Information large area flow monitoring method and system based on flow probe

Abstract

The invention discloses an information large area flow monitoring method and system based on a flow probe, and relates to the technical field of network security flow monitoring, and the method comprises the steps: collecting target data, and carrying out the standardization processing of the data; analyzing and identifying the security threats through a first engine, and generating log information; and uploading the collected data, and performing prevention and control through a first mechanism. According to the information large area flow monitoring method based on the flow probe, the flow data of all key network nodes are introduced into a unified collection framework, the data collection coverage rate and the real-time performance of a system in a complex network environment are improved, multi-dimensional threat detection is carried out on the collected flow data, and the threat log is generated; the threatening detection comprehensiveness and accuracy are improved, through integrated firewall linkage and event blocking, the joint defense and joint control capacity of the whole network is enhanced, and better effects are achieved in the aspects of real-time performance, accuracy and protection capacity.

Description

Technical Field

[0001] The present invention relates to the technical field of network security flow monitoring, and in particular to a method for monitoring large-area information flow based on flow probes. Background Art

[0002] In recent years, with the rapid development of informatization and digitalization, network security has gradually become the core demand of various industries. As a key national infrastructure, the stability and security of the network system of the power industry are particularly important. Situational awareness technology has been widely used in many fields due to its significant advantages in real-time monitoring, threat warning and traceability of network security. However, traditional situational awareness systems usually focus on threat monitoring of a single node and lack global collaboration and multi-dimensional defense capabilities. The emergence of flow probe technology provides a new technical means for situational awareness systems. Through the distributed deployment of flow probes, flow data in complex network environments can be efficiently collected and deeply analyzed, thereby significantly improving the coverage and real-time performance of network security management.

[0003] Although situational awareness technology has been initially applied in the power industry, the current system still has significant shortcomings. The performance bottleneck of the existing system limits its ability to process high-concurrency, large-scale data. The limitations of traditional situational awareness platforms on memory, CPU and storage resources make it impossible to effectively cope with the real-time processing needs of large traffic, which in turn affects the timeliness and accuracy of threat detection. The existing system lacks comprehensive monitoring capabilities for distributed network environments and can only cover single-point network nodes, making it difficult to achieve regional in-depth defense. The traditional system lacks compatibility and scalability and cannot flexibly connect to multi-source heterogeneous data, resulting in limited integration and comprehensive analysis capabilities of threat intelligence. In addition, due to the lack of an efficient threat tracing mechanism, existing technologies cannot quickly locate the source of threats and propagation paths, thereby reducing the response speed and handling capabilities to network attacks. Summary of the invention

[0004] In view of the above-mentioned problems, the present invention is proposed.

[0005] Therefore, the technical problem solved by the present invention is: the existing network security monitoring method has limited processing capabilities, cannot meet the needs of high concurrent real-time traffic, lacks in-depth defense capabilities for regional networks, and optimizes how to quickly and accurately trace threats and enhance the protection capabilities of the entire network.

[0006] To solve the above technical problems, the present invention provides the following technical solutions: a method for monitoring large-area information traffic based on traffic probes, comprising collecting target data and standardizing the data; identifying security threats through a first engine analysis and generating log information; uploading the collected data and performing prevention and control through a first mechanism.

[0007] As a preferred solution of the information large-area traffic monitoring method based on traffic probes described in the present invention, wherein: the collection of target data and standardization of the data include collecting regional traffic by deploying traffic probes.

[0008] As a preferred solution of the information large-area flow monitoring method based on flow probe described in the present invention, wherein: the collection of target data and standardization of the data also includes excluding irrelevant flow through standardization when collecting flow.

[0009] As a preferred solution of the information large-area traffic monitoring method based on traffic probe described in the present invention, wherein: the analysis and identification of security threats through the first engine includes detecting and identifying various types of security threats based on the first engine in the traffic probe.

[0010] As a preferred solution of the information large-area traffic monitoring method based on traffic probe described in the present invention, wherein: the generating log information includes generating log information according to the detected security threats and associating multi-dimensional events.

[0011] As a preferred solution of the information area traffic monitoring method based on traffic probes described in the present invention, the uploading of collected data includes integrating the data uploaded by each traffic probe into the network security situation awareness platform for dynamic correlation analysis.

[0012] As a preferred solution of the information large-area traffic monitoring method based on traffic probe described in the present invention, the prevention and control through the first mechanism includes identifying the attack path and source, and integrating protection resources for overall prevention and control.

[0013] Another object of the present invention is to provide an information area traffic monitoring system based on a traffic probe, which can perform in-depth analysis on the collected traffic data through an identification generation module, identify potential security threats, and solve the current problem of incomplete threat detection.

[0014] As a preferred solution of the information large-area flow monitoring system based on flow probe described in the present invention, it includes: an acquisition and processing module, an identification and generation module, and an upload prevention and control module; the acquisition and processing module is used to acquire target data and perform standardization on the data; the identification and generation module is used to analyze and identify security threats through the first engine and generate log information; the upload prevention and control module is used to upload the acquired data and perform prevention and control through the first mechanism.

[0015] A computer device includes a memory and a processor, wherein the memory stores a computer program, and wherein the processor executes the computer program to implement a step of a method for monitoring large-area information flow based on a flow probe.

[0016] A computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the steps of a method for monitoring large-area information flow based on a flow probe are implemented.

[0017] Beneficial effects of the present invention: The information area traffic monitoring method based on traffic probe provided by the present invention introduces the traffic data of all key network nodes into a unified collection architecture, thereby improving the data collection coverage and real-time performance of the system in a complex network environment, performing multi-dimensional threat detection on the collected traffic data and generating threat logs, thereby improving the comprehensiveness and accuracy of threat detection, and improving the threat handling efficiency and network-wide security visibility through threat tracing and real-time situation awareness, and enhancing the joint prevention and control capabilities of the entire network through integrated firewall linkage and event blocking. The present invention achieves better results in terms of real-time performance, accuracy and protection capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. Among them:

[0019] Figure 1 An overall flow chart of a method for monitoring large-area information traffic based on traffic probes provided in the first embodiment of the present invention.

[0020] Figure 2 An overall module diagram of a traffic probe-based information area traffic monitoring system provided in the fourth embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0022] Example 1

[0023] Reference Figure 1 , is an embodiment of the present invention, and provides an information area flow monitoring method based on flow probe, comprising:

[0024] S1: Collect target data and standardize the data.

[0025] Furthermore, collecting target data and standardizing the data includes collecting regional traffic by deploying traffic probes.

[0026] It should be noted that the flow probe is deployed on the network switches of the safety zone III and safety zone IV of the power generation unit through bypass mirroring to achieve non-interference collection of traffic in specific areas. This deployment method does not require adjustment to the existing network structure, reduces the difficulty of implementation, and avoids potential impact on production business traffic. Bypass mirroring is to copy and transmit the network data flowing through the port to the flow probe through the mirror port of the switch, ensuring the normal operation of the network and the real-time nature of data collection. During the collection process, the probe has efficient data reception and analysis capabilities. Through multi-channel parallel processing technology, it can quickly parse and organize massive traffic. The probe can parse a variety of network protocols, such as TCP / IP, HTTP, FTP, DNS, etc., to ensure comprehensive coverage of possible business traffic types. The probe allows users to pre-define the collection range to improve collection efficiency and target positioning capabilities. Accurate collection not only reduces the burden of redundant traffic, but also provides a highly relevant data basis for subsequent threat detection. The probe is designed with an automated collection optimization mechanism to adjust the collection strategy according to the dynamic changes of network traffic, give priority to key service traffic during peak traffic periods, ensure the integrity of important data, expand the collection range during low traffic stages, improve data coverage, and adapt to diverse needs in complex network environments.

[0027] Furthermore, collecting target data and performing standardization processing on the data also includes excluding irrelevant traffic through standardization processing when collecting traffic.

[0028] It should be noted that when collecting traffic, the traffic probe performs threat filtering and data normalization processing on the original traffic data to improve data quality and analysis value. The original data is sent to the protocol parsing unit. The system can automatically identify a variety of common network protocols and perform structured decoding on the data content. For HTTP protocol traffic, the probe can decode request header information, user agent information, URL path, etc. For DNS protocol traffic, it can parse query domain names, record types, etc. The parsing process ensures that the data format is unified. The filtering stage screens the traffic through preset security policies. The probe uses known threat intelligence libraries and abnormal behavior detection models to automatically identify and eliminate In addition to irrelevant traffic, including legitimate business traffic, duplicate traffic, and noise data, the probe will automatically filter stable internal communication traffic through a whitelist mechanism. For large traffic and frequent connection behaviors in a short period of time, they will be marked as possible threat traffic and retained for further analysis. The probe supports behavioral modeling of unknown traffic and marks data with abnormal patterns as high-priority traffic for upload to the situational awareness platform. Normalization ensures that all uploaded data meets the platform's data input standards. The probe will perform unified timestamp calibration on the data, add source identification, and convert it into a structured log in a predetermined format to support efficient parsing and analysis by the platform.

[0029] Example 2

[0030] Reference Figure 1 , is an embodiment of the present invention, and provides an information area flow monitoring method based on flow probe, comprising:

[0031] S2: Identify security threats through the first engine analysis and generate log information.

[0032] Furthermore, identifying security threats through the first engine analysis includes detecting and identifying various types of security threats based on the first engine in the traffic probe.

[0033] In the embodiment of the present application, the first engine is a multi-level threat detection engine. The multi-level threat detection engine is built into the traffic probe, which can accurately identify and analyze various network threats, covering a full range of detection capabilities from known threats to unknown threats. The threat detection engine combines rule matching with machine learning models to perform in-depth analysis based on multi-dimensional data features. In the process of malicious file identification, the probe uses a combination of file fingerprint feature library and behavioral analysis to quickly locate the propagation path of malicious files, and identify new threats based on the behavioral characteristics of the files, such as frequent access to suspicious IPs or encrypted communications. For zombie host detection, the probe accurately locates potential zombie network nodes by monitoring abnormal traffic patterns, such as continuous high-frequency connection attempts or traffic packet characteristics that do not conform to normal communications;

[0034] The traffic probe also supports real-time monitoring of various network attack behaviors. The weak password detection unit deeply analyzes service login information and issues risk warnings for unreinforced accounts and passwords. The cross-site attack detection unit combines abnormal features in HTTP requests, such as specific coding patterns of script injection, to quickly identify possible cross-site attacks. The threat detection engine also uses the threat intelligence library of the situational awareness platform to correlate and analyze known APT events and malicious programs on the entire network to further improve recognition accuracy.

[0035] In an optional embodiment, the first engine can also be implemented in other ways, such as a behavior anomaly detection engine. The behavior anomaly detection engine uses network data collected in real time by traffic probes to establish a baseline model of the network environment. The baseline model covers the behavioral characteristics of normal communication in the network, including communication frequency, traffic pattern, port usage and typical service request response time between hosts. These baseline data are dynamically updated through unsupervised learning or clustering algorithms to adapt to changes in the network environment. Real-time traffic is compared with the baseline model. Any behavior that obviously deviates from the baseline, such as abnormal traffic peaks, sudden activation of unauthorized ports, or a large number of concurrent connections initiated by the same host, is marked as a potential threat.

[0036] The detection capability of the behavior anomaly detection engine does not rely on predefined threat rules or known attack feature libraries, but captures unknown threats by identifying abnormal behaviors. When detecting data leaks, the behavior anomaly detection engine can identify the behavior of a host that normally transmits small amounts of traffic suddenly starting to upload large amounts of data. When a botnet is discovered, it can locate it by monitoring the intermittent and distributed behavior patterns of host communications.

[0037] The behavior anomaly detection engine also combines time series analysis and behavior correlation analysis to determine whether multiple hosts send similar requests to the same external IP when an anomaly occurs on a certain host, and whether related behaviors such as port scanning and brute force cracking occur. The analysis results further confirm the severity of the threat and possible attack intent.

[0038] Furthermore, generating log information includes generating log information according to detected security threats and correlating multi-dimensional events.

[0039] It should be noted that after a threat is detected, a structured and detailed log record will be automatically generated. The log content includes key information such as threat type, attack source IP, target system, timestamp of threat triggering, and scope of impact. This information is uploaded to the situation awareness platform after being standardized to ensure that the log format is compatible and easy to analyze centrally. At the same time, the probe supports multi-dimensional correlation analysis of multiple threat events during the log generation process, and associates multiple abnormal behaviors of the same IP address, such as scanning attacks, weak password blasting, and SQL injection, into a multi-step attack behavior in order to globally trace the source of complex threats. The probe uses real-time correlation rules to integrate events. When a zombie host is detected, the probe will correlate and analyze its communication behavior with known malicious domain names or C&C servers to form a complete attack path view. For distributed denial of service (DDoS) attacks, the attack scale and scope of impact can be quickly confirmed by analyzing the source IP distribution, traffic fluctuation pattern, and target system response time in the log. After the log is uploaded to the situation awareness platform, the platform performs dynamic correlation analysis and graphical display of the log based on big data analysis technology to further enhance the threat visualization capability.

[0040] S3: Upload the collected data and conduct prevention and control through the first mechanism.

[0041] Furthermore, uploading the collected data includes integrating the data uploaded by each flow probe into the network security situation awareness platform for dynamic correlation analysis.

[0042] It should be noted that dynamic threat analysis and rapid assessment are achieved through the integration of threat intelligence from multiple sources. The data uploaded by each power generation unit includes traffic logs, threat logs and other structured and unstructured data, which are classified and cleaned by the platform. The integrated data is compared and analyzed with the threat intelligence library built into the platform. The intelligence library is updated regularly and covers known APT attack events, malicious IP addresses, suspicious domain names and malicious file features. The platform automatically identifies potential complex threats based on dynamic association rules of data and real-time traffic monitoring. When a power generation unit has frequent cross-site scripting attack logs and multiple units report similar malicious IP communications at the same time, the platform identifies this as a multi-step APT attack against the region through dynamic association analysis. The platform models historical data through machine learning algorithms to predict possible attack trends in the future. After the prediction results are integrated with real-time intelligence, the platform generates a detailed risk report.

[0043] Furthermore, prevention and control through the first mechanism includes identifying attack paths and sources, and integrating protection resources for overall prevention and control.

[0044] In the embodiment of the present application, the first mechanism is a linkage mechanism, which realizes automated linkage from threat detection to disposal by integrating the protection resources of each power generation unit;

[0045] When the situation awareness platform identifies a high-risk threat, it dynamically generates linkage instructions based on the threat type, impact scope, and priority. The linkage instructions contain detailed disposal measures, such as blocking specific IP segments, closing specific ports, or limiting traffic bandwidth. The instructions are generated in a standardized format to ensure compatibility with network protection devices from different manufacturers.

[0046] The linkage mechanism supports a hierarchical disposal strategy. When a threat first appears, the platform will first instruct local protection devices to implement traffic blocking or isolation operations in the threatened unit to prevent the threat from spreading. If the threat exceeds the scope of a single unit, the platform will link the protection systems of other units through a global coordination mechanism to jointly block the source of the threat. When a distributed denial of service (DDoS) attack is detected, the platform will instruct the firewalls of all threatened units to block the attack traffic and notify upstream operators to clean the abnormal traffic, forming a multi-level protection barrier.

[0047] The execution process of the linkage mechanism is monitored by the situation awareness platform throughout the process. The platform collects the status information of each unit's protection equipment and the threat disposal results in real time, such as the application of blocking rules, traffic change trends, and whether abnormal behaviors still occur. Based on these feedbacks, the platform dynamically adjusts the linkage strategy. If blocking the initial IP fails to completely eliminate the threat, the platform will add new blocking rules or expand the linkage scope of the affected area based on log analysis;

[0048] The platform linkage mechanism has the ability to self-learn and optimize. It continuously improves the linkage rules by recording the handling process and effect of each linkage. When multiple units’ protection resources are linked, the platform analyzes which rules are most effective and which are redundant, and adjusts future policy priorities accordingly. At the same time, the platform supports scenario-based linkage policy presets, automatically triggering the full network isolation mode for botnet attacks, or giving priority to blocking the download path of suspicious files when malicious files are found to be spreading.

[0049] The linkage mechanism not only covers all power generation units, but also coordinates with higher-level management departments or network operators. When the threat impact expands to the regional or industry level, the platform will share threat intelligence and protection strategies through the linkage mechanism with upstream units to achieve a wider range of collaborative disposal. When an industry-level APT attack is detected, the platform can share key intelligence with the security operation center of the power industry to jointly formulate protection and response measures.

[0050] In an optional embodiment, the first mechanism may also be implemented in other ways, such as a distributed collaborative detection and response mechanism, which emphasizes that the flow probes and situation awareness platforms of each power generation unit jointly build a collaborative detection network to form a distributed closed loop from detection to response;

[0051] Distributed collaborative detection relies on the traffic probes deployed by each power generation unit. These probes not only perform threat detection tasks independently, but also communicate with the situational awareness platform in real time through the security zone network to form a distributed detection matrix. When a unit probe detects abnormal behavior, such as abnormal traffic surge or unknown protocol communication, it will broadcast brief threat feature information, such as suspicious IP, traffic pattern, and abnormal behavior description to probes in other units. This distributed sharing mechanism can identify the lateral spread trend of threats in the early stages of an attack. When a probe detects the communication of a malicious IP, other probes can immediately match similar traffic features, thereby achieving collaborative threat identification among multiple units.

[0052] After threat detection, each probe automatically triggers local protection measures according to established strategies, blocking suspicious communications, isolating infected terminal devices, etc. The distributed response mechanism ensures that the protection operations of multiple units will not conflict with each other through a lightweight decision-making engine. When multiple probes detect the same threat, the situation awareness platform coordinates and unifies the scope of disposal to avoid repeated execution of unnecessary blocking measures and ensure optimal allocation of resources.

[0053] The distributed coordination mechanism is suitable for regional attack scenarios, such as distributed denial of service attacks or multi-point APT attacks. In such scenarios, each probe does not need to wait for instructions from the centralized platform, but can immediately contain the threat through a localized rapid response mechanism. When the attack target is the network resources of multiple units, the distributed mechanism allows the unit that is most seriously attacked to initiate a higher priority blocking command, while other units decide whether to perform coordinated operations based on the intensity of the attack.

[0054] The distributed mechanism optimizes the coordination strategy by continuously learning the communication and detection records between probes. When the detection results of a probe frequently trigger invalid blocking, the system will automatically adjust its detection parameters or reduce its decision weight. On the contrary, for probes that frequently detect effective threats, the priority of their information broadcast will be increased.

[0055] It is particularly effective in dealing with time-sensitive threats, such as fast-spreading worm viruses, because the probes do not rely on real-time instructions from the centralized platform and can independently complete most detection and response tasks, greatly shortening the threat processing time and ensuring that even if the central platform temporarily fails, each unit can still maintain basic protection capabilities through communication between probes.

[0056] Example 3

[0057] An embodiment of the present invention provides an information large-area flow monitoring method based on a flow probe. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through economic benefit calculation and simulation experiments.

[0058] The experimental equipment includes 14 flow probes deployed at key nodes of each power generation unit, and bypass mirror ports are used to collect flow data. The situation awareness platform deploys 3 expansion servers with high-performance processing capabilities to support real-time data integration and threat analysis.

[0059] In the experiment, real-time network traffic was collected from security zones III and IV respectively through traffic probes. Each probe was configured with different collection rules, including traffic filtering for source address, destination address, time and other conditions. The collected traffic data was uploaded to the situation awareness platform for subsequent analysis. The experiment recorded the traffic size and its changing trend of each node. The built-in threat detection engine of the traffic probe was used to deeply analyze the collected traffic and identify potential threats. Threat detection mainly involves common network attacks (such as DDoS, malware propagation) and high-risk behaviors (such as weak password login). The platform generated relevant threat logs, recorded the number and type of threats detected, and restored the collected data traffic to verify the system's file restoration capability and storage efficiency. At the same time, the differences in data restoration success rate and threat detection accuracy between traditional technologies and the method of the present invention were compared. After identifying the threat, source tracing analysis was performed through the situation awareness platform to accurately locate the source of the attack. The experiment recorded the time required for tracing the source, and blocked malicious traffic through the linkage firewall to achieve in-depth network defense.

[0060] As shown in Table 1, in security zone III and security zone IV, the traffic collection volume achieved by the method of the present invention is increased by 25.0% and 22.7% respectively compared with the traditional technology. The method of the present invention improves the traffic monitoring coverage in a complex network environment by optimizing the deployment and collection rules of the traffic probe. The method of the present invention achieves a detection rate of 97% in malicious traffic detection, proving the advantages of the method of the present invention in detection engine optimization and multi-dimensional threat analysis, and can effectively reduce false positives and false negatives. The traffic restoration success rate is increased from 85% to 99%, indicating that the improvement of the method of the present invention in data processing and file restoration algorithms enhances the reliability of the system and provides high-quality data support for threat tracing and auditing. The number of threat logs generated by the method of the present invention is increased by 60% compared with the traditional technology. Through the multi-engine threat detection mechanism of the present invention, more potential threats can be captured, providing richer intelligence for network security management. The method of the present invention shortens the tracing time from 2.5 seconds of the traditional technology to 1.1 seconds, indicating that the method of the present invention can achieve faster attack path positioning and threat source identification.

[0061] Table 1 Experimental data table

[0062] Test A Test B Test C Traditional Technology The present invention Improvement rate Safety Zone III Flow 1200 1150 1180 1000 1250 25％ Safety Zone IV Flow 1300 1250 1270 1100 1350 22.7％ Malicious traffic detection 95 88 91 85 97 14.1％ Traffic restoration success rate 98 92 94 85 99 16.5％ Number of threat logs 150 140 145 100 160 60％ Tracing time (seconds) 1.2 1.5 1.4 2.5 1.1 56％

[0063] Example 4

[0064] Reference Figure 2, which is an embodiment of the present invention, provides an information area traffic monitoring system based on traffic probe, including: a collection and processing module, an identification and generation module, and an upload prevention and control module.

[0065] The collection and processing module is used to collect target data and standardize the data; the identification and generation module is used to identify security threats through the first engine analysis and generate log information; the upload prevention and control module is used to upload the collected data and perform prevention and control through the first mechanism.

[0066] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0067] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0068] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering, or processing in another suitable manner as necessary, and then stored in a computer memory.

[0069] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc. It should be noted that the above embodiments are only used to illustrate the technical solution of the present invention and are not limited. Although the present invention is described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that the technical solution of the present invention can be modified or replaced by equivalents without departing from the spirit and scope of the technical solution of the present invention, which should be included in the scope of the claims of the present invention.

[0070] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for monitoring traffic in a large information area based on traffic probes, characterized in that: include: Collect target data and standardize the data; Identify security threats through first engine analysis and generate log information; Upload the collected data and carry out prevention and control through the first mechanism.

2. The method for monitoring large-area information flow based on flow probe according to claim 1, characterized in that: The collecting of target data and standardizing the data includes collecting regional traffic by deploying traffic probes.

3. The method for monitoring large-area information flow based on flow probe according to claim 2, characterized in that: The collecting of target data and performing standardization processing on the data also includes excluding irrelevant traffic through standardization processing when collecting traffic.

4. The method for monitoring large-area information flow based on flow probes as claimed in claim 3, characterized in that: The identifying security threats through the first engine analysis includes detecting and identifying various types of security threats based on the first engine in the traffic probe.

5. The method for monitoring large-area information flow based on flow probes as claimed in claim 4, characterized in that: The generating log information includes generating log information according to the detected security threats and associating multi-dimensional events.

6. The method for monitoring large-area information flow based on flow probes as claimed in claim 5, characterized in that: The uploading of the collected data includes integrating the data uploaded by each flow probe into the network security situation awareness platform for dynamic correlation analysis.

7. The method for monitoring large-area information flow based on flow probes as claimed in claim 6, characterized in that: The prevention and control through the first mechanism includes identifying the attack path and source, and integrating protection resources for overall prevention and control.

8. A system using the information large area flow monitoring method based on flow probe as claimed in any one of claims 1 to 7, characterized in that: It includes collection and processing module, identification and generation module, and upload prevention and control module; The acquisition and processing module is used to acquire target data and perform standardized processing on the data; The identification and generation module is used to analyze and identify security threats through the first engine and generate log information; The upload prevention and control module is used to upload the collected data and perform prevention and control through the first mechanism.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the large-area information flow monitoring method based on flow probe described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the large-area information flow monitoring method based on a flow probe as described in any one of claims 1 to 7 are implemented.

Images