module is used to monitor all gateway nodes in the network and obtain the data interaction status information of all gateway nodes; A network partitioning module, configured to determine the data interaction relationship between all gateway nodes and all terminals accessed within the network based on the data interaction state information; and to divide the network into a plurality of network sub-areas based on the data interaction relationship; A data transmission channel identification module, configured to identify active data transmission channels in the network sub-area based on access locations of all terminals in the network sub-area; A data sampling processing module, configured to perform global sampling on the active data transmission channel based on the link characteristics of the active data transmission channel to obtain a full-path data sample set of the active data transmission channel; A data sample analysis module, used to perform time evolution analysis on the full path data sample set to obtain the attack data flow attribute information in the active data transmission channel; An operation thread identification module, used to determine the attack occurrence information of the terminal corresponding to the active data transmission channel based on the attack data flow attribute information; based on the attack occurrence information, identify the operation thread that needs to be controlled in the terminal; An abnormal operation data flow determination module is used to analyze the operation data of the operation thread that needs to be controlled, and determine the abnormal operation data flow in the operation thread that needs to be controlled; The security control operation module is used to perform security control operations on the terminal based on the operation-related objects of the abnormal operation data flow in the terminal.

[0010] In one embodiment disclosed in the present application, the gateway node monitoring module is used to monitor all gateway nodes in the network to obtain data interaction status information of all gateway nodes, including: Based on the network distances between all gateway nodes in the network, the distribution density information of all gateway nodes in the network is obtained; based on the distribution density information, all gateway nodes are divided into a number of gateway node groups; based on the number of gateway nodes included in each gateway node group, all gateway nodes included in each gateway node group are monitored in turn and cycle to obtain the transmission target address change information of the uplink data / downlink data of all gateway nodes, which is used as the data interaction state information; The network partitioning module is used to determine the data interaction relationship between all gateway nodes and all terminals accessed in the network based on the data interaction state information; based on the data interaction relationship, the network is divided into a plurality of network sub-areas, including: Based on the transmission target address change information of the uplink data / downlink data, the data interaction frequency between each gateway node and all terminals connected to the network is determined, so as to determine the data interaction occurrence probability information between all gateway nodes and all terminals connected to the network, and use this as the data interaction relationship; based on the data interaction occurrence probability information, the network is divided into several network sub-areas; wherein all gateway nodes in each network sub-area can interact with the same terminal for data.

[0011] In one embodiment disclosed in the present application, the data transmission channel identification module is used to identify the active data transmission channel in the network sub-area based on the access locations of all terminals in the network sub-area, including: Based on the respective access gateway location addresses of all the terminals in the network sub-area, all channels through which all the terminals in all the network sub-areas can perform data transmission are determined; based on the respective data transmission rate change information of all the channels, active data transmission channels in the network sub-area are identified from all the channels; The data sampling processing module is used to perform global sampling on the active data transmission channel based on the link characteristics of the active data transmission channel to obtain a full path data sample set of the active data transmission channel, including: Based on the data transfer traffic of all gateway nodes under the active data transmission channel, all gateway nodes under the active data transmission channel are differentiated and sampled to obtain the transfer data samples of all gateway nodes under the active data transmission channel; based on the data transmission order of all gateway nodes under the active data transmission channel, the transfer data samples of all gateway nodes are sorted and integrated to obtain the full path data sample set of the active data transmission channel.

[0012] In one embodiment disclosed in the present application, the data sample analysis module is used to perform time evolution analysis on the full path data sample set to obtain the attack data flow attribute information in the active data transmission channel, including: Performing time evolution analysis on the transfer data samples of all gateway nodes under the active data transmission channel contained in the full path data sample set, obtaining the attack data flow change information during the data transfer process of each gateway node under the active data transmission channel, and using this as the attack data flow attribute information in the active data transmission channel; The operation thread identification module is used to determine the attack occurrence information of the terminal corresponding to the active data transmission channel based on the attack data flow attribute information; based on the attack occurrence information, identify the operation thread that needs to be controlled in the terminal, including: Based on the attack data flow change information, determine the occurrence time information and the occurrence thread position information when the terminal corresponding to the active data transmission channel is in the attack data volume receiving limit state; based on the occurrence time information and the occurrence thread position information, identify the operation thread that needs to be controlled in the terminal.

[0013] In one embodiment disclosed in the present application, the abnormal operation data flow determination module is used to perform operation data analysis on the operation thread that needs to be controlled, and determine the abnormal operation data flow in the operation thread that needs to be controlled, including: Performing an operation data component analysis on the operation thread that needs to be controlled to determine the operation data code attribute information in the operation thread that needs to be controlled; and determining the abnormal operation data flow in the operation thread that needs to be controlled based on the operation data code attribute information; The security control operation module is used to perform security control operations on the terminal based on the operation-related object of the abnormal operation data flow in the terminal, including: Based on the work tasks associated with the abnormal operation data flow in the terminal, all the applications associated with the running process of the abnormal operation data flow in the terminal are determined, so as to perform attack and intrusion isolation or abnormal operation data flow shielding on all the associated applications.

[0014] Compared with the prior art, the network partition control and terminal security maintenance method and system monitors the data interaction status information of all gateway nodes in the network, thereby determining the data interaction relationship between all gateway nodes and all terminals connected to the network, thereby dividing the network into several sub-areas, performing network partitioning based on the data interaction behavior between the gateway nodes and the terminals, and accurately associating the terminals with the network partitions; based on the link characteristics of the active data transmission channels in the network sub-areas, global sampling is performed to obtain a full-path data sample set, and the transit data of all gateway nodes in the active data transmission channels is comprehensively extracted; based on the attack data flow attribute information in the active data transmission channel, the attack occurrence information of the terminal is determined, thereby identifying the operating threads that need to be controlled in the terminal, and checking and identifying the terminals at the thread level; based on the operation-related objects of the abnormal operation data flow in the operation thread that needs to be controlled in the terminal, security prevention and control operations are performed on the terminal, and attacks are identified and intercepted on the terminal, so as to achieve synchronous security maintenance of the network and the terminal.

[0015] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings.

[0016] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 A schematic diagram of the flow of the network partition management and terminal security maintenance method provided by the present invention.

[0019] Figure 2 A schematic diagram of the framework of the network partition management and control and terminal security maintenance system provided by the present invention. DETAILED DESCRIPTION

[0020] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] See also Figure 1 , is a flow chart of a network partition control and terminal security maintenance method provided by an embodiment of the present invention. The network partition control and terminal security maintenance method includes: Step S1, monitoring all gateway nodes in the network to obtain data interaction status information of all gateway nodes; based on the data interaction status information, determining the data interaction relationship between all gateway nodes and all terminals accessed in the network; based on the data interaction relationship, dividing the network into a plurality of network sub-areas; Step S2, based on the access locations of all terminals in the network sub-area, identifying the active data transmission channels in the network sub-area; based on the link characteristics of the active data transmission channels, performing global sampling on the active data transmission channels to obtain a full-path data sample set of the active data transmission channels; Step S3, performing a time evolution analysis on the full path data sample set to obtain the attack data flow attribute information in the active data transmission channel; based on the attack data flow attribute information, determining the attack occurrence information of the terminal corresponding to the active data transmission channel; based on the attack occurrence information, identifying the operation thread that needs to be controlled in the terminal; Step S4, analyzing the operation data of the operation thread that needs to be controlled, determining the abnormal operation data flow in the operation thread that needs to be controlled; and performing security control operations on the terminal based on the operation-related objects of the abnormal operation data flow in the terminal.

[0022] The beneficial effects of the above technical solution are as follows: the network partition control and terminal security maintenance method monitors and obtains the data interaction status information of all gateway nodes in the network, thereby determining the data interaction relationship between all gateway nodes and all terminals connected to the network, thereby dividing the network into several sub-areas, performing network partitioning based on the data interaction behavior between the gateway nodes and the terminals, and accurately associating the terminals with the network partitions; based on the link characteristics of the active data transmission channels in the network sub-areas, global sampling is performed to obtain a full-path data sample set, and the transit data of all gateway nodes in the active data transmission channels is comprehensively extracted; based on the attack data flow attribute information in the active data transmission channel, the attack occurrence information of the terminal is determined, thereby identifying the operating threads that need to be controlled in the terminal, and checking and identifying the terminals at the thread level; based on the operation-related objects of the abnormal operation data flow in the operation thread that needs to be controlled in the terminal, security prevention and control operations are performed on the terminal, and attacks are identified and intercepted on the terminal, so as to achieve synchronous security maintenance of the network and the terminal.

[0023] Preferably, in step S1, all gateway nodes in the network are monitored to obtain data interaction status information of all gateway nodes; based on the data interaction status information, the data interaction relationship between all gateway nodes and all terminals accessed in the network is determined; based on the data interaction relationship, the network is divided into several network sub-areas, including: Based on the network distances between all gateway nodes in the network, the distribution density information of all gateway nodes in the network is obtained; based on the distribution density information, all gateway nodes are divided into several gateway node groups; based on the number of gateway nodes included in each gateway node group, all gateway nodes included in each gateway node group are monitored in turn and cycle to obtain the transmission target address change information of the uplink data / downlink data of all gateway nodes, which is used as the data interaction status information; Based on the transmission target address change information of the uplink data / downlink data, the data interaction frequency between each gateway node and all terminals connected to the network is determined, so as to determine the probability information of data interaction between all gateway nodes and all terminals connected to the network, and use this as the data interaction relationship; based on the data interaction probability information, the network is divided into several network sub-areas; wherein all gateway nodes in each network sub-area can interact with the same terminal for data.

[0024] The beneficial effects of the above technical solution are as follows: the network contains a large number of gateway nodes, and each gateway node, as a data transfer node, can transfer data to other gateway nodes according to the data transmission target address, so as to realize data transmission along the corresponding path within the network. The distribution of gateway nodes within the network is not uniform, that is, the network distance between any two adjacent gateway nodes is not the same, so that the distribution density of gateway nodes in a certain area within the network is not the same. In order to monitor all gateway nodes within the network equally, based on the network distance between all gateway nodes in the network, the distribution density information of all gateway nodes in the network is obtained, that is, the number of gateway nodes within the unit data transmission distance in the network. Based on the distribution density information, all gateway nodes are divided into several gateway node groups, so that the number of gateway nodes contained in each gateway node group is basically the same, and then based on the number of gateway nodes contained in each gateway node group, all gateway nodes contained in each gateway node group are monitored in turn, that is, all gateway nodes contained in each gateway node group are periodically monitored for an equal period of time, and the transmission target address change information of the uplink data / downlink data of each gateway node under each gateway node group is obtained, that is, the change information of the transmission target address of the uplink data of each gateway node in different time periods during the data relay transmission process and the change information of the transmission target address of the downlink data of each gateway node in different time periods, so as to quantitatively represent the data interaction between each gateway node and different terminals during the data relay transmission process. In addition, based on the transmission target address change information of uplink data / downlink data, the frequency of data interaction between each gateway node and all terminals connected to the network is determined; wherein the data interaction frequency may be, but is not limited to, the number of occurrences of data interaction between each gateway node and each terminal connected to the network within a unit time length, and then the data interaction frequency is converted and processed to obtain the probability information of data interaction between all gateway nodes and all terminals connected to the network, thereby quantitatively representing the frequency of data interaction between different gateway nodes and different terminals, and providing a reliable basis for zoning the network. Based on the probability information of data interaction, the network is divided into several network sub-areas, so that all gateway nodes in each network sub-area can interact with the same terminal, which is convenient for the subsequent centralized data sampling of all gateway nodes that interact with the same terminal, and provides a global data basis for identifying the security of network sub-areas.

[0025] Preferably, in step S2, based on the access locations of all terminals in the network sub-area, an active data transmission channel in the network sub-area is identified; based on the link characteristics of the active data transmission channel, the active data transmission channel is globally sampled to obtain a full path data sample set of the active data transmission channel, including: Based on the respective access gateway location addresses of all terminals in the network sub-area, all channels through which all terminals in all network sub-areas can perform data transmission are determined; based on the respective data transmission rate change information of all channels, active data transmission channels in the network sub-area are identified from all channels; Based on the data transfer traffic of all gateway nodes under the active data transmission channel, differentiated sampling is performed on all gateway nodes under the active data transmission channel to obtain respective transfer data samples of all gateway nodes under the active data transmission channel; based on the data transmission order of all gateway nodes under the active data transmission channel, the respective transfer data samples of all gateway nodes are sorted and integrated to obtain the full path data sample set of the active data transmission channel.

[0026] The beneficial effect of the above technical solution is that all terminals in the network sub-area basically exchange data with each other through the gateway nodes in the network sub-area, that is, the gateway nodes in the network sub-area mainly constitute the data transmission channels of the corresponding terminals, but not all data transmission channels are often used for actual data transmission of the terminals, that is, some data transmission channels are idle for a long time, and only some data transmission channels are active. In order to narrow the scope of data transmission channel inspection and sampling in the network sub-area, based on the access gateway location address of all terminals in the network sub-area, all channels that all terminals in all network sub-areas can perform data transmission are determined, and based on the data transmission rate change information of all channels, it is determined whether the average data transmission rate of each channel exceeds the preset transmission rate threshold. If so, the channel is determined as an active data transmission channel; if not, the channel is not determined as an active data transmission channel, thereby limiting the scope of data sampling in the network sub-area to active data transmission channels, reducing the workload of data sampling. In addition, based on the data transfer flow of all gateway nodes under the active data transmission channel, all gateway nodes under the active data transmission channel are sampled separately to obtain the transfer data samples of all gateway nodes under the active data transmission channel. The larger the data transfer flow of the gateway node under the active data transmission channel, the larger the data sampling amount of the gateway node, so as to ensure that all gateway nodes can obtain comprehensive and accurate data sampling processing. Then, based on the data transmission sequence of all network nodes under the active data transmission channel, the transfer data samples of all gateway nodes are sorted and integrated to obtain the full path data sample set of the active data transmission channel, so that the full path data sample set accurately reflects the data transfer situation of all gateway nodes.

[0027] Preferably, in step S3, the full path data sample set is subjected to time evolution analysis to obtain the attack data flow attribute information in the active data transmission channel; based on the attack data flow attribute information, the attack occurrence information of the terminal corresponding to the active data transmission channel is determined; based on the attack occurrence information, the operation thread that needs to be controlled in the terminal is identified, including: Perform time evolution analysis on the transfer data samples of all gateway nodes under the active data transmission channel contained in the full path data sample set to obtain the attack data flow change information during the data transfer process of each gateway node under the active data transmission channel, and use this as the attack data flow attribute information in the active data transmission channel; Based on the attack data flow change information, determine the occurrence time information and the occurrence thread position information when the terminal corresponding to the active data transmission channel is in the attack data volume receiving limit state; based on the occurrence time information and the occurrence thread position information, identify the operation thread that needs to be controlled in the terminal.

[0028] The beneficial effects of the above technical solution are: the time evolution analysis of the transfer data samples of all gateway nodes under the active data transmission channel contained in the full path data sample set is performed to obtain the attack data flow change information during the data transfer process of each gateway node under the active data transmission channel, that is, the change information of the attack data flow size over time during the data transfer process of each gateway node. In addition, based on the attack data flow change information, the occurrence time information and the occurrence thread location information of the terminal corresponding to the active data transmission channel in the attack data volume receiving limit state are determined, so as to identify the operation threads that need to be controlled in the terminal, so as to accurately locate the operation threads in the terminal that have abnormal conditions due to network security issues.

[0029] Preferably, in step S4, the operation data of the operation thread that needs to be controlled is analyzed to determine the abnormal operation data flow in the operation thread that needs to be controlled; based on the operation-related object of the abnormal operation data flow in the terminal, a security control operation is performed on the terminal, including: Performing an operation data component analysis on the operation thread that needs to be controlled to determine the operation data code attribute information in the operation thread that needs to be controlled; and determining the abnormal operation data flow in the operation thread that needs to be controlled based on the operation data code attribute information; Based on the work tasks associated with the abnormal operation data flow in the terminal, all the applications associated with the running process of the abnormal operation data flow in the terminal are determined, so as to perform attack and intrusion isolation or abnormal operation data flow shielding on all the associated applications.

[0030] The beneficial effects of the above technical solution are: performing an operation data component analysis on the operation thread that needs to be controlled, determining the operation data code attribute information within the operation thread that needs to be controlled, wherein the operation data code attribute information may include the type information of the operation data code and the proportion of garbled data, and based on the operation data code attribute information, determining the abnormal operation data flow within the operation thread that needs to be controlled, for example, when the operation data code belongs to a preset type of data code or the proportion of garbled data exceeds a preset proportion threshold, the corresponding operation data flow is determined as the abnormal operation data flow within the operation thread that needs to be controlled. In addition, based on the work tasks associated with the abnormal operation data flow in the terminal, all applications associated with the abnormal operation data flow running in the terminal are determined, so as to isolate all associated applications from attacks and intrusions or shield abnormal operation data flows, perform security prevention and control operations on the terminal, identify and intercept attacks on the terminal, and achieve synchronous security maintenance of the network and the terminal, so as to avoid security problems caused by the mutual influence between the network and the terminals connected thereto.

[0031] See also Figure 2 , is a schematic diagram of the framework of the network partition management and terminal security maintenance system provided by an embodiment of the present invention. The network partition management and terminal security maintenance system includes: The gateway node monitoring module is used to monitor all gateway nodes in the network and obtain the data interaction status information of all gateway nodes; A network partitioning module is used to determine the data interaction relationship between all gateway nodes and all terminals accessed in the network based on the data interaction state information; based on the data interaction relationship, the network is divided into a plurality of network sub-areas; A data transmission channel identification module, used to identify active data transmission channels in the network sub-area based on access locations of all terminals in the network sub-area; A data sampling processing module, used to perform global sampling on the active data transmission channel based on the link characteristics of the active data transmission channel to obtain a full-path data sample set of the active data transmission channel; A data sample analysis module is used to perform a time evolution analysis on the full path data sample set to obtain the attack data flow attribute information in the active data transmission channel; An operation thread identification module is used to determine the attack occurrence information of the terminal corresponding to the active data transmission channel based on the attack data flow attribute information; based on the attack occurrence information, identify the operation thread that needs to be controlled in the terminal; An abnormal operation data flow determination module is used to analyze the operation data of the operation thread that needs to be controlled, and determine the abnormal operation data flow in the operation thread that needs to be controlled; The security control operation module is used to perform security control operations on the terminal based on the operation-related objects of the abnormal operation data flow in the terminal.

[0032] The beneficial effects of the above technical solution are as follows: the network partition control and terminal security maintenance system monitors and obtains the data interaction status information of all gateway nodes in the network, thereby determining the data interaction relationship between all gateway nodes and all terminals connected to the network, thereby dividing the network into several sub-areas, performing network partitioning based on the data interaction behavior between the gateway nodes and the terminals, and accurately associating the terminals with the network partitions; based on the link characteristics of the active data transmission channels in the network sub-areas, global sampling is performed to obtain a full-path data sample set, and the transit data of all gateway nodes in the active data transmission channels is comprehensively extracted; based on the attack data flow attribute information in the active data transmission channel, the attack occurrence information of the terminal is determined, thereby identifying the operating threads that need to be controlled in the terminal, and checking and identifying the terminals at the thread level; based on the operation-related objects of the abnormal operation data flow in the operation thread that needs to be controlled in the terminal, security prevention and control operations are performed on the terminal, and attacks are identified and intercepted on the terminal, so as to achieve synchronous security maintenance of the network and the terminal.

[0033] Preferably, the gateway node monitoring module is used to monitor all gateway nodes in the network to obtain data interaction status information of all gateway nodes, including: Based on the network distances between all gateway nodes in the network, the distribution density information of all gateway nodes in the network is obtained; based on the distribution density information, all gateway nodes are divided into several gateway node groups; based on the number of gateway nodes included in each gateway node group, all gateway nodes included in each gateway node group are monitored in turn and cycle to obtain the transmission target address change information of the uplink data / downlink data of all gateway nodes, which is used as the data interaction status information; The network partitioning module is used to determine the data interaction relationship between all gateway nodes and all terminals accessed in the network based on the data interaction state information; based on the data interaction relationship, the network is divided into a plurality of network sub-areas, including: Based on the transmission target address change information of the uplink data / downlink data, the data interaction frequency between each gateway node and all terminals connected to the network is determined, so as to determine the probability information of data interaction between all gateway nodes and all terminals connected to the network, and use this as the data interaction relationship; based on the data interaction probability information, the network is divided into several network sub-areas; wherein all gateway nodes in each network sub-area can interact with the same terminal for data.

[0034] The beneficial effects of the above technical solution are as follows: the network contains a large number of gateway nodes, and each gateway node, as a data transfer node, can transfer data to other gateway nodes according to the data transmission target address, so as to realize data transmission along the corresponding path within the network. The distribution of gateway nodes within the network is not uniform, that is, the network distance between any two adjacent gateway nodes is not the same, so that the distribution density of gateway nodes in a certain area within the network is not the same. In order to monitor all gateway nodes within the network equally, based on the network distance between all gateway nodes in the network, the distribution density information of all gateway nodes in the network is obtained, that is, the number of gateway nodes within the unit data transmission distance in the network. Based on the distribution density information, all gateway nodes are divided into several gateway node groups, so that the number of gateway nodes contained in each gateway node group is basically the same, and then based on the number of gateway nodes contained in each gateway node group, all gateway nodes contained in each gateway node group are monitored in turn, that is, all gateway nodes contained in each gateway node group are periodically monitored for an equal period of time, and the transmission target address change information of the uplink data / downlink data of each gateway node under each gateway node group is obtained, that is, the change information of the transmission target address of the uplink data of each gateway node in different time periods during the data relay transmission process and the change information of the transmission target address of the downlink data of each gateway node in different time periods, so as to quantitatively represent the data interaction between each gateway node and different terminals during the data relay transmission process. In addition, based on the transmission target address change information of uplink data / downlink data, the frequency of data interaction between each gateway node and all terminals connected to the network is determined; wherein the data interaction frequency may be, but is not limited to, the number of occurrences of data interaction between each gateway node and each terminal connected to the network within a unit time length, and then the data interaction frequency is converted and processed to obtain the probability information of data interaction between all gateway nodes and all terminals connected to the network, thereby quantitatively representing the frequency of data interaction between different gateway nodes and different terminals, and providing a reliable basis for zoning the network. Based on the probability information of data interaction, the network is divided into several network sub-areas, so that all gateway nodes in each network sub-area can interact with the same terminal, which is convenient for the subsequent centralized data sampling of all gateway nodes that interact with the same terminal, and provides a global data basis for identifying the security of network sub-areas.

[0035] Preferably, the data transmission channel identification module is used to identify active data transmission channels in the network sub-area based on access locations of all terminals in the network sub-area, including: Based on the respective access gateway location addresses of all terminals in the network sub-area, all channels through which all terminals in all network sub-areas can perform data transmission are determined; based on the respective data transmission rate change information of all channels, active data transmission channels in the network sub-area are identified from all channels; The data sampling processing module is used to perform global sampling on the active data transmission channel based on the link characteristics of the active data transmission channel to obtain a full path data sample set of the active data transmission channel, including: Based on the data transfer traffic of all gateway nodes under the active data transmission channel, differentiated sampling is performed on all gateway nodes under the active data transmission channel to obtain respective transfer data samples of all gateway nodes under the active data transmission channel; based on the data transmission order of all gateway nodes under the active data transmission channel, the respective transfer data samples of all gateway nodes are sorted and integrated to obtain the full path data sample set of the active data transmission channel.

[0036] The beneficial effect of the above technical solution is that all terminals in the network sub-area basically exchange data with each other through the gateway nodes in the network sub-area, that is, the gateway nodes in the network sub-area mainly constitute the data transmission channels of the corresponding terminals, but not all data transmission channels are often used for actual data transmission of the terminals, that is, some data transmission channels are idle for a long time, and only some data transmission channels are active. In order to narrow the scope of data transmission channel inspection and sampling in the network sub-area, based on the access gateway location address of all terminals in the network sub-area, all channels that all terminals in all network sub-areas can perform data transmission are determined, and based on the data transmission rate change information of all channels, it is determined whether the average data transmission rate of each channel exceeds the preset transmission rate threshold. If so, the channel is determined as an active data transmission channel; if not, the channel is not determined as an active data transmission channel, thereby limiting the scope of data sampling in the network sub-area to active data transmission channels, reducing the workload of data sampling. In addition, based on the data transfer flow of all gateway nodes under the active data transmission channel, all gateway nodes under the active data transmission channel are sampled separately to obtain the transfer data samples of all gateway nodes under the active data transmission channel. The larger the data transfer flow of the gateway node under the active data transmission channel, the larger the data sampling amount of the gateway node, so as to ensure that all gateway nodes can obtain comprehensive and accurate data sampling processing. Then, based on the data transmission sequence of all network nodes under the active data transmission channel, the transfer data samples of all gateway nodes are sorted and integrated to obtain the full path data sample set of the active data transmission channel, so that the full path data sample set accurately reflects the data transfer situation of all gateway nodes.

[0037] Preferably, the data sample analysis module is used to perform time evolution analysis on the full path data sample set to obtain the attack data flow attribute information in the active data transmission channel, including: Perform time evolution analysis on the transfer data samples of all gateway nodes under the active data transmission channel contained in the full path data sample set to obtain the attack data flow change information during the data transfer process of each gateway node under the active data transmission channel, and use this as the attack data flow attribute information in the active data transmission channel; The operation thread identification module is used to determine the attack occurrence information of the terminal corresponding to the active data transmission channel based on the attack data flow attribute information; based on the attack occurrence information, identify the operation thread that needs to be controlled in the terminal, including: Based on the attack data flow change information, determine the occurrence time information and the occurrence thread position information when the terminal corresponding to the active data transmission channel is in the attack data volume receiving limit state; based on the occurrence time information and the occurrence thread position information, identify the operation thread that needs to be controlled in the terminal.

[0038] The beneficial effects of the above technical solution are: the time evolution analysis of the transfer data samples of all gateway nodes under the active data transmission channel contained in the full path data sample set is performed to obtain the attack data flow change information during the data transfer process of each gateway node under the active data transmission channel, that is, the change information of the attack data flow size over time during the data transfer process of each gateway node. In addition, based on the attack data flow change information, the occurrence time information and the occurrence thread location information of the terminal corresponding to the active data transmission channel in the attack data volume receiving limit state are determined, so as to identify the operation threads that need to be controlled in the terminal, so as to accurately locate the operation threads in the terminal that have abnormal conditions due to network security issues.

[0039] Preferably, the abnormal operation data flow determination module is used to perform operation data analysis on the operation thread that needs to be controlled, and determine the abnormal operation data flow in the operation thread that needs to be controlled, including: Performing an operation data component analysis on the operation thread that needs to be controlled to determine the operation data code attribute information in the operation thread that needs to be controlled; and determining the abnormal operation data flow in the operation thread that needs to be controlled based on the operation data code attribute information; The security control operation module is used to perform security control operations on the terminal based on the operation-related object of the abnormal operation data flow in the terminal, including: Based on the work tasks associated with the abnormal operation data flow in the terminal, all the applications associated with the running process of the abnormal operation data flow in the terminal are determined, so as to perform attack and intrusion isolation or abnormal operation data flow shielding on all the associated applications.

[0040] The beneficial effects of the above technical solution are: performing an operation data component analysis on the operation thread that needs to be controlled, determining the operation data code attribute information within the operation thread that needs to be controlled, wherein the operation data code attribute information may include the type information of the operation data code and the proportion of garbled data, and based on the operation data code attribute information, determining the abnormal operation data flow within the operation thread that needs to be controlled, for example, when the operation data code belongs to a preset type of data code or the proportion of garbled data exceeds a preset proportion threshold, the corresponding operation data flow is determined as the abnormal operation data flow within the operation thread that needs to be controlled. In addition, based on the work tasks associated with the abnormal operation data flow in the terminal, all applications associated with the abnormal operation data flow running in the terminal are determined, so as to isolate all associated applications from attacks and intrusions or shield abnormal operation data flows, perform security prevention and control operations on the terminal, identify and intercept attacks on the terminal, and achieve synchronous security maintenance of the network and the terminal, so as to avoid security problems caused by the mutual influence between the network and the terminals connected thereto.

[0041] It can be seen from the contents of the above embodiments that the network partition control and terminal security maintenance method and system monitor and obtain the data interaction status information of all gateway nodes in the network, so as to determine the data interaction relationship between all gateway nodes and all terminals connected to the network, thereby dividing the network into several sub-areas, performing network partitioning based on the data interaction behavior between the gateway nodes and the terminals, and accurately associating the terminals with the network partitions; based on the link characteristics of the active data transmission channels in the network sub-areas, global sampling is performed to obtain a full-path data sample set, and the transit data of all gateway nodes in the active data transmission channels is comprehensively extracted; based on the attack data flow attribute information in the active data transmission channel, the attack occurrence information of the terminal is determined, so as to identify the operating threads that need to be controlled in the terminal, and the terminal is checked and identified at the thread level; based on the operation-related objects of the abnormal operation data flow in the operation thread that needs to be controlled in the terminal, security prevention and control operations are performed on the terminal, and attacks are identified and intercepted on the terminal, so as to achieve synchronous security maintenance of the network and the terminal.

[0042] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A network partition control and terminal security maintenance method, characterized in that: It includes the following steps: Step S1, monitoring all gateway nodes in the network to obtain data interaction status information of all gateway nodes; based on the data interaction status information, determining the data interaction relationship between all gateway nodes and all terminals accessed in the network; based on the data interaction relationship, dividing the network into a plurality of network sub-areas; Step S2, identifying active data transmission channels in the network sub-area based on access locations of all terminals in the network sub-area; Based on the link characteristics of the active data transmission channel, globally sampling the active data transmission channel to obtain a full path data sample set of the active data transmission channel; Step S3, performing time evolution analysis on the full path data sample set to obtain the attack data flow attribute information in the active data transmission channel; Based on the attack data flow attribute information, determining the attack occurrence information of the terminal corresponding to the active data transmission channel; Based on the attack occurrence information, identifying an operation thread in the terminal that needs to be controlled; Step S4, analyzing the operation data of the operation thread that needs to be controlled, and determining the abnormal operation data flow in the operation thread that needs to be controlled; Based on the operation-related object of the abnormal operation data flow in the terminal, a security prevention and control operation is performed on the terminal.

2. The network partition control and terminal security maintenance method according to claim 1, characterized in that: In the step S1, all gateway nodes in the network are monitored to obtain data interaction status information of all gateway nodes; based on the data interaction status information, the data interaction relationship between all gateway nodes and all terminals accessed in the network is determined; Based on the data interaction relationship, the network is divided into several network sub-areas, including: Based on the network distances between all gateway nodes in the network, the distribution density information of all gateway nodes in the network is obtained; based on the distribution density information, all gateway nodes are divided into a number of gateway node groups; based on the number of gateway nodes included in each gateway node group, all gateway nodes included in each gateway node group are monitored in turn and cycle to obtain the transmission target address change information of the uplink data / downlink data of all gateway nodes, which is used as the data interaction state information; Based on the transmission target address change information of the uplink data / downlink data, the data interaction frequency between each gateway node and all terminals connected to the network is determined, so as to determine the data interaction occurrence probability information between all gateway nodes and all terminals connected to the network, and use this as the data interaction relationship; based on the data interaction occurrence probability information, the network is divided into several network sub-areas; wherein all gateway nodes in each network sub-area can interact with the same terminal for data.

3. The network partition control and terminal security maintenance method according to claim 1, characterized in that: In the step S2, based on the access locations of all terminals in the network sub-area, an active data transmission channel in the network sub-area is identified; Based on the link characteristics of the active data transmission channel, globally sampling the active data transmission channel to obtain a full path data sample set of the active data transmission channel, including: Based on the respective access gateway location addresses of all the terminals in the network sub-area, all channels through which all the terminals in all the network sub-areas can perform data transmission are determined; based on the respective data transmission rate change information of all the channels, active data transmission channels in the network sub-area are identified from all the channels; Based on the data transfer traffic of all gateway nodes under the active data transmission channel, all gateway nodes under the active data transmission channel are differentiated and sampled to obtain the transfer data samples of all gateway nodes under the active data transmission channel; based on the data transmission order of all gateway nodes under the active data transmission channel, the transfer data samples of all gateway nodes are sorted and integrated to obtain the full path data sample set of the active data transmission channel.

4. The network partition control and terminal security maintenance method according to claim 1, characterized in that: In the step S3, the full path data sample set is subjected to a time evolution analysis to obtain the attack data flow attribute information in the active data transmission channel; based on the attack data flow attribute information, the attack occurrence information of the terminal corresponding to the active data transmission channel is determined; Based on the attack occurrence information, identifying an operation thread in the terminal that needs to be controlled, including: Performing time evolution analysis on the transfer data samples of all gateway nodes under the active data transmission channel contained in the full path data sample set, obtaining the attack data flow change information during the data transfer process of each gateway node under the active data transmission channel, and using this as the attack data flow attribute information in the active data transmission channel; Based on the attack data flow change information, determine the occurrence time information and the occurrence thread position information when the terminal corresponding to the active data transmission channel is in the attack data volume receiving limit state; based on the occurrence time information and the occurrence thread position information, identify the operation thread that needs to be controlled in the terminal.

5. The network partition control and terminal security maintenance method according to claim 1, characterized in that: In the step S4, the operation data of the operation thread that needs to be controlled is analyzed to determine the abnormal operation data flow in the operation thread that needs to be controlled; Based on the operation-related object of the abnormal operation data flow in the terminal, a security prevention and control operation is performed on the terminal, including: Performing an operation data component analysis on the operation thread that needs to be controlled to determine the operation data code attribute information in the operation thread that needs to be controlled; and determining the abnormal operation data flow in the operation thread that needs to be controlled based on the operation data code attribute information; Based on the work tasks associated with the abnormal operation data flow in the terminal, all the applications associated with the running process of the abnormal operation data flow in the terminal are determined, so as to perform attack and intrusion isolation or abnormal operation data flow shielding on all the associated applications.

6. Network partition management and terminal security maintenance system, characterized by: include: The gateway node monitoring module is used to monitor all gateway nodes in the network and obtain the data interaction status information of all gateway nodes; A network partitioning module, configured to determine the data interaction relationship between all gateway nodes and all terminals accessed within the network based on the data interaction state information; and to divide the network into a plurality of network sub-areas based on the data interaction relationship; A data transmission channel identification module, configured to identify active data transmission channels in the network sub-area based on access locations of all terminals in the network sub-area; A data sampling processing module, configured to perform global sampling on the active data transmission channel based on the link characteristics of the active data transmission channel to obtain a full-path data sample set of the active data transmission channel; A data sample analysis module, used to perform time evolution analysis on the full path data sample set to obtain the attack data flow attribute information in the active data transmission channel; An operation thread identification module, used to determine the attack occurrence information of the terminal corresponding to the active data transmission channel based on the attack data flow attribute information; based on the attack occurrence information, identify the operation thread that needs to be controlled in the terminal; An abnormal operation data flow determination module is used to analyze the operation data of the operation thread that needs to be controlled, and determine the abnormal operation data flow in the operation thread that needs to be controlled; The security control operation module is used to perform security control operations on the terminal based on the operation-related objects of the abnormal operation data flow in the terminal.

7. The network partition management and terminal security maintenance system according to claim 6, characterized in that: The gateway node monitoring module is used to monitor all gateway nodes in the network to obtain data interaction status information of all gateway nodes, including: Based on the network distances between all gateway nodes in the network, the distribution density information of all gateway nodes in the network is obtained; based on the distribution density information, all gateway nodes are divided into a number of gateway node groups; based on the number of gateway nodes included in each gateway node group, all gateway nodes included in each gateway node group are monitored in turn and cycle to obtain the transmission target address change information of the uplink data / downlink data of all gateway nodes, which is used as the data interaction state information; The network partitioning module is used to determine the data interaction relationship between all gateway nodes and all terminals accessed in the network based on the data interaction state information; based on the data interaction relationship, the network is divided into a plurality of network sub-areas, including: Based on the transmission target address change information of the uplink data / downlink data, the data interaction frequency between each gateway node and all terminals connected to the network is determined, so as to determine the data interaction occurrence probability information between all gateway nodes and all terminals connected to the network, and use this as the data interaction relationship; based on the data interaction occurrence probability information, the network is divided into several network sub-areas; wherein all gateway nodes in each network sub-area can interact with the same terminal for data.

8. The network partition management and terminal security maintenance system according to claim 6, characterized in that: The data transmission channel identification module is used to identify active data transmission channels in the network sub-area based on access locations of all terminals in the network sub-area, including: Based on the respective access gateway location addresses of all the terminals in the network sub-area, all channels through which all the terminals in all the network sub-areas can perform data transmission are determined; based on the respective data transmission rate change information of all the channels, active data transmission channels in the network sub-area are identified from all the channels; The data sampling processing module is used to perform global sampling on the active data transmission channel based on the link characteristics of the active data transmission channel to obtain a full path data sample set of the active data transmission channel, including: Based on the data transfer traffic of all gateway nodes under the active data transmission channel, all gateway nodes under the active data transmission channel are differentiated and sampled to obtain the transfer data samples of all gateway nodes under the active data transmission channel; based on the data transmission order of all gateway nodes under the active data transmission channel, the transfer data samples of all gateway nodes are sorted and integrated to obtain the full path data sample set of the active data transmission channel.

9. The network partition management and terminal security maintenance system according to claim 6, characterized in that: The data sample analysis module is used to perform time evolution analysis on the full path data sample set to obtain the attack data flow attribute information in the active data transmission channel, including: Performing time evolution analysis on the transfer data samples of all gateway nodes under the active data transmission channel contained in the full path data sample set, obtaining the attack data flow change information during the data transfer process of each gateway node under the active data transmission channel, and using this as the attack data flow attribute information in the active data transmission channel; The operation thread identification module is used to determine the attack occurrence information of the terminal corresponding to the active data transmission channel based on the attack data flow attribute information; based on the attack occurrence information, identify the operation thread that needs to be controlled in the terminal, including: Based on the attack data flow change information, determine the occurrence time information and the occurrence thread position information when the terminal corresponding to the active data transmission channel is in the attack data volume receiving limit state; based on the occurrence time information and the occurrence thread position information, identify the operation thread that needs to be controlled in the terminal.

10. The network partition management and terminal security maintenance system according to claim 6, characterized in that: The abnormal operation data flow determination module is used to analyze the operation data of the operation thread that needs to be controlled, and determine the abnormal operation data flow in the operation thread that needs to be controlled, including: Performing an operation data component analysis on the operation thread that needs to be controlled to determine the operation data code attribute information in the operation thread that needs to be controlled; and determining the abnormal operation data flow in the operation thread that needs to be controlled based on the operation data code attribute information; The security control operation module is used to perform security control operations on the terminal based on the operation-related object of the abnormal operation data flow in the terminal, including: Based on the work tasks associated with the abnormal operation data flow in the terminal, all the applications associated with the running process of the abnormal operation data flow in the terminal are determined, so as to perform attack and intrusion isolation or abnormal operation data flow shielding on all the associated applications.

Images