Network intrusion detection and security protection method and system based on data flow

Abstract

The invention relates to the field of network security, in particular to a data flow-based network intrusion detection and security protection method and system, which are used for monitoring and analyzing application program running logs of all terminals accessing a network, and determining a target application program for performing data flow interaction in each terminal; predicting data stream expected interaction feature information of the target application program in a future time interval; on the basis of the thread occupation information of the target application program in the terminal, data flow actual interaction feature information of the target application program is obtained, so that whether the target application program has an intrusion event or not is judged, and non-running associated data transmission traceability information in the target application program is recognized; according to the method, all gateways capable of carrying out attack data stream interception in the network are determined based on the data stream attack path, and data stream transmission path adjustment is carried out on the terminal based on respective attack data stream interception state information of all gateways, so that the reliability of intrusion detection and protection and the security of network operation are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a network intrusion detection and security protection method and system based on data flow. Background Art

[0002] The network can provide data interaction channels for different terminals connected to it. When the application program inside the terminal is running, it will interact with the outside world according to the task process of the application program. Under normal circumstances, the data traffic interaction of each terminal connected to the network is only related to the operation of the application program inside the terminal. However, when a terminal connected to the network is hijacked, the hijacked terminal will launch a data traffic attack on other terminals, causing other terminals to receive a huge amount of data flow that is irrelevant to the operation of their own applications, which is likely to cause risks such as paralysis and crash of other terminals. Data traffic attacks are common network attack behaviors. The existing technology performs attack intrusion detection and protection by identifying the source of the attack and intercepting it locally. It requires the terminal itself to have sufficient computing power, which puts forward high performance requirements for the attacked terminal itself, and cannot guarantee accurate and reliable detection and protection of intrusion attacks on the network, reducing the security and reliability of network operation. It can be seen that how to detect and protect the network from data traffic attacks without relying entirely on the performance of the terminal itself is of great significance for maintaining the normal and safe operation of the network. Summary of the invention

[0003] In view of the defects of the prior art, the present invention provides a network intrusion detection and security protection method and system based on data flow, which monitors and analyzes the application operation logs of all terminals connected to the network, determines the target application that interacts with the data flow in each terminal, and predicts the expected interaction feature information of the data flow of the target application in the future time interval; based on the thread occupancy information of the target application in the terminal, the actual interaction feature information of the data flow of the target application is obtained, and by comparing the two interaction feature information, it is identified whether the target application has received an abnormally large amount of data flow, so as to judge whether an intrusion event has occurred in the target application, and identify the non-operation-related data transmission tracing information therein, so as to realize the path positioning of the data flow attack; based on the data flow attack path, all gateways that can intercept the attack data flow in the network are determined, and based on the attack data flow interception status information of all gateways, the data flow transmission path of the terminal is adjusted, so as to reduce the dependence of the detection of data flow attack intrusion behavior on the terminal itself, and improve the reliability of intrusion detection and protection and the security of network operation.

[0004] The present invention provides a network intrusion detection and security protection method based on data flow, comprising the following steps: Step S1, monitoring all terminals accessing the network to obtain application program operation logs of all terminals; analyzing the application program operation logs to determine the target application program for data flow interaction within each terminal; Step S2, predicting the expected interaction characteristic information of the data flow of the target application in the future time interval based on the task running process information of the target application; monitoring the target application based on the thread occupancy information of the target application in the terminal to obtain the actual interaction characteristic information of the data flow of the target application; Step S3, based on the actual interaction feature information of the data flow and the expected interaction feature information of the data flow, determine whether an intrusion event occurs in the target application; identify the data components of the target application where the intrusion event occurs, and obtain the non-operation associated data transmission tracing information of the target application where the intrusion event occurs, so as to determine the data flow attack path corresponding to the target application where the intrusion event occurs; Step S4, based on the data flow attack path, determine all gateways within the network that intercept the attack data flow for the terminal; based on the attack data flow interception status information of all gateways respectively, adjust the data flow transmission path for the terminal.

[0005] In one embodiment disclosed in the present application, in the step S1, all terminals accessing the network are monitored to obtain application program operation logs of all terminals; the application program operation logs are analyzed to determine the target application program for data flow interaction within each terminal, including: Obtaining the access node distribution location information of all terminals accessing the network within the network, and determining the terminal access aggregation area within the network based on the access node distribution location information; based on the open node bandwidth upper limit information of the terminal access aggregation area, monitoring all terminals within the terminal access aggregation area to obtain the application running logs of all terminals; Analyze the application operation log to obtain the data interaction transmission status information of all applications in each terminal; wherein the data interaction transmission status information includes the time domain change information of the uplink data and downlink data traffic of the application; based on the data interaction transmission status information, determine the target application for data interaction in each terminal.

[0006] In one embodiment disclosed in the present application, in the step S2, based on the task running process information of the target application, the expected interaction characteristic information of the data flow of the target application in the future time interval is predicted; based on the thread occupancy information of the target application in the terminal, the target application is monitored to obtain the actual interaction characteristic information of the data flow of the target application, including: Based on the task running instructions and task data received by the target application, determine the task running process information of the target application; based on the task running process information, determine the data processing process information of the target application in the future time interval, so as to predict the expected data flow interaction feature information of the target application in the future time interval; wherein the expected data flow interaction feature information includes the data interaction flow distribution feature information of all sub-intervals of the target application in the future time interval; Based on the thread occupancy position information of the target application on the terminal, the thread occupancy duration interval of the target application on the terminal is continuously monitored to obtain the actual interaction characteristic information of the data flow of the target application; wherein the actual interaction characteristic information of the data flow includes the data interaction traffic distribution characteristic information corresponding to each thread occupancy duration interval during the actual operation of the target application.

[0007] In one embodiment disclosed in the present application, in the step S3, based on the actual interaction feature information of the data flow and the expected interaction feature information of the data flow, it is determined whether the target application has an intrusion event; data components of the target application where the intrusion event has occurred are identified to obtain non-operation associated data transmission tracing information of the target application where the intrusion event has occurred, thereby determining the data flow attack path corresponding to the target application where the intrusion event has occurred, including: Compare the actual interaction characteristic information of the data flow with the expected interaction characteristic information of the data flow to determine the time domain change rate of the data interaction flow difference between the two; compare the time domain change rate with a preset change rate threshold, and if the time domain change rate exceeds the preset change rate threshold, determine that an intrusion event has occurred in the target application; otherwise, determine that no intrusion event has occurred in the target application; Data sampling and code content identification are performed on the target application where the intrusion event occurs, and a non-operation-related data feature code received by the target application where the intrusion event occurs is obtained; the non-operation-related data feature code is inversely traced to obtain non-operation-related data transmission tracing information of the target application where the intrusion event occurs, thereby determining the data flow attack path corresponding to the target application where the intrusion event occurs.

[0008] In one embodiment disclosed in the present application, in the step S4, based on the data flow attack path, all gateways that intercept the attack data flow of the terminal within the network are determined; based on the attack data flow interception state information of all gateways, the data flow transmission path of the terminal is adjusted, including: Acquire all associated gateways of the data flow attack path within the network, and select all gateways that intercept attack data flows to the terminal from all associated gateways based on the data transmission loads of all associated gateways and their network distances from the terminal; Based on the data flow interception omission rate of all gateways that intercept attack data flows, all gateways that cannot effectively intercept attack data flows are identified; based on the relative network position information between all gateways that cannot effectively intercept attack data flows and the terminal, the data flow transmission path of the terminal is adjusted.

[0009] The present invention also provides a network intrusion detection and security protection system based on data stream, comprising: The terminal monitoring module is used to monitor all terminals connected to the network and obtain the application running logs of all terminals; An application identification module, used to analyze the application operation log and determine the target application for data flow interaction within each terminal; A data flow interaction prediction module, used to predict expected data flow interaction feature information of the target application in a future time interval based on the task running process information of the target application; A data flow interaction actual monitoring module, used to monitor the target application based on the thread occupancy information of the target application in the terminal, and obtain the data flow actual interaction feature information of the target application; An intrusion event judgment module, used to judge whether an intrusion event occurs in the target application based on the actual interaction feature information of the data flow and the expected interaction feature information of the data flow; A data flow attack path determination module is used to identify data components of a target application program where an intrusion event occurs, and obtain non-operation associated data transmission tracing information of the target application program where the intrusion event occurs, so as to determine the data flow attack path corresponding to the target application program where the intrusion event occurs; A data flow interception control module, used to determine all gateways within the network that intercept attack data flows on the terminal based on the data flow attack path; The data stream transmission path adjustment module is used to adjust the data stream transmission path of the terminal based on the attack data stream interception status information of all gateways.

[0010] In one embodiment disclosed in the present application, the terminal monitoring module is used to monitor all terminals accessing the network and obtain the application running logs of all terminals, including: Obtaining the access node distribution location information of all terminals accessing the network within the network, and determining the terminal access aggregation area within the network based on the access node distribution location information; based on the open node bandwidth upper limit information of the terminal access aggregation area, monitoring all terminals within the terminal access aggregation area to obtain the application running logs of all terminals; The application identification module is used to analyze the application operation log to determine the target application for data flow interaction in each terminal, including: Analyze the application operation log to obtain the data interaction transmission status information of all applications in each terminal; wherein the data interaction transmission status information includes the time domain change information of the uplink data and downlink data traffic of the application; based on the data interaction transmission status information, determine the target application for data interaction in each terminal.

[0011] In one embodiment disclosed in the present application, the data flow interaction prediction module is used to predict the expected data flow interaction feature information of the target application in a future time interval based on the task running process information of the target application, including: Based on the task running instructions and task data received by the target application, determine the task running process information of the target application; based on the task running process information, determine the data processing process information of the target application in the future time interval, so as to predict the expected data flow interaction feature information of the target application in the future time interval; wherein the expected data flow interaction feature information includes the data interaction flow distribution feature information of all sub-intervals of the target application in the future time interval; The data flow interaction actual monitoring module is used to monitor the target application based on the thread occupancy information of the target application in the terminal, and obtain the data flow actual interaction feature information of the target application, including: Based on the thread occupancy position information of the target application on the terminal, the thread occupancy duration interval of the target application on the terminal is continuously monitored to obtain the actual interaction characteristic information of the data flow of the target application; wherein the actual interaction characteristic information of the data flow includes the data interaction traffic distribution characteristic information corresponding to each thread occupancy duration interval during the actual operation of the target application.

[0012] In one embodiment disclosed in the present application, the intrusion event judgment module is used to judge whether an intrusion event occurs in the target application based on the actual interaction feature information of the data flow and the expected interaction feature information of the data flow, including: Compare the actual interaction characteristic information of the data flow with the expected interaction characteristic information of the data flow to determine the time domain change rate of the data interaction flow difference between the two; compare the time domain change rate with a preset change rate threshold, and if the time domain change rate exceeds the preset change rate threshold, determine that an intrusion event has occurred in the target application; otherwise, determine that no intrusion event has occurred in the target application; The data flow attack path determination module is used to identify the data components of the target application program where the intrusion event occurs, obtain the non-operation associated data transmission source tracing information of the target application program where the intrusion event occurs, and thereby determine the data flow attack path corresponding to the target application program where the intrusion event occurs, including: Data sampling and code content identification are performed on the target application where the intrusion event occurs, and a non-operation-related data feature code received by the target application where the intrusion event occurs is obtained; the non-operation-related data feature code is inversely traced to obtain non-operation-related data transmission tracing information of the target application where the intrusion event occurs, thereby determining the data flow attack path corresponding to the target application where the intrusion event occurs.

[0013] In one embodiment disclosed in the present application, the data flow interception control module is used to determine all gateways that intercept attack data flows of the terminal within the network based on the data flow attack path, including: Acquire all associated gateways of the data flow attack path within the network, and select all gateways that intercept attack data flows to the terminal from all associated gateways based on the data transmission loads of all associated gateways and their network distances from the terminal; The data stream transmission path adjustment module is used to adjust the data stream transmission path of the terminal based on the attack data stream interception status information of all gateways, including: Based on the data flow interception omission rate of all gateways that intercept attack data flows, all gateways that cannot effectively intercept attack data flows are identified; based on the relative network position information between all gateways that cannot effectively intercept attack data flows and the terminal, the data flow transmission path of the terminal is adjusted.

[0014] Compared with the prior art, the network intrusion detection and security protection method and system based on data flow monitors and analyzes the application operation logs of all terminals connected to the network, determines the target application for data flow interaction in each terminal, and predicts the expected data flow interaction feature information of the target application in the future time interval; it also obtains the actual data flow interaction feature information of the target application based on the thread occupancy information of the target application in the terminal, and by comparing the two interaction feature information, it is identified whether the target application has received an abnormally large amount of data flow, thereby judging whether an intrusion event has occurred in the target application, and identifying the non-operation-related data transmission tracing information therein, to achieve the path positioning of the data flow attack; based on the data flow attack path, it determines all gateways that can intercept the attack data flow in the network, and based on the attack data flow interception status information of all gateways, adjusts the data flow transmission path of the terminal, reduces the dependence of the detection of data flow attack intrusion behavior on the terminal itself, and improves the reliability of intrusion detection and protection and the security of network operation.

[0015] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings.

[0016] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 A schematic diagram of the flow of the network intrusion detection and security protection method based on data stream provided by the present invention.

[0019] Figure 2 A schematic diagram of the framework of the data stream-based network intrusion detection and security protection system provided by the present invention. DETAILED DESCRIPTION

[0020] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] See also Figure 1 , is a flow chart of a network intrusion detection and security protection method based on data stream provided by an embodiment of the present invention. The network intrusion detection and security protection method based on data stream includes: Step S1, monitoring all terminals connected to the network to obtain the application running logs of all terminals; analyzing the application running logs to determine the target application for data flow interaction within each terminal; Step S2, based on the task running process information of the target application, predict the expected interaction characteristic information of the data flow of the target application in the future time interval; based on the thread occupancy information of the target application in the terminal, monitor the target application to obtain the actual interaction characteristic information of the data flow of the target application; Step S3, based on the actual interaction feature information of the data flow and the expected interaction feature information of the data flow, determine whether an intrusion event occurs in the target application; identify the data components of the target application where the intrusion event occurs, and obtain the non-operation associated data transmission tracing information of the target application where the intrusion event occurs, so as to determine the data flow attack path corresponding to the target application where the intrusion event occurs; Step S4, based on the data flow attack path, determine all gateways within the network that intercept the attack data flow to the terminal; based on the attack data flow interception status information of all gateways respectively, adjust the data flow transmission path of the terminal.

[0022] The beneficial effects of the above technical solution are as follows: the data flow-based network intrusion detection and security protection method monitors and analyzes the application operation logs of all terminals connected to the network, determines the target application for data flow interaction within each terminal, and predicts the expected data flow interaction feature information of the target application in the future time interval; it also obtains the actual data flow interaction feature information of the target application based on the thread occupancy information of the target application in the terminal, and by comparing the two interaction feature information, it is identified whether the target application has received an abnormally large amount of data flow, thereby judging whether an intrusion event has occurred in the target application, and identifying the non-operation-related data transmission tracing information therein, to achieve path positioning of the data flow attack; based on the data flow attack path, it determines all gateways that can intercept the attack data flow within the network, and based on the attack data flow interception status information of all gateways, adjusts the data flow transmission path of the terminal, reduces the dependence of the data flow attack intrusion behavior detection on the terminal itself, and improves the reliability of intrusion detection and protection and the security of network operation.

[0023] Preferably, in step S1, all terminals accessing the network are monitored to obtain the application running logs of all terminals; the application running logs are analyzed to determine the target application for data flow interaction in each terminal, including: Obtain the access node distribution location information of all terminals accessing the network within the network, and determine the terminal access aggregation area within the network based on the access node distribution location information; based on the open node bandwidth upper limit information of the terminal access aggregation area, monitor all terminals within the terminal access aggregation area to obtain the application running logs of all terminals; Analyze the application operation log to obtain the data interaction transmission status information of all applications in each terminal; wherein the data interaction transmission status information includes the time domain change information of the uplink data and downlink data traffic of the application; based on the data interaction transmission status information, determine the target application for data interaction in each terminal.

[0024] The beneficial effects of the above technical solution are as follows: all terminals connected to the network may be invaded by data traffic attacks, and the data traffic attacks and intrusions within the network are all achieved through the transmission of several gateways and other nodes within the network, and the data traffic attacks and intrusions are usually directed at the application within the terminal, and the data traffic attacks and intrusions will only be received when the application within the terminal is started. In addition, the more terminals access a certain area within the network, the higher the probability that the area will be invaded by data traffic attacks. In order to accurately identify and locate the areas and terminals where data traffic attacks and intrusions may occur within the network, the distribution location information of the access gateway nodes of all terminals accessing the network within the network is obtained, so as to obtain the terminal access density distribution within the network, and then based on the terminal access density distribution, the network is divided, and the terminal access aggregation area within the network is determined, so as to define the scope for subsequent network intrusion detection, and avoid global detection of the network and increase the detection workload. Then, based on the maximum value of the allowed data transmission bandwidth of the open gateway node (i.e., the gateway node that is in an idle state and does not require an authentication connection) accessed by the terminal, all terminals in the access aggregation area are monitored in parallel to ensure that the application operation logs of all terminals are obtained in the same time period. In addition, the application operation logs are analyzed to obtain the time domain change information of the uplink data and downlink data traffic of all applications in each terminal, so as to quantify the change of the uplink and downlink data interaction traffic over time during the operation of the application. When the time domain change speed of the uplink data traffic of a certain application matches the time domain change speed of the downlink data traffic (i.e., the speed difference between the two is within the preset range), the application is determined to be the target application for data interaction within the terminal, so that subsequent intrusion detection is only performed on the target application, effectively narrowing the scope of the intrusion detection object.

[0025] Preferably, in step S2, based on the task running process information of the target application, the expected interaction characteristic information of the data flow of the target application in the future time interval is predicted; based on the thread occupancy information of the target application in the terminal, the target application is monitored to obtain the actual interaction characteristic information of the data flow of the target application, including: Based on the task running instructions and task data received by the target application, determine the task running process information of the target application; based on the task running process information, determine the data processing process information of the target application in the future time interval, so as to predict the expected data flow interaction feature information of the target application in the future time interval; wherein the expected data flow interaction feature information includes the data interaction flow distribution feature information of all sub-intervals of the target application in the future time interval; Based on the thread occupancy position information of the target application on the terminal, the thread occupancy duration interval of the target application on the terminal is continuously monitored to obtain the actual interaction characteristic information of the data flow of the target application; wherein the actual interaction characteristic information of the data flow includes the data interaction traffic distribution characteristic information corresponding to each thread occupancy duration interval of the target application during the actual operation process.

[0026] The beneficial effects of the above technical solution are as follows: the process of the target application in the terminal during the task operation process is related to the task operation instruction and task data received by the target application, wherein the task operation instruction directly controls the operation mode of the target application, and the task data affects the operation time of the target application. Generally speaking, the larger the amount of task data, the greater the operation time of the target application. Based on the task operation instruction and task data received by the target application, the task operation process information of the target application is determined, thereby determining the data processing process information of the target application in the future time interval, thereby predicting the expected interactive characteristic information of the data flow of the target application in the future time interval, so that the data interaction flow distribution characteristic information of all sub-intervals under the target application in the future time interval can be accurately distinguished, and a benchmark basis is provided for the subsequent comparison of the data interaction flow situation of the target application in the actual operation process. In addition, based on the thread occupation position information of the target application in the terminal, the thread occupation continuous interval of the target application in the terminal is continuously monitored, and the data interaction flow distribution characteristic information corresponding to each thread occupation continuous interval of the target application in the actual operation process is obtained, and the data interaction flow size of the target application in the actual operation process is accurately determined.

[0027] Preferably, in step S3, based on the actual interaction feature information of the data flow and the expected interaction feature information of the data flow, it is determined whether an intrusion event occurs in the target application; data components of the target application where the intrusion event occurs are identified to obtain non-operation associated data transmission tracing information of the target application where the intrusion event occurs, thereby determining the data flow attack path corresponding to the target application where the intrusion event occurs, including: Compare the actual interaction characteristic information of the data flow with the expected interaction characteristic information of the data flow to determine the time domain change rate of the data interaction flow difference between the two; compare the time domain change rate with a preset change rate threshold, and if the time domain change rate exceeds the preset change rate threshold, determine that an intrusion event has occurred in the target application; otherwise, determine that no intrusion event has occurred in the target application; Data sampling and code content identification are performed on the target application where the intrusion event occurs, and the non-operation-related data feature code received by the target application where the intrusion event occurs is obtained; the non-operation-related data feature code is inversely traced to obtain the non-operation-related data transmission tracing information of the target application where the intrusion event occurs, thereby determining the data flow attack path corresponding to the target application where the intrusion event occurs.

[0028] The beneficial effects of the above technical solution are: comparing the actual interaction characteristic information of the data flow with the expected interaction characteristic information of the data flow, determining the time domain change rate of the data interaction flow difference between the two, and performing a threshold comparison on the time domain change rate. If the time domain change rate exceeds the preset change rate threshold, it indicates that the target application receives a much larger data flow than expected under normal circumstances during the actual operation, and at this time, it can be determined that an intrusion event has occurred in the target application; if the time domain change rate does not exceed the preset change rate threshold, it indicates that the data flow received by the target application during the actual operation is equivalent to the expected normal situation, and at this time, it can be determined that no intrusion event has occurred in the target application. In addition, data sampling and code content recognition are performed on the target application where the intrusion event occurs, and the non-operation-related data feature code received by the target application where the intrusion event occurs is obtained, and the non-operation-related data transmission traceability information of the target application where the intrusion event occurs is obtained by inversion tracking, so as to determine the data flow attack path corresponding to the target application where the intrusion event occurs, so as to quickly and accurately determine the source of the data flow attack on the target application, and provide a reliable basis for subsequent interception of the attack data flow.

[0029] Preferably, in step S4, based on the data flow attack path, all gateways that intercept the attack data flow of the terminal within the network are determined; based on the attack data flow interception state information of each of the gateways, the data flow transmission path of the terminal is adjusted, including: Obtain all associated gateways of the data flow attack path within the network, and based on the data transmission loads of all associated gateways and the network distances between them and the terminal, select all gateways that intercept the attack data flow to the terminal from all associated gateways; Based on the data flow interception omission rate of all gateways that intercept attack data flows, all gateways that cannot effectively intercept attack data flows are identified; based on the relative network position information of all gateways that cannot effectively intercept attack data flows and the terminal, the data flow transmission path of the terminal is adjusted.

[0030] The beneficial effect of the above technical solution is: in order to avoid intercepting the attack data flow locally at the terminal after the attack data flow reaches the terminal, which increases the operating load of the terminal, the attack data flow can be accurately intercepted before it reaches the terminal according to the data flow attack path, thereby reducing the operating load of the terminal. For this purpose, all the associated gateways of the data flow attack path within the network are obtained, and based on the data transmission load of each of the associated gateways and the network distance from the terminal, all the gateways that intercept the attack data flow of the terminal are screened from all the associated gateways. In actual operation, the associated gateways whose network distance with the terminal exceeds the preset distance threshold and whose data transmission load is less than the preset load threshold are preferentially selected as all the gateways that intercept the attack data flow, so that the attack data flow can be accurately intercepted before it reaches the terminal at the minimum, effectively reducing the attack data flow interception pressure of the terminal. In addition, the data flow interception omission rate of all gateways that intercept attack data flows is compared with the preset interception omission rate. If the data flow interception omission rate exceeds the preset interception omission rate, the corresponding gateway will be determined as a gateway that cannot effectively intercept the attack data flow. Based on the relative network position information of all gateways that cannot effectively intercept the attack data flow and the terminal, the data flow transmission path of the terminal is adjusted so that the adjusted data transmission path can effectively intercept the attack data flow, thereby improving the reliability of intrusion detection and protection and the security of network operation.

[0031] See also Figure 2 , is a schematic diagram of a framework of a network intrusion detection and security protection system based on data streams provided by an embodiment of the present invention. The network intrusion detection and security protection system based on data streams includes: The terminal monitoring module is used to monitor all terminals connected to the network and obtain the application running logs of all terminals; An application identification module is used to analyze the application operation log and determine the target application for data flow interaction within each terminal; A data flow interaction prediction module, used to predict expected data flow interaction feature information of the target application in a future time interval based on the task running process information of the target application; A data flow interaction actual monitoring module is used to monitor the target application based on the thread occupancy information of the target application in the terminal, and obtain the data flow actual interaction feature information of the target application; An intrusion event judgment module, used to judge whether an intrusion event occurs in the target application based on the actual interaction feature information of the data stream and the expected interaction feature information of the data stream; A data flow attack path determination module is used to identify data components of the target application program where the intrusion event occurs, and obtain the non-operation associated data transmission source tracing information of the target application program where the intrusion event occurs, so as to determine the data flow attack path corresponding to the target application program where the intrusion event occurs; A data flow interception control module, used to determine all gateways within the network that intercept attack data flows to the terminal based on the data flow attack path; The data stream transmission path adjustment module is used to adjust the data stream transmission path of the terminal based on the attack data stream interception status information of all gateways.

[0032] The beneficial effects of the above technical solution are as follows: the data flow-based network intrusion detection and security protection system monitors and analyzes the application operation logs of all terminals connected to the network, determines the target application for data flow interaction within each terminal, and predicts the expected data flow interaction feature information of the target application in the future time interval; it also obtains the actual data flow interaction feature information of the target application based on the thread occupancy information of the target application in the terminal, and by comparing the two interaction feature information, it identifies whether the target application has received an abnormally large amount of data flow, thereby judging whether an intrusion event has occurred in the target application, and identifies the non-operation-related data transmission tracing information therein, to achieve path positioning of the data flow attack; based on the data flow attack path, it determines all gateways that can intercept the attack data flow within the network, and based on the attack data flow interception status information of all gateways, adjusts the data flow transmission path of the terminal, reduces the dependence of the detection of data flow attack intrusion behavior on the terminal itself, and improves the reliability of intrusion detection and protection and the security of network operation.

[0033] Preferably, the terminal monitoring module is used to monitor all terminals accessing the network and obtain the application running logs of all terminals, including: Obtain the access node distribution location information of all terminals accessing the network within the network, and determine the terminal access aggregation area within the network based on the access node distribution location information; based on the open node bandwidth upper limit information of the terminal access aggregation area, monitor all terminals within the terminal access aggregation area to obtain the application running logs of all terminals; The application identification module is used to analyze the application operation log and determine the target application for data flow interaction within each terminal, including: Analyze the application operation log to obtain the data interaction transmission status information of all applications in each terminal; wherein the data interaction transmission status information includes the time domain change information of the uplink data and downlink data traffic of the application; based on the data interaction transmission status information, determine the target application for data interaction in each terminal.

[0034] The beneficial effects of the above technical solution are as follows: all terminals connected to the network may be invaded by data traffic attacks, and the data traffic attacks and intrusions within the network are all achieved through the transmission of several gateways and other nodes within the network, and the data traffic attacks and intrusions are usually directed at the application within the terminal, and the data traffic attacks and intrusions will only be received when the application within the terminal is started. In addition, the more terminals access a certain area within the network, the higher the probability that the area will be invaded by data traffic attacks. In order to accurately identify and locate the areas and terminals where data traffic attacks and intrusions may occur within the network, the distribution location information of the access gateway nodes of all terminals accessing the network within the network is obtained, so as to obtain the terminal access density distribution within the network, and then based on the terminal access density distribution, the network is divided, and the terminal access aggregation area within the network is determined, so as to define the scope for subsequent network intrusion detection, and avoid global detection of the network and increase the detection workload. Then, based on the maximum value of the allowed data transmission bandwidth of the open gateway node (i.e., the gateway node that is in an idle state and does not require an authentication connection) accessed by the terminal, all terminals in the access aggregation area are monitored in parallel to ensure that the application operation logs of all terminals are obtained in the same time period. In addition, the application operation logs are analyzed to obtain the time domain change information of the uplink data and downlink data traffic of all applications in each terminal, so as to quantify the change of the uplink and downlink data interaction traffic over time during the operation of the application. When the time domain change speed of the uplink data traffic of a certain application matches the time domain change speed of the downlink data traffic (i.e., the speed difference between the two is within the preset range), the application is determined to be the target application for data interaction within the terminal, so that subsequent intrusion detection is only performed on the target application, effectively narrowing the scope of the intrusion detection object.

[0035] Preferably, the data flow interaction prediction module is used to predict the expected data flow interaction feature information of the target application in a future time interval based on the task running process information of the target application, including: Based on the task running instructions and task data received by the target application, determine the task running process information of the target application; based on the task running process information, determine the data processing process information of the target application in the future time interval, so as to predict the expected data flow interaction feature information of the target application in the future time interval; wherein the expected data flow interaction feature information includes the data interaction flow distribution feature information of all sub-intervals of the target application in the future time interval; The data flow interaction actual monitoring module is used to monitor the target application based on the thread occupancy information of the target application in the terminal, and obtain the data flow actual interaction feature information of the target application, including: Based on the thread occupancy position information of the target application on the terminal, the thread occupancy duration interval of the target application on the terminal is continuously monitored to obtain the actual interaction characteristic information of the data flow of the target application; wherein the actual interaction characteristic information of the data flow includes the data interaction traffic distribution characteristic information corresponding to each thread occupancy duration interval of the target application during the actual operation process.

[0036] The beneficial effects of the above technical solution are as follows: the process of the target application in the terminal during the task operation process is related to the task operation instruction and task data received by the target application, wherein the task operation instruction directly controls the operation mode of the target application, and the task data affects the operation time of the target application. Generally speaking, the larger the amount of task data, the greater the operation time of the target application. Based on the task operation instruction and task data received by the target application, the task operation process information of the target application is determined, thereby determining the data processing process information of the target application in the future time interval, thereby predicting the expected interactive characteristic information of the data flow of the target application in the future time interval, so that the data interaction flow distribution characteristic information of all sub-intervals under the target application in the future time interval can be accurately distinguished, and a benchmark basis is provided for the subsequent comparison of the data interaction flow situation of the target application in the actual operation process. In addition, based on the thread occupation position information of the target application in the terminal, the thread occupation continuous interval of the target application in the terminal is continuously monitored, and the data interaction flow distribution characteristic information corresponding to each thread occupation continuous interval of the target application in the actual operation process is obtained, and the data interaction flow size of the target application in the actual operation process is accurately determined.

[0037] Preferably, the intrusion event determination module is used to determine whether an intrusion event occurs in the target application based on the actual interaction feature information of the data stream and the expected interaction feature information of the data stream, including: Compare the actual interaction characteristic information of the data flow with the expected interaction characteristic information of the data flow to determine the time domain change rate of the data interaction flow difference between the two; compare the time domain change rate with a preset change rate threshold, and if the time domain change rate exceeds the preset change rate threshold, determine that an intrusion event has occurred in the target application; otherwise, determine that no intrusion event has occurred in the target application; The data flow attack path determination module is used to identify the data components of the target application program where the intrusion event occurs, obtain the non-operation associated data transmission source tracing information of the target application program where the intrusion event occurs, and thereby determine the data flow attack path corresponding to the target application program where the intrusion event occurs, including: Data sampling and code content identification are performed on the target application where the intrusion event occurs, and the non-operation-related data feature code received by the target application where the intrusion event occurs is obtained; the non-operation-related data feature code is inversely traced to obtain the non-operation-related data transmission tracing information of the target application where the intrusion event occurs, thereby determining the data flow attack path corresponding to the target application where the intrusion event occurs.

[0038] The beneficial effects of the above technical solution are: comparing the actual interaction characteristic information of the data flow with the expected interaction characteristic information of the data flow, determining the time domain change rate of the data interaction flow difference between the two, and performing a threshold comparison on the time domain change rate. If the time domain change rate exceeds the preset change rate threshold, it indicates that the target application receives a much larger data flow than expected under normal circumstances during the actual operation, and at this time, it can be determined that an intrusion event has occurred in the target application; if the time domain change rate does not exceed the preset change rate threshold, it indicates that the data flow received by the target application during the actual operation is equivalent to the expected normal situation, and at this time, it can be determined that no intrusion event has occurred in the target application. In addition, data sampling and code content recognition are performed on the target application where the intrusion event occurs, and the non-operation-related data feature code received by the target application where the intrusion event occurs is obtained, and the non-operation-related data transmission traceability information of the target application where the intrusion event occurs is obtained by inversion tracking, so as to determine the data flow attack path corresponding to the target application where the intrusion event occurs, so as to quickly and accurately determine the source of the data flow attack on the target application, and provide a reliable basis for subsequent interception of the attack data flow.

[0039] Preferably, the data flow interception control module is used to determine all gateways that intercept attack data flows to the terminal within the network based on the data flow attack path, including: Obtain all associated gateways of the data flow attack path within the network, and based on the data transmission loads of all associated gateways and the network distances between them and the terminal, select all gateways that intercept the attack data flow to the terminal from all associated gateways; The data stream transmission path adjustment module is used to adjust the data stream transmission path of the terminal based on the attack data stream interception status information of all gateways, including: Based on the data flow interception omission rate of all gateways that intercept attack data flows, all gateways that cannot effectively intercept attack data flows are identified; based on the relative network position information of all gateways that cannot effectively intercept attack data flows and the terminal, the data flow transmission path of the terminal is adjusted.

[0040] The beneficial effect of the above technical solution is: in order to avoid intercepting the attack data flow locally at the terminal after the attack data flow reaches the terminal, which increases the operating load of the terminal, the attack data flow can be accurately intercepted before it reaches the terminal according to the data flow attack path, thereby reducing the operating load of the terminal. For this purpose, all the associated gateways of the data flow attack path within the network are obtained, and based on the data transmission load of each of the associated gateways and the network distance from the terminal, all the gateways that intercept the attack data flow of the terminal are screened from all the associated gateways. In actual operation, the associated gateways whose network distance with the terminal exceeds the preset distance threshold and whose data transmission load is less than the preset load threshold are preferentially selected as all the gateways that intercept the attack data flow, so that the attack data flow can be accurately intercepted before it reaches the terminal at the minimum, effectively reducing the attack data flow interception pressure of the terminal. In addition, the data flow interception omission rate of all gateways that intercept attack data flows is compared with the preset interception omission rate. If the data flow interception omission rate exceeds the preset interception omission rate, the corresponding gateway will be determined as a gateway that cannot effectively intercept the attack data flow. Based on the relative network position information of all gateways that cannot effectively intercept the attack data flow and the terminal, the data flow transmission path of the terminal is adjusted so that the adjusted data transmission path can effectively intercept the attack data flow, thereby improving the reliability of intrusion detection and protection and the security of network operation.

[0041] It can be seen from the contents of the above embodiments that the data flow-based network intrusion detection and security protection method and system monitor and analyze the application operation logs of all terminals connected to the network, determine the target application for data flow interaction within each terminal, and predict the expected data flow interaction feature information of the target application in the future time interval; also based on the thread occupancy information of the target application in the terminal, obtain the actual data flow interaction feature information of the target application, and by comparing the two interaction feature information, identify whether the target application has received an abnormally large amount of data flow, thereby judging whether an intrusion event has occurred in the target application, and identify the non-operation-related data transmission tracing information therein, to achieve path positioning of the data flow attack; based on the data flow attack path, determine all gateways that can intercept the attack data flow within the network, and adjust the data flow transmission path of the terminal based on the attack data flow interception status information of all gateways, reduce the dependence of the data flow attack intrusion behavior detection on the terminal itself, and improve the reliability of intrusion detection and protection and the security of network operation.

[0042] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A network intrusion detection and security protection method based on data flow, characterized in that: It includes the following steps: Step S1, monitoring all terminals accessing the network to obtain application program operation logs of all terminals; analyzing the application program operation logs to determine the target application program for data flow interaction within each terminal; Step S2, predicting the expected interaction characteristic information of the data flow of the target application in the future time interval based on the task running process information of the target application; monitoring the target application based on the thread occupancy information of the target application in the terminal to obtain the actual interaction characteristic information of the data flow of the target application; Step S3, judging whether an intrusion event occurs in the target application based on the actual interaction feature information of the data flow and the expected interaction feature information of the data flow; Identify data components of the target application where the intrusion event occurs, and obtain non-operation-related data transmission tracing information of the target application where the intrusion event occurs, so as to determine the data flow attack path corresponding to the target application where the intrusion event occurs; Step S4, based on the data flow attack path, determining all gateways within the network that intercept attack data flows to the terminal; Based on the attack data flow interception status information of all gateways, the data flow transmission path of the terminal is adjusted.

2. The method for network intrusion detection and security protection based on data stream according to claim 1, characterized in that: In the step S1, all terminals accessing the network are monitored to obtain the application running logs of all the terminals; the application running logs are analyzed to determine the target application for data flow interaction in each terminal, including: Obtaining the access node distribution location information of all terminals accessing the network within the network, and determining the terminal access aggregation area within the network based on the access node distribution location information; based on the open node bandwidth upper limit information of the terminal access aggregation area, monitoring all terminals within the terminal access aggregation area to obtain the application running logs of all terminals; Analyze the application operation log to obtain the data interaction transmission status information of all applications in each terminal; wherein the data interaction transmission status information includes the time domain change information of the uplink data and downlink data traffic of the application; based on the data interaction transmission status information, determine the target application for data interaction in each terminal.

3. The method for network intrusion detection and security protection based on data stream according to claim 2, characterized in that: In step S2, based on the task running process information of the target application, the expected interaction characteristic information of the data flow of the target application in the future time interval is predicted; based on the thread occupancy information of the target application in the terminal, the target application is monitored to obtain the actual interaction characteristic information of the data flow of the target application, including: Based on the task running instructions and task data received by the target application, determine the task running process information of the target application; based on the task running process information, determine the data processing process information of the target application in the future time interval, so as to predict the expected data flow interaction feature information of the target application in the future time interval; wherein the expected data flow interaction feature information includes the data interaction flow distribution feature information of all sub-intervals of the target application in the future time interval; Based on the thread occupancy position information of the target application on the terminal, the thread occupancy duration interval of the target application on the terminal is continuously monitored to obtain the actual interaction characteristic information of the data flow of the target application; wherein the actual interaction characteristic information of the data flow includes the data interaction traffic distribution characteristic information corresponding to each thread occupancy duration interval during the actual operation of the target application.

4. The method for network intrusion detection and security protection based on data stream according to claim 3, characterized in that: In the step S3, based on the actual interaction characteristic information of the data flow and the expected interaction characteristic information of the data flow, it is determined whether an intrusion event occurs in the target application; Identify the data components of the target application where the intrusion event occurs, obtain the non-operation associated data transmission source tracing information of the target application where the intrusion event occurs, and thereby determine the data flow attack path corresponding to the target application where the intrusion event occurs, including: Compare the actual interaction characteristic information of the data flow with the expected interaction characteristic information of the data flow to determine the time domain change rate of the data interaction flow difference between the two; compare the time domain change rate with a preset change rate threshold, and if the time domain change rate exceeds the preset change rate threshold, determine that an intrusion event has occurred in the target application; otherwise, determine that no intrusion event has occurred in the target application; Data sampling and code content identification are performed on the target application where the intrusion event occurs, and a non-operation-related data feature code received by the target application where the intrusion event occurs is obtained; the non-operation-related data feature code is inversely traced to obtain non-operation-related data transmission tracing information of the target application where the intrusion event occurs, thereby determining the data flow attack path corresponding to the target application where the intrusion event occurs.

5. The method for network intrusion detection and security protection based on data stream according to claim 4, characterized in that: In the step S4, based on the data flow attack path, all gateways that intercept the attack data flow to the terminal within the network are determined; Based on the attack data flow interception status information of all gateways, adjusting the data flow transmission path of the terminal includes: Acquire all associated gateways of the data flow attack path within the network, and select all gateways that intercept attack data flows to the terminal from all associated gateways based on the data transmission loads of all associated gateways and their network distances from the terminal; Based on the data flow interception omission rate of all gateways that intercept attack data flows, all gateways that cannot effectively intercept attack data flows are identified; based on the relative network position information between all gateways that cannot effectively intercept attack data flows and the terminal, the data flow transmission path of the terminal is adjusted.

6. Network intrusion detection and security protection system based on data flow, characterized in that: include: The terminal monitoring module is used to monitor all terminals connected to the network and obtain the application running logs of all terminals; An application identification module, used to analyze the application operation log and determine the target application for data flow interaction within each terminal; A data flow interaction prediction module, used to predict expected data flow interaction feature information of the target application in a future time interval based on the task running process information of the target application; A data flow interaction actual monitoring module, used to monitor the target application based on the thread occupancy information of the target application in the terminal, and obtain the data flow actual interaction feature information of the target application; An intrusion event judgment module, used to judge whether an intrusion event occurs in the target application based on the actual interaction feature information of the data flow and the expected interaction feature information of the data flow; A data flow attack path determination module is used to identify data components of a target application program where an intrusion event occurs, and obtain non-operation associated data transmission tracing information of the target application program where the intrusion event occurs, so as to determine the data flow attack path corresponding to the target application program where the intrusion event occurs; A data flow interception control module, used to determine all gateways within the network that intercept attack data flows on the terminal based on the data flow attack path; The data stream transmission path adjustment module is used to adjust the data stream transmission path of the terminal based on the attack data stream interception status information of all gateways.

7. The data stream-based network intrusion detection and security protection system according to claim 6, characterized in that: The terminal monitoring module is used to monitor all terminals accessing the network and obtain the application running logs of all terminals, including: Obtaining the access node distribution location information of all terminals accessing the network within the network, and determining the terminal access aggregation area within the network based on the access node distribution location information; based on the open node bandwidth upper limit information of the terminal access aggregation area, monitoring all terminals within the terminal access aggregation area to obtain the application running logs of all terminals; The application identification module is used to analyze the application operation log to determine the target application for data flow interaction in each terminal, including: Analyze the application operation log to obtain the data interaction transmission status information of all applications in each terminal; wherein the data interaction transmission status information includes the time domain change information of the uplink data and downlink data traffic of the application; based on the data interaction transmission status information, determine the target application for data interaction in each terminal.

8. The data stream-based network intrusion detection and security protection system according to claim 7, characterized in that: The data flow interaction prediction module is used to predict the expected data flow interaction feature information of the target application in a future time interval based on the task running process information of the target application, including: Based on the task running instructions and task data received by the target application, determine the task running process information of the target application; based on the task running process information, determine the data processing process information of the target application in the future time interval, so as to predict the expected data flow interaction feature information of the target application in the future time interval; wherein the expected data flow interaction feature information includes the data interaction flow distribution feature information of all sub-intervals of the target application in the future time interval; The data flow interaction actual monitoring module is used to monitor the target application based on the thread occupancy information of the target application in the terminal, and obtain the data flow actual interaction feature information of the target application, including: Based on the thread occupancy position information of the target application on the terminal, the thread occupancy duration interval of the target application on the terminal is continuously monitored to obtain the actual interaction characteristic information of the data flow of the target application; wherein the actual interaction characteristic information of the data flow includes the data interaction traffic distribution characteristic information corresponding to each thread occupancy duration interval during the actual operation of the target application.

9. The data stream-based network intrusion detection and security protection system according to claim 8, characterized in that: The intrusion event judgment module is used to judge whether an intrusion event occurs in the target application based on the actual interaction feature information of the data flow and the expected interaction feature information of the data flow, including: Compare the actual interaction characteristic information of the data flow with the expected interaction characteristic information of the data flow to determine the time domain change rate of the data interaction flow difference between the two; compare the time domain change rate with a preset change rate threshold, and if the time domain change rate exceeds the preset change rate threshold, determine that an intrusion event has occurred in the target application; otherwise, determine that no intrusion event has occurred in the target application; The data flow attack path determination module is used to identify the data components of the target application program where the intrusion event occurs, obtain the non-operation associated data transmission source tracing information of the target application program where the intrusion event occurs, and thereby determine the data flow attack path corresponding to the target application program where the intrusion event occurs, including: Data sampling and code content identification are performed on the target application where the intrusion event occurs, and a non-operation-related data feature code received by the target application where the intrusion event occurs is obtained; the non-operation-related data feature code is inversely traced to obtain non-operation-related data transmission tracing information of the target application where the intrusion event occurs, thereby determining the data flow attack path corresponding to the target application where the intrusion event occurs.

10. The data stream-based network intrusion detection and security protection system according to claim 9, characterized in that: The data flow interception control module is used to determine all gateways that intercept attack data flows of the terminal within the network based on the data flow attack path, including: Acquire all associated gateways of the data flow attack path within the network, and select all gateways that intercept attack data flows to the terminal from all associated gateways based on the data transmission loads of all associated gateways and their network distances from the terminal; The data stream transmission path adjustment module is used to adjust the data stream transmission path of the terminal based on the attack data stream interception status information of all gateways, including: Based on the data flow interception omission rate of all gateways that intercept attack data flows, all gateways that cannot effectively intercept attack data flows are identified; based on the relative network position information between all gateways that cannot effectively intercept attack data flows and the terminal, the data flow transmission path of the terminal is adjusted.

Images