Computer network supervision system for distributed Internet of Things big data terminal security management

Abstract

The invention discloses a computer network supervision system for distributed Internet of Things big data terminal security management, which belongs to the technical field of network supervision and comprises a network monitoring module, a data processing module, an analysis and prediction module, an intelligent management and control module and a storage and display module. The problem that the computer network security management effect is poor due to the fact that the computer network of the distributed Internet of Things big data terminal cannot be supervised in real time in the prior art is solved. According to the invention, the computer network real-time data is monitored in real time, the computer network feature data is determined, the computer network feature data is analyzed and predicted, the computer network analysis and prediction result is determined, the computer network security management scheme is formulated, and the computer network is subjected to intelligent security management control. The method is convenient for a manager to check and daily manage, can supervise the computer network of the distributed Internet of Things big data terminal in real time, and can improve the security management effect of the computer network.

Description

Technical Field

[0001] The present invention relates to the technical field of network supervision, and in particular to a computer network supervision system for security management of distributed Internet of Things big data terminals. Background Art

[0002] Computer network refers to a computer system that connects multiple computers and their peripheral devices with independent functions in different geographical locations through communication lines and communication equipment, and realizes resource sharing and information transmission under the management and coordination of network operating system, network management software and network communication protocol. Computer network is mainly composed of some general and programmable hardware interconnected. These programmable hardware can be used to transmit many different types of data and support a wide range of and growing applications.

[0003] Among them, network security refers to the protection of the hardware, software and data of the network system, and they will not be destroyed, changed or leaked due to accidental or malicious reasons. The system will run continuously, reliably and normally, and network services will not be interrupted.

[0004] The Chinese patent with publication number CN115857634A discloses a big data computer network security intelligent protection device, which is provided with a series of structures to expand the circulation range of the heat dissipation airflow in the big data computer case, make the air circulation and heat dissipation more comprehensive, optimize the heat dissipation performance of the big data computer case, monitor the temperature, humidity and position of the big data computer equipment, facilitate the management of the big data computer network equipment, and improve the safety of equipment operation; however, the patent has the following defects:

[0005] The existing computer network of distributed IoT big data terminals cannot be supervised in real time, resulting in poor computer network security management. Summary of the invention

[0006] The purpose of the present invention is to provide a computer network supervision system for the security management of distributed Internet of Things big data terminals, which can perform real-time supervision on the computer network of distributed Internet of Things big data terminals, improve the computer network security management effect, and solve the problems raised in the above-mentioned background technology.

[0007] To achieve the above object, the present invention provides the following technical solutions:

[0008] Computer network supervision system for distributed IoT big data terminal security management, including:

[0009] A network monitoring module is used to monitor computer network flow data, computer network log data and computer network user data in real time to determine the real-time data of the computer network;

[0010] A data processing module is used to process the real-time data of the computer network and determine the characteristic data of the computer network;

[0011] An analysis and prediction module is used to analyze and predict computer network characteristic data and determine the computer network analysis and prediction results;

[0012] Intelligent management and control module, used to formulate computer network security management plans and conduct intelligent security management and control of computer networks;

[0013] The storage and display module is used to store and display computer network feature data, computer network analysis and prediction results, and computer network security management solutions, which are convenient for management personnel to view and manage on a daily basis.

[0014] Preferably, the network monitoring module includes:

[0015] A flow monitoring unit is used to monitor the computer network flow of the distributed IoT big data terminal in real time and determine the computer network flow data;

[0016] A log monitoring unit is used to monitor the computer event logs of the distributed IoT big data terminals in real time and determine the computer network log data;

[0017] A user monitoring unit is used to monitor the computer user behavior of the distributed IoT big data terminal in real time and determine the computer network user data;

[0018] Among them, based on computer network traffic data, computer network log data and computer network user data, the real-time data of the computer network based on the distributed Internet of Things big data terminal is determined.

[0019] Preferably, the network monitoring module further includes:

[0020] An operating parameter real-time monitoring module, used for real-time monitoring of the data acquisition operating parameters of the flow monitoring unit, wherein the data acquisition operating parameters include flow capture rate, data packet loss rate, flow analysis delay rate and interface utilization rate;

[0021] The first flow monitoring evaluation coefficient acquisition module is used to obtain the first flow monitoring evaluation coefficient by using the flow capture rate and the data packet loss rate; wherein the first flow monitoring evaluation coefficient is obtained by the following formula:

[0022]

[0023] Among them, S 01 represents the first flow monitoring evaluation coefficient; n represents the number of unit times experienced by the flow monitoring unit, and the unit time is 1s; P 01irepresents the traffic capture rate corresponding to the i-th unit time; P 02i represents the data packet loss rate corresponding to the i-th unit time; P 01i-1 represents the traffic capture rate corresponding to the i-1th unit time; P 02i-1 Indicates the data packet loss rate corresponding to the i-1th unit time;

[0024] The second flow monitoring evaluation coefficient acquisition module is used to obtain the second flow monitoring evaluation coefficient by using the flow analysis delay rate and the interface utilization rate; wherein the second flow monitoring evaluation coefficient is obtained by the following formula:

[0025]

[0026] Among them, S 02 represents the first flow monitoring evaluation coefficient; n represents the number of unit times experienced by the flow monitoring unit, and the unit time is 1s; P 03i represents the traffic analysis delay rate corresponding to the i-th unit time; P 04i represents the interface utilization corresponding to the i-th unit time;

[0027] A first determination module, configured to determine that the flow monitoring unit operates normally when both the first flow monitoring evaluation coefficient and the second flow monitoring evaluation coefficient are lower than their corresponding coefficient thresholds;

[0028] A second determination module, configured to determine that the flow monitoring unit is operating abnormally and issue an abnormal alarm when both the first flow monitoring evaluation coefficient and the second flow monitoring evaluation coefficient are not lower than their corresponding coefficient thresholds;

[0029] The third determination module is used to determine whether the flow monitoring unit operates normally through comprehensive evaluation parameters when any coefficient of the first flow monitoring evaluation coefficient and the second flow monitoring evaluation coefficient exceeds its corresponding coefficient threshold.

[0030] Preferably, the third determination module includes:

[0031] A numerical extraction module, used for extracting specific numerical values ​​corresponding to the first flow monitoring evaluation coefficient and the second flow monitoring evaluation coefficient when any coefficient of the first flow monitoring evaluation coefficient and the second flow monitoring evaluation coefficient exceeds its corresponding coefficient threshold;

[0032] A difference data extraction module, used to extract difference data between specific values ​​corresponding to the first flow monitoring evaluation coefficient and the second flow monitoring evaluation coefficient and their corresponding coefficient thresholds;

[0033] A comprehensive evaluation parameter acquisition module is used to obtain a comprehensive evaluation parameter using the difference data between the specific values ​​corresponding to the first flow monitoring evaluation coefficient and the second flow monitoring evaluation coefficient and the corresponding coefficient threshold, wherein the comprehensive evaluation parameter is obtained by the following formula:

[0034]

[0035] Among them, S represents the comprehensive evaluation parameter; S 01 Represents the first flow monitoring evaluation coefficient; S 02 Represents the first flow monitoring evaluation coefficient; S y01 represents the coefficient threshold corresponding to the first flow monitoring and evaluation system; S y02 Indicates the coefficient threshold corresponding to the second flow monitoring and evaluation system;

[0036] A comparison module, used for comparing the comprehensive evaluation parameter with a preset comprehensive parameter threshold;

[0037] The determination execution module is used to determine that the flow monitoring unit is operating abnormally and issue an abnormal alarm when the comprehensive evaluation parameter is lower than a preset comprehensive parameter threshold.

[0038] Preferably, the data processing module includes:

[0039] A data retrieval unit, used for retrieving real-time data from a computer network;

[0040] Obtain real-time data from computer networks based on distributed IoT big data terminals;

[0041] Retrieve real-time data from computer networks based on sequential retrieval methods;

[0042] Check the consistency of real-time data in computer networks;

[0043] According to the reasonable value range and mutual relationship of each variable in the real-time data of the computer network;

[0044] Remove inconsistent data that is beyond the normal range, logically unreasonable or contradictory in real-time data on computer networks;

[0045] Process invalid and missing values ​​of real-time data in computer networks;

[0046] Remove invalid and missing data that are of no value to computer network supervision from real-time computer network data;

[0047] Identify real-time computer network data that is valuable for computer network monitoring;

[0048] A data sorting unit, used for sorting the retrieved real-time data of the computer network;

[0049] Acquire real-time computer network data that is valuable to computer network supervision after retrieval;

[0050] Based on the internal sorting method, the computer network real-time data that is valuable to computer network supervision after retrieval is sorted;

[0051] Determine computer network real-time data with ranking order;

[0052] A feature extraction unit, used for extracting features from the sorted computer network real-time data;

[0053] Acquire computer network real-time data that is sorted and has an arrangement order;

[0054] Extracting features from computer network real-time data that has been sorted and has an arrangement order;

[0055] Determine computer network characteristic data based on distributed Internet of Things big data terminals.

[0056] Preferably, the analysis and prediction module includes:

[0057] A standard setting unit, used for presetting computer network standard data;

[0058] According to the computer network supervision requirements of distributed IoT big data terminal security management, computer network standard data is pre-set and stored for subsequent backup;

[0059] An indexing and retrieving unit, used for indexing and retrieving computer network standard data;

[0060] According to the computer network supervision requirements of distributed IoT big data terminal security management, pre-set computer network standard data is indexed and the indexed computer network standard data is retrieved;

[0061] An analysis and prediction unit, used for analyzing and predicting computer network characteristic data;

[0062] Obtain computer network feature data based on distributed IoT big data terminals;

[0063] Obtain retrieved computer network standard data;

[0064] Analyze and predict computer network characteristic data based on computer network standard data;

[0065] Determine the computer network analysis and prediction results based on distributed Internet of Things big data terminals.

[0066] Preferably, the computer network characteristic data is analyzed and predicted, and the following operations are performed:

[0067] When the computer network characteristic data is within the computer network standard data range, the computer network analysis prediction result based on the distributed Internet of Things big data terminal is that there is no abnormal behavior in computer network security management;

[0068] When the computer network characteristic data is not within the range of computer network standard data, the computer network analysis prediction result based on the distributed Internet of Things big data terminal is that there is abnormal behavior in computer network security management.

[0069] Preferably, the intelligent management and control module includes:

[0070] A policy-making unit, which is used to develop computer network security management plans;

[0071] Obtain computer network analysis and prediction results based on distributed IoT big data terminals;

[0072] Conduct in-depth mining and correlation analysis on computer network analysis and prediction results;

[0073] Determine a computer network security management solution based on distributed IoT big data terminals;

[0074] Intelligent management and control unit, used for intelligent security management and control of computer networks;

[0075] Obtain computer network security management solutions based on distributed IoT big data terminals;

[0076] Carry out intelligent security management and control of computer networks based on computer network security management solutions.

[0077] Preferably, intelligent security management and control of the computer network is performed by performing the following operations:

[0078] When abnormal behavior occurs in computer network security management, the computer network security management solution is to issue timely warning alarms for abnormal behavior, quickly respond to trigger defense actions to resist computer network intrusion, and intelligently guide managers to quickly query abnormal problems and solve them quickly and timely;

[0079] When there is no abnormal behavior in computer network security management, the computer network security management plan is to continue to comprehensively supervise the computer network in a stable manner to ensure computer network security.

[0080] Preferably, the storage display module includes:

[0081] A data storage unit for storing computer network characteristic data, computer network analysis and prediction results, and computer network security management solutions;

[0082] A data display unit, used to display computer network characteristic data, computer network analysis and prediction results, and computer network security management solutions;

[0083] Obtain computer network characteristic data, computer network analysis and prediction results, and computer network security management plans;

[0084] Conduct in-depth mining and relevant analysis of computer network feature data, computer network analysis and prediction results, and computer network security management solutions;

[0085] The computer network security management status is displayed to managers in a visual form, making it easier for managers to view and conduct daily management.

[0086] Compared with the prior art, the present invention has the following beneficial effects:

[0087] The present invention determines computer network real-time data by real-time monitoring of computer network traffic data, computer network log data and computer network user data, determines computer network real-time data by processing computer network real-time data, determines computer network characteristic data by analyzing and predicting computer network characteristic data, determines computer network analysis and prediction results by analyzing and predicting computer network characteristic data, and formulates a computer network security management plan to perform intelligent security management and control of the computer network. At the same time, the computer network characteristic data, computer network analysis and prediction results and computer network security management plan are stored and displayed for easy viewing and daily management by management personnel, and can perform real-time supervision on the computer network of distributed Internet of Things big data terminals, thereby improving the computer network security management effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0088] Figure 1 It is a module principle diagram of the computer network monitoring system of the present invention;

[0089] Figure 2 It is a framework diagram of the computer network monitoring system of the present invention;

[0090] Figure 3 The figure is a flow chart of the algorithm of the computer network monitoring system of the present invention. DETAILED DESCRIPTION

[0091] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0092] In order to solve the problem that the existing computer network of distributed IoT big data terminals cannot be supervised in real time, resulting in poor computer network security management, please refer to Figure 1-Figure 3 , this embodiment provides the following technical solutions:

[0093] The computer network supervision system for the security management of distributed Internet of Things big data terminals includes: network monitoring module, data processing module, analysis and prediction module, intelligent management and control module and storage and display module.

[0094] It should be noted that through the interactive communication between the network monitoring module, data processing module, analysis and prediction module, intelligent management and control module and storage and display module, the computer network of the distributed Internet of Things big data terminal can be supervised in real time, which can improve the computer network security management effect.

[0095] Among them, the network monitoring module is used to monitor computer network flow data, computer network log data and computer network user data in real time, and determine the real-time data of the computer network;

[0096] In this embodiment, as a preferred technical solution of the present invention, the network monitoring module includes:

[0097] A flow monitoring unit is used to monitor the computer network flow of the distributed IoT big data terminal in real time and determine the computer network flow data;

[0098] It should be noted that real-time monitoring of computer network traffic facilitates the identification of abnormal traffic;

[0099] A log monitoring unit is used to monitor the computer event logs of the distributed IoT big data terminals in real time and determine the computer network log data;

[0100] It should be noted that real-time monitoring of computer event logs that record user activities and system events facilitates subsequent review of computer event logs and tracing of responsibilities, and facilitates identification of abnormal events;

[0101] A user monitoring unit is used to monitor the computer user behavior of the distributed IoT big data terminal in real time and determine the computer network user data;

[0102] It should be noted that real-time monitoring of computer user behavior can be used to securely verify user identities and restrict users from accessing specific network resources or performing specific operations based on their roles and responsibilities;

[0103] Among them, based on computer network traffic data, computer network log data and computer network user data, the real-time data of the computer network based on the distributed Internet of Things big data terminal is determined.

[0104] Specifically, the network monitoring module further includes:

[0105] An operating parameter real-time monitoring module, used for real-time monitoring of the data acquisition operating parameters of the flow monitoring unit, wherein the data acquisition operating parameters include flow capture rate, data packet loss rate, flow analysis delay rate and interface utilization rate;

[0106] The first flow monitoring evaluation coefficient acquisition module is used to obtain the first flow monitoring evaluation coefficient by using the flow capture rate and the data packet loss rate; wherein the first flow monitoring evaluation coefficient is obtained by the following formula:

[0107]

[0108] Among them, S 01 represents the first flow monitoring evaluation coefficient; n represents the number of unit times experienced by the flow monitoring unit, and the unit time is 1s; P 01i represents the traffic capture rate corresponding to the i-th unit time; P 02i represents the data packet loss rate corresponding to the i-th unit time; P 01i-1 represents the traffic capture rate corresponding to the i-1th unit time; P 02i-1 Indicates the data packet loss rate corresponding to the i-1th unit time;

[0109] The second flow monitoring evaluation coefficient acquisition module is used to obtain the second flow monitoring evaluation coefficient by using the flow analysis delay rate and the interface utilization rate; wherein the second flow monitoring evaluation coefficient is obtained by the following formula:

[0110]

[0111] Among them, S 02 represents the first flow monitoring evaluation coefficient; n represents the number of unit times experienced by the flow monitoring unit, and the unit time is 1s; P 03i represents the traffic analysis delay rate corresponding to the i-th unit time; P 04i represents the interface utilization corresponding to the i-th unit time;

[0112] A first determination module, configured to determine that the flow monitoring unit operates normally when both the first flow monitoring evaluation coefficient and the second flow monitoring evaluation coefficient are lower than their corresponding coefficient thresholds;

[0113] A second determination module, configured to determine that the flow monitoring unit is operating abnormally and issue an abnormal alarm when both the first flow monitoring evaluation coefficient and the second flow monitoring evaluation coefficient are not lower than their corresponding coefficient thresholds;

[0114] The third determination module is used to determine whether the flow monitoring unit operates normally through comprehensive evaluation parameters when any coefficient of the first flow monitoring evaluation coefficient and the second flow monitoring evaluation coefficient exceeds its corresponding coefficient threshold.

[0115] The technical effect of the above technical solution is: through the real-time operating parameter monitoring module, the key operating parameters of the flow monitoring unit can be captured and monitored in real time, including flow capture rate, data packet loss rate, flow analysis delay rate and interface utilization rate. The real-time monitoring of these parameters provides basic data support for subsequent accurate evaluation, ensuring the timeliness and accuracy of monitoring.

[0116] The above technical solution uses two independent flow monitoring evaluation coefficients (the first flow monitoring evaluation coefficient and the second flow monitoring evaluation coefficient) to evaluate the performance of the flow monitoring unit from different dimensions (capture rate and packet loss rate, analysis delay rate and interface utilization rate). This multi-dimensional evaluation system can reflect the operating status of the flow monitoring unit more comprehensively and meticulously, and improve the accuracy and reliability of the evaluation.

[0117] The first determination module and the second determination module realize intelligent determination of the operating status of the flow monitoring unit through the preset coefficient threshold. When all evaluation coefficients are lower than the threshold, it is determined to be operating normally; when all evaluation coefficients are higher than the threshold, it is determined to be operating abnormally and an alarm is issued. This automated determination mechanism reduces manual intervention and improves monitoring efficiency and response speed.

[0118] The third judgment module introduces a comprehensive evaluation parameter for further judgment when any evaluation coefficient exceeds the threshold. This mechanism takes into account the mutual influence and weight between different parameters, and can more accurately judge the operating status of the flow monitoring unit in complex situations, avoiding misjudgment or missed judgment caused by a single parameter abnormality.

[0119] Through real-time monitoring, multi-dimensional evaluation, intelligent judgment and comprehensive evaluation mechanism, this technical solution can timely detect and handle the abnormal operation of the traffic monitoring unit, thereby effectively improving the stability and reliability of the entire network monitoring system. This is of great significance for ensuring the continuity and security of network services.

[0120] In summary, this technical solution realizes comprehensive, accurate and timely monitoring and evaluation of the operating status of the traffic monitoring unit through a series of innovative monitoring, evaluation and judgment mechanisms, providing a strong guarantee for the stable operation of the network monitoring system.

[0121] Specifically, the third determination module includes:

[0122] A numerical extraction module, used for extracting specific numerical values ​​corresponding to the first flow monitoring evaluation coefficient and the second flow monitoring evaluation coefficient when any coefficient of the first flow monitoring evaluation coefficient and the second flow monitoring evaluation coefficient exceeds its corresponding coefficient threshold;

[0123] A difference data extraction module, used to extract difference data between specific values ​​corresponding to the first flow monitoring evaluation coefficient and the second flow monitoring evaluation coefficient and their corresponding coefficient thresholds;

[0124] A comprehensive evaluation parameter acquisition module is used to obtain a comprehensive evaluation parameter using the difference data between the specific values ​​corresponding to the first flow monitoring evaluation coefficient and the second flow monitoring evaluation coefficient and the corresponding coefficient threshold, wherein the comprehensive evaluation parameter is obtained by the following formula:

[0125]

[0126] Among them, S represents the comprehensive evaluation parameter; S 01 Represents the first flow monitoring evaluation coefficient; S 02 Represents the first flow monitoring evaluation coefficient; S y01 represents the coefficient threshold corresponding to the first flow monitoring and evaluation system; S y02 Indicates the coefficient threshold corresponding to the second flow monitoring and evaluation system;

[0127] A comparison module, used for comparing the comprehensive evaluation parameter with a preset comprehensive parameter threshold;

[0128] The determination execution module is used to determine that the flow monitoring unit is operating abnormally and issue an abnormal alarm when the comprehensive evaluation parameter is lower than a preset comprehensive parameter threshold.

[0129] The technical effect of the above technical solution is: in the third determination module, a more detailed abnormal determination logic is introduced. When either the first flow monitoring evaluation coefficient or the second flow monitoring evaluation coefficient exceeds its corresponding coefficient threshold, it is not directly determined as abnormal, but further determined by extracting specific values, calculating difference data, and obtaining comprehensive evaluation parameters. This detailed logic processing improves the accuracy and rationality of abnormal determination.

[0130] By calculating the difference data between the first flow monitoring evaluation coefficient and the second flow monitoring evaluation coefficient and its corresponding coefficient threshold, and using these difference data to obtain comprehensive evaluation parameters, the technical solution can comprehensively consider the impact of multiple dimensions (i.e., flow capture rate and packet loss rate, flow analysis delay rate and interface utilization rate) on the operation status of the flow monitoring unit. This comprehensive consideration makes the judgment result more comprehensive and objective.

[0131] By comparing the preset comprehensive parameter threshold with the comprehensive evaluation parameter, the technical solution can adjust the sensitivity of the judgment according to actual needs. This flexibility and adaptability enables the technical solution to adapt to different network environments and application scenarios, improving its practicality and scalability.

[0132] By introducing comprehensive evaluation parameters and preset comprehensive parameter thresholds for judgment, false alarms or missed alarms caused by single parameter anomalies can be effectively reduced. Only when the comprehensive evaluation parameters are indeed lower than the preset threshold, an abnormal alarm is issued, thereby improving the accuracy and reliability of the alarm.

[0133] Through a more accurate and detailed abnormality determination mechanism, this technical solution can timely detect and handle the operation abnormalities of the traffic monitoring unit, thereby ensuring the stability and reliability of the entire network monitoring system. At the same time, reducing false positives and missed positives also helps improve user experience and avoid confusion and misunderstandings caused by unnecessary alarms.

[0134] In summary, the above technical solution improves the accuracy and reliability of determining abnormal operation of the traffic monitoring unit by introducing the third determination module and its internal refined logic processing mechanism, thereby improving the stability and user experience of the entire network monitoring system.

[0135] The data processing module is used to process the real-time data of the computer network and determine the characteristic data of the computer network;

[0136] In this embodiment, as a preferred technical solution of the present invention, the data processing module includes:

[0137] A data retrieval unit, used for retrieving real-time data from a computer network;

[0138] Obtain real-time data from computer networks based on distributed IoT big data terminals;

[0139] Retrieve real-time data from computer networks based on sequential retrieval methods;

[0140] Check the consistency of real-time data in computer networks;

[0141] According to the reasonable value range and mutual relationship of each variable in the real-time data of the computer network;

[0142] Remove inconsistent data that is beyond the normal range, logically unreasonable or contradictory in real-time data on computer networks;

[0143] Process invalid and missing values ​​of real-time data in computer networks;

[0144] Remove invalid and missing data that are of no value to computer network supervision from real-time computer network data;

[0145] Identify real-time computer network data that is valuable for computer network monitoring;

[0146] A data sorting unit, used for sorting the retrieved real-time data of the computer network;

[0147] Acquire real-time computer network data that is valuable to computer network supervision after retrieval;

[0148] Based on the internal sorting method, the computer network real-time data that is valuable to computer network supervision after retrieval is sorted;

[0149] Determine computer network real-time data with ranking order;

[0150] A feature extraction unit, used for extracting features from the sorted computer network real-time data;

[0151] Acquire computer network real-time data that is sorted and has an arrangement order;

[0152] Extracting features from computer network real-time data that has been sorted and has an arrangement order;

[0153] Determine computer network characteristic data based on distributed Internet of Things big data terminals.

[0154] The analysis and prediction module is used to analyze and predict computer network feature data and determine the computer network analysis and prediction results;

[0155] In this embodiment, as a preferred technical solution of the present invention, the analysis and prediction module includes:

[0156] A standard setting unit, used for presetting computer network standard data;

[0157] According to the computer network supervision requirements of distributed IoT big data terminal security management, computer network standard data is pre-set and stored for subsequent backup;

[0158] An indexing and retrieving unit, used for indexing and retrieving computer network standard data;

[0159] According to the computer network supervision requirements of distributed IoT big data terminal security management, pre-set computer network standard data is indexed and the indexed computer network standard data is retrieved;

[0160] An analysis and prediction unit, used for analyzing and predicting computer network characteristic data;

[0161] Obtain computer network feature data based on distributed IoT big data terminals;

[0162] Obtain retrieved computer network standard data;

[0163] Analyze and predict computer network characteristic data based on computer network standard data;

[0164] Determine the computer network analysis and prediction results based on distributed Internet of Things big data terminals.

[0165] In this embodiment, as a preferred technical solution of the present invention, the computer network characteristic data is analyzed and predicted, and the following operations are performed:

[0166] When the computer network characteristic data is within the computer network standard data range, the computer network analysis prediction result based on the distributed Internet of Things big data terminal is that there is no abnormal behavior in computer network security management;

[0167] When the computer network characteristic data is not within the range of computer network standard data, the computer network analysis prediction result based on the distributed Internet of Things big data terminal is that there is abnormal behavior in computer network security management.

[0168] Among them, the intelligent management and control module is used to formulate computer network security management plans and perform intelligent security management and control of computer networks;

[0169] In this embodiment, as a preferred technical solution of the present invention, the intelligent management and control module includes:

[0170] A policy-making unit, which is used to develop computer network security management plans;

[0171] Obtain computer network analysis and prediction results based on distributed IoT big data terminals;

[0172] Conduct in-depth mining and correlation analysis on computer network analysis and prediction results;

[0173] Determine a computer network security management solution based on distributed IoT big data terminals;

[0174] Intelligent management and control unit, used for intelligent security management and control of computer networks;

[0175] Obtain computer network security management solutions based on distributed IoT big data terminals;

[0176] Carry out intelligent security management and control of computer networks based on computer network security management solutions.

[0177] In this embodiment, as the preferred technical solution of the present invention, intelligent security management and control is performed on the computer network, and the following operations are performed:

[0178] When abnormal behavior occurs in computer network security management, the computer network security management solution is to issue timely warning alarms for abnormal behavior, quickly respond to trigger defense actions to resist computer network intrusion, and intelligently guide managers to quickly query abnormal problems and solve them quickly and timely;

[0179] When there is no abnormal behavior in computer network security management, the computer network security management plan is to continue to comprehensively supervise the computer network in a stable manner to ensure computer network security.

[0180] It should be noted that when the computer network supervision of distributed IoT big data terminals is managed securely, the computer network supervision security management situation is shown in Table 1:

[0181] Table 1: Computer network supervision and security management

[0182]

[0183] Therefore, based on computer network standard data, computer network characteristic data is analyzed and predicted, the computer network analysis and prediction results are determined, and a computer network security management plan is formulated to perform intelligent security management and control of computer networks. This can conduct real-time supervision of the computer networks of distributed Internet of Things big data terminals, and improve the effectiveness of computer network security management.

[0184] Among them, the storage and display module is used to store and display computer network feature data, computer network analysis and prediction results, and computer network security management solutions, which is convenient for management personnel to view and manage on a daily basis.

[0185] In this embodiment, as a preferred technical solution of the present invention, the storage display module includes:

[0186] A data storage unit for storing computer network characteristic data, computer network analysis and prediction results, and computer network security management solutions;

[0187] A data display unit, used to display computer network characteristic data, computer network analysis and prediction results, and computer network security management solutions;

[0188] Obtain computer network characteristic data, computer network analysis and prediction results, and computer network security management plans;

[0189] Conduct in-depth mining and relevant analysis of computer network feature data, computer network analysis and prediction results, and computer network security management solutions;

[0190] The computer network security management status is displayed to managers in a visual form, making it easier for managers to view and conduct daily management.

[0191] Therefore, by real-time monitoring of computer network traffic data, computer network log data and computer network user data, the real-time data of the computer network is determined, and by processing the real-time data of the computer network, the characteristic data of the computer network is determined. By analyzing and predicting the characteristic data of the computer network, the computer network analysis and prediction results are determined, and a computer network security management plan is formulated to perform intelligent security management and control of the computer network. At the same time, the computer network characteristic data, computer network analysis and prediction results and computer network security management plan are stored and displayed for the convenience of management personnel to view and manage on a daily basis. The computer network of the distributed Internet of Things big data terminal can be supervised in real time, which can improve the computer network security management effect.

[0192] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0193] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A computer network supervision system for security management of distributed IoT big data terminals, characterized in that: include: A network monitoring module is used to monitor computer network flow data, computer network log data and computer network user data in real time to determine the real-time data of the computer network; A data processing module is used to process the real-time data of the computer network and determine the characteristic data of the computer network; An analysis and prediction module is used to analyze and predict computer network characteristic data and determine the computer network analysis and prediction results; Intelligent management and control module, used to formulate computer network security management plans and conduct intelligent security management and control of computer networks; The storage and display module is used to store and display computer network feature data, computer network analysis and prediction results, and computer network security management solutions, which are convenient for management personnel to view and manage on a daily basis.

2. According to claim 1, the computer network supervision system for distributed Internet of Things big data terminal security management is characterized in that: The network monitoring module includes: A flow monitoring unit is used to monitor the computer network flow of the distributed IoT big data terminal in real time and determine the computer network flow data; A log monitoring unit is used to monitor the computer event logs of the distributed IoT big data terminals in real time and determine the computer network log data; A user monitoring unit is used to monitor the computer user behavior of the distributed IoT big data terminal in real time and determine the computer network user data; Among them, based on computer network traffic data, computer network log data and computer network user data, the real-time data of the computer network based on the distributed Internet of Things big data terminal is determined.

3. The computer network supervision system for distributed Internet of Things big data terminal security management according to claim 2 is characterized in that: The network monitoring module further includes: An operating parameter real-time monitoring module, used for real-time monitoring of the data acquisition operating parameters of the flow monitoring unit, wherein the data acquisition operating parameters include flow capture rate, data packet loss rate, flow analysis delay rate and interface utilization rate; The first flow monitoring evaluation coefficient acquisition module is used to obtain the first flow monitoring evaluation coefficient by using the flow capture rate and the data packet loss rate; wherein the first flow monitoring evaluation coefficient is obtained by the following formula: Among them, S 01 represents the first flow monitoring evaluation coefficient; n represents the number of unit times experienced by the flow monitoring unit, and the unit time is 1s; P 01i represents the traffic capture rate corresponding to the i-th unit time; P 02i represents the data packet loss rate corresponding to the i-th unit time; P 01i-1 represents the traffic capture rate corresponding to the i-1th unit time; P 02i-1 Indicates the data packet loss rate corresponding to the i-1th unit time; The second flow monitoring evaluation coefficient acquisition module is used to obtain the second flow monitoring evaluation coefficient by using the flow analysis delay rate and the interface utilization rate; wherein the second flow monitoring evaluation coefficient is obtained by the following formula: Among them, S 02 represents the first flow monitoring evaluation coefficient; n represents the number of unit times experienced by the flow monitoring unit, and the unit time is 1s; P 03i represents the traffic analysis delay rate corresponding to the i-th unit time; P 04i represents the interface utilization corresponding to the i-th unit time; A first determination module, configured to determine that the flow monitoring unit operates normally when both the first flow monitoring evaluation coefficient and the second flow monitoring evaluation coefficient are lower than their corresponding coefficient thresholds; A second determination module, configured to determine that the flow monitoring unit is operating abnormally and issue an abnormal alarm when both the first flow monitoring evaluation coefficient and the second flow monitoring evaluation coefficient are not lower than their corresponding coefficient thresholds; The third determination module is used to determine whether the flow monitoring unit operates normally through comprehensive evaluation parameters when any coefficient of the first flow monitoring evaluation coefficient and the second flow monitoring evaluation coefficient exceeds its corresponding coefficient threshold.

4. The computer network supervision system for distributed Internet of Things big data terminal security management according to claim 3 is characterized in that: The third determination module comprises: A numerical extraction module, used for extracting specific numerical values ​​corresponding to the first flow monitoring evaluation coefficient and the second flow monitoring evaluation coefficient when any coefficient of the first flow monitoring evaluation coefficient and the second flow monitoring evaluation coefficient exceeds its corresponding coefficient threshold; A difference data extraction module, used to extract difference data between specific values ​​corresponding to the first flow monitoring evaluation coefficient and the second flow monitoring evaluation coefficient and their corresponding coefficient thresholds; A comprehensive evaluation parameter acquisition module is used to obtain a comprehensive evaluation parameter using the difference data between the specific values ​​corresponding to the first flow monitoring evaluation coefficient and the second flow monitoring evaluation coefficient and the corresponding coefficient threshold, wherein the comprehensive evaluation parameter is obtained by the following formula: Among them, S represents the comprehensive evaluation parameter; S 01 Represents the first flow monitoring evaluation coefficient; S 02 Represents the first flow monitoring evaluation coefficient; S y01 represents the coefficient threshold corresponding to the first flow monitoring and evaluation system; S y02 Indicates the coefficient threshold corresponding to the second flow monitoring and evaluation system; A comparison module, used for comparing the comprehensive evaluation parameter with a preset comprehensive parameter threshold; The determination execution module is used to determine that the flow monitoring unit is operating abnormally and issue an abnormal alarm when the comprehensive evaluation parameter is lower than a preset comprehensive parameter threshold.

5. The computer network supervision system for distributed Internet of Things big data terminal security management according to claim 2 is characterized in that: The data processing module comprises: A data retrieval unit, used for retrieving real-time data from a computer network; Obtain real-time data from computer networks based on distributed IoT big data terminals; Retrieve real-time data from computer networks based on sequential retrieval methods; Check the consistency of real-time data in computer networks; According to the reasonable value range and mutual relationship of each variable in the real-time data of the computer network; Remove inconsistent data that is beyond the normal range, logically unreasonable or contradictory in real-time data on computer networks; Process invalid and missing values ​​of real-time data in computer networks; Remove invalid and missing data that are of no value to computer network supervision from real-time computer network data; Identify real-time computer network data that is valuable for computer network monitoring; A data sorting unit, used for sorting the retrieved real-time data of the computer network; Acquire real-time computer network data that is valuable to computer network supervision after retrieval; Based on the internal sorting method, the computer network real-time data that is valuable to computer network supervision after retrieval is sorted; Determine computer network real-time data with ranking order; A feature extraction unit, used for extracting features from the sorted computer network real-time data; Acquire computer network real-time data that is sorted and has an arrangement order; Extracting features from computer network real-time data that has been sorted and has an arrangement order; Determine computer network characteristic data based on distributed Internet of Things big data terminals.

6. The computer network supervision system for distributed Internet of Things big data terminal security management according to claim 5 is characterized in that: The analysis and prediction module comprises: A standard setting unit, used for presetting computer network standard data; According to the computer network supervision requirements of distributed IoT big data terminal security management, computer network standard data is pre-set and stored for subsequent backup; An indexing and retrieving unit, used for indexing and retrieving computer network standard data; According to the computer network supervision requirements of distributed IoT big data terminal security management, pre-set computer network standard data is indexed and the indexed computer network standard data is retrieved; An analysis and prediction unit, used for analyzing and predicting computer network characteristic data; Obtain computer network feature data based on distributed IoT big data terminals; Obtain retrieved computer network standard data; Analyze and predict computer network characteristic data based on computer network standard data; Determine the computer network analysis and prediction results based on distributed Internet of Things big data terminals.

7. The computer network supervision system for distributed Internet of Things big data terminal security management according to claim 6 is characterized in that: Analyze and predict computer network feature data and perform the following operations: When the computer network characteristic data is within the computer network standard data range, the computer network analysis prediction result based on the distributed Internet of Things big data terminal is that there is no abnormal behavior in computer network security management; When the computer network characteristic data is not within the range of computer network standard data, the computer network analysis prediction result based on the distributed Internet of Things big data terminal is that there is abnormal behavior in computer network security management.

8. The computer network supervision system for distributed Internet of Things big data terminal security management according to claim 7 is characterized in that: The intelligent management and control module includes: A policy-making unit, which is used to develop computer network security management plans; Obtain computer network analysis and prediction results based on distributed IoT big data terminals; Conduct in-depth mining and correlation analysis on computer network analysis and prediction results; Determine a computer network security management solution based on distributed IoT big data terminals; Intelligent management and control unit, used for intelligent security management and control of computer networks; Obtain computer network security management solutions based on distributed IoT big data terminals; Carry out intelligent security management and control of computer networks based on computer network security management solutions.

9. The computer network supervision system for distributed Internet of Things big data terminal security management according to claim 8 is characterized in that: Intelligent security management and control of computer networks, perform the following operations: When abnormal behavior occurs in computer network security management, the computer network security management solution is to issue timely warning alarms for abnormal behavior, quickly respond to trigger defense actions to resist computer network intrusion, and intelligently guide managers to quickly query abnormal problems and solve them quickly and timely; When there is no abnormal behavior in computer network security management, the computer network security management plan is to continue to comprehensively supervise the computer network in a stable manner to ensure computer network security.

10. The computer network supervision system for distributed Internet of Things big data terminal security management according to claim 9 is characterized in that: The storage display module includes: A data storage unit for storing computer network characteristic data, computer network analysis and prediction results, and computer network security management solutions; A data display unit, used to display computer network characteristic data, computer network analysis and prediction results, and computer network security management solutions; Obtain computer network characteristic data, computer network analysis and prediction results, and computer network security management plans; Conduct in-depth mining and relevant analysis of computer network feature data, computer network analysis and prediction results, and computer network security management solutions; The computer network security management status is displayed to managers in a visual form, making it easier for managers to view and conduct daily management.

Images