A network security-based intelligent device operation analysis system and method

Abstract

This invention discloses a network security-based intelligent device operation analysis system and method, belonging to the field of intelligent device operation analysis technology. The invention includes: S10: identifying abnormal traffic behavior characteristics of communication devices; S20: predicting the real-time network security index of communication devices based on integrated analysis results; S30: determining the real-time network attack type of communication devices; S40: monitoring the operation of communication devices in real time. Compared to analyzing the network security of communication devices solely through network traffic consumption, this invention can identify malicious programs lurking within communication devices, improving the monitoring effectiveness of network security. This invention evaluates the network security index of communication devices from two dimensions: source IP address and traffic distribution, which helps improve prediction accuracy and thus ensures that communication devices are always in a network security state.

Description

Technical Field

[0001] This invention relates to the field of intelligent device operation analysis technology, specifically to an intelligent device operation analysis system and method based on network security. Background Technology

[0002] Communication equipment refers to various devices used to realize information transmission and exchange. It is one of the indispensable infrastructures of modern information society and plays a vital role in people's daily life, work and business activities.

[0003] In today's digital age, network communication has permeated every corner of society. From personal information exchange to business operations, network communication plays a vital role. However, with the widespread adoption of the internet and the rapid development of information technology, network communication security faces unprecedented challenges. Malicious attacks, data breaches, and online fraud are rampant, posing serious threats to personal privacy and corporate interests. Current technologies rely solely on network traffic consumption during communication device operation to analyze network security. Due to low analytical accuracy, this approach fails to promptly identify potential network security vulnerabilities within communication devices, thus reducing the overall security of the network. Summary of the Invention

[0004] The purpose of this invention is to provide a smart device operation analysis system and method based on network security, so as to solve the problems raised in the prior art.

[0005] To achieve the above objectives, the present invention provides the following technical solution: a method for analyzing the operation of intelligent devices based on network security, the method comprising:

[0006] S10: Based on the historical system logs of the communication equipment, determine the real-time communication objects of the communication equipment and the requests sent by each communication object to the communication equipment server. Combined with the real-time response feedback sent by the communication equipment server, calculate the real-time attack characterization value of the communication equipment. Based on the real-time network traffic consumption of the communication equipment during operation, identify the abnormal traffic behavior characteristics of the communication equipment.

[0007] S20: Based on the initial duration of abnormal traffic behavior of communication equipment, obtain historical traffic behavior feature values ​​of communication equipment, integrate and analyze the obtained historical traffic behavior feature values, and predict the real-time network security index of communication equipment based on the integrated analysis results.

[0008] S30: Determine the abnormal traffic characteristics of the communication device, match the determined traffic characteristics with the traffic characteristics corresponding to various attack sources stored in the database, and determine the real-time network attack type of the communication device based on the matching results.

[0009] S40: Monitor the operation of communication equipment in real time.

[0010] Furthermore, S10 includes:

[0011] S101: Based on the historical system logs of the communication device within the time period [td, t], determine the communication objects of the communication device at time t+d, and the number of requests sent by each communication object to the communication device server at time t, combined with the number of response feedback S sent by the communication device server at time t+d. t+d The attack characterization value G of the communication device at time t+d t+d Perform calculations. Where t represents the time value and 0≤t≤24, d represents the average response time of the communication device server to a single request, i=1,2,…,m represents the number corresponding to each determined communication object, m represents the total number of determined communication objects, and U it This represents the number of requests sent by communication object numbered i to the communication device server at time t; the server will not respond to invalid requests, therefore... Invalid requests typically refer to requests that do not conform to normal user behavior patterns, such as requests generated by bots, web crawlers, or automated tools, or requests generated by user accidental clicks or fraudulent clicks.

[0012] S102: The total network traffic consumption X of the communication device at times t and t+d respectively. t X t+d To obtain;

[0013] When 0.7≤G t+d When ≤1, it indicates that the communication device was maliciously attacked at time t+d;

[0014] When 0≤G t+d <0.7 and (X) t+d -X t )*G t+d ≥Y d If Y is true, it means that the communication device was maliciously attacked at time t+d, where Y is true. d This represents the total amount of invalid traffic that a communication device is allowed to generate within time d;

[0015] When 0≤G t+d <0.7 and (X) t+d -X t )*G t+d <Y dIf the condition is met, it means that the communication device was not maliciously attacked at time t+d. Based on the above judgment conditions, it is possible to identify some large-scale attacks and malicious programs carried in the request, thereby improving the monitoring of network security. Malicious programs include traditional mobile phone viruses and some applications that are not viruses but have malicious behavior.

[0016] S103: When a communication device is maliciously attacked at time t+d, it indicates that the communication device exhibits abnormal traffic behavior at time t+d. (X) t+d -X t )*G t+d -Y d As a feature value representing the abnormal traffic behavior of communication devices, time t+d is taken as the initial time of action of the abnormal traffic behavior of communication devices.

[0017] Furthermore, S20 includes:

[0018] S201: Based on the initial action time t+d of the abnormal traffic behavior of the communication device, acquire the historical traffic values ​​consumed by the communication device at each data collection time point within the time period [tn*d,t], and obtain the historical traffic value set M, M={X t-n*d ,X t-(n-1)*d ,…,X t}, where n represents a constant and n=5;

[0019] According to R t-n*d =[(X t-(n-1)*d -X t-n*d )*G t-(n-1)*d ] / Y d The historical traffic behavior characteristic value R of the communication device at time tn*d t-n*d Perform calculations and put the results into set N, until all historical traffic values ​​stored in set M are included in the calculation, to obtain a set of historical traffic behavior features;

[0020] S202: Based on the formula for calculating the coefficient of variation = standard deviation / mean, the coefficient of variation γ of the historical traffic behavior feature set is calculated. t-n*d→t Perform calculations;

[0021] Based on the system logs of the communication device during the time period [tn*d,t], the source IP address of the communication target server that sent the request to the communication device is obtained, and the calculated dispersion coefficient γ is used as the basis for this determination. t-n*d→t The network security index of communication equipment at time t+d is predicted using the following formula:

[0022] ;

[0023] Among them, K t-n*d→tH represents the total number of requests sent by the communication object to the communication device server within the time period [tn*d,t]. t-n*d→t This represents the total number of address types of source IP addresses obtained within the time interval [tn*d,t], where e is a constant and e > 1, and Q t+d This represents the network security index of the communication device at time t+d.

[0024] Furthermore, S30 includes:

[0025] S301: When abnormal traffic behavior characteristics are identified in the communication device, the communication device starts the traffic cleaning mechanism to filter and clean the attack traffic, which helps to ensure the smooth passage of normal user requests and effectively block the intrusion of malicious traffic.

[0026] S302: The dispersion coefficient γ of the historical traffic behavior characteristic values ​​of the communication device within the time period [tn*d,t] t-n*d→t As an abnormal traffic characteristic of communication devices, the identified abnormal traffic characteristics are matched with the traffic characteristics corresponding to various attack sources stored in the database. The specific matching method is as follows:

[0027] The various attack sources stored in the database are numbered, and the numbering result is p=1,2,…,q; q represents the total number of attack source types stored in the database.

[0028] If 0 ≤ |γ t-n*d→t -τ p If |≤g, then the match is considered successful, and the communication device is attacked by the p-th type of attack source at time t+d.

[0029] If |γ t-n*d→t -τ p If |>g, then the match is considered unsuccessful, and the communication device was not attacked by the p-th type of attack source at time t+d.

[0030] Where g represents the error value, τ p This represents the discrete coefficient of network traffic consumed by a communication device when the device is attacked by the p-th type of attack source.

[0031] Furthermore, S40 includes:

[0032] When 0.7≤Q t+d When the value is ≤1, the communication device will physically isolate the service attacked by the p-th type of attack source from the network, while the service in the communication device that is not attacked by the p-th type of attack source will communicate normally.

[0033] When 0≤Q t+d When the value is less than 0.7, the communication equipment will automatically initiate a network disconnection operation and back up the data stored inside the communication equipment.

[0034] A network security-based intelligent device operation analysis system, the system comprising an abnormal traffic behavior feature identification module, a network security index prediction module, a network attack type determination module, and an intelligent device operation monitoring module;

[0035] The abnormal traffic behavior feature identification module is used to identify the abnormal traffic behavior features of communication devices.

[0036] The network security index prediction module is used to predict the real-time network security index of communication devices based on the integrated analysis results of historical traffic behavior feature values.

[0037] The network attack type determination module is used to determine the real-time network attack type of the communication device;

[0038] The intelligent device operation monitoring module is used to monitor the operation of communication devices in real time.

[0039] Furthermore, the abnormal traffic behavior feature identification module includes a characterization value calculation unit, an analysis and judgment unit, and an abnormal traffic behavior feature identification unit;

[0040] The characterization value calculation unit determines the communication objects of the communication device and the number of requests sent by each communication object to the communication device server based on the historical system logs of the communication device, and calculates the real-time attack characterization value of the communication device in combination with the number of response feedback sent by the communication device server in real time.

[0041] The analysis and judgment unit performs a preliminary analysis of the attack situation of the communication device based on the calculation results transmitted by the characterization value calculation unit, and determines the real-time attack situation of the communication device by combining the total network traffic consumption of the communication device at each time.

[0042] The abnormal traffic behavior feature identification unit determines the feature value of the abnormal traffic behavior feature of the communication device and the initial action time of the abnormal traffic behavior based on the determination result transmitted by the analysis and judgment unit.

[0043] Furthermore, the network security index prediction module includes a historical traffic behavior feature set acquisition unit, a discrete coefficient calculation unit, and a network security index prediction unit;

[0044] The historical traffic behavior feature set acquisition unit acquires the historical traffic values ​​consumed by the communication device at each data collection time point based on the initial action time of the abnormal traffic behavior of the communication device, obtains a set of historical traffic values, calculates the historical traffic behavior feature values ​​of the communication device at each moment based on the constructed mathematical model, and obtains the historical traffic behavior feature set based on the calculation results.

[0045] The discrete coefficient calculation unit calculates the discrete coefficients of the historical traffic behavior feature set according to the discrete coefficient calculation formula.

[0046] The network security index prediction unit obtains the source IP address of the communication object server that sent the request to the communication device based on the historical system logs of the communication device, and predicts the real-time network security index of the communication device by combining the calculation results transmitted by the discrete coefficient calculation unit.

[0047] Furthermore, the network attack type determination module includes a processing unit, a matching unit, and a network attack type determination unit;

[0048] When the processing unit identifies abnormal traffic behavior characteristics of the communication device, it automatically activates the traffic cleaning mechanism of the communication device to filter and clean the attack traffic.

[0049] The matching unit uses the discrete coefficient of the historical traffic behavior feature value of the communication device as the abnormal traffic feature of the communication device, and determines the matching situation between the abnormal traffic feature and the traffic features corresponding to various attack sources stored in the database according to the constructed matching model.

[0050] The network attack type determination unit determines the real-time network attack type of the communication device based on the matching result of the matching unit.

[0051] Furthermore, the intelligent device operation monitoring module monitors and manages the real-time operating status of the communication device based on the prediction results transmitted by the network security index prediction unit.

[0052] Compared with the prior art, the beneficial effects of the present invention are:

[0053] 1. This invention calculates the real-time attack characteristics of communication devices based on their response to requests, and analyzes and determines whether the communication device is under attack by combining this with the real-time network consumption of the communication device during operation. Furthermore, based on the analysis and judgment conditions, it can not only identify some large-scale attacks, but also identify malicious programs carried in the requests. Compared with analyzing the network security of communication devices solely through network traffic consumption, this invention can identify malicious programs lurking within the communication device, thereby improving the monitoring of network security.

[0054] 2. This invention predicts the real-time network security index of a communication device based on the source IP address of the communication object server that sends the request to the communication device and the dispersion coefficient of the historical traffic behavior feature set of the communication device. This process evaluates the network security index of the communication device from two dimensions: source IP address and traffic distribution, which helps to improve the prediction accuracy and thus ensure that the communication device is always in a network security state.

[0055] 3. This invention describes the attack characteristics of the attack source of the communication device by using the discrete coefficient of the historical traffic behavior feature value of the communication device as the abnormal traffic feature of the communication device. This is conducive to quickly and accurately matching the attack source of the communication device, and monitoring the real-time operating status of the communication device based on the matching result, thereby further improving the operation and management effect of the communication device. Attached Figure Description

[0056] Figure 1 This is a schematic diagram illustrating the workflow of a network security-based intelligent device operation analysis system and method according to the present invention.

[0057] Figure 2 This is a schematic diagram illustrating the working principle of a network security-based intelligent device operation analysis system and method according to the present invention. Detailed Implementation

[0058] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0059] Example: Figure 1 and Figure 2 As shown, this invention provides a network security-based intelligent device operation analysis system and method technical solution, and a network security-based intelligent device operation analysis method, the method comprising:

[0060] S10: Based on the historical system logs of the communication equipment, determine the real-time communication objects of the communication equipment and the requests sent by each communication object to the communication equipment server. Combined with the real-time response feedback sent by the communication equipment server, calculate the real-time attack characterization value of the communication equipment. Based on the real-time network traffic consumption of the communication equipment during operation, identify the abnormal traffic behavior characteristics of the communication equipment.

[0061] S10 includes:

[0062] S101: Based on the historical system logs of the communication device within the time period [td,t], and considering that the update cycle of the communication device's system logs is 1 day, the communication objects of the communication device at time t+d (communication objects refer to devices that have sent requests to the communication device server within the time period [td,t]) and the number of requests sent by each communication object to the communication device server at time t are determined, combined with the number of response feedback S sent by the communication device server at time t+d. t+d The attack characterization value G of the communication device at time t+d t+d Perform calculations. Where t represents the time value and 0≤t≤24, in hours; d represents the average response time of the communication device server to a single request; i=1,2,…,m represents the ID of each determined communication object; m represents the total number of determined communication objects; U it Let G represent the number of requests sent by communication object numbered i to the communication device server at time t. Since each HTTP request can only correspond to one HTTP response (HTTP is a stateless protocol; a client sends an HTTP request to a server, and the server returns a corresponding HTTP response), therefore 0 ≤ G. t+d ≤1;

[0063] S102: The total network traffic consumption X of the communication device at times t and t+d respectively. t X t+d To obtain;

[0064] When 0.7≤G t+d When ≤1, it indicates that the communication device was maliciously attacked at time t+d;

[0065] When 0≤G t+d <0.7 and (X) t+d -X t )*G t+d ≥Y d If Y is true, it means that the communication device was maliciously attacked at time t+d, where Y is true. d This represents the total amount of invalid traffic that a communication device is allowed to generate within time d. Invalid traffic refers to traffic that does not generate actual service or value, such as traffic generated by users clicking on advertisements without any actual need, or traffic generated through fraudulent means.

[0066] When 0≤G t+d <0.7 and (X) t+d -X t )*G t+d <Y d If the value is 1, it means that the communication device was not maliciously attacked at time t+d;

[0067] S103: When a communication device is maliciously attacked at time t+d, it indicates that the communication device exhibits abnormal traffic behavior at time t+d. (X) t+d -X t )*G t+d -Y d As a feature value for the abnormal traffic behavior of communication devices, time t+d is taken as the initial time of action of the abnormal traffic behavior of communication devices.

[0068] S20: Based on the initial duration of abnormal traffic behavior of communication equipment, obtain historical traffic behavior feature values ​​of communication equipment, integrate and analyze the obtained historical traffic behavior feature values, and predict the real-time network security index of communication equipment based on the integrated analysis results.

[0069] S20 includes:

[0070] S201: Based on the initial action time t+d of the abnormal traffic behavior of the communication device, acquire the historical traffic values ​​consumed by the communication device at each data collection time point within the time period [tn*d,t], and obtain the historical traffic value set M, M={X t-n*d ,X t-(n-1)*d ,…,X t}, where n represents a constant and n=5;

[0071] According to R t-n*d =[(X t-(n-1)*d -X t-n*d )*G t-(n-1)*d ] / Y d The historical traffic behavior characteristic value R of the communication device at time tn*d t-n*d Perform calculations and put the results into set N, until all historical traffic values ​​stored in set M are included in the calculation, to obtain a set of historical traffic behavior features;

[0072] S202: Based on the formula for calculating the coefficient of variation = standard deviation / mean, the coefficient of variation γ of the historical traffic behavior feature set is calculated. t-n*d→t Perform calculations;

[0073] Based on the system logs of the communication device during the time period [tn*d,t], the source IP address of the communication target server that sent the request to the communication device is obtained, and the calculated dispersion coefficient γ is used as the basis for this determination. t-n*d→t The network security index of communication equipment at time t+d is predicted using the following formula:

[0074] ;

[0075] Among them, K t-n*d→tH represents the total number of requests sent by the communication object to the communication device server within the time period [tn*d,t]. t-n*d→t This represents the total number of source IP addresses of different types obtained within the time interval [tn*d,t]. Addresses with identical source IP addresses are considered to be of the same type. e represents a constant and e > 1. Q t+d This represents the network security index of the communication device at time t+d;

[0076] S30: Determine the abnormal traffic characteristics of the communication device, match the determined traffic characteristics with the traffic characteristics corresponding to various attack sources stored in the database, and determine the real-time network attack type of the communication device based on the matching results.

[0077] S30 includes:

[0078] S301: When abnormal traffic behavior characteristics are identified in the communication device, the communication device starts the traffic cleaning mechanism. The traffic cleaning mechanism is a network security technology, mainly used to detect and filter malicious traffic, ensure that normal network communication is not affected, and filter and clean attack traffic.

[0079] S302: The dispersion coefficient γ of the historical traffic behavior characteristic values ​​of the communication device within the time period [tn*d,t] t-n*d→t As an abnormal traffic characteristic of communication devices, the identified abnormal traffic characteristics are matched with the traffic characteristics corresponding to various attack sources stored in the database. The specific matching method is as follows:

[0080] The various attack sources stored in the database are numbered, and the numbering result is p=1,2,…,q; q represents the total number of attack source types stored in the database.

[0081] If 0 ≤ |γ t-n*d→t -τ p If |≤g, then the match is considered successful. The communication device is attacked by the p-th type of attack source at time t+d. The attack sources include denial-of-service attacks (DoS / DDoS), man-in-the-middle attacks (MitM), SQL injection, cross-site scripting attacks (XSS), etc.

[0082] If |γ t-n*d→t -τ p If |>g, then the match is considered unsuccessful, and the communication device was not attacked by the p-th type of attack source at time t+d.

[0083] Where g represents the error value, τ p This represents the discrete coefficient of network traffic consumed by a communication device when the device is attacked by the p-th type of attack source.

[0084] S40: Real-time monitoring of the operation of communication equipment;

[0085] S40 includes:

[0086] When 0.7≤Q t+d When the value is ≤1, the communication device will physically isolate the service attacked by the p-th type of attack source from the network, while the service in the communication device that is not attacked by the p-th type of attack source will communicate normally.

[0087] When 0≤Q t+d When the value is less than 0.7, the communication equipment will automatically initiate a network disconnection operation and back up the data stored inside the communication equipment.

[0088] A network security-based intelligent device operation analysis system includes an abnormal traffic behavior feature identification module, a network security index prediction module, a network attack type determination module, and an intelligent device operation monitoring module.

[0089] The abnormal traffic behavior feature identification module is used to identify the abnormal traffic behavior features of communication devices;

[0090] The abnormal traffic behavior feature identification module includes a characterization value calculation unit, an analysis and judgment unit, and an abnormal traffic behavior feature identification unit.

[0091] The characterization value calculation unit determines the communication objects of the communication device and the number of requests sent by each communication object to the communication device server based on the historical system logs of the communication device. Combined with the number of response feedback sent by the communication device server in real time, the unit calculates the real-time attack characterization value of the communication device.

[0092] The analysis and judgment unit performs a preliminary analysis of the attack situation of the communication equipment based on the calculation results transmitted by the characterization value calculation unit, and determines the real-time attack situation of the communication equipment by combining the total network traffic consumption of the communication equipment at each time.

[0093] The abnormal traffic behavior feature identification unit determines the feature values ​​of the abnormal traffic behavior characteristics of the communication device and the initial action time of the abnormal traffic behavior based on the determination results transmitted by the analysis and judgment unit.

[0094] The network security index prediction module is used to predict the real-time network security index of communication devices based on the integrated analysis results of historical traffic behavior characteristics.

[0095] The network security index prediction module includes a historical traffic behavior feature set acquisition unit, a discrete coefficient calculation unit, and a network security index prediction unit.

[0096] The historical traffic behavior feature set acquisition unit acquires the historical traffic values ​​consumed by the communication device at each data collection time point based on the initial action time of the abnormal traffic behavior of the communication device, and obtains a set of historical traffic values. Based on the constructed mathematical model, the historical traffic behavior feature values ​​of the communication device at each time point are calculated, and the historical traffic behavior feature set is obtained based on the calculation results.

[0097] The discrete coefficient calculation unit calculates the discrete coefficients of the historical traffic behavior feature set according to the formula for calculating discrete coefficients.

[0098] The network security index prediction unit obtains the source IP address of the communication object server that sent the request to the communication device based on the historical system logs of the communication device, and predicts the real-time network security index of the communication device by combining the calculation results transmitted by the discrete coefficient calculation unit.

[0099] The network attack type determination module is used to determine the real-time network attack type of communication devices;

[0100] The network attack type determination module includes a processing unit, a matching unit, and a network attack type determination unit.

[0101] When the processing unit identifies abnormal traffic behavior characteristics of the communication device, it automatically activates the traffic cleaning mechanism of the communication device to filter and clean the attack traffic.

[0102] The matching unit uses the discrete coefficients of the historical traffic behavior feature values ​​of the communication device as the abnormal traffic feature of the communication device. Based on the constructed matching model, it determines the matching situation between the abnormal traffic feature and the traffic features corresponding to various attack sources stored in the database.

[0103] The network attack type determination unit determines the real-time network attack type of the communication device based on the matching results of the matching unit;

[0104] The intelligent device operation monitoring module is used to monitor the operation of communication equipment in real time;

[0105] The intelligent device operation monitoring module monitors and manages the real-time operating status of communication devices based on the prediction results transmitted by the network security index prediction unit.

[0106] Example 1: Suppose that the communication device has 4 communication objects at time t+d, and the number of requests sent by communication object numbered 1 to the communication device server at time t is U. 1t =2, the number of requests U sent by communication object numbered 2 to the communication device server at time t. 2t =1, the number of requests U sent by communication object numbered 3 to the communication device server at time t. 3t=3, the number of requests U sent by communication object numbered 4 to the communication device server at time t. 4t =4, the number of response feedback S sent by the communication equipment server at time t+d. t+d =6, then the attack characterization value G of the communication device at time t+d is 6. t+d for:

[0107] ;

[0108] Then the attack characterization value G of the communication device at time t+d t+d =0.4;

[0109] Let the total network traffic consumption of the communication device at times t and t+d be X respectively. t =3GB, X t+d =6GB, Y d =0.5GB, then (X t+d -X t )*G t+d =1.2GB>Y d =0.5GB;

[0110] It can be seen that the communication device was maliciously attacked at time t+d.

[0111] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

Claims

1. A method for analyzing the operation of intelligent devices based on network security, characterized in that: The method includes: S10: Based on the historical system logs of the communication equipment, determine the real-time communication objects of the communication equipment and the requests sent by each communication object to the communication equipment server. Combined with the real-time response feedback sent by the communication equipment server, calculate the real-time attack characterization value of the communication equipment. Based on the real-time network traffic consumption of the communication equipment during operation, identify the abnormal traffic behavior characteristics of the communication equipment. S10 includes: S101: Based on the historical system logs of the communication device within the time period [td, t], determine the communication objects of the communication device at time t+d, and the number of requests sent by each communication object to the communication device server at time t, combined with the number of response feedback S sent by the communication device server at time t+d. t+d The attack characterization value G of the communication device at time t+d t+d Perform calculations. Where t represents the time value and 0≤t≤24, d represents the average response time of the communication device server to a single request, i=1,2,…,m represents the number corresponding to each determined communication object, m represents the total number of determined communication objects, and U it This represents the number of requests sent by the communication object with ID i to the communication device server at time t. S102: The total network traffic consumption X of the communication device at times t and t+d respectively. t X t+d To obtain; When 0.7≤G t+d When ≤1, it indicates that the communication device was maliciously attacked at time t+d; When 0≤G t+d <0.7 and (X) t+d -X t )*G t+d ≥Y d If Y is true, it means that the communication device was maliciously attacked at time t+d, where Y is true. d This represents the total amount of invalid traffic that a communication device is allowed to generate within time d; When 0≤G t+d <0.7 and (X) t+d -X t )*G t+d <Y d If the value is 1, it means that the communication device was not maliciously attacked at time t+d; S103: When a communication device is maliciously attacked at time t+d, it indicates that the communication device exhibits abnormal traffic behavior at time t+d. (X) t+d -X t )*G t+d -Y d As a feature value for the abnormal traffic behavior of communication devices, time t+d is taken as the initial time of action of the abnormal traffic behavior of communication devices. S20: Based on the initial duration of abnormal traffic behavior of communication equipment, obtain historical traffic behavior feature values ​​of communication equipment, integrate and analyze the obtained historical traffic behavior feature values, and predict the real-time network security index of communication equipment based on the integrated analysis results. S30: Determine the abnormal traffic characteristics of the communication device, match the determined traffic characteristics with the traffic characteristics corresponding to various attack sources stored in the database, and determine the real-time network attack type of the communication device based on the matching results. S40: Monitor the operation of communication equipment in real time.

2. The method for analyzing the operation of intelligent devices based on network security according to claim 1, characterized in that: S20 includes: S201: Based on the initial action time t+d of the abnormal traffic behavior of the communication device, acquire the historical traffic values ​​consumed by the communication device at each data collection time point within the time period [tn*d,t], and obtain the historical traffic value set M, M={X t-n*d ,X t-(n-1)*d ,…,X t }, where n represents a constant and n=5; According to R t-n*d =[(X t-(n-1)*d -X t-n*d )*G t-(n-1)*d ] / Y d The historical traffic behavior characteristic value R of the communication device at time tn*d t-n*d Perform calculations and put the results into set N, until all historical traffic values ​​stored in set M are included in the calculation, to obtain a set of historical traffic behavior features; S202: Based on the formula for calculating the coefficient of variation = standard deviation / mean, the coefficient of variation γ of the historical traffic behavior feature set is calculated. t-n*d→t Perform calculations; Based on the system logs of the communication device during the time period [tn*d,t], the source IP address of the communication target server that sent the request to the communication device is obtained, and the calculated dispersion coefficient γ is used as the basis for this determination. t-n*d→t The network security index of communication equipment at time t+d is predicted using the following formula: ； Among them, K t-n*d→t H represents the total number of requests sent by the communication object to the communication device server within the time period [tn*d,t]. t-n*d→t This represents the total number of address types of source IP addresses obtained within the time interval [tn*d,t], where e is a constant and e > 1, and Q t+d This represents the network security index of the communication device at time t+d.

3. The method for analyzing the operation of intelligent devices based on network security according to claim 2, characterized in that: S30 includes: S301: When abnormal traffic behavior characteristics are identified in the communication device, the communication device starts the traffic cleaning mechanism to filter and clean the attack traffic; S302: The dispersion coefficient γ of the historical traffic behavior characteristic values ​​of the communication device within the time period [tn*d,t] t-n*d→t As an abnormal traffic characteristic of communication devices, the identified abnormal traffic characteristics are matched with the traffic characteristics corresponding to various attack sources stored in the database. The specific matching method is as follows: The various attack sources stored in the database are numbered, and the numbering result is p=1,2,…,q; q represents the total number of attack source types stored in the database. If 0 ≤ |γ t-n*d→t -τ p If |≤g, then the match is considered successful, and the communication device is attacked by the p-th type of attack source at time t+d. If |γ t-n*d→t -τ p If |>g, then the match is considered unsuccessful, and the communication device was not attacked by the p-th type of attack source at time t+d. Where g represents the error value, τ p This represents the discrete coefficient of network traffic consumed by a communication device when the device is attacked by the p-th type of attack source.

4. The method for analyzing the operation of intelligent devices based on network security according to claim 3, characterized in that: S40 includes: When 0.7≤Q t+d When the value is ≤1, the communication device will physically isolate the service attacked by the p-th type of attack source from the network, while the service in the communication device that is not attacked by the p-th type of attack source will communicate normally. When 0≤Q t+d When the value is less than 0.7, the communication equipment will automatically initiate a network disconnection operation and back up the data stored inside the communication equipment.

5. A network security-based intelligent device operation analysis system applied to the network security-based intelligent device operation analysis method according to any one of claims 1-4, characterized in that: The system includes an abnormal traffic behavior feature identification module, a network security index prediction module, a network attack type determination module, and a smart device operation monitoring module. The abnormal traffic behavior feature identification module is used to identify the abnormal traffic behavior features of communication devices. The network security index prediction module is used to predict the real-time network security index of communication devices based on the integrated analysis results of historical traffic behavior feature values. The network attack type determination module is used to determine the real-time network attack type of the communication device; The intelligent device operation monitoring module is used to monitor the operation of communication devices in real time.

6. The intelligent device operation analysis system based on network security according to claim 5, characterized in that: The abnormal traffic behavior feature identification module includes a characterization value calculation unit, an analysis and judgment unit, and an abnormal traffic behavior feature identification unit. The characterization value calculation unit determines the communication objects of the communication device and the number of requests sent by each communication object to the communication device server based on the historical system logs of the communication device, and calculates the real-time attack characterization value of the communication device in combination with the number of response feedback sent by the communication device server in real time. The analysis and judgment unit performs a preliminary analysis of the attack situation of the communication device based on the calculation results transmitted by the characterization value calculation unit, and determines the real-time attack situation of the communication device by combining the total network traffic consumption of the communication device at each time. The abnormal traffic behavior feature identification unit determines the feature value of the abnormal traffic behavior feature of the communication device and the initial action time of the abnormal traffic behavior based on the determination result transmitted by the analysis and judgment unit.

7. The intelligent device operation analysis system based on network security according to claim 6, characterized in that: The network security index prediction module includes a historical traffic behavior feature set acquisition unit, a discrete coefficient calculation unit, and a network security index prediction unit. The historical traffic behavior feature set acquisition unit acquires the historical traffic values ​​consumed by the communication device at each data collection time point based on the initial action time of the abnormal traffic behavior of the communication device, obtains a set of historical traffic values, calculates the historical traffic behavior feature values ​​of the communication device at each moment based on the constructed mathematical model, and obtains the historical traffic behavior feature set based on the calculation results. The discrete coefficient calculation unit calculates the discrete coefficients of the historical traffic behavior feature set according to the discrete coefficient calculation formula. The network security index prediction unit obtains the source IP address of the communication object server that sent the request to the communication device based on the historical system logs of the communication device, and predicts the real-time network security index of the communication device by combining the calculation results transmitted by the discrete coefficient calculation unit.

8. The intelligent device operation analysis system based on network security according to claim 7, characterized in that: The network attack type determination module includes a processing unit, a matching unit, and a network attack type determination unit; When the processing unit identifies abnormal traffic behavior characteristics of the communication device, it automatically activates the traffic cleaning mechanism of the communication device to filter and clean the attack traffic. The matching unit uses the discrete coefficient of the historical traffic behavior feature value of the communication device as the abnormal traffic feature of the communication device, and determines the matching situation between the abnormal traffic feature and the traffic features corresponding to various attack sources stored in the database according to the constructed matching model. The network attack type determination unit determines the real-time network attack type of the communication device based on the matching result of the matching unit.

9. The intelligent device operation analysis system based on network security according to claim 8, characterized in that: The intelligent device operation monitoring module monitors and manages the real-time operating status of communication devices based on the prediction results transmitted by the network security index prediction unit.

Images