Method and system for supervising Internet data processing

Abstract

The invention discloses a method and a system for supervising internet data processing, and relates to the technical field of internet supervising, the method comprises the steps of flow data capture, data doubt judgment, problem data coping and early warning prompt, real-time supervision is executed on each internet transmission data packet, each doubt data packet is captured, and each doubt data packet is sent to the internet supervising module; the method comprises the following steps: receiving doubt data packets, executing corresponding analysis and reduction on the doubt data packets, judging whether the doubt data packets are malicious data packets, extracting features corresponding to the malicious data packets, judging to obtain malicious types corresponding to the malicious data packets, and analyzing to obtain countermeasures of the malicious types corresponding to the malicious data packets. According to the method, the security of the Internet data in acquisition and transmission is guaranteed, the application security corresponding to the Internet data is reduced, and meanwhile, the data risk is quickly and efficiently found based on judgment on the malicious data packet corresponding to the Internet data, so that timely data security risk measure prevention is realized.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet supervision, and in particular to a method, system and method for supervising Internet data processing. Background Art

[0002] With the emergence and application of the Internet, users can widely choose various Internet data, but there are endless applications on the network. Therefore, it is necessary to perform corresponding supervision on the processing of Internet data during transmission or application, so as to ensure the security of Internet data acquisition and application. By performing corresponding supervision and detection on the transmitted Internet data, malicious data can be discovered quickly and timely, so as to carry out timely data security prevention and ensure the security of Internet data.

[0003] Prior art, such as the invention patent application with announcement number CN115085967A, discloses a method and system for supervising Internet data processing, which obtains the transmission data type of Internet data; determines whether the data type is suspicious data; if so, terminates the transmission or delivery of the suspicious data; sets a verification procedure for the suspicious data, and uses the verification procedure to determine whether the suspicious data contains preset data elements; if so, determines that the suspicious data is illegal data; confirms the demand for illegal data based on the distribution of dimension elements of the data body preset for the illegal data; the dimensional elements are specifically the data body according to the number of element distributions to arrange the primary and secondary tasks to be completed; cuts off the Internet connection of the illegal data and removes the data records of the illegal data; the present invention monitors the data body and data packet during data transmission to determine whether the transmitted data is illegal data, thereby effectively solving the problem of criminals using the Internet for malicious data transmission or delivery.

[0004] In response to the above scheme, the applicant of the present invention found that the above technical problems have at least the following technical problems: the above invention mainly determines whether the transmitted data is illegal data, and does not analyze the malicious type encountered by each malicious data packet from the characteristics corresponding to each malicious data packet, and thus cannot accurately analyze and obtain the corresponding countermeasures for each malicious data packet, and cannot ensure the security of Internet data in transmission, reduce the corresponding availability and transmission quality of Internet data, and reduce the accuracy of the judgment of the corresponding abnormal type of Internet data. Summary of the invention

[0005] In view of the above-mentioned technical deficiencies, the purpose of the present invention is to provide a method and system for supervising Internet data processing.

[0006] In order to solve the above technical problems, the present invention adopts the following technical solutions: The present invention provides a method for supervising Internet data processing, including: Step 1, flow data capture: by performing real-time supervision on each transmission data packet of the Internet, and then capturing each suspicious data packet, when each suspicious data packet is captured, each suspicious data packet is placed according to the data packet level to obtain the placement area corresponding to each suspicious data packet.

[0007] Step 2: Data suspicion judgment: After each suspicious data packet is stored in the placement area, the corresponding analysis and restoration is performed on each suspicious data packet, and the corresponding supervision and detection is performed on each suspicious data packet after analysis, so as to determine whether each suspicious data packet is a malicious data packet, and extract the corresponding features of each malicious data packet to determine the malicious type corresponding to each malicious data packet.

[0008] Step 3: Response to problem data: Based on the malicious type corresponding to each malicious data packet, the response measures corresponding to the malicious type of each malicious data packet are analyzed and obtained.

[0009] Step 4: Early warning: When the supervisor finds that a suspicious data packet is a malicious data packet, an early warning will be issued.

[0010] In a second aspect, the present invention provides a system for supervising Internet data processing, including: a flow data capture module, which is used to perform real-time supervision on each transmission data packet of the Internet, and then capture each suspicious data packet. When each suspicious data packet is captured, each suspicious data packet is placed in a corresponding area according to the data packet level.

[0011] The data doubt judgment module is used to store each doubtful data packet in the placement area, perform corresponding analysis and restoration on each doubtful data packet, and perform corresponding supervision and detection on each doubtful data packet after analysis, so as to determine whether each doubtful data packet is a malicious data packet, extract the corresponding features of each malicious data packet, and determine the malicious type corresponding to each malicious data packet.

[0012] The problem data response module is used to analyze and obtain the response measures corresponding to the malicious types of each malicious data packet based on the malicious types corresponding to each malicious data packet.

[0013] The early warning terminal is used to issue an early warning prompt when the supervision finds that a suspicious data packet is a malicious data packet.

[0014] Compared with the prior art, the beneficial effects of the present invention are as follows: 1. The present invention provides a method and system for supervising Internet data processing, which performs real-time supervision on each transmission data packet of the Internet, thereby capturing each suspicious data packet, and performing corresponding analysis and restoration on each suspicious data packet to determine whether each suspicious data packet is a malicious data packet, and at the same time extracts the corresponding features of each malicious data packet, and determines the malicious type corresponding to each malicious data packet, thereby analyzing and obtaining the corresponding malicious type of each malicious data packet. Countermeasures for the malicious type, thereby ensuring the security of Internet data in acquisition and transmission, reducing the application security corresponding to Internet data, and solving the deficiencies in the current technology, and at the same time based on the determination of the malicious data packet corresponding to the Internet data, thereby realizing rapid and efficient discovery of data risks, thereby realizing timely prevention of data security risk measures, ensuring the availability and security of Internet data, timely terminating the transmission of malicious data packets, reducing the damage caused by malicious data, reducing the interference of spam and malicious content, and efficiently and comprehensively maintaining the security rights and interests of users, and based on the automated Internet data processing supervision method, effectively reducing the workload and detection cost of manual supervision and review, improving the efficiency of Internet data security supervision, and ensuring timely processing of malicious data.

[0015] 2. In the process of capturing mobile data, the present invention conducts in-depth analysis and supervision on each data packet transmitted on the Internet, and then captures each suspicious data packet, thereby realizing rapid Internet data investigation, ensuring the security of Internet data during transmission, reducing the corresponding transmission risk of Internet data, and ensuring the quality and availability of Internet data to a certain extent.

[0016] 3. In the judgment of data doubt, the present invention conducts in-depth supervision and analysis on each suspicious data packet after analysis, and then determines whether each suspicious data packet is a malicious data packet, and determines the malicious type corresponding to each malicious data packet, thereby realizing in-depth and detailed investigation of each suspicious data packet to ensure the accuracy and effectiveness of data packet judgment. At the same time, based on the extraction and characteristics of malicious data packets, efficient and accurate data packet type judgment is achieved, and class response can be effectively executed to achieve timely and efficient malicious prevention.

[0017] 4. In response to problematic data, the present invention conducts an in-depth analysis of the malicious types corresponding to each malicious data packet, and then obtains response measures corresponding to the malicious types of each malicious data packet, thereby achieving targeted response and rectification, and to a certain extent strengthening the prevention of Internet data and ensuring the security of Internet data. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 The present invention is a schematic flow chart of the steps for implementing the method.

[0020] Figure 2 It is a schematic diagram of the system structure connection of the present invention. DETAILED DESCRIPTION

[0021] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0022] See also Figure 1 As shown, a method for supervising Internet data processing includes: Step 1, flow data capture: by performing real-time supervision on each transmission data packet of the Internet, each suspicious data packet is captured, and when each suspicious data packet is captured, each suspicious data packet is placed in a corresponding area according to the data packet level.

[0023] It should be noted that type features include web page content, API data, pictures or videos.

[0024] As an optional implementation, the capture obtains each suspicious data packet, and the specific capture process is as follows: based on the known type feature data of each Internet transmission data packet stored in the rule base, the transmission supervision of the corresponding Internet transmission data packet is directly performed, and the corresponding HTTP request is sent to each Internet transmission data packet by utilizing the crawler technology, so as to capture the HTML and XML documents corresponding to each Internet transmission data packet, and extract the transmission features corresponding to each current Internet transmission data packet, including burst traffic, server errors, request return errors and connection surges, and compare the features extracted from each Internet transmission data packet with the various suspicious transmission features of the corresponding historical transmission data packets in the rule base. If the extracted feature corresponding to a certain Internet transmission data packet is the same as a certain suspicious transmission feature of the corresponding historical transmission data packet in the rule base, then the transmission data packet is determined to be a suspicious data packet, and each suspicious data packet is captured.

[0025] The present invention conducts in-depth analysis and supervision of each Internet transmission data packet during flow data capture, and then captures each suspicious data packet, thereby achieving rapid Internet data screening, ensuring the security of Internet data during transmission, reducing the corresponding transmission risk of Internet data, and ensuring the quality and availability of Internet data to a certain extent.

[0026] Step 2: Data suspicion judgment: After each suspicious data packet is stored in the placement area, each suspicious data packet is analyzed and restored accordingly, and corresponding supervision detection is performed on each suspicious data packet after analysis to determine whether each suspicious data packet is a malicious data packet, and the corresponding features of each malicious data packet are extracted to determine the malicious type corresponding to each malicious data packet.

[0027] It should be noted that protocol analysis tools include Wireshark, Fiddler, Charles, BurpSuite and tcpdump.

[0028] It should be noted that malicious types include malicious tampering, abnormal access, and carrying illegal malware.

[0029] It should be noted that the characteristic data include data content, number of modifications and hash value; number of visits, active time period, access source and call operation; file extension, network traffic, execution file and warning interception records.

[0030] It should be noted that when the same data file is modified three times or more, it can be determined that the data file is frequently modified. The MD5 algorithm is used to convert the string "HelloWorld" into a 32-bit hexadecimal number "b10a8db164e0754105b7a99be72e3fe5" as its original hash value, and the currently extracted hash value is "b20a8db164e0754105b7a99be72e3fe6", which means that the hash values ​​are inconsistent. When the server responds slowly or the network is congested, it means that the access volume has increased suddenly. When the network traffic usage increases faster than the regular traffic usage stored in the rule base, it is determined that the network traffic has increased abnormally. When the number of warning interceptions corresponding to the firewall reaches three times or more, the execution file is based on the malicious judgment standard of containing malicious code or the number of warning interceptions corresponding to the firewall under static code analysis.

[0031] It should also be noted that the characteristic access volume of each malicious data packet is extracted based on the aggregation function method, the characteristic active time period is extracted according to the timestamp corresponding to each malicious data packet, the characteristic access source corresponding to each malicious data packet is extracted from the log, the characteristic call operation corresponding to each malicious data packet is extracted from the operation type recorded in the log, the characteristic file extension corresponding to each malicious data packet is extracted using a string, the characteristic network traffic corresponding to each malicious data packet is extracted using a network traffic analysis tool, such as Wireshark or tcpdump, the characteristic execution file corresponding to each malicious data packet is extracted using static analysis technology or dynamic analysis technology, and the characteristic warning interception record corresponding to each malicious data packet is extracted using ELK or Splunk tools.

[0032] As an optional implementation, the corresponding analysis and restoration is performed on each suspicious data packet, and corresponding supervision and detection is performed on each suspicious data packet after analysis, so as to determine whether each suspicious data packet is a malicious data packet. The specific determination process is as follows: a protocol analysis tool is used to analyze and restore each suspicious data packet corresponding to the placement area, and based on the function of the protocol analysis tool, field information data corresponding to each suspicious data packet is extracted, wherein the field information includes source address, destination address, protocol type and load data, so as to complete the analysis and restoration of each suspicious data packet, and compare the field information data extracted from each suspicious data packet with the field features corresponding to the malicious data in the rule base. If the field information data extracted from a suspicious data packet is consistent with a field feature corresponding to the malicious data in the rule base, the suspicious data is determined to be malicious data, so as to determine whether each suspicious data packet is a malicious data packet.

[0033] As an optional implementation, the features corresponding to each malicious data packet are extracted to determine the malicious type corresponding to each malicious data packet. The specific determination process is as follows: feature extraction is performed on each malicious data packet to obtain feature data corresponding to each malicious data packet, and each data feature corresponding to each malicious data packet is compared with each malicious feature set stored in a rule base. If a data feature corresponding to a malicious data packet is within a certain type of malicious feature set stored in the rule base, then the malicious type corresponding to the malicious feature set in the rule base is used as the malicious type of the malicious data packet. In this way, the malicious type corresponding to each malicious data packet is obtained by analogy.

[0034] Q1. Extract features from each malicious data packet. When the features extracted from each malicious data packet are data content, number of modifications and hash value, if the features extracted from a malicious data packet show that the data content is inconsistent with the original version, the same data file is frequently modified or the hash value is inconsistent, then the malicious data packet is determined to be malicious, and the transmission application of the malicious data packet is immediately stopped, and the malicious features extracted from the malicious data packet are compared with the corresponding malicious features in the rule library. If the malicious features extracted from the malicious data packet are the same as the corresponding malicious features in the rule library, the malicious tampering type corresponding to the malicious feature in the rule library is used as the malicious type of the malicious data packet.

[0035] It should be noted again that the data content corresponding to each malicious data packet is compared with the data content stored in the rule base, and the number of modifications and hash value corresponding to each malicious data packet are also compared with the upper limit value of the number of modifications and hash value stored in the rule base. If the data content corresponding to a malicious data packet is inconsistent with the data content stored in the rule base, and the number of modifications corresponding to the malicious data packet exceeds the upper limit value of the number of modifications stored in the rule base and is inconsistent with the hash value stored in the rule base, then the malicious data packet is determined to be malicious.

[0036] As an optional implementation method, the analogy obtains the malicious type corresponding to each malicious data packet, and the specific analogy process is as follows: R1. When the features extracted from each malicious data packet are the number of visits, active time period, access source and calling operation, if the features extracted from a malicious data packet show a sudden increase in the number of visits, unconventional access time period, unknown location and unconventional research method, then the malicious data packet is judged to be malicious, and the malicious features extracted from the malicious data packet are compared with the corresponding malicious features in the rule library. If the malicious features extracted from the malicious data packet are the same as the corresponding malicious features in the rule library, the abnormal access type corresponding to the malicious feature in the rule library is used as the malicious type of the malicious data packet.

[0037] It should be noted again that the access volume corresponding to each malicious data packet is compared with the access volume interval stored in the rule base. If the access volume corresponding to a malicious data packet is not in the access volume interval stored in the rule base, the malicious data packet is determined to be malicious. In this way, the feature data extracted from each malicious data packet is inferred by comparison to determine whether each malicious data packet is malicious.

[0038] As an optional implementation method, the analogy obtains the malicious type corresponding to each malicious data packet, and the specific analogy process is as follows: W1. When the features extracted from each malicious data packet are file extension, network traffic, execution file and warning interception record, if the features extracted from a malicious data packet show the appearance of a new file extension, an abnormal surge in network traffic, the execution file contains malicious code based on static code analysis, or the number of warning interceptions corresponding to the firewall, then the malicious data packet is judged to be malicious, and the malicious features extracted from the malicious data packet are compared with the corresponding malicious features in the rule library. If the malicious features extracted from the malicious data packet are the same as the corresponding malicious features in the rule library, the type of illegal malware corresponding to the malicious feature in the rule library is used as the malicious type of the malicious data packet.

[0039] It should be noted again that the file extension corresponding to each malicious data packet is compared with the file extension stored in the rule base. If the file extension corresponding to a malicious data packet is inconsistent with the file extension stored in the rule base, the malicious data packet is determined to be malicious. In this way, the feature data extracted from each malicious data packet is inferred by comparison to determine whether each malicious data packet is malicious.

[0040] In the judgment of data doubt, the present invention conducts in-depth supervision and analysis on each doubtful data packet after parsing, and then determines whether each doubtful data packet is a malicious data packet, and determines the malicious type corresponding to each malicious data packet, thereby realizing in-depth and detailed investigation of each doubtful data packet, ensuring the accuracy and effectiveness of data packet judgment, and at the same time, based on the extraction and characteristics of malicious data packets, thereby realizing efficient and accurate data packet type judgment, and being able to effectively execute class response, and realize timely and efficient malicious prevention.

[0041] Step 3: Response to problem data: Based on the malicious type corresponding to each malicious data packet, the response measures corresponding to the malicious type of each malicious data packet are analyzed and obtained.

[0042] It should be noted that the historical application encryption security rate corresponding to each encryption method is obtained from the database, that is, the number of times each encryption method was cracked in the corresponding historical application is divided by the number of times each encryption method was used in the corresponding historical application and multiplied by a percentage, so as to obtain the historical application encryption security rate corresponding to each encryption method, and the historical application encryption security rates corresponding to each encryption method are arranged in order from high to low, so as to obtain the encryption security value corresponding to each encryption method.

[0043] As an optional implementation, the analysis obtains countermeasures for the malicious types corresponding to each malicious data packet. The specific analysis process is as follows: the malicious type corresponding to each malicious data packet is compared with the malicious types corresponding to the countermeasures stored in the rule base. If the malicious type corresponding to a malicious data packet is the same as a malicious type corresponding to a countermeasure stored in the rule base, the countermeasure corresponding to the malicious type in the rule base is used as the malicious type of the malicious data packet. In this way, measures are matched to obtain countermeasures for the malicious types corresponding to each malicious data packet.

[0044] When the malicious type corresponding to a malicious data packet is a malicious tampering type: the malicious data packet is returned to the initial data packet state through a retransmission mechanism or a repair mechanism, and the encryption security value corresponding to each encryption method is obtained. The encryption method with the first encryption security value is used as the encryption method of the malicious data packet, and the countermeasures for the malicious data packet being maliciously tampered with are completed.

[0045] As an optional implementation method, the measure matching is performed, and the specific matching process is as follows: when the malicious type corresponding to a malicious data packet is an abnormal access type: when a malicious data packet is abnormally accessed, by comprehensively analyzing the access end corresponding to the malicious data packet, the corresponding speed limit or blocking is implemented on the unknown or specific location end to deal with the abnormal access of the malicious data packet, and the response measures corresponding to the abnormal access of each malicious data packet are analyzed.

[0046] As an optional implementation method, the measure matching is performed, and the specific matching process is as follows: when the malicious type corresponding to a malicious data packet is a type of carrying illegal malware: by deploying the corresponding firewall and intrusion detection system, turning on the protection and detection options corresponding to the firewall and intrusion detection system, and setting the corresponding malicious interval, and installing anti-virus software to regularly scan network traffic, so as to deal with malicious tampering of malicious data packets, and analyze and obtain the corresponding countermeasures for malicious tampering of each malicious data packet.

[0047] In response to problematic data, the present invention conducts an in-depth analysis of the malicious types corresponding to each malicious data packet, and then obtains response measures corresponding to the malicious types of each malicious data packet, thereby achieving targeted response and rectification, and to a certain extent strengthening the prevention of Internet data and ensuring the security of Internet data.

[0048] Step 4: Early warning: When the supervisor finds that a suspicious data packet is a malicious data packet, an early warning will be issued.

[0049] See also Figure 2 As shown, the present invention provides a system for supervising Internet data processing, including a flow data capture module, a data doubt judgment module, a problem data response module and an early warning terminal.

[0050] The data doubt judgment module is connected to the flow data capture module, the problem data response module and the early warning terminal respectively.

[0051] The flow data capture module is used to perform real-time monitoring on each transmission data packet of the Internet, and then capture each suspicious data packet. When each suspicious data packet is captured, each suspicious data packet is placed in a corresponding area according to the data packet level.

[0052] The data doubt judgment module is used to store each doubtful data packet in the placement area, perform corresponding analysis and restoration on each doubtful data packet, and perform corresponding supervision and detection on each doubtful data packet after analysis, so as to determine whether each doubtful data packet is a malicious data packet, extract the corresponding features of each malicious data packet, and determine the malicious type corresponding to each malicious data packet.

[0053] The problem data response module is used to analyze and obtain the response measures corresponding to the malicious types of each malicious data packet based on the malicious types corresponding to each malicious data packet.

[0054] The early warning terminal is used to issue an early warning prompt when the supervision finds that a suspicious data packet is a malicious data packet.

[0055] The embodiment of the present invention performs real-time supervision on each transmission data packet of the Internet, thereby capturing each suspicious data packet, and performing corresponding analysis and restoration on each suspicious data packet to determine whether each suspicious data packet is a malicious data packet, and at the same time extracts the corresponding features of each malicious data packet, determines the malicious type corresponding to each malicious data packet, and thereby analyzes and obtains the corresponding malicious type of each malicious data packet. The countermeasures of the malicious type, ensure the security of Internet data in acquisition and transmission, reduce the application security corresponding to the Internet data, and solve the deficiencies in the current technology. At the same time, based on the determination of the malicious data packet corresponding to the Internet data, the rapid and efficient discovery of data risks is achieved, thereby achieving timely prevention of data security risk measures, ensuring the availability and security of Internet data, timely terminating the transmission of malicious data packets, reducing the damage caused by malicious data, reducing the interference of junk information and malicious content, and efficiently and comprehensively maintaining the security rights and interests of users. Based on the automated Internet data processing supervision method, the workload and detection cost of manual supervision and auditing are effectively reduced, the efficiency of Internet data security supervision is improved, and the timely processing of malicious data is guaranteed.

[0056] The above contents are merely examples and explanations of the concept of the present invention. Those skilled in the art may make various modifications or additions to the specific embodiments described or replace them in a similar manner. As long as they do not deviate from the concept of the invention or exceed the scope defined in this specification, they shall all fall within the protection scope of the present invention.

Claims

1. A method for supervising Internet data processing, characterized in that: include: Step 1: Capture flow data: Real-time monitoring of each Internet transmission data packet is performed to capture each suspicious data packet. When each suspicious data packet is captured, the placement area corresponding to each suspicious data packet is obtained according to the data packet level; Step 2: Data suspicion judgment: After each suspicious data packet is stored in the placement area, the corresponding analysis and restoration is performed on each suspicious data packet, and the corresponding supervision and detection is performed on each suspicious data packet after analysis, so as to determine whether each suspicious data packet is a malicious data packet, and extract the corresponding features of each malicious data packet to determine the malicious type corresponding to each malicious data packet; Step 3: Response to problem data: Based on the malicious type corresponding to each malicious data packet, the response measures corresponding to the malicious type of each malicious data packet are analyzed; Step 4: Early warning: When the supervisor finds that a suspicious data packet is a malicious data packet, an early warning will be issued.

2. A method for supervising Internet data processing as claimed in claim 1, characterized in that: The capture process is as follows: Based on the known type feature data of each Internet transmission data packet stored in the rule base, the transmission supervision of the corresponding Internet transmission data packet is directly performed. By using the crawler technology to send the corresponding HTTP request to each Internet transmission data packet, the HTML and XML documents corresponding to each Internet transmission data packet are captured, and the transmission features corresponding to each current Internet transmission data packet are extracted, including burst traffic, server errors, request return errors and connection surges. The features extracted from each Internet transmission data packet are compared with the various questionable transmission features of the corresponding historical transmission data packets in the rule base. If the extracted feature of a certain Internet transmission data packet is the same as a certain questionable transmission feature of the corresponding historical transmission data packet in the rule base, then the transmission data packet is determined to be a questionable data packet, and each questionable data packet is captured.

3. A method for supervising Internet data processing as claimed in claim 1, characterized in that: The corresponding analysis and restoration is performed on each suspicious data packet, and the corresponding supervision and detection is performed on each suspicious data packet after analysis, so as to determine whether each suspicious data packet is a malicious data packet. The specific determination process is as follows: A protocol analysis tool is used to parse and restore each suspicious data packet corresponding to the placement area. Based on the function of the protocol analysis tool, field information data corresponding to each suspicious data packet is extracted, where the field information includes source address, destination address, protocol type and load data, so as to complete the parsing and restoration of each suspicious data packet, and compare the field information data extracted from each suspicious data packet with the field features corresponding to the malicious data in the rule base. If the field information data extracted from a suspicious data packet is consistent with a field feature corresponding to the malicious data in the rule base, the suspicious data is determined to be malicious data, so as to determine whether each suspicious data packet is a malicious data packet.

4. A method for supervising Internet data processing as claimed in claim 1, characterized in that: The features corresponding to each malicious data packet are extracted to determine the malicious type corresponding to each malicious data packet. The specific determination process is as follows: Extract features from each malicious data packet, and then obtain feature data corresponding to each malicious data packet, compare each data feature corresponding to each malicious data packet with each malicious feature set stored in the rule base, if a data feature corresponding to a malicious data packet is in a certain type of malicious feature set stored in the rule base, then use the malicious type corresponding to the malicious feature set in the rule base as the malicious type of the malicious data packet, and in this way, obtain the malicious type corresponding to each malicious data packet; Q1. Extract features from each malicious data packet. When the features extracted from each malicious data packet are data content, number of modifications and hash value, if the features extracted from a malicious data packet show that the data content is inconsistent with the original version, the same data file is frequently modified or the hash value is inconsistent, then the malicious data packet is determined to be malicious, and the transmission application of the malicious data packet is immediately stopped, and the malicious features extracted from the malicious data packet are compared with the corresponding malicious features in the rule library. If the malicious features extracted from the malicious data packet are the same as the corresponding malicious features in the rule library, the malicious tampering type corresponding to the malicious feature in the rule library is used as the malicious type of the malicious data packet.

5. A method for supervising Internet data processing as claimed in claim 4, characterized in that: The malicious type corresponding to each malicious data packet is obtained by analogy, and the specific analogy process is as follows: R1. When the features extracted from each malicious data packet are the number of visits, active time period, access source and calling operation, if the features extracted from a malicious data packet show a sudden increase in the number of visits, unconventional access time period, unknown location and unconventional research method, then the malicious data packet is judged to be malicious, and the malicious features extracted from the malicious data packet are compared with the corresponding malicious features in the rule base. If the malicious features extracted from the malicious data packet are the same as the corresponding malicious features in the rule base, the abnormal access type corresponding to the malicious feature in the rule base is used as the malicious type of the malicious data packet.

6. A method for supervising Internet data processing as claimed in claim 4, characterized in that: The malicious type corresponding to each malicious data packet is obtained by analogy, and the specific analogy process is as follows: W1. When the features extracted from each malicious data packet are file extension, network traffic, executable file and warning interception record, if the features extracted from a malicious data packet show the appearance of a new file extension, an abnormal surge in network traffic, the executable file contains malicious code based on static code analysis, or the number of warning interceptions corresponding to the firewall, then the malicious data packet is judged to be malicious, and the malicious features extracted from the malicious data packet are compared with the corresponding malicious features in the rule base. If the malicious features extracted from the malicious data packet are the same as the corresponding malicious features in the rule base, the type of illegal malware corresponding to the malicious feature in the rule base is used as the malicious type of the malicious data packet.

7. A method for supervising Internet data processing as claimed in claim 1, characterized in that: The analysis obtains the corresponding countermeasures for each malicious data packet and the malicious type. The specific analysis process is as follows: Compare the malicious type corresponding to each malicious data packet with the malicious type corresponding to each countermeasure stored in the rule base. If the malicious type corresponding to a malicious data packet is the same as a malicious type corresponding to a countermeasure stored in the rule base, then use the countermeasure corresponding to a malicious type in the rule base as the malicious type of the malicious data packet. In this way, measure matching is performed to obtain the countermeasure corresponding to the malicious type of each malicious data packet. When the malicious type corresponding to a malicious data packet is a malicious tampering type: the malicious data packet is returned to the initial data packet state through a retransmission mechanism or a repair mechanism, and the encryption security value corresponding to each encryption method is obtained. The encryption method with the first encryption security value is used as the encryption method of the malicious data packet, and the countermeasures for the malicious data packet being maliciously tampered with are completed.

8. A method for supervising Internet data processing as claimed in claim 7, characterized in that: The specific matching process is as follows: When the malicious type corresponding to a malicious data packet is an abnormal access type: When a malicious data packet is abnormally accessed, the access end corresponding to the malicious data packet is comprehensively analyzed, and corresponding speed limits or blocks are implemented on unknown or specific location ends to deal with the abnormal access of the malicious data packet, and the response measures corresponding to the abnormal access of each malicious data packet are analyzed.

9. A method for supervising Internet data processing as claimed in claim 7, characterized in that: The specific matching process is as follows: When the malicious type corresponding to a malicious data packet is the type that carries illegal malware: by deploying the corresponding firewall and intrusion detection system, turning on the corresponding protection and detection options of the firewall and intrusion detection system, and setting the corresponding malicious interval, and installing anti-virus software to scan network traffic regularly, in order to deal with the malicious tampering of malicious data packets, analyze and obtain the corresponding countermeasures for malicious tampering of each malicious data packet.

10. A system for supervising Internet data processing for executing the method for supervising Internet data processing according to any one of claims 1 to 9, characterized in that: include: A flow data capture module is used to perform real-time monitoring on each transmission data packet of the Internet, and then capture each suspicious data packet. When each suspicious data packet is captured, each suspicious data packet is placed in a corresponding area according to the data packet level; The data doubt judgment module is used to store each doubtful data packet in the placement area, perform corresponding analysis and restoration on each doubtful data packet, and perform corresponding supervision and detection on each doubtful data packet after analysis, so as to determine whether each doubtful data packet is a malicious data packet, extract the corresponding features of each malicious data packet, and determine the malicious type corresponding to each malicious data packet; A problem data response module is used to analyze and obtain response measures for each malicious data packet based on the malicious type corresponding to each malicious data packet; The early warning terminal is used to issue an early warning prompt when the supervision finds that a suspicious data packet is a malicious data packet.

Images