Network security monitoring method and device based on network traffic, equipment and storage medium

Abstract

The invention belongs to the technical field of network security monitoring, and discloses a network security monitoring method, device and equipment based on network traffic, and a storage medium, and the method comprises the steps: obtaining network traffic data flowing into a switch; analyzing the network flow data to obtain network flows respectively corresponding to a plurality of application devices accessing the switch; based on the network traffic corresponding to each application device, performing address access and protocol traffic identification analysis, abnormal traffic analysis and specific feature analysis on the application device to obtain a corresponding first analysis result, a corresponding second analysis result and a corresponding third analysis result, according to the three analysis results, whether network security abnormity exists in each application device is judged, and if yes, abnormal behaviors are positioned and recognized; the network security risk is determined according to the abnormal behavior, and monitoring is performed based on the network security risk, so that the abnormal traffic and the abnormal behavior can be accurately identified and detected, and the network security can be effectively monitored.

Description

Technical Field

[0001] The present invention relates to the technical field of network security monitoring, and in particular to a network security monitoring method, device, equipment and storage medium based on network traffic. Background Art

[0002] Currently, the Internet is increasingly becoming an indispensable and important foundation for people's production and life. Its network security has gone beyond the scope of technical security and system protection, and has become a comprehensive security involving various fields such as economy and society.

[0003] With the expansion of computer network scale and diversification of applications, network traffic data presents huge scale and complex characteristics. Traditional computer network traffic analysis methods can no longer meet the current requirements for accurate identification and detection of abnormal traffic and abnormal behavior, and cannot effectively monitor network security.

[0004] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention

[0005] The main purpose of the present invention is to provide a network security monitoring method, device, equipment and storage medium based on network traffic, aiming to solve the technical problem that traditional computer network traffic analysis methods can no longer meet the current requirements for accurate identification and detection of abnormal traffic and abnormal behavior, and cannot effectively monitor network security.

[0006] To achieve the above object, the present invention provides a network security monitoring method based on network traffic, the network security monitoring method based on network traffic comprising the following steps:

[0007] Get the network traffic data flowing into the switch;

[0008] Analyze the network traffic data to obtain network traffic corresponding to each of the plurality of application devices connected to the switch;

[0009] Based on the network traffic corresponding to each of the application devices, address access and protocol traffic identification analysis, abnormal traffic analysis, and specific feature analysis are performed on the application devices to obtain corresponding first analysis results, second analysis results, and third analysis results;

[0010] Determine whether each application device has a network security anomaly according to the first analysis result, the second analysis result, and the third analysis result, and if so, locate and identify the network security anomaly;

[0011] A network security risk is determined according to the network security anomaly, and monitoring is performed based on the network security risk.

[0012] In some embodiments, analyzing the network traffic data to obtain network traffic corresponding to each of several application devices connected to the switch includes:

[0013] Parsing the network traffic data to obtain processed network traffic data;

[0014] Determine the application device connected to each port of the switch based on the port mapping relationship of the switch and the preset connection information;

[0015] Constructing a mapping relationship between each application device and the corresponding IP address based on the processed network traffic data;

[0016] The network traffic data is classified based on the mapping relationship to obtain the network traffic generated by each application device.

[0017] In some embodiments, the parsing and processing the network traffic data to obtain processed network traffic data includes:

[0018] Unifying the packet header length and the load length of the network flow data to obtain first network flow data;

[0019] Identify redundant traffic data in the first network traffic data that is unrelated to application classification or traffic characteristics, and perform traffic filtering on the first network traffic data based on the redundant traffic data to obtain second network traffic data;

[0020] Performing traffic segmentation on the second network traffic data based on the data packet header field of the network traffic data to obtain third network traffic data;

[0021] The data packet structure of the third network traffic data is adjusted to obtain processed network traffic data.

[0022] In some embodiments, the address access and protocol traffic identification analysis, abnormal traffic analysis, and specific feature analysis are performed on the application devices based on the network traffic corresponding to each of the application devices to obtain the corresponding first analysis result, second analysis result, and third analysis result, including:

[0023] Extracting traffic behavior characteristics from the network traffic corresponding to each of the application devices;

[0024] Determine the time point when the abnormal behavior occurs based on the traffic behavior characteristics;

[0025] Analyze several destination IP addresses with the largest traffic at the time when the abnormal behavior occurred;

[0026] Identifying abnormal IP addresses among the plurality of destination IP addresses based on fine-grained traffic parameters of sub-flows formed within a historical time window;

[0027] Determine changes in characteristic behavior parameters of the abnormal IP address within a preset time to obtain a first analysis result, wherein the characteristic behavior parameters at least include a connection port corresponding to the address and a number of accesses corresponding to the address;

[0028] Performing abnormal traffic analysis on the application devices based on the network traffic corresponding to each of the application devices to obtain a second analysis result;

[0029] Based on the network traffic corresponding to each of the application devices, specific feature analysis is performed on the application devices to obtain a third analysis result.

[0030] In some embodiments, the performing abnormal traffic analysis on the application devices based on the network traffic corresponding to each of the application devices to obtain the second analysis result includes:

[0031] Calculating a baseline vector difference based on the network traffic corresponding to each of the application devices;

[0032] Determining the probability distribution relationship of abnormal traffic time series characteristics according to the baseline vector difference;

[0033] Determine the abnormal traffic time series characteristics according to the probability distribution relationship;

[0034] Determine a deviation estimate of the abnormal flow according to the abnormal flow time series characteristics;

[0035] An abnormal flow analysis is performed based on the deviation estimation value to obtain a second analysis result.

[0036] In some embodiments, performing specific feature analysis on the application devices based on the network traffic corresponding to each of the application devices to obtain a third analysis result includes:

[0037] Extracting network traffic behavior characteristics from the network traffic corresponding to each of the application devices;

[0038] A normalization algorithm is used to map the traffic behavior feature values ​​of different dimensions into the same dimension, thus obtaining network traffic behavior features with the same dimension.

[0039] Re-mapping the network traffic behavior features having the same dimension to a new space using a preset kernel function;

[0040] Based on the preset kernel function, a support vector machine is used to perform specific feature analysis based on the network traffic behavior characteristics of the new space to obtain a third analysis result.

[0041] In some embodiments, determining a network security risk according to the network security anomaly and monitoring based on the network security risk includes:

[0042] Determine the anomaly type of the network security anomaly;

[0043] Determine the risk weight corresponding to the abnormal type based on the type number corresponding to the abnormal type;

[0044] A cybersecurity risk is determined based on the risk weight.

[0045] In addition, to achieve the above-mentioned purpose, the present invention also proposes a network security monitoring device based on network traffic, and the network security monitoring device based on network traffic includes:

[0046] An acquisition module, used to acquire network traffic data flowing into the switch;

[0047] An analysis module, used for analyzing the network flow data to obtain the network flow corresponding to each of the plurality of application devices connected to the switch;

[0048] A detection module, configured to perform address access and protocol traffic identification analysis, abnormal traffic analysis, and specific feature analysis on the application devices based on the network traffic corresponding to each of the application devices, so as to obtain corresponding first analysis results, second analysis results, and third analysis results;

[0049] A judgment module, configured to judge whether each application device has a network security anomaly according to the first analysis result, the second analysis result and the third analysis result, and if so, locate and identify the network security anomaly;

[0050] An assessment module is used to determine network security risks according to the network security anomalies and to perform monitoring based on the network security risks.

[0051] The present invention obtains network traffic data flowing into a switch; analyzes the network traffic data to obtain network traffic corresponding to a plurality of application devices connected to the switch; performs address access and protocol traffic identification analysis, abnormal traffic analysis, and specific feature analysis on the application devices based on the network traffic corresponding to each application device to obtain corresponding first analysis results, second analysis results, and third analysis results, and determines whether each application device has network security anomalies based on the three analysis results, and if so, locates and identifies the abnormal behavior; determines network security risks based on the abnormal behavior, and monitors based on the network security risks. Through the above-mentioned method, abnormal traffic and abnormal behavior can be accurately identified and detected, and network security can be effectively monitored. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 It is a flow chart of a first embodiment of a network security monitoring method based on network traffic of the present invention;

[0053] Figure 2 It is a schematic diagram of the overall technical solution flow in the network security monitoring method based on network traffic of the present invention;

[0054] Figure 3 It is a schematic diagram of the overall architecture of the network security monitoring method based on network traffic of the present invention;

[0055] Figure 4 A schematic diagram of the technical architecture of the network security monitoring method based on network traffic of the present invention;

[0056] Figure 5 It is a schematic diagram of the functional architecture of the network security monitoring method based on network traffic of the present invention;

[0057] Figure 6 It is a flow chart of a second embodiment of the network security monitoring method based on network traffic of the present invention;

[0058] Figure 7 It is a structural block diagram of the first embodiment of the network security monitoring device based on network traffic of the present invention.

[0059] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0060] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0061] The embodiment of the present invention provides a network security monitoring method based on network traffic, referring to Figure 1 , Figure 1 The present invention is a flowchart of a first embodiment of a network security monitoring method based on network traffic.

[0062] In this embodiment, the network security monitoring method based on network traffic includes the following steps:

[0063] Step S10: Acquire network traffic data flowing into the switch.

[0064] In this embodiment, the executor of this embodiment is a network security monitoring device based on network traffic, wherein the network security monitoring device based on network traffic has functions such as data processing, data communication and program running. The network security monitoring device based on network traffic can be a computer terminal device or other network device, and of course it can also be other devices with similar functions, and this embodiment does not limit this.

[0065] It should be noted that with the expansion of computer network scale and diversification of applications, network traffic data presents huge scale and complex characteristics. Traditional computer network traffic analysis methods can no longer meet the current requirements for accurate identification and detection of abnormal traffic and abnormal behavior, and cannot effectively monitor network security.

[0066] In order to solve the above technical problems, this embodiment obtains network traffic data flowing into the switch; analyzes the network traffic data to obtain the network traffic corresponding to several application devices connected to the switch; based on the network traffic corresponding to each application device, performs address access and protocol traffic identification analysis, abnormal traffic analysis and specific feature analysis on the application device to obtain the corresponding first analysis result, second analysis result and third analysis result, and judges whether each application device has network security anomalies based on the three analysis results. If so, locate and identify the abnormal behavior; determine network security risks based on the abnormal behavior, and monitor based on the network security risks. Through the above methods, abnormal traffic and abnormal behavior can be accurately identified and detected, and network security can be effectively monitored. Specifically, it can be achieved in the following way.

[0067] In the specific implementation, in this embodiment, it is necessary to first obtain the network traffic data flowing into the switch. Obtaining the network traffic data flowing through the switch can make the network security monitoring more comprehensive. The overall technical solution of this embodiment can refer to Figure 2As shown, it mainly includes 1. Traffic analysis and identification of address access and protocol. Address access analysis: mainly classifies and summarizes the access to addresses in network traffic, counts the number of address accesses, access traffic, etc., and analyzes whether there are abnormal access situations. 2. Protocol identification: mainly analyzes whether there is any behavior of using controlled or disabled ports in the network based on the port usage specifications and requirements in the management specifications. 3. Abnormal traffic analysis based on traffic statistics, including abnormal analysis of excessive traffic of the network TCP handshake protocol: grouping the access traffic of the TCP handshake protocol in the network environment, and analyzing and summarizing the data of excessive traffic. Abnormal traffic analysis of address access times: statistical analysis of the traffic with the same source IP address, destination IP address, protocol, and destination port in the network environment, and analyzes the traffic information with too many access times. 4. Access behavior analysis based on special features, including HTTP proxy behavior analysis: the existence of HTTP proxy or privately built proxy server environment in the network, to achieve the behavior analysis of access to the network. Behavior analysis of access to the network through mobile phones: the use of 360 wireless wifi in the network environment to achieve the behavior analysis of access to the network. 5. Real-time analysis of network traffic and security risk research, including real-time capture and analysis of network communication traffic, discovery and location of existing network security behaviors. The overall architecture based on which the above technical solution is implemented in this embodiment can be referred to Figure 3 As shown, based on the mode combining B / S and Windows services, it mainly includes monitoring end (monitoring program) and management end. Monitoring end: runs in the server device in the form of Windows service, and monitors the traffic flowing through the switch by mirroring the switch port, and parses and analyzes the traffic packets, realizes security detection and monitoring of network security in the network environment, and issues early warning notifications for abnormal network security issues; Management end: runs in the server in the form of B / S, and mainly realizes: basic configuration of the project, alarm notification maintenance, network security analysis results display, etc. Further, the specific technical architecture can refer to Figure 4As shown in the figure, the display layer is mainly a page display implemented by html+css, JSP, and JavaScript technology, which is used to complete the display of business data and the related logic of human-computer interaction. The presentation layer receives user input and converts the user's intention into a call to the business layer related logic. The display layer also involves the implementation of related business. In order to separate data presentation from business logic, the J2EE standard multi-layer application architecture Web framework is introduced in the presentation layer. The business layer mainly completes the business logic of enterprise applications and is the core part of the system. This layer is responsible for verifying the data input by users from the presentation layer and performing business processing according to the user instructions of the presentation layer. Ordinary business is to interact with the J2EE application server through Restful to complete related business operations. The data layer is composed of the data persistence layer framework MyBATIS and the database Oracle. It is mainly responsible for data access, maintaining the relationship between various data, completing the persistence of data through user calls, and ensuring the security of the data source of the entire system. It is used to support the data operation service of the business layer and complete the communication between the business layer and the data layer. The collection / analysis layer is implemented through JAVA and C#. On the one hand, it realizes the collection of basic data and interacts with the data layer. On the other hand, it captures the data source from the service layer and realizes the analysis of basic data. The infrastructure service layer provides the basic service layer of this system and is the carrier of system deployment. At the same time, based on the switch equipment, it realizes the acquisition of network traffic data and realizes the smooth flow of the network to ensure the normal operation and display of the system. Functional architecture is as follows Figure 5As shown, the system is mainly divided into traffic capture and analysis, basic configuration, traffic statistics analysis, traffic access analysis, access behavior analysis, port identification analysis, and user management. Traffic capture and analysis: 1. Network traffic capture, through port mirroring technology, the switch is used to collect traffic, and all traffic flowing through the switch is captured through WinPcap. 2. Network traffic analysis uses Redis cache, multi-level queues and multi-threading technologies to achieve real-time analysis of large traffic data, and obtain key elements such as source address, destination address, destination port, protocol type, etc. at high speed and high precision. Basic configuration: Modify the system configuration information and other operations, mainly including: alarm format configuration, traffic collection configuration, etc. Traffic statistics analysis: Statistical analysis of the traffic with the same source IP address, destination IP address, protocol, and destination port in the network environment, and analyze the traffic information with too many access times. Traffic access analysis: It mainly classifies and summarizes the access to addresses in the network traffic, counts the number of accesses to the address, access traffic, etc., and analyzes whether there is abnormal access. Access behavior analysis: 1. HTTP proxy behavior analysis: There is an HTTP proxy or a privately built proxy server environment in the network to achieve behavior analysis of access to the network. 2. Analysis of the behavior of accessing the network through mobile phones: Analysis of the behavior of accessing the network by using 360 wireless WIFI in the network environment. Port identification analysis: mainly based on the port usage specifications and requirements in the "State Grid Corporation Information System Remote Access Port Management Specifications" issued by the State Grid Corporation, analyze whether there is any behavior of using controlled or disabled ports in the network. SMS alarm configuration: Maintain the SMS alarm configuration function and implement the SMS alarm function. User management: mainly manage the user information that can log in to the system. Provide the function of adding and deleting users.

[0068] Step S20: Analyze the network traffic data to obtain the network traffic corresponding to each of the plurality of application devices connected to the switch.

[0069] After obtaining the above network flow data, in this embodiment, the network flow data is analyzed to obtain the network flow corresponding to each of the several application devices connected to the switch.

[0070] Specifically, the network traffic data is parsed and processed to obtain processed network traffic data; the application devices connected to each port of the switch are determined based on the port mapping relationship of the switch and preset connection information; a mapping relationship between each application device and the corresponding IP address is established according to the processed network traffic data; the network traffic data is classified based on the mapping relationship to obtain the network traffic generated by each application device.

[0071] It should be noted that the switch port mapping relationship refers to the protocol corresponding to each port. The preset connection information contains the connection information of each device, such as the corresponding connected port. Through these two pieces of information, the application device connected to each port can be determined, and then the corresponding IP address can be obtained based on the network traffic data. Finally, the network traffic generated by each application device can be obtained through the mapping relationship. In the above way, network security monitoring can locate each application device.

[0072] Furthermore, the process of parsing and processing the network traffic data to obtain processed network traffic data specifically includes unifying the packet header length and the load length of the network traffic data to obtain first network traffic data; identifying redundant traffic data in the first network traffic data that is not related to application classification or traffic characteristics, and filtering the first network traffic data based on the redundant traffic data to obtain second network traffic data; performing traffic segmentation on the second network traffic data based on the data packet header field of the network traffic data to obtain third network traffic data; and adjusting the data packet structure of the third network traffic data to obtain processed network traffic data.

[0073] It should be noted that the header length and the load length can be unified by adjusting the load length to be consistent with the header length based on the header length, or by adjusting the header length to be consistent with the load length based on the load length, or by adjusting the load length and the header length to be consistent with the preset length based on the preset length. The specific method can be selected according to actual needs, and this is not limited in this embodiment. Traffic filtering is to remove redundant traffic data that is not related to application classification or traffic characteristics from the first network traffic data, such as SYN packets and FIN packets for establishing and dismantling TCP connections, DNS packets for resolving domain names to IP addresses, etc. Traffic segmentation is to segment network traffic data according to five categories: source IP address, destination IP address, source port number, destination port number, and protocol. The adjustment of the data packet structure is to remove the Ethernet frame header, such as the source MAC, destination MAC, type, and FCS fields in the data packet header, and for the load, retain the first 150 bytes of the payload.

[0074] Step S30: Based on the network traffic corresponding to each of the application devices, address access and protocol traffic identification analysis, abnormal traffic analysis and specific feature analysis are performed on the application devices to obtain corresponding first analysis results, second analysis results and third analysis results.

[0075] It should be noted that in this embodiment, network security-related monitoring of application devices is performed through three dimensions. The first dimension is address access and protocol traffic identification analysis, which is aimed at the access analysis of abnormal IP addresses. The second dimension is abnormal traffic analysis, which is aimed at the analysis of abnormal traffic that occurs. The third dimension is specific feature analysis, which is aimed at the analysis of abnormal network behavior.

[0076] Step S40: judging whether each application device has a network security anomaly based on the first analysis result, the second analysis result and the third analysis result; if so, locating and identifying the network security anomaly.

[0077] After obtaining the above three analysis results, based on the above analysis, it can be determined whether there is an abnormal IP address, whether there is abnormal traffic, and whether there is abnormal behavior. If at least one exists, it is determined that the corresponding application device has a network security anomaly, that is, at least one of the above first analysis result, the second analysis result, and the third analysis result is an abnormal analysis result. If there is a network security anomaly, the network security anomaly can be directly located, and the network security anomaly can be determined in combination with the above analysis results. For example, the network security anomaly is the simultaneous existence of abnormal traffic and abnormal network behavior, or the network security anomaly is the access of only abnormal IP addresses.

[0078] Step S50: determining network security risks according to the network security anomalies, and performing monitoring based on the network security risks.

[0079] In a specific implementation, after locating and identifying the network security anomaly, the anomaly type of the network security anomaly can be further determined in this embodiment, thereby determining the type number corresponding to the anomaly type. For example, assuming that the number of types is 3, that is, the network security anomaly is the access of abnormal IP addresses, abnormal traffic, and abnormal network behavior at the same time, then the weights corresponding to the three anomaly types are L, M, and N. Assuming that the only anomaly type is abnormal network behavior, the number of types is 1, and the corresponding weight becomes N', that is, the corresponding weight will change with different types and quantities. After determining the weight, each anomaly has its corresponding risk score, and the final network security risk score can be obtained through weighted calculation, and evaluation and monitoring can be achieved through this score.

[0080] This embodiment obtains network traffic data flowing into the switch; analyzes the network traffic data to obtain the network traffic corresponding to each of the several application devices connected to the switch; performs address access and protocol traffic identification analysis, abnormal traffic analysis, and specific feature analysis on the application devices based on the network traffic corresponding to each application device to obtain the corresponding first analysis result, second analysis result, and third analysis result, and determines whether each application device has network security anomalies based on the three analysis results, and if so, locates and identifies the abnormal behavior; determines network security risks based on the abnormal behavior, and monitors based on the network security risks. Through the above methods, abnormal traffic and abnormal behavior can be accurately identified and detected, and network security can be effectively monitored.

[0081] refer to Figure 6 , Figure 6 The present invention is a flowchart of a second embodiment of a network security monitoring method based on network traffic.

[0082] Based on the above first embodiment, in the network security monitoring method based on network traffic in this embodiment, step S30 further includes:

[0083] Step S301: extracting traffic behavior characteristics from the network traffic corresponding to each of the application devices.

[0084] The traffic behavior features extracted in this embodiment include, but are not limited to, the number of flows, the number of packets, the number of bytes, the source IP address, the destination IP address, the source autonomous domain number, the destination autonomous domain number, and the destination port number.

[0085] Step S302: Determine the time point when the abnormal behavior occurs based on the traffic behavior characteristics.

[0086] By dividing time into a series of time intervals and counting the network traffic information in each time interval, the information entropy of attribute X in the time interval is defined as follows:

[0087]

[0088] Among them, P i is the probability of a certain value in attribute X, and N is the number of all possible values ​​in attribute X. By analyzing the above information entropy P, the time point when the abnormal behavior occurs can be determined. The specific process is as follows:

[0089] Input - network traffic behavior characteristic information;

[0090] Output - the time point at which the normal behavior occurs.

[0091] 1) Let a=a0;

[0092] 2) Initialize the current time point;

[0093] 3) while {the current time point belongs to the time point to be detected}

[0094] 4) Calculate the change h of the information entropy at the current time point compared to the value at the previous time point;

[0095] 5) if h>a

[0096] 6) Mark the current time point as an abnormal time point;

[0097] 7)end if

[0098] 8) Current time point++;

[0099] 9) end while

[0100] Step S303: Analyze several destination IP addresses with the largest traffic at the time when the abnormal behavior occurs.

[0101] Step S304: Identify abnormal IP addresses among the plurality of destination IP addresses based on the fine-grained traffic parameters of the sub-flows constructed within the historical time window.

[0102] Since the mapping relationship has been established in the foregoing, in this embodiment, several destination IP addresses with the largest traffic at the time when the abnormal behavior occurs can be obtained based on the network traffic corresponding to each application device.

[0103] Furthermore, the traffic size corresponding to each destination IP address at the abnormal time point is sorted, and the top N destination IP addresses in traffic ranking are extracted; then, for each filtered destination IP address, the sub-flow containing the destination IP address at each time point in the historical time window is extracted; then, the values ​​of each traffic behavior characteristic parameter of the sub-flow and its change ratio are calculated; finally, the abnormal IP address is determined based on the change trend and change ratio of the traffic behavior characteristic parameter values ​​of the traffic corresponding to each destination IP address.

[0104] Step S305: Determine changes in characteristic behavior parameters of the abnormal IP address within a preset time to obtain a first analysis result.

[0105] The characteristic behavior parameters in this embodiment include the connection port corresponding to the address, and the number of accesses corresponding to the address. The change within the preset time refers to whether there is a change in the behavior of using a controlled or disabled port, and a sudden increase in the number of accesses to exceed the average number of accesses under the normal access state. If there is a behavior of using a controlled or disabled port or the number of accesses suddenly increases to exceed the average number of accesses under the normal access state, it can be determined that there is a network security anomaly.

[0106] Step S306: performing abnormal traffic analysis on the application devices based on the network traffic corresponding to each of the application devices to obtain a second analysis result.

[0107] In a specific implementation, abnormal traffic analysis is performed on the application devices based on the network traffic corresponding to each of the application devices, and the process of obtaining the second analysis result specifically includes calculating a baseline vector difference based on the network traffic corresponding to each of the application devices; determining a probability distribution relationship of abnormal traffic timing characteristics based on the baseline vector difference; determining abnormal traffic timing characteristics based on the probability distribution relationship; determining a deviation estimate of the abnormal traffic based on the abnormal traffic timing characteristics; and performing abnormal traffic analysis based on the deviation estimate to obtain a second analysis result.

[0108] It should be noted that the calculation formula of the baseline vector difference is: Where Q represents the distribution coefficient of the abnormal traffic key vector; Q m represents the abnormal traffic range; e represents the statistical vector of bidirectional transmission data flow; Represents the baseline mean of normal traffic services; Represents the baseline mean of abnormal traffic services. Based on the above baseline vector difference, the probability distribution relationship can be obtained. in, represents the mean vector; σ represents the degree of fluctuation; U represents the variance matrix, λ=(A,B,β), A represents the continuous distribution weight; B represents the observation sequence; β represents the continuous observation variable. Further, the abnormal traffic time series characteristics are Among them, a represents the learning rate; γ1 and γ0 represent the forward probability and backward probability respectively; α represents the data flow time window. Finally, according to the above abnormal traffic time series characteristics, the deviation estimation value of the abnormal traffic can be obtained. Among them, E i represents the initial injection discrete expectation, A i Represents the expected mean. When the unbiased estimate is close to 1, it proves that the dispersion of network traffic is high and there are abnormal traffic.

[0109] Step S307: performing specific feature analysis on the application devices based on the network traffic corresponding to each of the application devices to obtain a third analysis result.

[0110] In a specific implementation, a specific feature analysis is performed on the application devices based on the network traffic corresponding to each of the application devices, and the process of obtaining the third analysis result specifically includes extracting network traffic behavior characteristics from the network traffic corresponding to each of the application devices; using a normalization algorithm to map traffic behavior feature values ​​of different dimensions to the same dimension to obtain network traffic behavior characteristics with the same dimension; using a preset kernel function to remap the network traffic behavior characteristics with the same dimension to a new space; and using a support vector machine on the basis of the preset kernel function to perform specific feature analysis based on the network traffic behavior characteristics in the new space to obtain the third analysis result.

[0111] It should be noted that the formula corresponding to the normalization algorithm is Where b' represents the normalized value in the feature value set; b represents any feature in the feature set; max b Indicates the maximum value of this type of feature in the collection; min b Indicates the minimum value of this type of feature in the set. Then, in the process of using the support vector machine to classify the network traffic behavior features, each byte of the extracted traffic behavior features is used as the input vector, and a cycle is used as the complete process of iterative calculation, which can be expressed by the following formula: z = {T, ID, b1, b2, ...}, where z represents the input vector of the support vector machine; T represents the cycle; ID represents the message in the network, and mapping it to the new space is The preset sum function, i.e., H, can be a radial basis function. Finally, a specific feature analysis is performed to classify abnormal behavior, for example, x = sign[bkH(b)], k is the flow state label, k∈[-1,1], where 1 represents normal behavior and -1 represents abnormal behavior. If the final result of the above x is 1, it is normal behavior; if the result is -1, it is abnormal behavior.

[0112] This embodiment extracts traffic behavior characteristics from the network traffic corresponding to each of the application devices; determines the time point when the abnormal behavior occurs based on the traffic behavior characteristics; analyzes several destination IP addresses with the largest traffic at the time point when the abnormal behavior occurs; identifies abnormal IP addresses among the several destination IP addresses based on the fine-grained traffic parameters of the sub-flows constituted in the historical time window; determines the changes in the characteristic behavior parameters of the abnormal IP addresses within a preset time to obtain a first analysis result, wherein the characteristic behavior parameters at least include the connection port corresponding to the address and the number of visits corresponding to the address; calculates a baseline vector difference based on the network traffic corresponding to each of the application devices; determines the probability distribution relationship of the abnormal traffic timing characteristics based on the baseline vector difference; and determines the probability distribution relationship of the abnormal traffic timing characteristics based on the probability distribution relationship. The system determines the time series characteristics of abnormal traffic; determines the deviation estimation value of abnormal traffic according to the time series characteristics of abnormal traffic; performs abnormal traffic analysis based on the deviation estimation value to obtain a second analysis result; extracts network traffic behavior characteristics from the network traffic corresponding to each of the application devices; uses a normalization algorithm to map traffic behavior characteristic values ​​of different dimensions to the same dimension to obtain network traffic behavior characteristics with the same dimension; uses a preset kernel function to remap the network traffic behavior characteristics with the same dimension to a new space; uses a support vector machine based on the preset kernel function to perform specific feature analysis based on the network traffic behavior characteristics of the new space to obtain a third analysis result. The above method can accurately identify network security anomalies and ensure the effectiveness of network security monitoring.

[0113] Reference Figure 7 , Figure 7 It is a structural block diagram of the first embodiment of the network security monitoring device based on network traffic of the present invention.

[0114] like Figure 7 As shown, the network security monitoring device based on network traffic proposed in the embodiment of the present invention includes:

[0115] The acquisition module 10 is used to acquire network traffic data flowing into the switch.

[0116] The analysis module 20 is used to analyze the network traffic data to obtain the network traffic corresponding to each of the plurality of application devices connected to the switch.

[0117] The detection module 30 is used to perform address access and protocol traffic identification analysis, abnormal traffic analysis and specific feature analysis on the application devices based on the network traffic corresponding to each application device, so as to obtain the corresponding first analysis result, second analysis result and third analysis result.

[0118] The judgment module 40 is used to judge whether each application device has a network security anomaly according to the first analysis result, the second analysis result and the third analysis result, and if so, locate and identify the network security anomaly.

[0119] The evaluation module 50 is used to determine network security risks according to the network security anomalies and perform monitoring based on the network security risks.

[0120] This embodiment obtains network traffic data flowing into the switch; analyzes the network traffic data to obtain the network traffic corresponding to each of the several application devices connected to the switch; performs address access and protocol traffic identification analysis, abnormal traffic analysis, and specific feature analysis on the application devices based on the network traffic corresponding to each application device to obtain the corresponding first analysis result, second analysis result, and third analysis result, and determines whether each application device has network security anomalies based on the three analysis results, and if so, locates and identifies the abnormal behavior; determines network security risks based on the abnormal behavior, and monitors based on the network security risks. Through the above methods, abnormal traffic and abnormal behavior can be accurately identified and detected, and network security can be effectively monitored.

[0121] In some embodiments, the analysis module 20 is used to parse and process the network traffic data to obtain processed network traffic data; determine the application devices connected to each port of the switch based on the port mapping relationship of the switch and preset connection information; construct a mapping relationship between each application device and the corresponding IP address according to the processed network traffic data; and classify the network traffic data based on the mapping relationship to obtain the network traffic generated by each application device.

[0122] In some embodiments, the analysis module 20 is used to unify the packet header length and the load length of the network traffic data to obtain first network traffic data; identify redundant traffic data in the first network traffic data that is not related to application classification or traffic characteristics, and perform traffic filtering on the first network traffic data based on the redundant traffic data to obtain second network traffic data; perform traffic segmentation on the second network traffic data based on the data packet header field of the network traffic data to obtain third network traffic data; adjust the data packet structure of the third network traffic data to obtain processed network traffic data.

[0123] In some embodiments, the detection module 30 is used to extract traffic behavior characteristics from the network traffic corresponding to each of the application devices; determine the time point when the abnormal behavior occurs based on the traffic behavior characteristics; analyze several destination IP addresses with the largest traffic at the time point when the abnormal behavior occurs; identify abnormal IP addresses among the several destination IP addresses based on the fine-grained traffic parameters of the sub-flows constituted within the historical time window; determine the changes in the characteristic behavior parameters of the abnormal IP addresses within a preset time to obtain a first analysis result, wherein the characteristic behavior parameters include at least the connection port corresponding to the address and the number of visits corresponding to the address; perform abnormal traffic analysis on the application devices based on the network traffic corresponding to each of the application devices to obtain a second analysis result; perform specific feature analysis on the application devices based on the network traffic corresponding to each of the application devices to obtain a third analysis result.

[0124] In some embodiments, the detection module 30 is used to calculate a baseline vector difference based on the network traffic corresponding to each of the application devices; determine a probability distribution relationship of abnormal traffic timing characteristics based on the baseline vector difference; determine abnormal traffic timing characteristics based on the probability distribution relationship; determine a deviation estimate of the abnormal traffic based on the abnormal traffic timing characteristics; and perform abnormal traffic analysis based on the deviation estimate to obtain a second analysis result.

[0125] In some embodiments, the detection module 30 is used to extract network traffic behavior characteristics from the network traffic corresponding to each of the application devices; use a normalization algorithm to map the traffic behavior characteristic values ​​of different dimensions to the same dimension to obtain network traffic behavior characteristics with the same dimension; use a preset kernel function to remap the network traffic behavior characteristics with the same dimension to a new space; and use a support vector machine on the basis of the preset kernel function to perform specific feature analysis based on the network traffic behavior characteristics of the new space to obtain a third analysis result.

[0126] In some embodiments, the assessment module 50 is used to determine the anomaly type of the network security anomaly; determine the risk weight corresponding to the anomaly type based on the type number corresponding to the anomaly type; and determine the network security risk based on the risk weight.

[0127] An embodiment of the present application also provides a network security monitoring device based on network traffic, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus, and the memory is used to store a network security monitoring program based on network traffic; the processor is used to implement the above-mentioned network security monitoring method based on network traffic when executing the program stored in the memory.

[0128] The communication bus mentioned in the network security monitoring device based on network traffic can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc.

[0129] The communication interface is used for communication between the above network traffic-based network security monitoring device and other devices.

[0130] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0131] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, and discrete hardware components.

[0132] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive Solid State Disk (SSD)), etc.

[0133] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0134] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0135] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

[0136] It should be understood that the above is only an example and does not constitute any limitation on the technical solution of the present invention. In specific applications, technicians in this field can make settings as needed, and the present invention does not limit this.

[0137] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of the present invention. In practical applications, technicians in this field can select part or all of them according to actual needs to achieve the purpose of the present embodiment, and no limitation is made here.

[0138] In addition, for technical details not fully described in this embodiment, reference can be made to the network security monitoring method based on network traffic provided in any embodiment of the present invention, and will not be repeated here.

[0139] In addition, it should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0140] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0141] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory (ROM) / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0142] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

[0143] It is understandable that the system provided by the embodiment of the present invention corresponds to the method provided by the embodiment of the present invention, and the explanation, examples and beneficial effects of the relevant contents can refer to the corresponding parts in the above method.

Claims

1. A network security monitoring method based on network traffic, characterized in that: The network security monitoring method based on network traffic includes: Get the network traffic data flowing into the switch; Analyzing the network traffic data to obtain network traffic corresponding to each of the plurality of application devices connected to the switch; Based on the network traffic corresponding to each of the application devices, address access and protocol traffic identification analysis, abnormal traffic analysis, and specific feature analysis are performed on the application devices to obtain corresponding first analysis results, second analysis results, and third analysis results; Determine whether each application device has a network security anomaly according to the first analysis result, the second analysis result, and the third analysis result, and if so, locate and identify the network security anomaly; A network security risk is determined according to the network security anomaly, and monitoring is performed based on the network security risk.

2. The network security monitoring method based on network traffic according to claim 1, characterized in that: The analyzing the network traffic data to obtain the network traffic corresponding to each of the plurality of application devices connected to the switch includes: Parsing the network traffic data to obtain processed network traffic data; Determine the application device connected to each port of the switch based on the port mapping relationship of the switch and the preset connection information; Constructing a mapping relationship between each application device and the corresponding IP address based on the processed network traffic data; The network traffic data is classified based on the mapping relationship to obtain the network traffic generated by each application device.

3. The network security monitoring method based on network traffic as claimed in claim 2, characterized in that: The parsing and processing of the network traffic data to obtain processed network traffic data includes: Unifying the packet header length and the load length of the network flow data to obtain first network flow data; Identify redundant traffic data in the first network traffic data that is unrelated to application classification or traffic characteristics, and perform traffic filtering on the first network traffic data based on the redundant traffic data to obtain second network traffic data; Performing traffic segmentation on the second network traffic data based on the data packet header field of the network traffic data to obtain third network traffic data; The data packet structure of the third network traffic data is adjusted to obtain processed network traffic data.

4. The network security monitoring method based on network traffic according to claim 1, characterized in that: The address access and protocol traffic identification analysis, abnormal traffic analysis, and specific feature analysis are performed on the application devices based on the network traffic corresponding to each of the application devices to obtain the corresponding first analysis result, second analysis result, and third analysis result, including: Extracting traffic behavior characteristics from the network traffic corresponding to each of the application devices; Determine the time point when the abnormal behavior occurs based on the traffic behavior characteristics; Analyze several destination IP addresses with the largest traffic at the time when the abnormal behavior occurred; Identifying abnormal IP addresses among the plurality of destination IP addresses based on fine-grained traffic parameters of sub-flows formed within a historical time window; Determine changes in characteristic behavior parameters of the abnormal IP address within a preset time to obtain a first analysis result, wherein the characteristic behavior parameters at least include a connection port corresponding to the address and a number of accesses corresponding to the address; Performing abnormal traffic analysis on the application devices based on the network traffic corresponding to each of the application devices to obtain a second analysis result; Based on the network traffic corresponding to each of the application devices, specific feature analysis is performed on the application devices to obtain a third analysis result.

5. The network security monitoring method based on network traffic as claimed in claim 4, characterized in that: The abnormal traffic analysis of the application devices based on the network traffic corresponding to each of the application devices is performed to obtain a second analysis result, including: Calculating a baseline vector difference based on the network traffic corresponding to each of the application devices; Determining a probability distribution relationship of abnormal traffic time series characteristics according to the baseline vector difference; Determine the abnormal traffic time series characteristics according to the probability distribution relationship; Determine a deviation estimate of the abnormal flow according to the abnormal flow time series characteristics; An abnormal flow analysis is performed based on the deviation estimation value to obtain a second analysis result.

6. The network security monitoring method based on network traffic according to claim 4, characterized in that: The performing specific feature analysis on the application devices based on the network traffic corresponding to each of the application devices to obtain a third analysis result includes: Extracting network traffic behavior characteristics from the network traffic corresponding to each of the application devices; A normalization algorithm is used to map the traffic behavior feature values ​​of different dimensions into the same dimension, thus obtaining network traffic behavior features with the same dimension. Re-mapping the network traffic behavior features having the same dimension to a new space using a preset kernel function; Based on the preset kernel function, a support vector machine is used to perform specific feature analysis based on the network traffic behavior characteristics of the new space to obtain a third analysis result.

7. The network security monitoring method based on network traffic according to any one of claims 1 to 6, characterized in that: Determining a network security risk according to the network security anomaly and monitoring based on the network security risk includes: Determine the anomaly type of the network security anomaly; Determine the risk weight corresponding to the abnormal type based on the type number corresponding to the abnormal type; A cybersecurity risk is determined based on the risk weight.

8. A network security monitoring device based on network traffic, characterized in that: The network security monitoring device based on network traffic includes: An acquisition module, used to acquire network traffic data flowing into the switch; An analysis module, used for analyzing the network flow data to obtain the network flow corresponding to each of the plurality of application devices connected to the switch; A detection module, configured to perform address access and protocol traffic identification analysis, abnormal traffic analysis, and specific feature analysis on the application devices based on the network traffic corresponding to each of the application devices, so as to obtain corresponding first analysis results, second analysis results, and third analysis results; A judgment module, configured to judge whether each application device has a network security anomaly according to the first analysis result, the second analysis result and the third analysis result, and if so, locate and identify the network security anomaly; An assessment module is used to determine network security risks according to the network security anomalies and to perform monitoring based on the network security risks.

9. A network security monitoring device based on network traffic, characterized in that: The network traffic-based network security monitoring device includes: a memory, a processor, and a network traffic-based network security monitoring program stored in the memory and executable on the processor, wherein the network traffic-based network security monitoring program is configured to implement the steps of the network traffic-based network security monitoring method as described in any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium stores a network security monitoring program based on network traffic, and when the network security monitoring program based on network traffic is executed by the processor, the steps of the network security monitoring method based on network traffic as described in any one of claims 1 to 7 are implemented.

Images