Monitoring integrated system and method for detecting unauthorized access security network

Abstract

The invention relates to the technical field of fraud detection, in particular to a monitoring integrated system and method for detecting an unauthorized access security network. The method comprises the following steps: receiving monitoring data from each remote monitoring device in a secure network, and obtaining sending information of each remote monitoring device; comparing a first data volume in the sending information of each remote monitoring device with a reference data volume to obtain a first comparison result, and judging whether the remote monitoring device is a first unauthorized device according to the first comparison result; when the remote monitoring equipment is not the first unauthorized equipment, comparing communication records in the sending information with communication records in the forwarding information, and judging whether second unauthorized equipment exists near the remote monitoring equipment; and when the first unauthorized device or the second unauthorized device exists, data transmission is blocked in real time, and alarm information is sent to the cloud supervision platform. According to the invention, the problem of low precision of security network detection of unauthorized equipment is solved, and the detection precision is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of fraud detection, and more specifically to an integrated monitoring system and method for detecting unauthorized access to a secure network. Background Art

[0002] With the continuous development of computer and communication technology, the types of attacks faced by security networks are gradually increasing, so it is indispensable to carry out security protection of the network environment. At present, the main security protection methods mainly include firewalls, intrusion detection, etc. Similar prior art includes a Chinese patent with publication number CN118678356A, which proposes a wireless network intrusion detection method based on an arithmetic optimization algorithm, including: obtaining a wireless network data set to be tested, and preprocessing the wireless network data set to be tested; preprocessing the wireless network data set to be tested is specifically: normalizing and digitizing the traffic data in the wireless network data set to be tested, and obtaining the preprocessed wireless network data set to be tested; inputting the preprocessed wireless network data set to be tested into the final intrusion detection model to obtain the intrusion detection result. In addition, similar prior art includes a U.S. patent with publication number US20230362173A1, which proposes a satellite communication network intrusion detection system and method. The system may include a non-temporary memory containing a set of instructions. The system may also include a processor operably coupled to the non-temporary memory configured to execute the instruction set. One of these instructions may include obtaining streaming metric data from a satellite network management system, another instruction in the instructions may include identifying terminals in an intrusion detection database, and another one of these instructions may include determining based on the streaming metric data whether a confidence score indicating the authenticity of the identified terminal meets or exceeds a predetermined threshold, and another one of the instructions may include generating an alarm based on the determination. The technical solutions of the above two patents both solve the problem of illegal intrusion detection, but can only filter out a part of the intrusion behavior, but cannot cope with complex and hidden unauthorized device access, and the detection accuracy is low. Summary of the invention

[0003] In order to better solve the above problems, the present invention provides a supervision integrated method for detecting unauthorized access to a secure network, the method comprising the following steps: Step S1: Periodically receiving monitoring data from each remote monitoring device in the security network through a monitoring unit, and obtaining sending information of each remote monitoring device, wherein the monitoring unit also obtains forwarding information when the switch forwards the monitoring data; Step S2: Compare the first data volume of the monitoring data in the information sent by each remote monitoring device with the reference data volume stored in the storage unit, and obtain a first comparison result. When the first comparison result is greater than a first threshold, determine whether the remote monitoring device is a first unauthorized device according to the first comparison result and the configuration information of the remote monitoring device; Step S3: when the first comparison result is less than or equal to the first threshold, the monitoring data of each remote monitoring device forwarded by the switch is compared with the corresponding background data at a preset period by the monitoring unit to obtain a second comparison result, and whether the remote monitoring device is a first unauthorized device is determined according to the second comparison result; Step S4: when the remote monitoring device is not the first unauthorized device, the monitoring unit compares each of the acquired sending information with the corresponding forwarding information, obtains a third comparison result, and determines whether there is a second unauthorized device near the location of the remote monitoring device according to the third comparison result; Step S5: When the first unauthorized device and the second unauthorized device exist in the security network, the monitoring unit takes corresponding measures to block data transmission in real time, and sends an alarm message to the cloud monitoring platform.

[0004] As a preferred technical solution of the present invention, in step S1, the sending information of the remote monitoring device includes the size of the monitoring data sent, the sending time, the address of the remote monitoring device and the destination address of the sending, and the forwarding information of the switch includes the address of the remote monitoring device corresponding to the forwarded monitoring data and the corresponding monitoring data, the size of the monitoring data and the receiving time.

[0005] As a preferred technical solution of the present invention, step S2 includes: Step S21: taking the size of the monitoring data in the information sent by each remote monitoring device as the first data volume, and obtaining the sending time of the monitoring data; Step S22: comparing the first data volume corresponding to the remote monitoring device with the reference data volume corresponding to the remote monitoring device stored in the storage unit, and obtaining the first comparison result, and when the first comparison result is greater than the first threshold, sending a query instruction to the corresponding remote monitoring device, wherein the time corresponding to the reference data volume is consistent with the sending time; Step S23: After receiving the query instruction, the remote monitoring device sends the configuration information and the modification record to the monitoring unit, and determines whether the configuration information of the remote monitoring device is modified through the modification record. When the configuration information of the remote monitoring device is modified, the monitoring unit calculates the second data volume of the remote monitoring device forwarded by the switch at a single time based on the data collection period, the single collection data volume and the sending period in the configuration information, and calculates the difference between the second data volume and the first data volume. When the configuration information is not modified or the difference is greater than the set difference, the remote monitoring device is the first unauthorized device; when the difference is less than or equal to the set difference, the remote monitoring device is not the first unauthorized device.

[0006] As a preferred technical solution of the present invention, step S3 includes: Step S31: when the first comparison result is less than or equal to the first threshold, the monitoring data of each remote monitoring device forwarded by the switch is compared with the background data corresponding to the remote monitoring device stored in the database by the monitoring unit at a preset period, and the second comparison result is obtained; Step S32: When the second comparison result is that the similarity between the monitoring data and the background data is less than or equal to a first set threshold, the remote monitoring device is the first unauthorized device; otherwise, the remote monitoring device is not the first unauthorized device.

[0007] As a preferred technical solution of the present invention, step S4 includes: Step S41: When the remote monitoring device is not the first unauthorized device, the monitoring unit compares the sending record in the sending information of each remote monitoring device with the forwarding record in the forwarding information of the switch, and obtains a third comparison result; Step S42: When the third comparison result is that the forwarding record includes the sending record of the remote monitoring device, the second unauthorized device does not exist at the location of the remote monitoring device; when the third comparison result is that the forwarding record does not completely include the sending record of the remote monitoring device, the second unauthorized device exists near the location of the remote monitoring device.

[0008] As a preferred technical solution of the present invention, step S5 includes: When the first unauthorized device or the second unauthorized device exists in the security network, an alarm message is generated by the monitoring unit and sent to the cloud supervision platform for display. For the first unauthorized device, the data transmission of the first unauthorized device is blocked by the monitoring unit, and at the same time, the authorization information is updated so that each of the remote monitoring devices re-establishes a communication connection with the switch through the authorization information; when the second unauthorized device exists near the location of the remote monitoring device, the address information of the second unauthorized device is obtained through the third comparison result, and the second unauthorized device is identified based on the address information, and the communication connection between the remote monitoring device and the second unauthorized device is disconnected.

[0009] As a preferred technical solution of the present invention, in step S3, when the second comparison result is that the similarity between the monitoring data of the remote monitoring device and the background data is greater than the first set threshold and less than or equal to the second set threshold for a duration greater than or equal to a set time, the monitoring data is used as the new background data.

[0010] As a preferred technical solution of the present invention, the monitoring unit also forwards the corresponding monitoring data through the switch according to the authorization period in the corresponding authorization information of the remote monitoring device authorized in the security network, and stops forwarding the monitoring data after the authorization period expires, wherein the switch is a 1 optical 5 electrical Gigabit switch, and the lightning protection standard of the network port of the switch is 5KA.

[0011] The present invention also provides an integrated monitoring system for detecting unauthorized access to a secure network, the system being used to implement the above method, the system comprising: A monitoring unit, used to periodically receive monitoring data from each remote monitoring device in the security network, and obtain the sending information of each remote monitoring device, wherein the monitoring unit also obtains the forwarding information when the switch forwards the monitoring data; The switch is used to forward the monitoring data sent by each of the remote monitoring devices; The judgment unit is configured to: compare the first data volume of the monitoring data in the sending information corresponding to each of the remote monitoring devices with the reference data volume stored in the storage unit, and obtain a first comparison result; when the first comparison result is greater than a first threshold, judge whether the remote monitoring device is a first unauthorized device according to the first comparison result and the configuration information of the remote monitoring device; when the first comparison result is less than or equal to the first threshold, compare the monitoring data of each of the remote monitoring devices forwarded by the switch with the corresponding background data at a preset period through the monitoring unit, obtain a second comparison result, and judge whether the remote monitoring device is a first unauthorized device according to the second comparison result; when the remote monitoring device is not the first unauthorized device, compare each of the sent information obtained with the corresponding forwarded information through the monitoring unit, and obtain a third comparison result, and judge whether there is a second unauthorized device at the location of the remote monitoring device according to the third comparison result; The early warning unit is used to take corresponding measures through the monitoring unit to block data transmission in real time when the first unauthorized device or the second unauthorized device exists in the security network, and send alarm information to the cloud supervision platform.

[0012] The present invention also provides a computer storage medium, wherein the storage medium stores program instructions, wherein when the program instructions are executed, the device where the storage medium is located is controlled to execute the above method.

[0013] Compared with the prior art, the beneficial effects of the present invention are at least as follows: The present invention compares the first data volume of each remote monitoring device with the corresponding reference data volume through a monitoring unit, and obtains a first comparison result, and determines whether the data volume of the remote monitoring device is abnormal according to the first comparison result, that is, whether it is a first unauthorized device that maliciously occupies bandwidth traffic. When the above-mentioned first comparison result is greater than a first threshold, the above-mentioned remote monitoring device is the above-mentioned first unauthorized device. When the above-mentioned data volume is less than the first threshold, the monitoring data of the above-mentioned remote monitoring device obtained by the above-mentioned switch is also compared with the background data set to determine whether the monitoring area has changed, thereby further determining whether the above-mentioned remote monitoring device is the first unauthorized device. Furthermore, by comparing the sending record of each remote monitoring device with the forwarding record of the switch, it is determined whether the data of the above-mentioned remote monitoring device is illegally obtained by the second unauthorized device, wherein the above-mentioned first unauthorized device is an unauthorized network camera or an unauthorized multi-network card device, and can also be other unauthorized terminal devices, and the above-mentioned second unauthorized device is an unauthorized wireless router or other unauthorized access point. When the above-mentioned first unauthorized device or the above-mentioned second unauthorized device exists in the above-mentioned security network, corresponding measures are taken to prevent data intrusion or data leakage. Through the mutual cooperation of the above-mentioned technical solutions, the detection accuracy of unauthorized devices in the security network is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 A flow chart of a supervisory integrated method for detecting unauthorized access to a secure network according to the present invention; Figure 2 This is a structural diagram of an integrated monitoring system for detecting unauthorized access to a secure network according to the present invention. DETAILED DESCRIPTION

[0015] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0016] The present invention provides an integrated monitoring method for detecting unauthorized access to a security network. The monitoring unit determines whether the first data volume of each remote monitoring device is abnormal, that is, whether it is a first unauthorized device that maliciously occupies bandwidth traffic, based on the difference between the first data volume of each remote monitoring device and the reference data volume. When the difference is less than a first threshold, the monitoring data of the remote monitoring device obtained by the switch is compared with the background data to determine whether the monitoring area has changed, thereby further determining whether the remote monitoring device is the first unauthorized device. The sending record of each remote monitoring device is compared with the forwarding record of the switch to determine whether the data of the remote monitoring device is illegally obtained by a second unauthorized device. The first unauthorized device is an unauthorized network camera or an unauthorized multi-network card device, and may also be other unauthorized terminal devices. The second unauthorized device is an unauthorized wireless router or other unauthorized access point. When the first unauthorized device or the second unauthorized device exists in the security network, corresponding measures are taken to prevent data intrusion or data leakage, such as Figure 1 As shown, the method comprises the following steps: Step S1: Periodically receiving monitoring data from each remote monitoring device in the security network through a monitoring unit, and obtaining sending information of each remote monitoring device, wherein the monitoring unit also obtains forwarding information when the switch forwards the monitoring data; Specifically, the above-mentioned security network includes multiple above-mentioned remote monitoring devices, each of the above-mentioned remote monitoring devices will periodically send the collected monitoring data to the corresponding port of the above-mentioned switch, and forward the above-mentioned monitoring data to the data server through the above-mentioned switch. When the above-mentioned remote monitoring device sends the above-mentioned monitoring data, it will also send the sending record, that is, the above-mentioned sending information, to the above-mentioned monitoring unit. At the same time, when the above-mentioned switch forwards the above-mentioned monitoring data of the above-mentioned remote monitoring device, it will also send the above-mentioned forwarding record, that is, the above-mentioned forwarding information, to the above-mentioned monitoring unit, wherein the sending information and the above-mentioned forwarding information of the same above-mentioned remote monitoring device appear in pairs, and the above-mentioned sending time and receiving time correspond to each other. Through the above-mentioned technical solution, a foundation is laid for determining whether there is a second unauthorized device near the above-mentioned remote monitoring unit based on the above-mentioned sending information and the above-mentioned forwarding information, that is, an unauthorized router or other unauthorized access point.

[0017] Step S2: Compare the first data volume of the monitoring data in the information sent by each remote monitoring device with the reference data volume stored in the storage unit, and obtain a first comparison result. When the first comparison result is greater than a first threshold, determine whether the remote monitoring device is a first unauthorized device according to the first comparison result and the configuration information of the remote monitoring device; Specifically, the size of the monitoring data sent in the sending information of the above-mentioned remote monitoring device is used as the above-mentioned first data amount. At the same time, the sending time of the above-mentioned monitoring data is also obtained. The above-mentioned first data amount is compared with the above-mentioned reference data amount, and the above-mentioned first comparison result is obtained, wherein the above-mentioned reference data amount is consistent with the sending time of the above-mentioned monitoring data. Since the reference data amount is the historical statistical result of the above-mentioned remote monitoring device, under normal circumstances, the difference between the amount of monitoring data sent by the above-mentioned remote monitoring device within the set time period, that is, the first data amount and the corresponding reference data amount, should be less than the above-mentioned first threshold value. However, when the above-mentioned remote monitoring device is the above-mentioned first unauthorized device, that is, an unauthorized network camera, an unauthorized multi-network card device or other illegal terminals, it will cause the above-mentioned first data amount to surge. There is also a situation that after the configuration information of the above-mentioned remote monitoring device is changed and the configuration information causes a surge in data volume. When the monitoring data is sent for the first time, the second comparison result will be greater than the first threshold. Therefore, it is necessary to send a query instruction through the monitoring unit to obtain the configuration information modification record and the configuration information of the remote monitoring device, and judge whether the configuration information of the remote monitoring device has been modified through the modification record. When no modification occurs and the data volume surges, it is possible that an illegal camera, an illegal multi-network card device or other illegal terminal has illegally accessed the security network. When the configuration information is modified, the difference between the second data volume sent in a single time after the modification and the first data volume actually sent is calculated, and whether the remote monitoring device is the first unauthorized device is judged based on the difference. Through the technical solution, it is possible to accurately judge whether the remote monitoring device is the first unauthorized device when the data volume sent by the remote monitoring device surges.

[0018] Step S3: when the first comparison result is less than or equal to the first threshold, the monitoring data of each remote monitoring device forwarded by the switch is compared with the corresponding background data at a preset period by the monitoring unit to obtain a second comparison result, and whether the remote monitoring device is a first unauthorized device is determined according to the second comparison result; Specifically, when the first comparison result is less than or equal to the first threshold, that is, when the first data volume sent by the remote monitoring device is normal, it cannot be said that the remote monitoring device is an authorized device, and it is necessary to determine whether it is an authorized device through the monitoring data collected by the remote monitoring device. Therefore, the monitoring data of each remote monitoring device obtained by the switch at a preset period is compared with the background data stored in the database and corresponding to the remote monitoring device through the monitoring unit. Since the monitoring area corresponding to each remote monitoring device is fixed, and the monitoring area is bound to the address information of the remote monitoring device, although the monitoring data of the monitoring area changes relative to the background data, the changed part will not cover the entire background, and there is still a certain degree of correlation between the monitoring data and the background data. Similarity, therefore, by comparing the above-mentioned monitoring data corresponding to the above-mentioned remote monitoring device with the above-mentioned background data corresponding to the above-mentioned remote monitoring device stored in the above-mentioned database, and obtaining the above-mentioned second comparison result, that is, the similarity between the above-mentioned monitoring data and the above-mentioned background data, when the above-mentioned similarity is greater than the above-mentioned set threshold, the above-mentioned remote monitoring device is not the above-mentioned first unauthorized device, on the contrary, when the above-mentioned similarity is less than or equal to the above-mentioned remote monitoring device being the above-mentioned first unauthorized device, the above-mentioned first unauthorized device is an unauthorized network camera, unauthorized multi-network card device or other unauthorized terminal that illegally steals the address and authority information of the above-mentioned remote monitoring device, and sends illegal data to the switch to impersonate monitoring data. Through the above-mentioned technical solution, the above-mentioned first unauthorized device can be more accurately identified, thereby improving the accuracy of identifying illegal intrusions into the security network.

[0019] Step S4: when the remote monitoring device is not the first unauthorized device, the monitoring unit compares each of the acquired sending information with the corresponding forwarding information, obtains a third comparison result, and determines whether there is a second unauthorized device near the location of the remote monitoring device according to the third comparison result; Specifically, when the above-mentioned remote monitoring device is not the above-mentioned first unauthorized device, the above-mentioned monitoring unit compares the sending record in each of the above-mentioned remote monitoring devices with the forwarding record in the above-mentioned switch forwarding information, and obtains a third comparison result. The third comparison result is that the above-mentioned sending record is consistent with the corresponding forwarding record of the above-mentioned remote monitoring device. At this time, it is considered that there is no second unauthorized device that illegally accesses the vicinity of the location of the above-mentioned collection device. When the third comparison result is that the above-mentioned sending record of the above-mentioned collection device is inconsistent with the above-mentioned forwarding record corresponding to the above-mentioned remote monitoring device, it is possible that it is sent to the above-mentioned second unauthorized device, that is, an unauthorized router or other illegal access point. Through the above-mentioned technical solution, it can be accurately determined whether the above-mentioned second unauthorized device exists at the location of each of the above-mentioned remote monitoring devices.

[0020] Step S5: When the first unauthorized device and the second unauthorized device exist in the security network, the monitoring unit takes corresponding measures to block data transmission in real time, and sends an alarm message to the cloud monitoring platform.

[0021] Specifically, when the first unauthorized device and the second unauthorized device exist in the security network, an alarm message is generated by the monitoring unit, and the alarm message is sent to the display platform for display. For the first unauthorized device, the data transmission of the first unauthorized device is blocked by the monitoring unit. At the same time, the authorization information is updated, and each of the remote monitoring devices in the security network is re-authenticated, and a communication connection is established with the switch, so as to filter the first unauthorized device out of the security network. For the second unauthorized device, the address information of the second unauthorized device is obtained through the third comparison result, that is, the communication record that exists in the sending record of the remote monitoring device and does not exist in the forwarding data, and the second unauthorized device is identified based on the address information, and the communication connection between the corresponding remote monitoring device and the second unauthorized device is disconnected, so as to achieve data blocking. Through the technical solution, not only the alarm message can be generated and displayed in time, but also the data transmission of the unauthorized device can be blocked in time.

[0022] Furthermore, in step S1, the sending information of the remote monitoring device includes the size of the monitoring data sent, the sending time, the address of the remote monitoring device and the destination address of the sending, and the forwarding information of the switch includes the address of the remote monitoring device corresponding to the forwarded monitoring data and the corresponding monitoring data, the size of the monitoring data and the receiving time.

[0023] Specifically, the above-mentioned security network includes multiple remote monitoring devices. When the above-mentioned remote monitoring device sends the above-mentioned monitoring data, it also sends a sending record, i.e., the above-mentioned sending information, to the above-mentioned monitoring unit, wherein the above-mentioned sending record includes the address of the above-mentioned remote monitoring device, the size of the above-mentioned monitoring data, the sending time and the sending destination of the above-mentioned monitoring data. At the same time, when the above-mentioned switch forwards the above-mentioned monitoring data of the above-mentioned remote monitoring device, it also sends the above-mentioned forwarding record, i.e., the above-mentioned forwarding information, to the above-mentioned monitoring unit, wherein the forwarding information includes the address of the above-mentioned remote monitoring device corresponding to the forwarded monitoring data, the above-mentioned monitoring data, the size of the above-mentioned monitoring data and the time of receiving the above-mentioned monitoring data, wherein the sending information and the above-mentioned forwarding information of the same above-mentioned remote monitoring device appear in pairs, and the above-mentioned sending time and the receiving time correspond. Through the above-mentioned technical solution, a foundation is laid for determining whether the above-mentioned second unauthorized device exists near the above-mentioned remote monitoring unit based on the above-mentioned sending information and the above-mentioned forwarding information.

[0024] Furthermore, the step S2 comprises: Step S21: taking the size of the monitoring data in the information sent by each remote monitoring device as the first data volume, and obtaining the sending time of the monitoring data; Step S22: comparing the first data volume corresponding to the remote monitoring device with the reference data volume corresponding to the remote monitoring device stored in the storage unit, and obtaining the first comparison result, and when the first comparison result is greater than the first threshold, sending a query instruction to the corresponding remote monitoring device, wherein the time corresponding to the reference data volume is consistent with the sending time; Step S23: After receiving the query instruction, the remote monitoring device sends the configuration information and the modification record to the monitoring unit, and determines whether the configuration information of the remote monitoring device is modified through the modification record. When the configuration information of the remote monitoring device is modified, the monitoring unit calculates the second data volume of the remote monitoring device forwarded by the switch at a single time based on the data collection period, the single collection data volume and the sending period in the configuration information, and calculates the difference between the second data volume and the first data volume. When the configuration information is not modified or the difference is greater than the set difference, the remote monitoring device is the first unauthorized device; when the difference is less than or equal to the set difference, the remote monitoring device is not the first unauthorized device.

[0025] Specifically, the size of the monitoring data sent in the sending information of the remote monitoring device, that is, the data volume of the monitoring data sent by the remote monitoring device this time, is used as the first data volume. At the same time, the sending time of the monitoring data is also obtained. The first data volume is compared with the reference data volume corresponding to the remote monitoring device stored in the storage unit, and the first comparison result is obtained. When the second comparison result is greater than the first threshold, the monitoring unit sends a query instruction to obtain the configuration information modification record of the remote monitoring device and the configuration information, and determines whether the configuration information of the remote monitoring device has been modified through the modification record. When no modification has occurred and the data volume surges, it may be an illegal camera or an illegal multi-network card device. Or other illegal terminals illegally access the above-mentioned security network. When the above-mentioned configuration information is modified, the ratio of the sending period to the data collection period in the configuration information is calculated, and the product of the above-mentioned ratio and the single collection data volume is used as the second data volume of the remote monitoring device forwarded by the switch at a single time, and the difference between the second data volume and the above-mentioned first data volume is calculated, that is, the difference between the modified single transmission data volume and the actual transmission data volume. When the difference between the two is small, the above-mentioned remote monitoring device is likely to be a normal and legal device. When the above-mentioned difference is large, that is, greater than the above-mentioned set difference, the above-mentioned remote monitoring device is the above-mentioned first unauthorized device. Through the above-mentioned technical solution, it is possible to accurately judge whether the above-mentioned remote monitoring device is the above-mentioned first unauthorized device when the amount of data sent by the remote monitoring device surges.

[0026] Furthermore, the step S3 comprises: Step S31: when the first comparison result is less than or equal to the first threshold, the monitoring data of each remote monitoring device forwarded by the switch is compared with the background data corresponding to the remote monitoring device stored in the database by the monitoring unit at a preset period, and the second comparison result is obtained; Step S32: When the second comparison result is that the similarity between the monitoring data and the background data is less than or equal to a first set threshold, the remote monitoring device is the first unauthorized device; otherwise, the remote monitoring device is not the first unauthorized device.

[0027] Specifically, when the first comparison result is less than or equal to the first threshold, that is, when the first data volume sent by the remote monitoring device is normal, it cannot be said that the remote monitoring device is an authorized device, and it is necessary to determine whether it is an authorized device through the monitoring data collected by the remote monitoring device. Therefore, the monitoring data of each remote monitoring device obtained by the switch at a preset period is compared with the background data stored in the database and corresponding to the remote monitoring device through the monitoring unit. Since the monitoring area corresponding to each remote monitoring device is fixed, and the monitoring area is bound to the address information of the remote monitoring device, although the monitoring data of the monitoring area changes relative to the background data, the changed part will not cover the entire background, and there is still a certain degree of correlation between the monitoring data and the background data. Similarity, therefore, by comparing the above-mentioned monitoring data corresponding to the above-mentioned remote monitoring device with the above-mentioned background data corresponding to the above-mentioned remote monitoring device stored in the above-mentioned database, and obtaining the above-mentioned second comparison result, that is, the similarity between the above-mentioned monitoring data and the above-mentioned background data, when the above-mentioned similarity is greater than the above-mentioned set threshold, the above-mentioned remote monitoring device is not the above-mentioned first unauthorized device, on the contrary, when the above-mentioned similarity is less than or equal to the above-mentioned remote monitoring device being the above-mentioned first unauthorized device, the above-mentioned first unauthorized device is an unauthorized network camera, unauthorized multi-network card device or other unauthorized terminal that illegally steals the address and authority information of the above-mentioned remote monitoring device, and sends illegal data to the switch to impersonate monitoring data. Through the above-mentioned technical solution, the above-mentioned first unauthorized device can be more accurately identified, thereby improving the accuracy of identifying illegal intrusions into the security network.

[0028] Furthermore, the step S4 comprises: Step S41: When the remote monitoring device is not the first unauthorized device, the monitoring unit compares the sending record in the sending information of each remote monitoring device with the forwarding record in the forwarding information of the switch, and obtains a third comparison result; Step S42: When the third comparison result is that the forwarding record includes the sending record of the remote monitoring device, the second unauthorized device does not exist at the location of the remote monitoring device; when the third comparison result is that the forwarding record does not completely include the sending record of the remote monitoring device, the second unauthorized device exists near the location of the remote monitoring device.

[0029] Specifically, when the above-mentioned remote monitoring device is not the above-mentioned first unauthorized device, the above-mentioned monitoring unit compares the sending record in each of the above-mentioned remote monitoring devices with the forwarding record in the above-mentioned switch forwarding information, and obtains a third comparison result, that is, whether the monitoring data of the above-mentioned remote monitoring device are all sent to the above-mentioned switch. When the monitoring data of the above-mentioned remote monitoring device are all sent to the above-mentioned switch, that is, the third comparison result is that the above-mentioned sending record is consistent with the corresponding forwarding record of the above-mentioned remote monitoring device. At this time, it is considered that there is no second unauthorized device that illegally accesses the vicinity of the location of the above-mentioned collection device. When the third comparison result is that the above-mentioned sending record of the above-mentioned collection device is inconsistent with the above-mentioned forwarding record corresponding to the above-mentioned remote monitoring device, that is, the above-mentioned forwarding record does not completely include the above-mentioned sending record, that is, the data sent by the above-mentioned remote monitoring device is not completely sent to the above-mentioned switch, and may also be sent to the above-mentioned second unauthorized device, that is, an unauthorized router or other illegal access point. Through the above-mentioned technical solution, it is possible to accurately determine whether the above-mentioned second unauthorized device exists at the location of each of the above-mentioned remote monitoring devices.

[0030] Furthermore, the step S5 comprises: When the first unauthorized device or the second unauthorized device exists in the security network, an alarm message is generated by the monitoring unit and sent to the cloud supervision platform for display. For the first unauthorized device, the data transmission of the first unauthorized device is blocked by the monitoring unit, and at the same time, the authorization information is updated so that each of the remote monitoring devices re-establishes a communication connection with the switch through the authorization information; when the second unauthorized device exists near the location of the remote monitoring device, the address information of the second unauthorized device is obtained through the third comparison result, and the second unauthorized device is identified based on the address information, and the communication connection between the remote monitoring device and the second unauthorized device is disconnected.

[0031] Specifically, when the first unauthorized device and the second unauthorized device exist in the security network, an alarm message is generated by the monitoring unit, and the alarm message is sent to the display platform for display, wherein the alarm message includes the address information and IP information of the first unauthorized device and / or the second unauthorized device. For the first unauthorized device, the data transmission of the first unauthorized device is blocked by the monitoring unit, that is, the communication connection is disconnected. At the same time, the authorization information is updated, and each of the remote monitoring devices in the security network is re-authenticated, and a communication connection is established with the switch, so that the first unauthorized device is filtered out of the security network. For the second unauthorized device, the address information of the second unauthorized device is obtained through the third comparison result, that is, the communication record that exists in the sending record of the remote monitoring device and does not exist in the forwarding data, and the second unauthorized device is identified based on the address information, and the communication connection between the corresponding remote monitoring device and the second unauthorized device is disconnected, so as to achieve data blocking. Through the technical solution, not only the alarm message can be generated and displayed in time, but also the data transmission of the unauthorized device can be blocked in time.

[0032] Furthermore, in step S3, when the second comparison result is that the similarity between the monitoring data of the remote monitoring device and the background data is greater than the first set threshold and less than or equal to the second set threshold for a duration greater than or equal to a set time, the monitoring data is used as the new background data.

[0033] Specifically, when the second comparison result is that the similarity between the monitoring data of the remote monitoring device and the background data is greater than the first set threshold and less than or equal to the second set threshold, for example: the first set threshold is 90%, the second set threshold is 97%, and the duration of this state exceeds the upper set time, for example: 5 minutes, then it is considered that the content of the monitoring area corresponding to the remote monitoring device has changed. In order to more accurately identify the first unauthorized device, the monitoring data is used as the new background data and replaces the background data in the database. Through the above technical solution, the identification accuracy of the first unauthorized device is further improved.

[0034] Furthermore, the monitoring unit also forwards the corresponding monitoring data through the switch according to the authorization period in the authorization information corresponding to the remote monitoring device authorized in the security network, and stops forwarding the monitoring data after the authorization period expires, wherein the switch is a 1 optical 5 electrical Gigabit switch, and the lightning protection standard of the network port of the switch is 5KA.

[0035] The present invention also provides an integrated monitoring system for detecting unauthorized access to a secure network, the system being used to implement the above method, such as Figure 2 As shown, the system comprises: A monitoring unit, used to periodically receive monitoring data from each remote monitoring device in the security network, and obtain the sending information of each remote monitoring device, wherein the monitoring unit also obtains the forwarding information when the switch forwards the monitoring data; The switch is used to forward the monitoring data sent by each of the remote monitoring devices; The judgment unit is configured to: compare the first data volume of the monitoring data in the sending information corresponding to each of the remote monitoring devices with the reference data volume stored in the storage unit, and obtain a first comparison result; when the first comparison result is greater than a first threshold, judge whether the remote monitoring device is a first unauthorized device according to the first comparison result and the configuration information of the remote monitoring device; when the first comparison result is less than or equal to the first threshold, compare the monitoring data of each of the remote monitoring devices forwarded by the switch with the corresponding background data at a preset period through the monitoring unit, obtain a second comparison result, and judge whether the remote monitoring device is a first unauthorized device according to the second comparison result; when the remote monitoring device is not the first unauthorized device, compare each of the sent information obtained with the corresponding forwarded information through the monitoring unit, and obtain a third comparison result, and judge whether there is a second unauthorized device at the location of the remote monitoring device according to the third comparison result; The early warning unit is used to take corresponding measures through the monitoring unit to block data transmission in real time when the first unauthorized device or the second unauthorized device exists in the security network, and send alarm information to the cloud supervision platform.

[0036] The present invention also provides a computer storage medium, wherein the storage medium stores program instructions, wherein when the program instructions are executed, the device where the storage medium is located is controlled to execute the above method.

[0037] In summary, the present invention compares the first data volume of each remote monitoring device with the corresponding reference data volume through the monitoring unit, and obtains the first comparison result, and determines whether the data volume of the remote monitoring device is abnormal according to the first comparison result, that is, whether it is the first unauthorized device that maliciously occupies bandwidth traffic. When the above-mentioned first comparison result is greater than the first threshold, the above-mentioned remote monitoring device is the above-mentioned first unauthorized device. When the above-mentioned data volume is less than the first threshold, the monitoring data of the above-mentioned remote monitoring device obtained by the above-mentioned switch is also compared with the background data set to determine whether the monitoring area has changed, thereby further determining whether the above-mentioned remote monitoring device is the first unauthorized device. The sending record of each remote monitoring device is compared with the forwarding record of the switch, and it is determined whether the data of the above-mentioned remote monitoring device is illegally obtained by the second unauthorized device, wherein the above-mentioned first unauthorized device is an unauthorized network camera or an unauthorized multi-network card device, and can also be other unauthorized terminal devices, and the above-mentioned second unauthorized device is an unauthorized wireless router or other unauthorized access point, and when the above-mentioned first unauthorized device or the above-mentioned second unauthorized device exists in the above-mentioned security network, corresponding measures are taken to prevent data intrusion or data leakage. Through the mutual cooperation of the above-mentioned technical solutions, the recognition accuracy of unauthorized devices in the security network is improved.

[0038] The technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above-mentioned embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0039] The above-mentioned embodiments only express several implementation methods of the present invention, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the patent of the present invention. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

[0040] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A supervisory integrated method for detecting unauthorized access to a secure network, characterized in that: The method comprises the following steps: Step S1: Periodically receiving monitoring data from each remote monitoring device in the security network through a monitoring unit, and obtaining sending information of each remote monitoring device, wherein the monitoring unit also obtains forwarding information when the switch forwards the monitoring data; Step S2: Compare the first data volume of the monitoring data in the information sent by each remote monitoring device with the reference data volume stored in the storage unit, and obtain a first comparison result. When the first comparison result is greater than a first threshold, determine whether the remote monitoring device is a first unauthorized device according to the first comparison result and the configuration information of the remote monitoring device; Step S3: when the first comparison result is less than or equal to the first threshold, the monitoring data of each remote monitoring device forwarded by the switch is compared with the corresponding background data at a preset period by the monitoring unit to obtain a second comparison result, and whether the remote monitoring device is a first unauthorized device is determined according to the second comparison result; Step S4: when the remote monitoring device is not the first unauthorized device, the monitoring unit compares each of the acquired sending information with the corresponding forwarding information, obtains a third comparison result, and determines whether there is a second unauthorized device near the location of the remote monitoring device according to the third comparison result; Step S5: When the first unauthorized device and the second unauthorized device exist in the security network, the monitoring unit takes corresponding measures to block data transmission in real time, and sends an alarm message to the cloud monitoring platform.

2. The method according to claim 1, characterized in that In step S1, the sending information of the remote monitoring device includes the size of the sent monitoring data, the sending time, the address of the remote monitoring device and the destination address of the sending, and the forwarding information of the switch includes the address of the remote monitoring device corresponding to the forwarded monitoring data and the corresponding monitoring data, the size of the monitoring data and the receiving time.

3. The method according to claim 1, characterized in that The step S2 comprises: Step S21: taking the size of the monitoring data in the information sent by each remote monitoring device as the first data volume, and obtaining the sending time of the monitoring data; Step S22: comparing the first data volume corresponding to the remote monitoring device with the reference data volume corresponding to the remote monitoring device stored in the storage unit, and obtaining the first comparison result, and when the first comparison result is greater than the first threshold, sending a query instruction to the corresponding remote monitoring device, wherein the time corresponding to the reference data volume is consistent with the sending time; Step S23: After receiving the query instruction, the remote monitoring device sends the configuration information and the modification record to the monitoring unit, and determines whether the configuration information of the remote monitoring device is modified through the modification record. When the configuration information of the remote monitoring device is modified, the monitoring unit calculates the second data volume of the remote monitoring device forwarded by the switch at a single time based on the data collection period, the single collection data volume and the sending period in the configuration information, and calculates the difference between the second data volume and the first data volume. When the configuration information is not modified or the difference is greater than the set difference, the remote monitoring device is the first unauthorized device; when the difference is less than or equal to the set difference, the remote monitoring device is not the first unauthorized device.

4. The method according to claim 1, characterized in that: The step S3 comprises: Step S31: when the first comparison result is less than or equal to the first threshold, the monitoring data of each remote monitoring device forwarded by the switch is compared with the background data corresponding to the remote monitoring device stored in the database by the monitoring unit at a preset period, and the second comparison result is obtained; Step S32: When the second comparison result is that the similarity between the monitoring data and the background data is less than or equal to a first set threshold, the remote monitoring device is the first unauthorized device; otherwise, the remote monitoring device is not the first unauthorized device.

5. The method according to claim 1, characterized in that The step S4 comprises: Step S41: When the remote monitoring device is not the first unauthorized device, the monitoring unit compares the sending record in the sending information of each remote monitoring device with the forwarding record in the forwarding information of the switch, and obtains a third comparison result; Step S42: When the third comparison result is that the forwarding record includes the sending record of the remote monitoring device, the second unauthorized device does not exist at the location of the remote monitoring device; when the third comparison result is that the forwarding record does not completely include the sending record of the remote monitoring device, the second unauthorized device exists near the location of the remote monitoring device.

6. The method according to claim 1, characterized in that The step S5 comprises: When the first unauthorized device or the second unauthorized device exists in the security network, an alarm message is generated by the monitoring unit and sent to the cloud supervision platform for display. For the first unauthorized device, the data transmission of the first unauthorized device is blocked by the monitoring unit, and at the same time, the authorization information is updated so that each of the remote monitoring devices re-establishes a communication connection with the switch through the authorization information; when the second unauthorized device exists near the location of the remote monitoring device, the address information of the second unauthorized device is obtained through the third comparison result, and the second unauthorized device is identified based on the address information, and the communication connection between the remote monitoring device and the second unauthorized device is disconnected.

7. The method according to claim 1, characterized in that In step S3, when the second comparison result is that the similarity between the monitoring data of the remote monitoring device and the background data is greater than the first set threshold and less than or equal to the second set threshold for a duration greater than or equal to a set time, the monitoring data is used as the new background data.

8. The method according to claim 1, characterized in that The monitoring unit also forwards the corresponding monitoring data through the switch according to the authorization period in the authorization information corresponding to the remote monitoring device authorized in the security network, and stops forwarding the monitoring data after the authorization period expires, wherein the switch is a 1 optical 5 electrical Gigabit switch, and the lightning protection standard of the network port of the switch is 5KA.

9. A monitoring integrated system for detecting unauthorized access to a secure network, the system being used to implement the method according to any one of claims 1 to 8, characterized in that: The system comprises: A monitoring unit, used to periodically receive monitoring data from each remote monitoring device in the security network, and obtain the sending information of each remote monitoring device, wherein the monitoring unit also obtains the forwarding information when the switch forwards the monitoring data; The switch is used to forward the monitoring data sent by each of the remote monitoring devices; The judgment unit is configured to: compare the first data volume of the monitoring data in the sending information corresponding to each of the remote monitoring devices with the reference data volume stored in the storage unit, and obtain a first comparison result; when the first comparison result is greater than a first threshold, judge whether the remote monitoring device is a first unauthorized device according to the first comparison result and the configuration information of the remote monitoring device; when the first comparison result is less than or equal to the first threshold, compare the monitoring data of each of the remote monitoring devices forwarded by the switch with the corresponding background data at a preset period through the monitoring unit, obtain a second comparison result, and judge whether the remote monitoring device is a first unauthorized device according to the second comparison result; when the remote monitoring device is not the first unauthorized device, compare each of the sent information obtained with the corresponding forwarded information through the monitoring unit, and obtain a third comparison result, and judge whether there is a second unauthorized device at the location of the remote monitoring device according to the third comparison result; The early warning unit is used to take corresponding measures through the monitoring unit to block data transmission in real time when the first unauthorized device and the second unauthorized device exist in the security network, and send alarm information to the cloud supervision platform.

10. A computer storage medium, characterized in that: The storage medium stores program instructions, wherein when the program instructions are executed, the device where the storage medium is located is controlled to execute the method according to any one of claims 1 to 8.

Images