Safety control method and system applied to communication base station, medium and product

Abstract

The invention relates to the technical field of security control, in particular to a security control method and system applied to a communication base station, a medium and a product, and the method comprises the steps: obtaining real-time communication data of a to-be-controlled communication base station, and recognizing communication features corresponding to the real-time communication data; when the communication features include preset hidden danger features, determining that the real-time communication data is hidden danger communication data; identifying a hidden danger transmission behavior and a hidden danger access behavior corresponding to the hidden danger communication data, and determining a hidden danger transmission channel corresponding to the hidden danger communication data and an influence coverage area corresponding to the hidden danger transmission channel based on the hidden danger transmission behavior and the hidden danger access behavior; and determining a substitute transmission channel based on the hidden danger transmission channel and a historical communication demand of the influence coverage area, generating a hidden danger isolation instruction based on the substitute transmission channel to isolate the influence transmission channel, and using the substitute transmission channel to provide a communication service for the influence coverage area. According to the invention, hidden dangers existing in the communication process can be found timely.

Description

Technical Field

[0001] The present application relates to the field of security management and control technology, and in particular to a security management and control method, system, medium and product applied to a communication base station. Background Art

[0002] Communication base stations are an important part of the communication network, and they undertake important tasks such as signal transmission and data processing. If the security management of base stations is not in place, it may cause the communication network to be interrupted, affecting the normal use of users, and may even cause serious social problems. In addition, communication base stations generally store a large amount of user data and communication data. If the security management of communication base stations is not good, it may lead to the leakage of user data and communication data, threatening user privacy. Therefore, it is particularly important to carry out security management of base stations.

[0003] In the related technology, communication base stations are generally inspected and maintained regularly by relevant maintenance personnel to ensure the normal operation and stability of the equipment. However, due to the limitations of inspection frequency and coverage, it may not be possible to capture all instantaneous hidden dangers in the communication process. In addition, the technical levels of relevant maintenance personnel vary, which may lead to limited ability to identify and handle hidden dangers during the inspection process, which may result in poor timeliness and accuracy in identifying hidden dangers. Summary of the invention

[0004] In order to facilitate the timely discovery of hidden dangers in the communication process and reduce the impact of communication hidden dangers on the communication network, the present application provides a security management method, system, medium and product applied to communication base stations.

[0005] In a first aspect, the present application provides a security control method applied to a communication base station, which adopts the following technical solution: A security management and control method applied to a communication base station, comprising: Acquire real-time communication data of the communication base station to be controlled, and identify communication characteristics corresponding to the real-time communication data, wherein the real-time communication data includes real-time transmission data and real-time access data; When the communication feature includes a preset hidden danger feature, determining that the real-time communication data is hidden danger communication data; Identify the hidden danger transmission behavior and the hidden danger access behavior corresponding to the hidden danger communication data, and determine the hidden danger transmission channel corresponding to the hidden danger communication data and the affected coverage area corresponding to the hidden danger transmission channel based on the hidden danger transmission behavior and the hidden danger access behavior; A backup transmission channel is determined based on the hidden danger transmission channel and the historical communication needs of the affected coverage area, and a hidden danger isolation instruction is generated based on the backup transmission channel to isolate the affected transmission channel, and use the backup transmission channel to provide communication services for the affected coverage area.

[0006] By adopting the above technical scheme, through real-time identification and analysis of the communication characteristics contained in the communication data, it is convenient to timely discover the hidden danger characteristics, thereby facilitating the timely discovery of hidden danger communication data, and by analyzing the hidden danger communication data, it is convenient to quickly and accurately locate the hidden danger transmission channel involved in the hidden danger communication data without the need for personnel screening, thereby facilitating the improvement of the response rate during subsequent inspection or maintenance. In addition, after locating the hidden danger transmission channel, the hidden danger transmission channel is isolated by quickly generating a hidden danger isolation instruction to limit the development of the hidden danger situation and prevent it from further spreading, thereby facilitating the reduction of the impact of the communication hidden danger on the entire communication network. Finally, by determining the substitute transmission channel and continuing to provide communication services to the affected area based on the substitute transmission channel, it is convenient to avoid communication interruption and service quality degradation due to the hidden danger situation, thereby facilitating the further reduction of the impact of the communication hidden danger on the communication network.

[0007] In a possible implementation manner, determining the backup transmission channel based on the hidden danger transmission channel and the historical communication demand of the affected coverage area includes: Performing feature recognition on the hidden danger transmission channel to obtain a hidden danger relay point corresponding to the hidden danger transmission channel; Determine at least one primary transmission channel based on the affected coverage area, and screen the at least one primary transmission channel based on the hidden danger relay point to obtain at least one secondary transmission channel, wherein the secondary transmission channel does not contain the hidden danger relay point; Based on the historical communication demand affecting the coverage area, each secondary transmission channel is evaluated to obtain a channel score of each secondary transmission channel, wherein the historical communication demand includes historical communication volume, historical communication rate, and historical communication safety factor; Based on the channel score of each secondary transmission channel, a substitute transmission channel is determined from the at least one secondary transmission channel.

[0008] By adopting the above technical scheme, when screening secondary transmission channels, transmission channels containing potential danger relay points are excluded, thereby facilitating the avoidance of communication failures and security risks that may be caused by potential danger relay points. In addition, by excluding potential danger relay points, the security of secondary transmission channels can be improved, thereby facilitating the enhancement of the defense capability of the entire communication network. The determined secondary transmission channels are evaluated based on historical communication needs, and finally, the backup transmission channels are determined based on the evaluation results, so that the communication network can flexibly respond to changes in future communication needs. At the same time, the existence of backup transmission channels can also facilitate the improvement of the fault tolerance capability of the entire communication network. Even if some transmission channels fail, the continuity of communication can be ensured by quickly switching to the backup channels.

[0009] In a possible implementation manner, when there is no secondary transmission channel, the method further includes: Based on the at least one primary transmission channel and the hidden danger relay point, determining at least one candidate transmission channel, wherein the candidate transmission channel includes hidden danger relay points, and the number of the hidden danger relay points included is less than a preset number of hidden dangers; Determining a predicted communication demand corresponding to a first preset time period based on the historical communication demand affecting the coverage area; Performing communication simulation on each candidate transmission channel based on the predicted communication demand to obtain simulated communication data corresponding to each candidate transmission channel, and determining a simulation score for each candidate transmission channel based on the type and number of simulated hidden danger features appearing in each simulated communication data; Based on the simulation score of each candidate transmission channel, a substitute transmission channel corresponding to the first preset time period is determined from the at least one candidate transmission channel.

[0010] By adopting the above technical scheme, when there is no secondary transmission channel, an alternative transmission channel can also be determined based on the primary transmission channel and the hidden danger relay point. Although the alternative transmission channel includes hidden danger relay points, the number is lower than the preset number of hidden dangers. This is convenient for improving the continuity of communication while reducing the probability of communication failures and security risks. By performing communication simulation on each alternative transmission channel, it is convenient to select the alternative transmission channel with the best performance and the highest security as the substitute transmission channel, thereby facilitating enhancing the reliability and stability of the communication network.

[0011] In one possible implementation, the method further includes: Determine, based on the simulated communication data of each candidate transmission channel, a simulated impact area corresponding to each candidate transmission channel and a simulated impact degree of each simulated impact area; Determine a simulated affected layer of each candidate transmission channel based on the simulated affected area of ​​the candidate transmission channel and the simulated affected degree of each simulated affected area; Superimposing each affected layer of the simulation to obtain a target simulation layer, and determining a simulation area of ​​interest based on the target simulation layer; A defense reinforcement instruction is generated based on the simulated area of ​​interest, and the defense reinforcement instruction is fed back.

[0012] By adopting the above technical solution, the simulated impact degree of each alternative transmission channel is presented in the form of a layer, which is convenient for intuitively comparing the impact degree between different alternative transmission channels. By superimposing each simulated affected layer to obtain the target simulation layer, the overall impact of all alternative transmission channels can be comprehensively evaluated, which is convenient for relevant maintenance personnel to pay attention to key areas, and through timely feedback of defense reinforcement instructions, ensure that the security risks faced by the simulated area of ​​concern in the first preset time period are effectively controlled.

[0013] In a possible implementation manner, determining a simulated impact area corresponding to the candidate transmission channel based on simulated communication data of the candidate transmission channel includes: Identify the hidden danger position of each hidden danger relay point in the alternative transmission channel, where the hidden danger position of the hidden danger relay point is the sequential position of the hidden danger relay point in all the hidden danger relay points corresponding to the alternative transmission channel; Determine the communication value level corresponding to each hidden danger relay point based on the simulated communication data of the alternative transmission channel; Based on the hidden danger position and communication value level of each hidden danger relay point, the relay point influence area corresponding to each hidden danger relay point is determined, and based on each relay point influence area, the simulated influence area of ​​the alternative transmission channel is determined.

[0014] By adopting the above technical solution, through comprehensive analysis of the hidden danger location and corresponding communication value level of each hidden danger relay point, it is convenient to improve the accuracy in determining the relay point impact area, thereby facilitating the improvement of the accuracy in determining the simulated impact area.

[0015] In a possible implementation manner, before determining at least one candidate transmission channel based on the at least one primary transmission channel and the vulnerable relay point, the method further includes: Acquire defense data of each hidden danger relay point in the hidden danger transmission channel within a second preset time period, and identify the number of defense times and the defense success rate from each defense data; Determine the defense score of each hidden danger relay point based on the number of defenses and the defense success rate corresponding to each hidden danger relay point; Hidden hidden danger relay points whose defense scores are lower than the preset scores are processed.

[0016] By adopting the above technical scheme, the defense capability of each hidden danger relay point is evaluated through the defense operations of each hidden danger relay point in the historical time period, and then by comparing the defense scores of different relay points, it is convenient to give priority to selecting hidden danger relay points with higher safety performance and stronger defense capability as part of the alternative transmission channel, thereby facilitating improving the reliability and security of the alternative transmission channel.

[0017] In the second aspect, the present application provides a management and control system, which adopts the following technical solutions: A management and control system, the management and control system comprising: at least one processor; Memory; At least one application, wherein the at least one application is stored in a memory and configured to be executed by at least one processor, and the at least one application is configured to: execute the above-mentioned security management and control method applied to a communication base station.

[0018] In a third aspect, the present application provides a computer-readable storage medium, which adopts the following technical solution: A computer-readable storage medium includes: storing a computer program that can be loaded by a processor and execute the above-mentioned security management and control method applied to a communication base station.

[0019] In a fourth aspect, the present application provides a computer program product, which adopts the following technical solution: A computer program product includes a computer program, and when the computer program is executed by a processor, the security management and control method applied to a communication base station is implemented.

[0020] In summary, the present application includes at least one of the following beneficial technical effects: By real-time identification and analysis of the communication features contained in the communication data, it is convenient to timely discover the hidden danger features, thereby facilitating the timely discovery of hidden danger communication data. By analyzing the hidden danger communication data, it is convenient to quickly and accurately locate the hidden danger transmission channel involved in the hidden danger communication data without the need for personnel screening, thereby facilitating the improvement of the response rate during subsequent inspection or maintenance. In addition, after locating the hidden danger transmission channel, the hidden danger transmission channel is isolated by quickly generating a hidden danger isolation instruction, so as to limit the development of the hidden danger situation and prevent it from further spreading, thereby facilitating the reduction of the impact of the communication hidden danger on the entire communication network. Finally, by determining the substitute transmission channel and continuing to provide communication services to the affected area based on the substitute transmission channel, it is convenient to avoid communication interruption and service quality degradation due to the hidden danger situation, thereby facilitating the further reduction of the impact of the communication hidden danger on the communication network.

[0021] By presenting the simulated impact degree of each alternative transmission channel in the form of a layer, it is convenient to intuitively compare the impact degree between different alternative transmission channels, and then by superimposing each simulated affected layer to obtain the target simulation layer, the overall impact of all alternative transmission channels can be comprehensively evaluated, which is convenient for relevant maintenance personnel to pay attention to key areas, and through timely feedback of defense reinforcement instructions, ensure that the security risks faced by the simulated area of ​​concern in the first preset time period are effectively controlled. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is a flowchart of a security control method applied to a communication base station in an embodiment of the present application; Figure 2 It is a schematic diagram of a process for determining a defense reinforcement instruction in an embodiment of the present application; Figure 3 It is a structural diagram of a management and control system in an embodiment of the present application. DETAILED DESCRIPTION

[0023] The following is combined with Figures 1 to 3 This application is described in further detail.

[0024] After reading this specification, those skilled in the art may make non-creative modifications to this embodiment as needed, but such modifications are protected by patent law as long as they are within the scope of the claims of this application.

[0025] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0026] It should be noted that in the optional embodiments of the present application, the object information and other related data involved, when the embodiments in the present application are applied to specific products or technologies, need to obtain the permission or consent of the object, and the collection, use and processing of the relevant data need to comply with the relevant laws, regulations and standards of the relevant countries and regions. In other words, if the embodiments of the present application involve data related to the object, it needs to be obtained with the authorization and consent of the object, the authorization and consent of the relevant departments, and in compliance with the relevant laws, regulations and standards of the country and region. If personal information is involved in the embodiments, the acquisition of all personal information needs to obtain the consent of the individual. If sensitive information is involved, the separate consent of the information subject needs to be obtained. The embodiments also need to be implemented with the authorization and consent of the object.

[0027] Specifically, the embodiment of the present application provides a security control method applied to a communication base station, which is executed by a control system, and the control system can be a server or a terminal device, wherein the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services. The terminal device can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc., but is not limited thereto. The terminal device and the server can be directly or indirectly connected via wired or wireless communication, and the embodiment of the present application does not limit this.

[0028] refer to Figure 1 , Figure 1 1 is a flow chart of a security control method applied to a communication base station in an embodiment of the present application, the method comprising steps S110 to S140, wherein: Step S110: acquiring real-time communication data of the communication base station to be controlled, and identifying communication characteristics corresponding to the real-time communication data, where the real-time communication data includes real-time transmission data and real-time access data.

[0029] Specifically, the communication base station to be controlled is a communication base station that needs to be security controlled. Different communication base stations to be controlled have corresponding coverage areas, and the range of the coverage area mainly depends on the base station type, transmission power, antenna characteristics, frequency band used, etc. of the base station to be controlled. Among them, the base station type can be a macro base station, a micro base station and a cellular base station; the transmission power is one of the key factors affecting the range of the coverage area. The greater the transmission power, the larger the corresponding coverage area; the type and direction of the antenna may also affect the range of the coverage area. Directional antennas can concentrate signals in a specific direction, thereby increasing the coverage distance in a specific direction, while omnidirectional antennas can provide more uniform coverage in all directions; signals in different frequency bands have different propagation characteristics, so the coverage range of base stations using different frequency bands will also be different.

[0030] Real-time communication data refers to the communication behavior of relevant users in the coverage area of ​​the communication base station to be controlled, including but not limited to real-time transmission data and real-time access data, wherein real-time transmission data usually includes audio, video, text messages or other types of data streams, transmission rate, transmission data volume and transmission time during the communication process, etc., and real-time access data usually includes the access request frequency, access time and access object initiated by the relevant user during the real-time communication process. Real-time communication data can be obtained through communication logs, and real-time communication data of relevant users can be obtained based on API interfaces after obtaining authorization from relevant users. The method of obtaining real-time communication data is not specifically limited in the embodiment of this application, as long as the communication behavior of relevant users can be monitored according to the acquired real-time communication data. Communication features in real-time communication data can be identified based on a preset feature recognition algorithm, wherein communication features include transmission rate, transmission data volume, transmission time, access request frequency, access time and access object, etc. The specific communication features and preset feature recognition algorithms are not specifically limited in the embodiment of this application, and can be determined by relevant staff based on historical experimental data and uploaded to the control system.

[0031] Step S120: When the communication characteristics include preset hidden danger characteristics, the real-time communication data is determined to be hidden danger communication data.

[0032] Specifically, by comparing the communication characteristics with the preset hidden danger characteristics, it can be determined whether the real-time communication data is hidden danger communication data. The preset hidden danger characteristics are a transmission rate higher than a preset rate, a transmission data volume higher than a preset data volume, a transmission time outside a preset transmission time period, an access request frequency higher than a preset frequency, an access time outside a preset access time period, an access object on a prohibited access list, etc. If the real-time communication data contains the preset hidden danger characteristics, it indicates that the real-time communication data may have potential security risks or hidden dangers. Among them, if the transmission rate in the communication feature is higher than the preset rate, it may indicate that the real-time communication data is undergoing large-scale data transmission, which may involve data leakage or illegal data sharing; if the transmission data volume in the communication feature is higher than the preset data volume, it may indicate that the real-time communication data has abnormal data transmission behavior, which may involve the transmission of sensitive data; if the transmission time in the communication feature is outside the preset transmission time period, it may indicate that there is unauthorized access or communication in the real-time communication data; if the access request frequency in the communication feature is higher than the preset frequency, it may indicate that there is malicious behavior in the real-time communication data, such as brute force cracking or scanning for vulnerabilities; if the access time in the communication feature is outside the preset access time period, it may indicate that there is a security risk in the real-time communication data; if the access object in the communication feature is in the prohibited access list, it may indicate that there is a network attack or malicious behavior in the real-time communication data. The prohibited access list may include malicious websites, malicious IPs, malicious domain names, etc. The specific prohibited access list can be determined by relevant staff based on historical security defense data and uploaded to the management and control system.

[0033] Step S130: identifying the hidden danger transmission behavior and the hidden danger access behavior corresponding to the hidden danger communication data, and determining the hidden danger transmission channel corresponding to the hidden danger communication data and the affected coverage area corresponding to the hidden danger transmission channel based on the hidden danger transmission behavior and the hidden danger access behavior.

[0034] Specifically, the hidden danger communication data is communication data containing preset hidden danger characteristics. The hidden danger communication data includes hidden danger transmission data and hidden danger access data. The hidden danger transmission behavior in the hidden danger communication data may be a transmission behavior involving hidden danger transmission rate, hidden danger transmission data volume and hidden danger transmission time. Similarly, the hidden danger access behavior may be an access behavior involving hidden danger access request frequency, hidden danger access time and hidden danger access object.

[0035] Based on the identified hidden danger transmission behavior and hidden danger access behavior, the hidden danger transmission channel corresponding to the hidden danger communication data can be determined. Specifically, by analyzing network traffic logs, security event logs, etc., the specific occurrence time of the hidden danger transmission behavior and hidden danger access behavior can be identified, and then based on the preset network topology structure and preset security policy, the transmission channel that the hidden danger communication data may pass through during the transmission process can be inferred. Among them, the preset network topology structure includes node devices such as data processing equipment, data communication control equipment, and data terminal equipment in the communication network, and also includes links and paths between each node device. The specific preset network topology structure can be uploaded to the management and control system in advance by relevant staff. The preset security policy refers to a series of rules and measures formulated to ensure network security, including but not limited to access control policy, encryption policy, firewall policy, intrusion detection and defense policy, etc. The specific content of the preset network topology structure and the preset security policy is not specifically limited in the embodiments of this application.

[0036] Different transmission channels serve different coverage areas, that is, devices or users in a certain coverage area can communicate with other devices or users through corresponding transmission channels to realize data interaction. Therefore, the corresponding impact coverage area can be determined based on the hidden danger transmission channel, and the impact coverage area corresponding to the hidden danger transmission channel can be determined based on the preset area mapping relationship. The preset area mapping relationship contains the coverage area corresponding to each transmission channel. The preset area mapping relationship can be determined by relevant staff according to historical experimental data and uploaded to the management and control system. However, since data transmission may be affected by factors such as physical obstruction, material properties, electromagnetic interference and weather conditions, after determining the hidden danger transmission channel, the regional optimization value can be determined according to the building parameters, material parameters, electromagnetic parameters and weather parameters, and then the impact coverage area determined based on the preset area mapping relationship is optimized based on the regional optimization value. Among them, the building parameters, material parameters, electromagnetic parameters and weather parameters can be imported into the trained optimization model, and the trained optimization model can directly output the regional optimization value. The optimization model can be trained based on a large number of sample data including sample building parameters, sample material parameters, sample electromagnetic parameters and sample weather parameters and manually annotated regional optimization values. The specific training method is not specifically limited in the embodiment of the present application. Among them, the area optimization value can be reduced by xx square meters or enlarged by xx square meters.

[0037] Step S140: Determine a backup transmission channel based on the hidden danger transmission channel and the historical communication demand of the affected coverage area, and generate a hidden danger isolation instruction based on the backup transmission channel to isolate the affected transmission channel and use the backup transmission channel to provide communication services for the affected coverage area.

[0038] Specifically, since the hidden danger transmission channel may have security vulnerabilities or improper configuration, which makes sensitive information easy to be stolen or tampered with, after the hidden danger transmission channel is determined, the hidden danger transmission channel can be isolated to prevent external attacks or reduce content threats. The isolation of the hidden danger transmission channel can be achieved through physical isolation devices such as isolation gates and one-way optical gates. Security isolation can also be achieved by configuring firewall rules, security gateways, etc. For example, when isolating the hidden danger transmission channel by configuring a firewall, the communication between the hidden danger transmission channel and other transmission channels can be limited according to the source address, destination address, port number and other information of the hidden danger transmission channel. The specific method of isolating the hidden danger transmission channel is not specifically limited in the embodiments of the present application.

[0039] When hidden danger communication data is detected, it only means that when the hidden danger transmission channel is used for communication, there is hidden danger communication data in the affected coverage area, or there is hidden danger communication data in the affected coverage area, but it cannot be said that all communication data in the affected coverage area have hidden dangers. At this time, in order to ensure the transmission of other non-hidden danger communication data in the affected coverage area, a substitute transmission channel can be determined for the affected coverage area based on the historical communication needs of the affected coverage area. The security level of the substitute transmission channel is higher than that of the hidden danger transmission channel. In addition to considering the security level when determining the substitute transmission channel, it is also necessary to select from the idle transmission channels based on the historical communication needs such as the historical communication volume and historical communication rate of the affected coverage area. The historical communication needs include information such as the historical communication volume and historical communication rate corresponding to the affected coverage area in the historical time period. Specifically, the specific process of determining the substitute transmission channel based on the hidden danger transmission channel and the historical communication needs of the affected coverage area can include: Perform feature identification on the hidden danger transmission channel to obtain the hidden danger relay point corresponding to the hidden danger transmission channel; determine at least one primary transmission channel based on the affected coverage area, and screen at least one primary transmission channel based on the hidden danger relay point to obtain at least one secondary transmission channel, and the secondary transmission channel does not contain the hidden danger relay point; evaluate each secondary transmission channel based on the historical communication demand of the affected coverage area to obtain a channel score for each secondary transmission channel, and the historical communication demand includes the historical communication volume, the historical communication rate and the historical communication safety factor; determine a backup transmission channel from at least one secondary transmission channel based on the channel score of each secondary transmission channel.

[0040] Specifically, the hidden danger relay point is a node in the hidden danger transmission channel used to forward or amplify the signal. Since the hidden danger transmission channel may have been attacked by malicious websites or hackers, when the communication data passes through these hidden danger relay points, it may be affected, resulting in problems such as reduced transmission quality, data loss, and security vulnerabilities. Therefore, when determining the backup transmission channel, it is necessary to avoid the hidden danger relay point as much as possible. Among them, the hidden danger relay point in the hidden danger transmission channel can be identified based on a preset feature recognition algorithm, and then the secondary transmission channel is determined from multiple idle primary transmission channels based on the hidden danger relay point. The specific feature recognition algorithm is not specifically limited in the embodiment of this application. The number of primary transmission channels and secondary transmission channels is not specifically limited in the embodiment of this application, and can be limited by relevant staff.

[0041] A simulation communication model can be constructed based on historical communication volume, historical communication rate, and historical communication safety factor. Each secondary transmission channel is imported into the constructed simulation communication model to obtain a channel score for each secondary transmission channel. The channel score is related to the type of simulated hidden danger features and the number of simulated hidden danger features that appear during the simulation process. The higher the channel score, the more reliable the corresponding secondary transmission channel. The construction process of the simulation communication model is not specifically limited in the embodiment of the present application. By constructing a simulation communication model, it is convenient to evaluate the transmission capacity of each secondary transmission channel. The secondary transmission channel with the highest channel score can be determined as the backup transmission channel. Determining the backup transmission channel based on the evaluation results facilitates the communication network to flexibly respond to changes in future communication needs. At the same time, the existence of the backup transmission channel also facilitates improving the fault tolerance of the entire communication network. Even if some transmission channels fail, they can be quickly switched to the backup channel to ensure the continuity of communication.

[0042] After determining the backup transmission channel, the backup transmission channel can be activated after isolating the hidden danger transmission channel to continue to provide communication services for the affected coverage area. The management and control system can directly isolate the hidden danger transmission channel according to the hidden danger isolation instruction and activate the backup transmission channel, or it can feedback the hidden danger isolation instruction to the relevant management and control personnel and let the relevant management and control personnel perform the operation.

[0043] For the embodiments of the present application, by real-time identification and analysis of communication features contained in communication data, it is convenient to timely discover hidden danger features, thereby facilitating timely discovery of hidden danger communication data; by analyzing the hidden danger communication data, it is convenient to quickly and accurately locate the hidden danger transmission channel involved in the hidden danger communication data without the need for personnel screening, thereby facilitating improving the response rate during subsequent inspection or maintenance; in addition, after locating the hidden danger transmission channel, by quickly generating a hidden danger isolation instruction to isolate the hidden danger transmission channel, it is convenient to limit the development of the hidden danger situation and prevent it from further spreading, thereby facilitating reducing the impact of communication hidden dangers on the entire communication network; finally, by determining a substitute transmission channel and continuing to provide communication services to the affected area based on the substitute transmission channel, it is convenient to avoid communication interruption and service quality degradation due to hidden danger situations, thereby facilitating further reducing the impact of communication hidden dangers on the communication network.

[0044] Furthermore, when there is no secondary transmission channel, the method provided in the embodiment of the present application further includes: Based on at least one primary transmission channel and a hidden danger relay point, at least one alternative transmission channel is determined, the alternative transmission channel includes hidden danger relay points, and the number of hidden danger relay points included is lower than the preset number of hidden dangers; based on the historical communication demand affecting the coverage area, the predicted communication demand corresponding to the first preset time period is determined; based on the predicted communication demand, communication simulation is performed on each alternative transmission channel to obtain simulated communication data corresponding to each alternative transmission channel, and based on the type of simulated hidden danger features and the number of simulated hidden danger features appearing in each simulated communication data, a simulated score of each alternative transmission channel is determined; based on the simulated score of each alternative transmission channel, a backup transmission channel corresponding to the first preset time period is determined from at least one alternative transmission channel.

[0045] Specifically, if there is no idle secondary transmission channel that does not contain a hidden danger relay point, the criteria for determining the backup transmission channel can be appropriately lowered, that is, the backup transmission channel can be selected from the candidate transmission channels containing a small number of hidden danger relay points, wherein the number of hidden danger relay points contained in the candidate transmission channel must be lower than the preset number of hidden dangers, which can be 2 or 3, and the specific number is not specifically limited in the embodiments of the present application. After determining at least one backup transmission channel, the method of determining the backup transmission channel from the secondary transmission channel in the above embodiment can be used to achieve the determination of the backup transmission channel from the at least one backup transmission channel.

[0046] Different from the above method, it is necessary to first determine the predicted communication demand corresponding to the first preset time period based on the historical communication demand, and then build a predicted simulation communication model based on the predicted communication demand. The first preset time period is a period of time after the current moment. The length of the first preset time period is related to the waiting time of the secondary transmission channel. For example, according to the working status of each transmission channel, the waiting time of the secondary transmission channel is determined to be 10 minutes, that is, there will be a secondary transmission channel after 10 minutes. At this time, it can be determined that the length corresponding to the first preset time period is 10 minutes, and the first preset time period is 10 minutes after the current moment. Each alternative transmission channel is imported into the predicted simulation communication model to obtain the simulated hidden danger feature type and the number of simulated hidden danger features that appear in the simulated communication process of each alternative transmission channel in the first preset time period. The simulated score of each alternative transmission channel can be determined based on the preset simulation score mapping relationship. The preset simulation score mapping relationship is the corresponding relationship between the combination of the simulated hidden danger feature type and the simulated hidden danger feature number and the simulated score. The specific content is not specifically limited in the embodiment of the present application. Finally, the candidate transmission channel with the highest simulation score may be determined as the substitute transmission channel corresponding to the first preset time period, that is, after the first preset time period, the substitute transmission channel needs to be re-determined based on the secondary transmission channel.

[0047] However, in order to improve the reliability and security of the alternative transmission channel, before determining at least one alternative transmission channel based on at least one primary transmission channel and the potential danger relay point, the method provided in the embodiment of the present application further includes: Obtain the defense data of each hidden danger relay point in the hidden danger transmission channel within the second preset time period, and identify the number of defense times and the defense success rate from each defense data; determine the defense score of each hidden danger relay point based on the number of defense times and the defense success rate corresponding to each hidden danger relay point; hide the hidden danger relay points whose defense scores are lower than the preset scores.

[0048] Specifically, the second preset time period is a period of time before the current moment, and the duration corresponding to the second preset time period can be 10 days or 20 days. The specific duration is not specifically limited in the embodiment of the present application. By analyzing the defense behavior of each hidden danger relay point in the historical period, it is convenient to evaluate the defense capability of each hidden danger relay point. The defense data of each hidden danger relay point can be obtained from the defense log, and then based on the preset feature recognition algorithm, the total number of times each hidden danger relay point triggers the defense and the proportion of successful defense attacks within the second preset time period are determined from the defense data corresponding to each hidden danger relay point. Based on the preset score mapping relationship, the defense score corresponding to any combination of the number of defense times and the defense success rate can be determined. The more defense times and the higher the defense success rate, the higher the corresponding defense score. The specific content of the preset score mapping relationship is not specifically limited in the embodiment of the present application.

[0049] Hidden processing is performed on the potential danger relay points whose defense scores are lower than the preset scores. The hiding processing may include removing them from the relay point list, marking them as unavailable, or taking other measures to ensure that these relay points with scores lower than the preset scores are not selected into the alternative transmission channels. The specific preset score is not specifically limited in the embodiments of the present application.

[0050] Furthermore, the method provided in the embodiment of the present application further includes steps S210 to S240, such as Figure 2 As shown, where: Step S210: Based on the simulated communication data of each candidate transmission channel, determine the simulated impact area corresponding to each candidate transmission channel and the simulated impact degree of each simulated impact area.

[0051] Specifically, since the alternative transmission channel contains a relay point with hidden dangers, when communicating based on the alternative transmission channel, malicious websites or hackers may attack the alternative transmission channel through the relay point with hidden dangers to conduct further network penetration or data theft, resulting in security risks when using the alternative transmission channel for communication. The simulated impact area corresponding to the alternative transmission channel is the area that is subject to security threats after the alternative transmission channel is subjected to malicious attacks. The simulated impact area can be determined based on the location, number and connection relationship of the relay points subjected to malicious attacks. The simulated degree of impact of the simulated impact area can be determined based on the percentage of data transmission rate reduction and the delay increase duration in the simulated impact area. Specifically, the simulated degree of impact corresponding to any combination of the percentage of data transmission rate reduction and the delay increase duration can be determined based on the preset degree of impact mapping relationship. The specific content of the preset degree of impact mapping relationship is not specifically limited in the embodiments of the present application.

[0052] Further, in order to improve the accuracy of determining the simulated impact area, determining the simulated impact area corresponding to the candidate transmission channel based on the simulated communication data of the candidate transmission channel may specifically include: Identify the hidden danger position of each hidden danger relay point in the alternative transmission channel, the hidden danger position of the hidden danger relay point is the sequential position of the hidden danger relay point in all hidden danger relay points corresponding to the alternative transmission channel; determine the communication value level corresponding to each hidden danger relay point based on the simulated communication data of the alternative transmission channel; determine the relay point influence area corresponding to each hidden danger relay point based on the hidden danger position and communication value level of each hidden danger relay point, and determine the simulated influence area of ​​the alternative transmission channel based on each relay point influence area.

[0053] Specifically, for any alternative transmission channel, since the alternative transmission channel may contain one or more potential danger relay points, it is first necessary to determine the sequential position of each potential danger relay point among all potential danger relay points according to the data transmission direction of the alternative transmission channel. Since the data to be transmitted will pass through each relay point along the alternative transmission channel, if two potential danger relay points are closely related in terms of physical connection, data transmission path, network topology, or security and defense strategy, then the potential danger of one potential danger relay point is likely to affect another potential danger relay point. Therefore, when determining the simulated impact area of ​​the alternative transmission channel, it is necessary to consider and analyze the potential danger position of each potential danger relay point.

[0054] At the same time, it is also necessary to consider and analyze the communication value level corresponding to each hidden danger relay point. The higher the communication value level, the larger the relay point impact area. The communication value level corresponding to each hidden danger relay point can be determined by identifying the communication data characteristics contained in the communication data flowing through the hidden danger relay point. There is a level correspondence between the communication data characteristics and the communication value level. Based on the level correspondence, the communication value level corresponding to any hidden danger relay point can be determined. After obtaining a quantitative score by quantifying the hidden danger location and the communication value level, the relay point impact area corresponding to each hidden danger relay point can be determined based on the quantitative score. Specifically, the hidden danger relay point can be determined as the regional center, and then the regional area can be determined according to the quantitative score. Finally, the relay point impact area corresponding to the hidden danger relay point can be determined based on the regional center and the regional area. Different quantitative scores correspond to different regional areas. The correspondence between the quantitative score and the regional area can be determined by relevant staff based on historical experimental data.

[0055] Step S220: Determine the simulated affected layer of each candidate transmission channel based on the simulated affected area of ​​the candidate transmission channel and the simulated affected degree of each simulated affected area.

[0056] Specifically, for any alternative transmission channel, the channel layer corresponding to each alternative transmission channel can be determined based on each alternative transmission channel, and then the corresponding simulated display area range can be determined according to each simulated impact area in the alternative transmission channel, that is, each simulated impact area is framed out from the channel layer, and then the corresponding display color depth is determined according to the preset color depth mapping relationship and the simulated impact degree of each simulated impact area. The preset color depth mapping relationship is the correspondence between the simulated impact degree and the display color depth. The specific content is not specifically limited in the embodiments of the present application. Finally, the display color depth of the corresponding simulated display area range is adjusted based on the display color depth of each simulated impact area to obtain the simulated affected layer of the alternative transmission channel. Based on the above method, the simulated affected layer of each alternative transmission channel can be obtained.

[0057] Step S230: superimposing each affected simulation layer to obtain a target simulation layer, and determining a simulation area of ​​interest based on the target simulation layer.

[0058] Specifically, the superposition of multiple simulated affected layers can be achieved based on GIS software or a preset programming environment. After the superposition operation is completed, a target simulation layer containing all simulated affected layers will be generated, and the target simulation layer will display the simulated affected degree of each simulated affected area. In order to improve the accuracy of the target simulation layer, data standardization processing can be performed on all simulated affected layers before the superposition operation, for example, the data values ​​of all simulated affected layers are converted into a range of 0-100. The simulation area of ​​interest can be determined from the target simulation layer based on a preset display color depth threshold, that is, the display color depth corresponding to the simulation area of ​​interest is higher than the preset display color depth threshold. The specific preset display color depth threshold is not specifically limited in the embodiment of the present application, and can be determined by relevant staff based on historical experimental data. After determining the simulation area of ​​interest, the visualization function of the GIS software can be used to highlight the simulation area of ​​interest on the target simulation layer.

[0059] Step S240: Generate a defense reinforcement instruction based on the simulated area of ​​interest, and feed back the defense reinforcement instruction.

[0060] Specifically, the simulation area of ​​concern is an area where there is a greater security risk regardless of which alternative transmission channel is used as the substitute transmission channel corresponding to the first preset time period. Under the premise that any alternative transmission channel must be used as the substitute transmission channel corresponding to the first preset time period, the data security index of the simulation area of ​​concern can be improved by generating defense reinforcement instructions to ensure that the security risks faced by the simulation area of ​​concern are effectively controlled when using any alternative transmission channel as the substitute transmission channel corresponding to the first preset time period.

[0061] The present application provides a management and control system, such as Figure 3 As shown, Figure 3 The management and control system 300 shown includes: a processor 301 and a memory 303. The processor 301 and the memory 303 are connected, such as through a bus 302. Optionally, the management and control system 300 may also include a transceiver 304. It should be noted that in actual applications, the transceiver 304 is not limited to one, and the structure of the management and control system 300 does not constitute a limitation on the embodiments of the present application.

[0062] The processor 301 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. The processor 301 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0063] The bus 302 may include a path to transmit information between the above components. The bus 302 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus 302 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 The fact that only one line is used in the diagram does not mean that there is only one bus or only one type of bus.

[0064] The memory 303 may be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0065] The memory 303 is used to store the application code for executing the solution of the present application, and the execution is controlled by the processor 301. The processor 301 is used to execute the application code stored in the memory 303 to implement the contents shown in the above method embodiment.

[0066] The control system includes, but is not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), and fixed terminals such as digital TVs, desktop computers, etc. It can also be a server, etc. Figure 3 The management and control system shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0067] An embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer-readable storage medium is run on a computer, the computer can execute the corresponding content in the aforementioned method embodiment.

[0068] An embodiment of the present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the method in any of the above embodiments is implemented.

[0069] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0070] The above description is only a partial implementation method of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A security management and control method applied to a communication base station, characterized in that: include: Acquire real-time communication data of the communication base station to be controlled, and identify communication characteristics corresponding to the real-time communication data, wherein the real-time communication data includes real-time transmission data and real-time access data; When the communication feature includes a preset hidden danger feature, determining that the real-time communication data is hidden danger communication data; Identify the hidden danger transmission behavior and the hidden danger access behavior corresponding to the hidden danger communication data, and determine the hidden danger transmission channel corresponding to the hidden danger communication data and the affected coverage area corresponding to the hidden danger transmission channel based on the hidden danger transmission behavior and the hidden danger access behavior; A backup transmission channel is determined based on the hidden danger transmission channel and the historical communication needs of the affected coverage area, and a hidden danger isolation instruction is generated based on the backup transmission channel to isolate the hidden danger transmission channel, and use the backup transmission channel to provide communication services for the affected coverage area.

2. According to claim 1, a security management and control method applied to a communication base station is characterized in that: The determining of the substitute transmission channel based on the hidden danger transmission channel and the historical communication demand of the affected coverage area comprises: Performing feature recognition on the hidden danger transmission channel to obtain a hidden danger relay point corresponding to the hidden danger transmission channel; Determine at least one primary transmission channel based on the affected coverage area, and screen the at least one primary transmission channel based on the hidden danger relay point to obtain at least one secondary transmission channel, wherein the secondary transmission channel does not contain the hidden danger relay point; Based on the historical communication demand affecting the coverage area, each secondary transmission channel is evaluated to obtain a channel score of each secondary transmission channel, wherein the historical communication demand includes historical communication volume, historical communication rate, and historical communication safety factor; Based on the channel score of each secondary transmission channel, a substitute transmission channel is determined from the at least one secondary transmission channel.

3. A security management and control method applied to a communication base station according to claim 2, characterized in that: When there is no secondary transmission channel, it also includes: Based on the at least one primary transmission channel and the hidden danger relay point, determining at least one candidate transmission channel, wherein the candidate transmission channel includes hidden danger relay points, and the number of the hidden danger relay points included is less than a preset number of hidden dangers; Determining a predicted communication demand corresponding to a first preset time period based on the historical communication demand affecting the coverage area; Performing communication simulation on each candidate transmission channel based on the predicted communication demand to obtain simulated communication data corresponding to each candidate transmission channel, and determining a simulation score for each candidate transmission channel based on the type and number of simulated hidden danger features appearing in each simulated communication data; Based on the simulation score of each candidate transmission channel, a substitute transmission channel corresponding to the first preset time period is determined from the at least one candidate transmission channel.

4. A security control method applied to a communication base station according to claim 3, characterized in that: Also includes: Determine, based on the simulated communication data of each candidate transmission channel, a simulated impact area corresponding to each candidate transmission channel and a simulated impact degree of each simulated impact area; Determine a simulated affected layer of each candidate transmission channel based on the simulated affected area of ​​the candidate transmission channel and the simulated affected degree of each simulated affected area; Superimposing each simulated affected layer to obtain a target simulated layer, and determining a simulation area of ​​interest based on the target simulated layer; A defense reinforcement instruction is generated based on the simulated area of ​​interest, and the defense reinforcement instruction is fed back.

5. A security control method applied to a communication base station according to claim 4, characterized in that: Determining a simulated impact area corresponding to the candidate transmission channel based on simulated communication data of the candidate transmission channel includes: Identify the hidden danger position of each hidden danger relay point in the alternative transmission channel, where the hidden danger position of the hidden danger relay point is the sequential position of the hidden danger relay point in all the hidden danger relay points corresponding to the alternative transmission channel; Determine the communication value level corresponding to each hidden danger relay point based on the simulated communication data of the alternative transmission channel; Based on the hidden danger position and communication value level of each hidden danger relay point, the relay point influence area corresponding to each hidden danger relay point is determined, and based on each relay point influence area, the simulated influence area of ​​the alternative transmission channel is determined.

6. A security management and control method applied to a communication base station according to claim 3, characterized in that: Before determining at least one candidate transmission channel based on the at least one primary transmission channel and the vulnerable relay point, the method further includes: Acquire defense data of each hidden danger relay point in the hidden danger transmission channel within a second preset time period, and identify the number of defense times and the defense success rate from each defense data; Determine the defense score of each hidden danger relay point based on the number of defenses and the defense success rate corresponding to each hidden danger relay point; Hidden hidden danger relay points whose defense scores are lower than the preset scores are processed.

7. A management and control system, characterized in that: The control system includes: at least one processor; Memory; At least one application, wherein the at least one application is stored in a memory and configured to be executed by at least one processor, and the at least one application is configured to: execute a security management and control method applied to a communication base station according to any one of claims 1-6.

8. A computer-readable storage medium, characterized in that: include: A computer program is stored which can be loaded by a processor and executed according to any one of claims 1 to 6, and is applied to a security management and control method for a communication base station.

9. A computer program product, characterized in that It includes a computer program, which, when executed by a processor, implements the steps of a security management and control method applied to a communication base station according to any one of claims 1 to 6.

Images