Intelligent equipment operation analysis system and method based on network security

Abstract

The invention discloses an intelligent equipment operation analysis system and method based on network security, and relates to the technical field of intelligent equipment operation analysis, and the method comprises the steps: S10, recognizing abnormal traffic behavior characteristics of communication equipment; s20, predicting a real-time network security index of the communication equipment according to an integrated analysis result; s30, determining a real-time network attack type of the communication equipment; and S40, monitoring the operation condition of the communication equipment in real time. Compared with the method for analyzing the network security of the communication equipment only through the consumption condition of the network flow, the method has the advantages that malicious programs latent in the communication equipment can be identified, the monitoring strength on the network security is improved, the network security index of the communication equipment is evaluated from the two dimensions of the source IP address and the flow distribution, and the network security of the communication equipment is improved. The prediction precision can be improved, and the communication equipment is always in a network security state.

Description

Technical Field

[0001] The present invention relates to the technical field of intelligent device operation analysis, and in particular to an intelligent device operation analysis system and method based on network security. Background Art

[0002] Communication equipment refers to various types of equipment used to achieve information transmission and exchange. It is one of the indispensable infrastructures in the modern information society and plays a vital role in people's daily life, work and business activities.

[0003] In today's digital age, network communications have penetrated into every corner of society. From information exchange between individuals to business operations of enterprises, network communications play a vital role. However, with the popularization of the Internet and the rapid development of information technology, network communication security faces unprecedented challenges. Malicious attacks, data leakage, network fraud and other security issues are emerging in an endless stream, posing a serious threat to personal privacy, corporate interests, etc. The existing technology only relies on the network traffic consumption of communication equipment during operation to analyze whether the operating network of the communication equipment is safe. Due to the low analysis accuracy, it is impossible to identify the potential network security in the communication equipment in a timely manner, which reduces the operating network security of the communication equipment. Summary of the invention

[0004] The purpose of the present invention is to provide a smart device operation analysis system and method based on network security to solve the problems raised in the prior art.

[0005] To achieve the above object, the present invention provides the following technical solution: a method for analyzing the operation of an intelligent device based on network security, the method comprising: S10: According to the historical system log of the communication device, the real-time communication object of the communication device and the request status sent by each communication object to the communication device server are determined, and the real-time attack characterization value of the communication device is calculated in combination with the response feedback status sent in real time by the communication device server, and the abnormal traffic behavior characteristics of the communication device are identified according to the real-time network traffic consumption of the communication device during operation; S20: according to the initial action time of the abnormal traffic behavior of the communication device, obtaining the historical traffic behavior characteristic value of the communication device, integrating and analyzing the obtained historical traffic behavior characteristic value, and predicting the real-time network security index of the communication device according to the integrated analysis result; S30: determining abnormal traffic characteristics of the communication device, matching the determined traffic characteristics with traffic characteristics corresponding to various attack sources stored in the database, and determining the real-time network attack type of the communication device based on the matching result; S40: Monitor the operation status of communication equipment in real time.

[0006] Further, the S10 includes: S101: According to the historical system log of the communication device in the time period [td, t], the communication object of the communication device at time t+d and the number of requests sent by each communication object to the communication device server at time t are determined, and the number of response feedbacks S sent by the communication device server at time t+d is combined. t+d , the attack characterization value G of the communication device at time t+d t+d Perform calculations, , where t represents the time value and 0≤t≤24, d represents the average response time of the communication device server to a single request, i=1,2,…,m, represents the number corresponding to each communication object, m represents the total number of communication objects, U it Indicates the number of requests sent by the communication object numbered i to the communication device server at time t; the server will not respond to invalid requests, so Invalid requests usually refer to those that do not conform to normal user behavior patterns, such as requests generated by robots, crawlers, or automated tools, or requests generated by users' accidental or fraudulent clicks; S102: The total network traffic consumption X of the communication device at time t and time t+d is calculated respectively. t , X t+d To obtain; When 0.7≤G t+d When ≤1, it means that the communication device is maliciously attacked at time t+d; When 0≤G t+d <0.7 and (X t+d -X t )*G t+d ≥Y d , it means that the communication device is maliciously attacked at time t+d, where Y d It represents the total amount of invalid traffic that the communication device is allowed to generate within time d; When 0≤G t+d <0.7 and (X t+d -X t )*G t+d <Y d , it means that the communication device has not been attacked maliciously at time t+d. Based on the above judgment conditions, some large-scale attacks can be detected, as well as malicious programs carried in the request, which improves the monitoring of network security. Malicious programs include traditional mobile phone viruses, some applications that are not viruses but have malicious behaviors, etc. S103: When the communication device is maliciously attacked at time t+d, it means that the communication device has abnormal traffic behavior characteristics at time t+d.t+d -X t )*G t+d -Y is used as the characteristic value of the abnormal traffic behavior characteristic of the communication device, and time t+d is used as the initial action time of the abnormal traffic behavior of the communication device.

[0007] Further, the S20 includes: S201: According to the initial action time t+d of the abnormal traffic behavior of the communication device, the historical traffic value consumed by the communication device at each data collection time point in the [tn*d, t] time period is obtained to obtain a historical traffic value set M, M={X t-n*d ,X t-(n-1)*d ,…,X t}, where n represents a constant and n=5; According to R t-n*d =[(X t-(n-1)*d -X t-n*d )*G t-(n-1)*d ] / Y d The historical traffic behavior characteristic value R of the communication device at time tn*d t-n*d Perform calculations and put the calculation results into set N until all historical traffic values ​​stored in set M are involved in the calculations to obtain a historical traffic behavior feature set; S202: According to the calculation formula of dispersion coefficient = standard deviation / average value, the dispersion coefficient γ of the historical traffic behavior feature set is calculated. t-n*d→t Perform calculations; According to the system log of the communication device in the time period [tn*d,t], the source IP address of the communication target server that sends the request to the communication device is obtained, combined with the calculated discrete coefficient γ t-n*d→t , the network security index of the communication equipment at time t+d is predicted. The specific prediction formula is: ; Among them, K t-n*d→t Indicates the total number of requests sent by the communication object to the communication device server during the time period [tn*d,t], H t-n*d→t Indicates the total number of source IP address types obtained within the [tn*d,t] time period, e represents a constant and e>1, Q t+d Represents the network security index of the communication equipment at time t+d.

[0008] Further, the S30 includes: S301: When the communication device is identified to have abnormal traffic behavior characteristics, the communication device starts a traffic cleaning mechanism to filter and clean the attack traffic, which is conducive to ensuring the smooth passage of normal user requests and effectively blocking the intrusion of malicious traffic; S302: The discrete coefficient γ of the historical traffic behavior characteristic value of the communication device in the [tn*d,t] time period t-n*d→t As the abnormal traffic characteristics of the communication device, the determined abnormal traffic characteristics are matched with the traffic characteristics corresponding to various attack sources stored in the database. The specific matching method is: The various attack sources stored in the database are numbered, and the numbering result is p=1,2,…,q; q represents the total number of attack source types stored in the database; If 0≤|γ t-n*d→t -τ p |≤g, the match is considered successful, and the communication device is attacked by the pth type of attack source at time t+d; If |γ t-n*d→t -τ p |>g, the match is considered unsuccessful and the communication device is not attacked by the pth type of attack source at time t+d; Among them, g represents the error value, τ p It represents the discrete coefficient corresponding to the network traffic consumed by the communication device when the communication device is attacked by the pth type of attack source.

[0009] Further, the S40 includes: When 0.7≤Q t+d When ≤1, the communication device physically isolates the service attacked by the pth type of attack source from the network, and the services in the communication device that are not attacked by the pth type of attack source communicate normally; When 0≤Q t+d When the value is less than 0.7, the communication device automatically starts the network disconnection operation and backs up the data stored inside the communication device.

[0010] A network security-based intelligent device operation analysis system, the system comprising an abnormal traffic behavior feature recognition module, a network security index prediction module, a network attack type determination module and an intelligent device operation supervision module; The abnormal traffic behavior feature identification module is used to identify abnormal traffic behavior features of communication equipment; The network security index prediction module is used to predict the real-time network security index of the communication device based on the integrated analysis results of the historical traffic behavior characteristic values; The network attack type determination module is used to determine the real-time network attack type of the communication device; The smart device operation monitoring module is used to monitor the operation status of the communication device in real time.

[0011] Furthermore, the abnormal traffic behavior feature identification module includes a characterization value calculation unit, an analysis and judgment unit, and an abnormal traffic behavior feature identification unit; The characterization value calculation unit determines the communication object of the communication device and the number of requests sent by each communication object to the communication device server according to the historical system log of the communication device, and calculates the real-time attack characterization value of the communication device in combination with the number of response feedbacks sent in real time by the communication device server; The analysis and judgment unit performs a preliminary analysis on the attack status of the communication device according to the calculation result transmitted by the characterization value calculation unit, and determines the real-time attack status of the communication device in combination with the total network traffic consumption of the communication device at each moment; The abnormal traffic behavior characteristic identification unit determines the characteristic value of the abnormal traffic behavior characteristic of the communication device and the initial action time of the normal traffic behavior according to the determination result transmitted by the analysis and judgment unit.

[0012] Furthermore, the network security index prediction module includes a historical traffic behavior feature set acquisition unit, a discrete coefficient calculation unit and a network security index prediction unit; The historical traffic behavior feature set acquisition unit acquires the historical traffic value consumed by the communication device at each data collection time point according to the initial action time of the abnormal traffic behavior of the communication device, obtains a historical traffic value set, calculates the historical traffic behavior feature value of the communication device at each time according to the constructed mathematical model, and obtains the historical traffic behavior feature set based on the calculation result; The discrete coefficient calculation unit calculates the discrete coefficient of the historical traffic behavior feature set according to the discrete coefficient calculation formula; The network security index prediction unit obtains the source IP address of the communication object server that sends a request to the communication device based on the historical system log of the communication device, and predicts the real-time network security index of the communication device in combination with the calculation result transmitted by the discrete coefficient calculation unit.

[0013] Further, the network attack type determination module includes a processing unit, a matching unit and a network attack type determination unit; When the processing unit identifies abnormal traffic behavior characteristics of the communication device, it automatically starts the traffic cleaning mechanism of the communication device to filter and clean the attack traffic; The matching unit uses the discrete coefficient of the historical traffic behavior characteristic value of the communication device as the abnormal traffic characteristic of the communication device, and determines the matching between the abnormal traffic characteristic and the traffic characteristics corresponding to various attack sources stored in the database according to the constructed matching model; The network attack type determination unit determines the real-time network attack type of the communication device according to the matching result of the matching unit.

[0014] Furthermore, the intelligent device operation supervision module monitors and manages the real-time operation status of the communication device according to the prediction result transmitted by the network security index prediction unit.

[0015] Compared with the prior art, the present invention has the following beneficial effects: 1. The present invention calculates the real-time attack characteristic value of the communication device according to the response feedback of the communication device to the request, and analyzes and determines whether the communication device is in an attacked state in combination with the real-time network consumption of the communication device during operation. Moreover, according to the analysis and judgment conditions, not only some large-scale attacks can be identified, but also malicious programs carried in the request can be identified. Compared with analyzing the network security of the communication device only through the consumption of network traffic, malicious programs lurking in the communication device can be identified, thereby improving the monitoring of network security.

[0016] 2. The present invention predicts the real-time network security index of the communication device based on the source IP address of the communication object server that sends a request to the communication device and the discrete coefficient of the historical traffic behavior feature set of the communication device. This process evaluates the network security index of the communication device from two dimensions: source IP address and traffic distribution, which is conducive to improving the prediction accuracy and thereby ensuring that the communication device is always in a network security state.

[0017] 3. The present invention describes the attack characteristics of the attack source of the communication device by taking the discrete coefficient of the historical traffic behavior characteristic value of the communication device as the abnormal traffic characteristic of the communication device, which is conducive to quickly and accurately matching the attack source of the communication device, and monitoring the real-time operation status of the communication device according to the matching result, further improving the operation control effect of the communication equipment. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 A schematic diagram of the workflow of a network security-based intelligent device operation analysis system and method of the present invention; Figure 2 The present invention is a schematic structural diagram of the working principle of a network security-based intelligent device operation analysis system and method. DETAILED DESCRIPTION

[0019] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0020] Example: Figure 1 and Figure 2 As shown, the present invention provides a system and method for analyzing the operation of an intelligent device based on network security, and a method for analyzing the operation of an intelligent device based on network security, the method comprising: S10: According to the historical system log of the communication device, the real-time communication object of the communication device and the request status sent by each communication object to the communication device server are determined, and the real-time attack characterization value of the communication device is calculated in combination with the response feedback status sent in real time by the communication device server, and the abnormal traffic behavior characteristics of the communication device are identified according to the real-time network traffic consumption of the communication device during operation; S10 includes: S101: According to the historical system log of the communication device in the time period [td, t], the update cycle of the communication device system log is 1 day, the communication object of the communication device at time t+d, the communication object refers to the device that has sent a request to the communication device server in the time period [td, t], and the number of requests sent by each communication object to the communication device server at time t are determined, combined with the number of response feedbacks S sent by the communication device server at time t+d t+d , the attack characterization value G of the communication device at time t+d t+d Perform calculations, , where t represents the time value and 0≤t≤24, unit: hour, d represents the average response time of the communication device server to a single request, i=1,2,…,m, represents the number corresponding to each communication object, m represents the total number of communication objects, U it G represents the number of requests sent by the communication object numbered i to the communication device server at time t. Since each HTTP request can only correspond to one HTTP response (HTTP protocol is a stateless protocol. The client sends an HTTP request to the server, and the server returns a corresponding HTTP response), 0≤G t+d ≤1; S102: The total network traffic consumption X of the communication device at time t and time t+d is calculated respectively. t , X t+d To obtain; When 0.7≤G t+d When ≤1, it means that the communication device is maliciously attacked at time t+d; When 0≤G t+d <0.7 and (X t+d -X t )*G t+d ≥Y d , it means that the communication device is maliciously attacked at time t+d, where Y dIndicates the total amount of invalid traffic that a communication device is allowed to generate within time d. Invalid traffic refers to traffic that does not generate actual services or value, such as users clicking on ads without actual needs, or traffic generated through fraudulent means‌; When 0≤G t+d <0.7 and (X t+d -X t )*G t+d <Y d , it means that the communication device has not been maliciously attacked at time t+d; S103: When the communication device is maliciously attacked at time t+d, it means that the communication device has abnormal traffic behavior characteristics at time t+d. t+d -X t )*G t+d -Y is used as the characteristic value of the abnormal traffic behavior characteristic of the communication device, and time t+d is used as the initial action time of the abnormal traffic behavior of the communication device; S20: according to the initial action time of the abnormal traffic behavior of the communication device, obtaining the historical traffic behavior characteristic value of the communication device, integrating and analyzing the obtained historical traffic behavior characteristic value, and predicting the real-time network security index of the communication device according to the integrated analysis result; The S20 includes: S201: According to the initial action time t+d of the abnormal traffic behavior of the communication device, the historical traffic value consumed by the communication device at each data collection time point in the [tn*d, t] time period is obtained to obtain a historical traffic value set M, M={X t-n*d ,X t-(n-1)*d ,…,X t}, where n represents a constant and n=5; According to R t-n*d =[(X t-(n-1)*d -X t-n*d )*G t-(n-1)*d ] / Y d The historical traffic behavior characteristic value R of the communication device at time tn*d t-n*d Perform calculations and put the calculation results into set N until all historical traffic values ​​stored in set M are involved in the calculations to obtain a historical traffic behavior feature set; S202: According to the calculation formula of dispersion coefficient = standard deviation / average value, the dispersion coefficient γ of the historical traffic behavior feature set is calculated. t-n*d→t Perform calculations; According to the system log of the communication device in the time period [tn*d,t], the source IP address of the communication target server that sends the request to the communication device is obtained, combined with the calculated discrete coefficient γ t-n*d→t, the network security index of the communication equipment at time t+d is predicted. The specific prediction formula is: ; Among them, K t-n*d→t Indicates the total number of requests sent by the communication object to the communication device server during the time period [tn*d,t], H t-n*d→t It indicates the total number of source IP addresses obtained in the time period [tn*d,t]. The source IP addresses that are exactly the same are called the same type of addresses. e indicates a constant and e>1. Q t+d Indicates the network security index of the communication equipment at time t+d; S30: determining abnormal traffic characteristics of the communication device, matching the determined traffic characteristics with traffic characteristics corresponding to various attack sources stored in the database, and determining the real-time network attack type of the communication device based on the matching result; S30 includes: S301: When the communication device is identified to have abnormal traffic behavior characteristics, the communication device starts a traffic cleaning mechanism. The traffic cleaning mechanism is a network security technology that is mainly used to detect and filter malicious traffic, ensure that normal network communications are not affected, and filter and clean attack traffic. S302: The discrete coefficient γ of the historical traffic behavior characteristic value of the communication device in the [tn*d,t] time period t-n*d→t As the abnormal traffic characteristics of the communication device, the determined abnormal traffic characteristics are matched with the traffic characteristics corresponding to various attack sources stored in the database. The specific matching method is: The various attack sources stored in the database are numbered, and the numbering result is p=1,2,…,q; q represents the total number of attack source types stored in the database; If 0≤|γ t-n*d→t -τ p |≤g, the match is considered successful, and the communication device is attacked by the pth type of attack source at time t+d, including denial of service attack (DoS / DDoS), man-in-the-middle attack (MitM), SQL injection, cross-site scripting attack (XSS), etc. If |γ t-n*d→t -τ p |>g, the match is considered unsuccessful and the communication device is not attacked by the pth type of attack source at time t+d; Among them, g represents the error value, τ p It represents the discrete coefficient corresponding to the network traffic consumed by the communication device when the communication device is attacked by the pth type of attack source.

[0021] S40: Monitor the operation of communication equipment in real time; S40 includes: When 0.7≤Q t+d When ≤1, the communication device physically isolates the service attacked by the pth type of attack source from the network, and the services in the communication device that are not attacked by the pth type of attack source communicate normally; When 0≤Q t+d When the value is less than 0.7, the communication device automatically starts the network disconnection operation and backs up the data stored inside the communication device.

[0022] A network security-based intelligent device operation analysis system, the system includes an abnormal traffic behavior feature recognition module, a network security index prediction module, a network attack type determination module and an intelligent device operation supervision module; The abnormal traffic behavior feature identification module is used to identify the abnormal traffic behavior features of the communication equipment; The abnormal traffic behavior feature recognition module includes a characterization value calculation unit, an analysis and judgment unit, and an abnormal traffic behavior feature recognition unit; The characterization value calculation unit determines the communication object of the communication device and the number of requests sent by each communication object to the communication device server according to the historical system log of the communication device, and calculates the real-time attack characterization value of the communication device in combination with the number of response feedbacks sent in real time by the communication device server; The analysis and judgment unit performs a preliminary analysis on the attack status of the communication device according to the calculation result transmitted by the characterization value calculation unit, and determines the real-time attack status of the communication device in combination with the total network traffic consumption of the communication device at each moment; The abnormal traffic behavior characteristic identification unit determines the characteristic value of the abnormal traffic behavior characteristic of the communication device and the initial action time of the normal traffic behavior according to the determination result transmitted by the analysis and judgment unit; The network security index prediction module is used to predict the real-time network security index of communication equipment based on the integrated analysis results of historical traffic behavior characteristic values; The network security index prediction module includes a historical traffic behavior feature set acquisition unit, a discrete coefficient calculation unit and a network security index prediction unit; The historical traffic behavior characteristic set acquisition unit acquires the historical traffic value consumed by the communication device at each data collection time point according to the initial action time of the abnormal traffic behavior of the communication device, obtains a historical traffic value set, calculates the historical traffic behavior characteristic value of the communication device at each time according to the constructed mathematical model, and obtains the historical traffic behavior characteristic set based on the calculation result; The discrete coefficient calculation unit calculates the discrete coefficient of the historical traffic behavior feature set according to the discrete coefficient calculation formula; The network security index prediction unit obtains the source IP address of the communication target server that sends a request to the communication device based on the historical system log of the communication device, and predicts the real-time network security index of the communication device in combination with the calculation result transmitted by the discrete coefficient calculation unit; The network attack type determination module is used to determine the real-time network attack type of the communication device; The network attack type determination module includes a processing unit, a matching unit and a network attack type determination unit; When the processing unit identifies abnormal traffic behavior characteristics of the communication device, it automatically starts the traffic cleaning mechanism of the communication device to filter and clean the attack traffic; The matching unit uses the discrete coefficient of the historical traffic behavior characteristic value of the communication device as the abnormal traffic characteristic of the communication device, and determines the matching between the abnormal traffic characteristic and the traffic characteristics corresponding to various attack sources stored in the database according to the constructed matching model; The network attack type determination unit determines the real-time network attack type of the communication device according to the matching result of the matching unit; The intelligent device operation supervision module is used to monitor the operation of communication equipment in real time; The intelligent device operation supervision module monitors and manages the real-time operation status of the communication equipment according to the prediction results transmitted by the network security index prediction unit.

[0023] Example 1: Assume that the communication device has 4 communication partners at time t+d, and the number of requests U sent by the communication partner numbered 1 to the communication device server at time t is 1t =2, the number of requests U sent by the communication object No. 2 to the communication device server at time t 2t =1, the number of requests U sent by the communication object No. 3 to the communication device server at time t 3t =3, the number of requests U sent by the communication object No. 4 to the communication device server at time t 4t =4, the number of response feedbacks S sent by the communication device server at time t+d t+d =6, then the attack characterization value G of the communication device at time t+d t+d for: ; Then the attack characterization value G of the communication device at time t+d is t+d =0.4; Assume that the total network traffic consumption of the communication equipment at time t and time t+d is X t =3GB, X t+d =6GB, Y d =0.5GB, then (X t+d -Xt )*G t+d =1.2GB>Y d =0.5GB; It can be seen that the communication device was maliciously attacked at time t+d.

[0024] It will be apparent to those skilled in the art that the invention is not limited to the details of the exemplary embodiments described above and that the invention can be implemented in other specific forms without departing from the spirit or essential features of the invention. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description, and it is intended that all variations falling within the meaning and scope of the equivalent elements of the claims be included in the invention. Any reference numeral in a claim should not be considered as limiting the claim to which it relates.

Claims

1. A method for analyzing the operation of intelligent devices based on network security, characterized in that: The method comprises: S10: According to the historical system log of the communication device, the real-time communication object of the communication device and the request status sent by each communication object to the communication device server are determined, and the real-time attack characterization value of the communication device is calculated in combination with the response feedback status sent in real time by the communication device server, and the abnormal traffic behavior characteristics of the communication device are identified according to the real-time network traffic consumption of the communication device during operation; S20: according to the initial action time of the abnormal traffic behavior of the communication device, obtaining the historical traffic behavior characteristic value of the communication device, integrating and analyzing the obtained historical traffic behavior characteristic value, and predicting the real-time network security index of the communication device according to the integrated analysis result; S30: determining abnormal traffic characteristics of the communication device, matching the determined traffic characteristics with traffic characteristics corresponding to various attack sources stored in the database, and determining the real-time network attack type of the communication device based on the matching result; S40: Monitor the operation status of communication equipment in real time.

2. According to the method for analyzing the operation of intelligent devices based on network security in claim 1, it is characterized by: The S10 includes: S101: According to the historical system log of the communication device in the time period [td, t], the communication object of the communication device at time t+d and the number of requests sent by each communication object to the communication device server at time t are determined, and the number of response feedbacks S sent by the communication device server at time t+d is combined. t+d , the attack characterization value G of the communication device at time t+d t+d Perform calculations, , where t represents the time value and 0≤t≤24, d represents the average response time of the communication device server to a single request, i=1,2,…,m, represents the number corresponding to each communication object, m represents the total number of communication objects, U it Indicates the number of requests sent by the communication object numbered i to the communication device server at time t; S102: The total network traffic consumption X of the communication device at time t and time t+d is calculated respectively. t , X t+d To obtain; When 0.7≤G t+d When ≤1, it means that the communication device is maliciously attacked at time t+d; When 0≤G t+d <0.7 and (X t+d -X t )*G t+d ≥Y d , it means that the communication device is maliciously attacked at time t+d, where Y d It represents the total amount of invalid traffic that the communication device is allowed to generate within time d; When 0≤G t+d <0.7 and (X t+d -X t )*G t+d <Y d , it means that the communication device has not been maliciously attacked at time t+d; S103: When the communication device is maliciously attacked at time t+d, it means that the communication device has abnormal traffic behavior characteristics at time t+d. t+d -X t )*G t+d -Y is used as the characteristic value of the abnormal traffic behavior characteristic of the communication device, and time t+d is used as the initial action time of the abnormal traffic behavior of the communication device.

3. The method for analyzing the operation of an intelligent device based on network security according to claim 2, characterized in that: The S20 includes: S201: According to the initial action time t+d of the abnormal traffic behavior of the communication device, the historical traffic value consumed by the communication device at each data collection time point in the [tn*d, t] time period is obtained to obtain a historical traffic value set M, M={X t-n*d ,X t-(n-1)*d ,…,X t }, where n represents a constant and n=5; According to R t-n*d =[(X t-(n-1)*d -X t-n*d )*G t-(n-1)*d ] / Y d The historical traffic behavior characteristic value R of the communication device at time tn*d t-n*d Perform calculations and put the calculation results into set N until all historical traffic values ​​stored in set M are involved in the calculations to obtain a historical traffic behavior feature set; S202: According to the calculation formula of dispersion coefficient = standard deviation / average value, the dispersion coefficient γ of the historical traffic behavior feature set is calculated. t-n*d→t Perform calculations; According to the system log of the communication device in the time period [tn*d,t], the source IP address of the communication target server that sends the request to the communication device is obtained, combined with the calculated discrete coefficient γ t-n*d→t , the network security index of the communication equipment at time t+d is predicted. The specific prediction formula is: ； Among them, K t-n*d→t Indicates the total number of requests sent by the communication object to the communication device server during the time period [tn*d,t], H t-n*d→t Indicates the total number of source IP address types obtained within the [tn*d,t] time period, e represents a constant and e>1, Q t+d Represents the network security index of the communication equipment at time t+d.

4. The method for analyzing the operation of an intelligent device based on network security according to claim 3 is characterized in that: The S30 includes: S301: When the communication device is identified to have abnormal traffic behavior characteristics, the communication device starts a traffic cleaning mechanism to filter and clean the attack traffic; S302: The discrete coefficient γ of the historical traffic behavior characteristic value of the communication device in the [tn*d,t] time period t-n*d→t As the abnormal traffic characteristics of the communication device, the determined abnormal traffic characteristics are matched with the traffic characteristics corresponding to various attack sources stored in the database. The specific matching method is: The various attack sources stored in the database are numbered, and the numbering result is p=1,2,…,q; q represents the total number of attack source types stored in the database; If 0≤|γ t-n*d→t -τ p |≤g, the match is considered successful, and the communication device is attacked by the pth type of attack source at time t+d; If |γ t-n*d→t -τ p |>g, the match is considered unsuccessful and the communication device is not attacked by the pth type of attack source at time t+d; Among them, g represents the error value, τ p It represents the discrete coefficient corresponding to the network traffic consumed by the communication device when the communication device is attacked by the pth type of attack source.

5. The method for analyzing the operation of an intelligent device based on network security according to claim 4, characterized in that: The S40 includes: When 0.7≤Q t+d When ≤1, the communication device physically isolates the service attacked by the pth type of attack source from the network, and the services in the communication device that are not attacked by the pth type of attack source communicate normally; When 0≤Q t+d When the value is less than 0.7, the communication device automatically starts the network disconnection operation and backs up the data stored inside the communication device.

6. A network security-based intelligent device operation analysis system applied to the network security-based intelligent device operation analysis method according to any one of claims 1 to 5, characterized in that: The system includes an abnormal traffic behavior feature recognition module, a network security index prediction module, a network attack type determination module and an intelligent device operation supervision module; The abnormal traffic behavior feature identification module is used to identify abnormal traffic behavior features of communication equipment; The network security index prediction module is used to predict the real-time network security index of the communication device based on the integrated analysis results of the historical traffic behavior characteristic values; The network attack type determination module is used to determine the real-time network attack type of the communication device; The smart device operation monitoring module is used to monitor the operation status of the communication device in real time.

7. The network security-based intelligent device operation analysis system according to claim 6 is characterized by: The abnormal traffic behavior feature recognition module includes a characterization value calculation unit, an analysis and judgment unit, and an abnormal traffic behavior feature recognition unit; The characterization value calculation unit determines the communication object of the communication device and the number of requests sent by each communication object to the communication device server according to the historical system log of the communication device, and calculates the real-time attack characterization value of the communication device in combination with the number of response feedbacks sent in real time by the communication device server; The analysis and judgment unit performs a preliminary analysis on the attack status of the communication device according to the calculation result transmitted by the characterization value calculation unit, and determines the real-time attack status of the communication device in combination with the total network traffic consumption of the communication device at each moment; The abnormal traffic behavior characteristic identification unit determines the characteristic value of the abnormal traffic behavior characteristic of the communication device and the initial action time of the normal traffic behavior according to the determination result transmitted by the analysis and judgment unit.

8. The network security-based intelligent device operation analysis system according to claim 7, characterized in that: The network security index prediction module includes a historical traffic behavior feature set acquisition unit, a discrete coefficient calculation unit and a network security index prediction unit; The historical traffic behavior feature set acquisition unit acquires the historical traffic value consumed by the communication device at each data collection time point according to the initial action time of the abnormal traffic behavior of the communication device, obtains a historical traffic value set, calculates the historical traffic behavior feature value of the communication device at each time according to the constructed mathematical model, and obtains the historical traffic behavior feature set based on the calculation result; The discrete coefficient calculation unit calculates the discrete coefficient of the historical traffic behavior feature set according to the discrete coefficient calculation formula; The network security index prediction unit obtains the source IP address of the communication object server that sends a request to the communication device based on the historical system log of the communication device, and predicts the real-time network security index of the communication device in combination with the calculation result transmitted by the discrete coefficient calculation unit.

9. The intelligent device operation analysis system based on network security according to claim 8 is characterized in that: The network attack type determination module includes a processing unit, a matching unit and a network attack type determination unit; When the processing unit identifies abnormal traffic behavior characteristics of the communication device, it automatically starts the traffic cleaning mechanism of the communication device to filter and clean the attack traffic; The matching unit uses the discrete coefficient of the historical traffic behavior characteristic value of the communication device as the abnormal traffic characteristic of the communication device, and determines the matching between the abnormal traffic characteristic and the traffic characteristics corresponding to various attack sources stored in the database according to the constructed matching model; The network attack type determination unit determines the real-time network attack type of the communication device according to the matching result of the matching unit.

10. The intelligent device operation analysis system based on network security according to claim 9, characterized in that: The intelligent device operation supervision module monitors and manages the real-time operation status of the communication device according to the prediction result transmitted by the network security index prediction unit.

Images