Intelligent network threat automatic sensing method and device based on 5G DPI technology

Abstract

The invention relates to the technical field of electronic information, in particular to an intelligent network threat automatic sensing method and device based on the 5G DPI technology. The method comprises the following steps that: information processing equipment 1 generates an information routing scheme; performing hash processing on the information routing scheme to generate an initial hash value; sending the initial hash value to the information processing device 2; the information processing device 2 constructs an actual information routing process and calculates a hash value of the actual information routing process as an actual hash value; and comparing the initial hash value with the actual hash value, and performing link security verification. According to the invention, the information routing scheme in the data transmission process is compared with the actual information routing process, and the security of the passed nodes and links is verified, so that the accuracy and efficiency of network security protection are improved, the method can adapt to continuously changing network threat environments, and a powerful guarantee is provided for the safe operation of the 5G network.

Description

Technical Field

[0001] The present invention relates to the field of electronic information technology, and specifically to an intelligent network threat automatic perception method and device based on 5G DPI technology. Background Art

[0002] In today's era of rapid development of information technology, 5G networks, as a new generation of information transmission infrastructure, not only provide faster transmission speeds and lower latency, but also greatly expand the breadth and depth of network connections. However, with the continuous advancement of network technology and its extensive and in-depth application, network security issues have become increasingly prominent, becoming an important factor restricting the further development and application of 5G networks.

[0003] Traditional network security means, such as firewalls and intrusion detection systems, mainly rely on static rules and feature matching to identify and prevent network attacks. However, in the 5G network environment, the means and methods of network attacks have become increasingly complex and changeable, and traditional network security means have been unable to cope with such dynamically changing threats. Attackers can take advantage of the high-speed transmission and low-latency characteristics of 5G networks to quickly launch large-scale, high-intensity network attacks, such as DDoS (distributed denial of service) attacks and advanced persistent threats (APT), which pose great challenges to network security protection.

[0004] In order to cope with this complex and ever-changing network security threat, it is urgent to develop a new technology that can automatically perceive network threats in real time and accurately and respond quickly. Intelligent network threat automatic perception technology based on 5G DPI (deep packet inspection) technology was born to solve this problem. DPI technology is a technology that deeply analyzes network traffic data. It can parse the data packets transmitted by the network layer by layer and extract key information from the data packets, such as source address, destination address, protocol type, data content, etc. Through in-depth analysis of this information, DPI technology can detect abnormal behavior and potential threats in network traffic, providing strong support for network security protection.

[0005] Based on 5G DPI technology, combined with cutting-edge technologies such as machine learning and deep learning, an intelligent network threat automatic perception system can be built. The system can automatically collect and process network traffic data, extract key features, and use machine learning algorithms to build threat detection models. When abnormal behavior occurs in network traffic, the system can detect it in real time and respond quickly, such as blocking attacks and isolating infected devices.

[0006] Therefore, the research on intelligent network threat automatic perception technology based on 5G DPI technology has important practical significance and broad application prospects. Summary of the invention

[0007] In order to overcome the problems existing in the prior art, the purpose of the present invention is to provide an intelligent network threat automatic perception method and device based on 5G DPI technology, so as to improve the level of network security protection, promote the innovative development of network security technology, and make positive contributions to ensuring network security and social stability.

[0008] To achieve the above object, the present invention provides the following technical solution: an intelligent network threat automatic perception method based on 5G DPI technology, comprising the following steps:

[0009] S1: Information processing device 1 generates an information routing plan;

[0010] S2: The information processing device 1 performs hash processing on the information routing scheme to generate an initial hash value;

[0011] S3: Sending the initial hash value to the information processing device 2;

[0012] S4: the information processing device 2 constructs an actual information routing process and calculates a hash value of the actual information routing process as an actual hash value;

[0013] S5: Compare the initial hash value with the actual hash value to verify the link security.

[0014] The present invention is further configured as follows: the information routing scheme described in step S1 includes the nodes to be passed through and the IP address of each node and the information sending time from this node to the next node, as shown in the following formula: R = {(N1, IP1, T1), (N2, IP2, T2), ..., (N i , IP i , T i ),…,(N n , IP n , T n )}

[0015] Where R is the information routing scheme, i is the node number, n is the total number of nodes, i = 1, 2, ..., n; N i is the i-th node, IP i is the IP address of the ith node, T i is the time it takes for data to be sent from the i-th node to the i+1-th node.

[0016] The present invention is further configured as follows: in step S3, the Beidou satellite navigation and positioning system sends the initial hash value to the information processing device 2 via a short message, and the process is as follows:

[0017] hashD1=H(R)

[0018]

[0019] in, represents the information sent by information processing device 1, H(R) represents the result obtained by applying the hash function to the information routing scheme, BDS represents the Beidou satellite navigation and positioning system, D1 represents information processing device 1, and D2 represents information processing device 2.

[0020] The present invention is further configured as follows: Step S3 passes through several nodes during the sending process, each node has a deep packet parsing program, the deep packet parsing program of each node parses the data packet received from the previous node, and extracts the IP address and sending time of the next node, and so on and so forth.

[0021] For each node N i , i=1,2,...,n-1:

[0022] (IP i+1 , T i+1 )=DPI i (received_packet)

[0023] Among them, DPI i is the deep packet parser of the ith node.

[0024] The present invention is further configured as follows: Step S4 constructs an actual information routing process R′ based on the deep packet parsing program of each node obtained in Step S3:

[0025] R′={(extracted-values_from-DPIs)}

[0026]

[0027] Among them, DPI s A deep packet parser for all nodes that the actual information routing process passes through. represents the information received by the information processing device 2, and H(R′) represents the result obtained by applying the hash function in the actual information routing process.

[0028] The present invention is further configured as follows: Step S5 specifically includes: if the initial hash value is the same as the actual hash value, the information system link is credible; if the initial hash value is different from the actual hash value, the information system link is untrustworthy, and an early warning is issued;

[0029] The process is as follows:

[0030]

[0031] The text link is credible

[0032] textelse

[0033] The text link is unreliable. Please notify the relevant parties to check.

[0034] The present invention is further configured as follows: the hash processing adopts the SHA-256 hash function, and the calculation process of the hash value is irreversible.

[0035] The present invention is further configured as follows: in step S1, the information routing scheme is randomly generated by an algorithm: node and link data are selected, a starting point and an end point of the information routing scheme are randomly selected, and then a function for generating the information routing scheme is defined to generate the information routing scheme.

[0036] The present invention is further configured such that the selection of nodes and links is based on practical factors, including network topology, link quality, bandwidth and delay.

[0037] The present invention also provides an intelligent network threat automatic perception device based on 5G DPI technology, which is used in conjunction with the above-mentioned intelligent network threat automatic perception method based on 5G DPI technology, including:

[0038] Information processing device 1, used for sending information and generating information routing scheme;

[0039] Information processing device 2, used for receiving information sent by information processing device 1 and verifying link security;

[0040] Beidou satellite navigation and positioning system is used to send the information encrypted by information processing device 1 to information processing device 2 via a short message.

[0041] In summary, the beneficial effects of the above technical solution of the present invention are as follows:

[0042] Based on 5G DPI technology, the present invention verifies the security of nodes and links passed through by comparing the information routing scheme with the actual information routing process during data transmission. It not only improves the accuracy and efficiency of network security protection, but also can adapt to the ever-changing network threat environment, providing strong protection for the safe operation of 5G networks.

[0043] The present invention adopts the short message of Beidou satellite navigation system to transmit information, which has high overall security, improves the level of network security protection, promotes the innovative development of network security technology, and makes positive contributions to ensuring national network security and social stability. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for describing the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0045] Figure 1 This is a flow chart of the intelligent network threat automatic perception method based on 5G DPI technology in an embodiment.

[0046] Figure 2 Schematic diagram of the information transmission path between information processing device 1 and information processing device 2 in the embodiment. DETAILED DESCRIPTION

[0047] In order to enable those skilled in the art to better understand the technical solution of the present invention, the technical solution of the present invention is clearly and completely described below in conjunction with the accompanying drawings of the present invention. Based on the embodiments of the present invention, other similar embodiments obtained by ordinary technicians in the field without making any creative work should all fall within the scope of protection of the present invention.

[0048] The present invention will be further described below in conjunction with the accompanying drawings and preferred embodiments.

[0049] Example:

[0050] like Figure 1 As shown in the figure, a preferred embodiment of the present invention is an intelligent network threat automatic perception method based on 5G DPI technology, comprising the following steps:

[0051] S1: Information processing device 1 generates an information routing plan;

[0052] The information routing scheme includes the nodes to be passed through, the IP address of each node, and the information sending time from this node to the next node, as shown in the following formula:

[0053] R={(N1, IP1, T1), (N2, IP2, T2), ..., (N i , IP i , T i ),…,(N n , IP n , T n )}R=D1(generate_route())

[0054] Where R is the information routing scheme, i is the node number, n is the total number of nodes, i = 1, 2, ..., n; N i is the i-th node, IP i is the IP address of the ith node, T i is the time it takes for data to be sent from the i-th node to the i+1-th node.

[0055] like Figure 2As shown, it is a schematic diagram of the transmission path between the information processing devices provided in this embodiment. The information routing scheme is randomly generated by an algorithm: select node and link data, randomly select the starting point and end point of the information routing scheme, and then define a function for generating the information routing scheme to generate the information routing scheme.

[0056] The following is a simplified Python code example for implementing the above random intelligent generation information routing scheme:

[0057]

[0058]

[0059] In practical applications, the above code should add appropriate error handling and exception catching mechanisms to ensure the robustness and stability of the program. For example, when a valid routing solution cannot be generated, appropriate prompts should be given or other measures should be taken.

[0060] S2: The information processing device 1 performs hash processing on the information routing scheme to generate an initial hash value. To ensure security, the SHA-256 hash function is used, and the calculation process of the hash value must be irreversible.

[0061] S3: The Beidou satellite navigation and positioning system sends the initial hash value to the information processing device 2 via a short message. The process is as follows:

[0062]

[0063] in, represents the information sent by information processing device 1, H(R) represents the result obtained by applying the hash function to the information routing scheme, BDS represents the Beidou satellite navigation and positioning system, D1 represents information processing device 1, and D2 represents information processing device 2.

[0064] During the sending process, it passes through several nodes, each of which has a deep packet parser. The deep packet parser of each node parses the data packet received from the previous node and extracts the IP address and sending time of the next node, and so on.

[0065] For each node N i , i=1,2,...,n-1:

[0066] (IP i+1 , T i+1 )=DPI i (received_packet)

[0067] Among them, DPI i is the deep packet parser of the ith node.

[0068] S4: the information processing device 2 constructs an actual information routing process and calculates a hash value of the actual information routing process as an actual hash value;

[0069] Based on the deep packet parsing program of each node obtained in step S3, the actual information routing process R' is constructed:

[0070] R′={(extracted_values_from_DPIs)}

[0071]

[0072] Among them, DPI s A deep packet parser for all nodes that the actual information routing process passes through. represents the information received by the information processing device 2, and H(R') represents the result obtained by applying the hash function in the actual information routing process.

[0073] S5: Compare the initial hash value with the actual hash value to verify the link security.

[0074] If the initial hash value is the same as the actual hash value, the information system link is credible; if the initial hash value is different from the actual hash value, the information system link is untrustworthy and an early warning is issued;

[0075] The process is as follows:

[0076]

[0077] The text link is credible

[0078] textelse

[0079] The text link is unreliable. Please notify the relevant parties to check.

[0080] The following content is a representation of the above process in this embodiment converted into a detailed computer pseudocode. It should be noted that the pseudocode is simplified to show the process logic and does not include all possible error handling, boundary condition checks, and details that may be required in actual implementation. In actual programming, these logics need to be improved according to the specific programming language, environment, and requirements. In addition, functions such as `GetNextNode`, `GetIPAddress`, `CalculateSendTime`, `ExtractNextNodeInfo`, `GetCurrentNodeFromPacket`, and `NotifyRelevantParties` are assumed to exist, and their specific implementation will depend on the actual network environment and business requirements.

[0081]

[0082] / / Information processing device 1 sends the hash value

[0083] function D1_SendHash(route):

[0084] hashValue = H(route)

[0085] BDS_Send(hashValue,D2)

[0086] / / Node deep packet parsing program

[0087] function DPI_ProcessPacket(packet,currentNode):

[0088] nextNodeInfo=ExtractNextNodeInfo(packet) / / Extract the next node information from the data packet

[0089] nextNode=nextNodeInfo.node

[0090] sendTime=nextNodeInfo.sendTime

[0091] / / You can add verification logic for extracted information here

[0092] return(nextNode,sendTime)

[0093] / / Information processing device 2 receives and processes information

[0094] function D2_ReceiveAndProcess():

[0095] receivedPackets = EmptyList() / / Assume that all packets have been received

[0096] actualRoute=EmptyList()

[0097] for each packet in receivedPackets:

[0098] currentNode=GetCurrentNodeFromPacket(packet) / / Get the node currently processing the data packet

[0099] while currentNode is not Null:

[0100] (nextNode,sendTime)=DPI_ProcessPacket(packet,currentNode)

[0101] actualRoute.Append((currentNode,GetIPAddress(currentNode),sendTime))

[0102] currentNode=nextNode

[0103] return actualRoute

[0104] / / Information processing device 2 verifies the hash value

[0105] function D2_VerifyHash(actualRoute,receivedHash):

[0106] calculatedHash=H(actualRoute)

[0107] if calculatedHash==receivedHash:

[0108] return True / / The link is credible

[0109] else:

[0110]

[0111] Embodiment 2:

[0112] An intelligent network threat automatic perception device based on 5G DPI technology, used in conjunction with the above-mentioned intelligent network threat automatic perception method based on 5GDPI technology, comprises:

[0113] Information processing device 1, used for sending information and generating information routing scheme;

[0114] Information processing device 2, used for receiving information sent by information processing device 1 and verifying link security;

[0115] Beidou satellite navigation and positioning system is used to send the information encrypted by information processing device 1 to information processing device 2 via a short message.

[0116] Finally, it should be noted that the above content is only used to illustrate the technical solution of the present invention, rather than to limit the scope of protection of the present invention. Simple modifications or equivalent substitutions of the technical solution of the present invention by ordinary technicians in this field do not deviate from the essence and scope of the technical solution of the present invention.

Claims

1. An intelligent network threat automatic perception method based on 5G DPI technology, characterized in that: The following steps are involved: S1: Information processing device 1 generates an information routing plan; S2: The information processing device 1 performs hash processing on the information routing scheme to generate an initial hash value; S3: Sending the initial hash value to the information processing device 2; S4: the information processing device 2 constructs an actual information routing process and calculates a hash value of the actual information routing process as an actual hash value; S5: Compare the initial hash value with the actual hash value to verify the link security.

2. According to claim 1, a method for automatic intelligent network threat perception based on 5G DPI technology is characterized in that: The information routing scheme described in step S1 includes the nodes to be passed, the IP address of each node, and the information sending time from this node to the next node, as shown in the following formula: R={(N1,IP1,T1),(N2,IP2,T2),…,(N i ,IP i ,T i ),…,(N n ,IP n ,T n )} Where R is the information routing scheme, i is the node number, n is the total number of nodes, i = 1, 2, ..., n; N i is the i-th node, IP i is the IP address of the ith node, T i is the time it takes for data to be sent from the i-th node to the i+1-th node.

3. According to claim 1, the intelligent network threat automatic perception method based on 5G DPI technology is characterized in that: In step S3, the Beidou satellite navigation and positioning system sends the initial hash value to the information processing device 2 via a short message, and the process is as follows: in, represents the information sent by information processing device 1, H(R) represents the result obtained by applying the hash function to the information routing scheme, BDS represents the Beidou satellite navigation and positioning system, D1 represents information processing device 1, and D2 represents information processing device 2.

4. According to claim 3, the intelligent network threat automatic perception method based on 5G DPI technology is characterized in that: Step S3 passes through several nodes during the sending process. Each node has a deep packet parser. The deep packet parser of each node parses the data packet received from the previous node and extracts the IP address and sending time of the next node, and so on. For each node N i , i=1,2,...,n-1: (IP i+1 ,T i+1 )=DPI i (received_packet) Among them, DPI i is the deep packet parser of the ith node.

5. According to claim 4, the intelligent network threat automatic perception method based on 5G DPI technology is characterized in that: Step S4 constructs the actual information routing process R' based on the deep packet parsing program of each node obtained in step S3: R′={(extracted_values_from_DPIs)} Among them, DPI s A deep packet parser for all nodes that the actual information routing process passes through. represents the information received by the information processing device 2, and H(R') represents the result obtained by applying the hash function in the actual information routing process.

6. According to claim 1, the intelligent network threat automatic perception method based on 5G DPI technology is characterized in that: Step S5 specifically includes: if the initial hash value is the same as the actual hash value, the information system link is credible; if the initial hash value is different from the actual hash value, the information system link is untrustworthy, and a notification warning is issued.

7. According to claim 1, the intelligent network threat automatic perception method based on 5G DPI technology is characterized in that: The hash processing adopts the SHA-256 hash function, and the calculation process of the hash value is irreversible.

8. According to claim 1, the intelligent network threat automatic perception method based on 5G DPI technology is characterized in that: In step S1, the information routing scheme is randomly generated by an algorithm: node and link data are selected, a starting point and an end point of the information routing scheme are randomly selected, and then a function for generating the information routing scheme is defined to generate the information routing scheme.

9. According to claim 8, the intelligent network threat automatic perception method based on 5G DPI technology is characterized in that: The selection of nodes and links is based on practical factors including network topology, link quality, bandwidth and latency.

10. An intelligent network threat automatic perception device based on 5G DPI technology, used in conjunction with an intelligent network threat automatic perception method based on 5G DPI technology as described in any one of claims 1 to 9, comprising: Information processing device 1, used for sending information and generating information routing scheme; Information processing device 2, used for receiving information sent by information processing device 1 and verifying link security; Beidou satellite navigation and positioning system is used to send the information encrypted by information processing device 1 to information processing device 2 via a short message.

Images