Network intrusion detection and security protection method and system based on data flow

Abstract

The present invention relates to the field of network security, and specifically to a data flow-based network intrusion detection and security protection method and system. The method monitors and analyzes the application operation logs of all terminals connected to the network, determines the target application that performs data flow interaction within each terminal, and predicts the expected data flow interaction feature information of the target application in the future time interval; further, based on the thread occupancy information of the target application in the terminal, obtains the actual data flow interaction feature information of the target application, thereby judging whether an intrusion event has occurred in the target application and identifying the non-operation-related data transmission tracing information therein; based on the data flow attack path, determines all gateways within the network that can intercept attack data flows, and adjusts the data flow transmission path of the terminal based on the attack data flow interception status information of each gateway, thereby improving the reliability of intrusion detection and protection and the security of network operation.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a method and system for network intrusion detection and security protection based on data flow. Background Art

[0002] A network provides data exchange channels for different terminals connected to it. When applications within a terminal are running, they interact with the outside world based on the application's task progress. Under normal circumstances, the data traffic exchanged by each terminal connected to the network is only related to the operation of the terminal's internal applications. However, when a terminal connected to the network is hijacked, it can launch data traffic attacks on other terminals, causing them to receive massive amounts of data streams unrelated to their own applications, potentially paralyzing and crashing other terminals. Data traffic attacks are a common network attack. Existing technologies detect and protect against intrusions through attack source identification and local interception. This requires sufficient computing power on the terminal itself, placing high performance demands on the attacked terminal itself. Accurate and reliable detection and protection against network intrusions cannot be guaranteed, reducing the security and reliability of network operations. Therefore, detecting and protecting against data traffic attacks on the network without relying solely on the terminal's own performance is crucial for maintaining the normal and secure operation of the network. Summary of the Invention

[0003] In response to the defects of the existing technology, the present invention provides a network intrusion detection and security protection method and system based on data flow, which monitors and analyzes the application operation logs of all terminals connected to the network, determines the target application that interacts with the data flow within each terminal, and predicts the expected data flow interaction feature information of the target application in the future time interval; it also obtains the actual data flow interaction feature information of the target application based on the thread occupancy information of the target application in the terminal, and by comparing the two interaction feature information, it identifies whether the target application has received an abnormally large amount of data flow, thereby judging whether an intrusion event has occurred in the target application, and identifies the non-operation-related data transmission tracing information therein, thereby locating the path of the data flow attack; based on the data flow attack path, it determines all gateways within the network that can intercept the attack data flow, and based on the attack data flow interception status information of each gateway, adjusts the data flow transmission path of the terminal, reduces the dependence of the detection of data flow attack intrusion behavior on the terminal itself, and improves the reliability of intrusion detection and protection and the security of network operation.

[0004] The present invention provides a network intrusion detection and security protection method based on data flow, comprising the following steps:

[0005] Step S1: monitor all terminals connected to the network to obtain the application running logs of all terminals; analyze the application running logs to determine the target application for data flow interaction within each terminal;

[0006] Step S2: predicting expected data flow interaction characteristic information of the target application in a future time interval based on the task running process information of the target application; monitoring the target application based on the thread occupancy information of the target application on the terminal to obtain actual data flow interaction characteristic information of the target application;

[0007] Step S3: Based on the actual interaction feature information of the data flow and the expected interaction feature information of the data flow, determining whether an intrusion event has occurred in the target application; identifying data components of the target application where the intrusion event has occurred, and obtaining non-operation-related data transmission tracing information of the target application where the intrusion event has occurred, thereby determining the data flow attack path corresponding to the target application where the intrusion event has occurred;

[0008] Step S4: Based on the data flow attack path, determine all gateways within the network that intercept the attack data flow for the terminal; and adjust the data flow transmission path for the terminal based on the attack data flow interception status information of all gateways.

[0009] In one embodiment disclosed in the present application, in step S1, all terminals accessing the network are monitored to obtain application program execution logs of all terminals; and the application program execution logs are analyzed to determine a target application program for data flow interaction within each terminal, including:

[0010] Obtaining access node distribution location information of all terminals accessing the network within the network, and determining a terminal access aggregation area within the network based on the access node distribution location information; monitoring all terminals within the terminal access aggregation area based on the upper bandwidth limit information of open nodes in the terminal access aggregation area to obtain application running logs for all terminals;

[0011] Analyze the application operation log to obtain the data interaction transmission status information of all applications in each terminal; wherein, the data interaction transmission status information includes the time domain change information of the uplink data and downlink data traffic of the application; based on the data interaction transmission status information, determine the target application for data interaction in each terminal.

[0012] In one embodiment disclosed in the present application, in step S2, based on the task running process information of the target application, expected interaction characteristic information of the data flow of the target application in a future time interval is predicted; based on the thread occupancy information of the target application on the terminal, the target application is monitored to obtain the actual interaction characteristic information of the data flow of the target application, including:

[0013] Determine the task running process information of the target application based on the task running instructions and task data received by the target application; determine the data processing process information of the target application in a future time interval based on the task running process information, thereby predicting the expected data flow interaction characteristic information of the target application in the future time interval; wherein the expected data flow interaction characteristic information includes the data interaction traffic distribution characteristic information of all subintervals of the target application in the future time interval;

[0014] Based on the thread occupancy position information of the target application on the terminal, the thread occupancy duration interval of the target application on the terminal is continuously monitored to obtain the actual interaction characteristic information of the data flow of the target application; wherein, the actual interaction characteristic information of the data flow includes the data interaction traffic distribution characteristic information corresponding to the continuous occupation interval of each thread during the actual operation of the target application.

[0015] In one embodiment disclosed in the present application, in step S3, based on the actual interaction feature information of the data flow and the expected interaction feature information of the data flow, it is determined whether an intrusion event has occurred in the target application; data components of the target application where the intrusion event has occurred are identified to obtain non-operation-related data transmission tracing information of the target application where the intrusion event has occurred, thereby determining the data flow attack path corresponding to the target application where the intrusion event has occurred, including:

[0016] Comparing the actual interaction characteristic information of the data flow with the expected interaction characteristic information of the data flow to determine a time-domain change rate of a difference in data interaction flow between the two; comparing the time-domain change rate with a preset change rate threshold; if the time-domain change rate exceeds the preset change rate threshold, determining that an intrusion event has occurred in the target application; otherwise, determining that no intrusion event has occurred in the target application;

[0017] Data sampling and code content identification are performed on the target application where the intrusion event occurs to obtain the non-operation-related data feature code received by the target application where the intrusion event occurs; the non-operation-related data feature code is inversely traced to obtain the non-operation-related data transmission tracing information of the target application where the intrusion event occurs, thereby determining the data flow attack path corresponding to the target application where the intrusion event occurs.

[0018] In one embodiment disclosed in the present application, in step S4, based on the data flow attack path, all gateways that intercept the attack data flow of the terminal within the network are determined; and based on the attack data flow interception status information of each of the gateways, the data flow transmission path of the terminal is adjusted, including:

[0019] Obtaining all associated gateways of the data flow attack path within the network, and screening all gateways from all associated gateways for intercepting attack data flows to the terminal based on the data transmission loads of the associated gateways and their network distances from the terminal;

[0020] Based on the data flow interception omission rate of all gateways that intercept attack data flows, all gateways that cannot effectively intercept attack data flows are identified; based on the relative network position information of all gateways that cannot effectively intercept attack data flows and the terminal, the data flow transmission path of the terminal is adjusted.

[0021] The present invention also provides a network intrusion detection and security protection system based on data stream, comprising:

[0022] The terminal monitoring module is used to monitor all terminals connected to the network and obtain the application running logs of all terminals;

[0023] An application identification module is used to analyze the application operation logs and determine the target application for data flow interaction within each terminal;

[0024] A data flow interaction prediction module is used to predict expected data flow interaction feature information of the target application in a future time interval based on the task running process information of the target application;

[0025] A data flow interaction actual monitoring module is used to monitor the target application based on thread occupancy information of the target application on the terminal, and obtain actual data flow interaction feature information of the target application;

[0026] an intrusion event judgment module, configured to judge whether an intrusion event occurs in the target application based on the actual interaction feature information of the data flow and the expected interaction feature information of the data flow;

[0027] A data flow attack path determination module is used to identify data components of the target application where the intrusion event occurs, obtain non-operational associated data transmission tracing information of the target application where the intrusion event occurs, and thereby determine the data flow attack path corresponding to the target application where the intrusion event occurs;

[0028] A data flow interception control module is used to determine all gateways within the network that intercept attack data flows on the terminal based on the data flow attack path;

[0029] The data flow transmission path adjustment module is used to adjust the data flow transmission path of the terminal based on the attack data flow interception status information of all gateways.

[0030] In one embodiment disclosed in the present application, the terminal monitoring module is used to monitor all terminals accessing the network and obtain the application running logs of all terminals, including:

[0031] Obtaining access node distribution location information of all terminals accessing the network within the network, and determining a terminal access aggregation area within the network based on the access node distribution location information; monitoring all terminals within the terminal access aggregation area based on the upper bandwidth limit information of open nodes in the terminal access aggregation area to obtain application running logs for all terminals;

[0032] The application identification module is used to analyze the application operation log to determine the target application for data flow interaction within each terminal, including:

[0033] Analyze the application operation log to obtain the data interaction transmission status information of all applications in each terminal; wherein, the data interaction transmission status information includes the time domain change information of the uplink data and downlink data traffic of the application; based on the data interaction transmission status information, determine the target application for data interaction in each terminal.

[0034] In one embodiment disclosed in the present application, the data flow interaction prediction module is configured to predict expected data flow interaction feature information of the target application in a future time interval based on the task running process information of the target application, including:

[0035] Determine the task running process information of the target application based on the task running instructions and task data received by the target application; determine the data processing process information of the target application in a future time interval based on the task running process information, thereby predicting the expected data flow interaction characteristic information of the target application in the future time interval; wherein the expected data flow interaction characteristic information includes the data interaction traffic distribution characteristic information of all subintervals of the target application in the future time interval;

[0036] The data flow interaction actual monitoring module is used to monitor the target application based on the thread occupancy information of the target application in the terminal, and obtain the data flow actual interaction feature information of the target application, including:

[0037] Based on the thread occupancy position information of the target application on the terminal, the thread occupancy duration interval of the target application on the terminal is continuously monitored to obtain the actual interaction characteristic information of the data flow of the target application; wherein, the actual interaction characteristic information of the data flow includes the data interaction traffic distribution characteristic information corresponding to the continuous occupation interval of each thread during the actual operation of the target application.

[0038] In one embodiment disclosed in the present application, the intrusion event determination module is configured to determine whether an intrusion event occurs in the target application based on the actual interaction feature information of the data flow and the expected interaction feature information of the data flow, including:

[0039] Comparing the actual interaction characteristic information of the data flow with the expected interaction characteristic information of the data flow to determine a time-domain change rate of a difference in data interaction flow between the two; comparing the time-domain change rate with a preset change rate threshold; if the time-domain change rate exceeds the preset change rate threshold, determining that an intrusion event has occurred in the target application; otherwise, determining that no intrusion event has occurred in the target application;

[0040] The data flow attack path determination module is used to identify data components of the target application where the intrusion event occurs, obtain non-operation-related data transmission tracing information of the target application where the intrusion event occurs, and thereby determine the data flow attack path corresponding to the target application where the intrusion event occurs, including:

[0041] Data sampling and code content identification are performed on the target application where the intrusion event occurs to obtain the non-operation-related data feature code received by the target application where the intrusion event occurs; the non-operation-related data feature code is inversely traced to obtain the non-operation-related data transmission tracing information of the target application where the intrusion event occurs, thereby determining the data flow attack path corresponding to the target application where the intrusion event occurs.

[0042] In one embodiment disclosed in the present application, the data flow interception control module is configured to determine all gateways within the network that intercept attack data flows against the terminal based on the data flow attack path, including:

[0043] Obtaining all associated gateways of the data flow attack path within the network, and screening all gateways from all associated gateways for intercepting attack data flows to the terminal based on the data transmission loads of the associated gateways and their network distances from the terminal;

[0044] The data stream transmission path adjustment module is used to adjust the data stream transmission path of the terminal based on the attack data stream interception status information of all gateways, including:

[0045] Based on the data flow interception omission rate of all gateways that intercept attack data flows, all gateways that cannot effectively intercept attack data flows are identified; based on the relative network position information of all gateways that cannot effectively intercept attack data flows and the terminal, the data flow transmission path of the terminal is adjusted.

[0046] Compared with the existing technology, the data flow-based network intrusion detection and security protection method and system monitors and analyzes the application operation logs of all terminals connected to the network, determines the target application for data flow interaction within each terminal, and predicts the expected data flow interaction feature information of the target application in the future time interval; it also obtains the actual data flow interaction feature information of the target application based on the thread occupancy information of the target application in the terminal, and by comparing the two interaction feature information, identifies whether the target application has received an abnormally large amount of data flow, thereby judging whether an intrusion event has occurred in the target application, and identifies the non-operation-related data transmission tracing information therein, to achieve the path positioning of the data flow attack; based on the data flow attack path, determines all gateways within the network that can intercept attack data flows, and based on the attack data flow interception status information of each gateway, adjusts the data flow transmission path of the terminal, reduces the dependence of data flow attack intrusion behavior detection on the terminal itself, and improves the reliability of intrusion detection and protection and the security of network operation.

[0047] Other features and advantages of the present invention will be described in the following description, and in part will become apparent from the description, or will be understood by practicing the present invention. The purposes and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings.

[0048] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0050] Figure 1 This is a flow chart of the data stream-based network intrusion detection and security protection method provided by the present invention.

[0051] Figure 2 This is a schematic diagram of the framework of the data stream-based network intrusion detection and security protection system provided by the present invention. DETAILED DESCRIPTION

[0052] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0053] See Figure 1 , is a flow chart of a data stream-based network intrusion detection and security protection method provided by an embodiment of the present invention. The data stream-based network intrusion detection and security protection method includes:

[0054] Step S1: monitor all terminals connected to the network to obtain the application running logs of all terminals; analyze the application running logs to determine the target application for data flow interaction within each terminal;

[0055] Step S2: predicting expected data flow interaction characteristics of the target application in a future time interval based on the task running process information of the target application; monitoring the target application based on the thread occupancy information of the target application on the terminal to obtain actual data flow interaction characteristics of the target application;

[0056] Step S3: Based on the actual interaction feature information of the data flow and the expected interaction feature information of the data flow, determine whether an intrusion event has occurred in the target application; identify the data components of the target application where the intrusion event occurred, and obtain the non-operational associated data transmission traceability information of the target application where the intrusion event occurred, thereby determining the data flow attack path corresponding to the target application where the intrusion event occurred;

[0057] Step S4: Based on the data flow attack path, determine all gateways within the network that intercept the attack data flow of the terminal; and adjust the data flow transmission path of the terminal based on the attack data flow interception status information of each gateway.

[0058] The beneficial effects of the above technical solution are: the data flow-based network intrusion detection and security protection method monitors and analyzes the application operation logs of all terminals connected to the network, determines the target application for data flow interaction within each terminal, and predicts the expected data flow interaction feature information of the target application in the future time interval; it also obtains the actual data flow interaction feature information of the target application based on the thread occupancy information of the target application in the terminal, and by comparing the two interaction feature information, identifies whether the target application has received an abnormally large amount of data flow, thereby judging whether an intrusion event has occurred in the target application, and identifies the non-operation-related data transmission tracing information therein, to achieve path positioning of the data flow attack; based on the data flow attack path, determines all gateways within the network that can intercept attack data flows, and based on the attack data flow interception status information of each gateway, adjusts the data flow transmission path of the terminal, reduces the dependence of data flow attack intrusion behavior detection on the terminal itself, and improves the reliability of intrusion detection and protection and the security of network operation.

[0059] Preferably, in step S1, all terminals accessing the network are monitored to obtain the application running logs of all terminals; and the application running logs are analyzed to determine the target application for data flow interaction within each terminal, including:

[0060] Obtain the access node distribution location information of all terminals accessing the network within the network, and determine the terminal access aggregation area within the network based on the access node distribution location information; based on the open node bandwidth upper limit information of the terminal access aggregation area, monitor all terminals within the terminal access aggregation area to obtain the application operation logs of all terminals;

[0061] Analyze the application operation log to obtain the data interaction transmission status information of all applications in each terminal; wherein, the data interaction transmission status information includes the time domain change information of the uplink data and downlink data traffic of the application; based on the data interaction transmission status information, determine the target application for data interaction in each terminal.

[0062] The beneficial effects of the above technical solution are as follows: all terminals connected to the network may be invaded by data traffic attacks, and the data traffic attacks and intrusions within the network are all achieved through the transmission of several gateways and other nodes within the network, and the data traffic attacks and intrusions are usually targeted at the applications within the terminal. Only when the applications within the terminal are started will the data traffic attacks and intrusions be received. In addition, the more terminals access a certain area within the network, the higher the probability that the area will be invaded by data traffic attacks. In order to accurately identify and locate the areas and terminals that may be invaded by data traffic attacks within the network, the distribution position information of the access gateway nodes within the network of all terminals accessing the network is obtained, thereby obtaining the terminal access density distribution within the network, and then based on the terminal access density distribution, the network is divided to determine the terminal access concentration area within the network, and the scope is delineated for subsequent network intrusion detection, avoiding global detection of the network and increasing the detection workload. Based on the maximum allowed data transmission bandwidth of the open gateway node (i.e., a gateway node that is idle and does not require an authenticated connection) within the clustered area accessed by the terminal, parallel monitoring is performed on all terminals within the clustered area accessed by the terminal, ensuring that the application operation logs of all terminals are obtained within the same time period. Furthermore, the application operation logs are analyzed to obtain the time-domain variation information of the uplink and downlink data traffic of all applications within each terminal, thereby quantifying the time-domain variation of the uplink and downlink data interaction traffic of the applications during operation. When the time-domain variation speed of the uplink data traffic of a certain application matches the time-domain variation speed of the downlink data traffic (i.e., the speed difference between the two is within a preset range), the application is determined to be the target application for data interaction within the terminal, facilitating subsequent intrusion detection targeting only the target application, effectively narrowing the scope of intrusion detection.

[0063] Preferably, in step S2, based on the task running process information of the target application, the expected interaction characteristic information of the data flow of the target application in the future time interval is predicted; based on the thread occupancy information of the target application on the terminal, the target application is monitored to obtain the actual interaction characteristic information of the data flow of the target application, including:

[0064] Determine the task execution process information of the target application based on the task execution instructions and task data received by the target application; determine the data processing process information of the target application in a future time interval based on the task execution process information, thereby predicting the expected data flow interaction characteristic information of the target application in the future time interval; wherein the expected data flow interaction characteristic information includes the data interaction traffic distribution characteristic information of all subintervals of the target application in the future time interval;

[0065] Based on the thread occupancy position information of the target application on the terminal, the thread occupancy duration interval of the target application on the terminal is continuously monitored to obtain the actual interaction characteristic information of the data flow of the target application; wherein, the actual interaction characteristic information of the data flow includes the data interaction traffic distribution characteristic information corresponding to the continuous occupation interval of each thread of the target application during the actual operation process.

[0066] The beneficial effects of the above technical solution are as follows: the progress of the target application in the task execution process within the terminal is related to the task execution instructions and task data received by the target application, wherein the task execution instructions directly control the operation mode of the target application, while the task data affects the operation time of the target application. Generally speaking, the larger the task data volume, the longer the operation time of the target application. Based on the task execution instructions and task data received by the target application, the task execution process information of the target application is determined, thereby determining the data processing process information of the target application in the future time interval, thereby predicting the expected data flow interaction characteristics of the target application in the future time interval. In this way, the data interaction traffic distribution characteristics of all subintervals within the future time interval of the target application can be accurately distinguished, providing a benchmark for subsequent comparison with the data interaction traffic situation of the target application during actual operation. In addition, based on the thread occupancy position information of the target application in the terminal, the thread occupancy duration interval of the target application in the terminal is continuously monitored, and the data interaction traffic distribution characteristics information corresponding to each thread occupancy duration interval of the target application during actual operation is obtained, and the data interaction traffic size of the target application during actual operation is accurately determined.

[0067] Preferably, in step S3, based on the actual interaction feature information of the data flow and the expected interaction feature information of the data flow, it is determined whether an intrusion event has occurred in the target application; data components of the target application where the intrusion event has occurred are identified to obtain non-operation-related data transmission tracing information of the target application where the intrusion event has occurred, thereby determining the data flow attack path corresponding to the target application where the intrusion event has occurred, including:

[0068] Comparing the actual interaction characteristic information of the data flow with the expected interaction characteristic information of the data flow to determine the time-domain change rate of the data interaction flow difference between the two; comparing the time-domain change rate with a preset change rate threshold; if the time-domain change rate exceeds the preset change rate threshold, determining that an intrusion event has occurred in the target application; otherwise, determining that no intrusion event has occurred in the target application;

[0069] Data sampling and code content identification are performed on the target application where the intrusion event occurs to obtain the non-operation-related data feature code received by the target application where the intrusion event occurs; the non-operation-related data feature code is inversely tracked to obtain the non-operation-related data transmission tracing information of the target application where the intrusion event occurs, thereby determining the data flow attack path corresponding to the target application where the intrusion event occurs.

[0070] The beneficial effects of the above technical solution are as follows: comparing the actual interaction characteristic information of the data flow with the expected interaction characteristic information of the data flow, determining the time domain change rate of the data interaction flow difference between the two, and performing a threshold comparison on the time domain change rate. If the time domain change rate exceeds the preset change rate threshold, it indicates that the target application receives a much larger data flow during actual operation than expected under normal circumstances, and it can be determined that an intrusion event has occurred in the target application; if the time domain change rate does not exceed the preset change rate threshold, it indicates that the data flow received by the target application during actual operation is equivalent to the expected normal situation, and it can be determined that no intrusion event has occurred in the target application. In addition, data sampling and code content identification are performed on the target application where the intrusion event occurred to obtain the non-operation-related data feature code received by the target application where the intrusion event occurred, and this is used for inverse tracing to obtain the non-operation-related data transmission traceability information of the target application where the intrusion event occurred, thereby determining the data flow attack path corresponding to the target application where the intrusion event occurred, facilitating the rapid and accurate determination of the source of the data flow attack suffered by the target application, and providing a reliable basis for subsequent interception of the attack data flow.

[0071] Preferably, in step S4, based on the data flow attack path, all gateways that intercept the attack data flow of the terminal within the network are determined; and based on the attack data flow interception status information of each of the gateways, the data flow transmission path of the terminal is adjusted, including:

[0072] Obtain all associated gateways of the data flow attack path within the network, and select all gateways from all associated gateways that can intercept the attack data flow to the terminal based on the data transmission load of each associated gateway and the network distance between the gateway and the terminal;

[0073] Based on the data flow interception omission rate of all gateways that intercept attack data flows, all gateways that cannot effectively intercept attack data flows are identified; based on the relative network position information of all gateways that cannot effectively intercept attack data flows and the terminal, the data flow transmission path of the terminal is adjusted.

[0074] The beneficial effect of the above technical solution is that, in order to avoid intercepting the attack data stream locally at the terminal after it reaches the terminal, which increases the terminal's operational load, the attack data stream can be accurately intercepted before it reaches the terminal based on the data stream attack path, thereby reducing the terminal's operational load. To this end, all associated gateways within the network of the data stream attack path are obtained, and based on the data transmission load of each associated gateway and the network distance from the terminal, all gateways that intercept the attack data stream for the terminal are screened from all associated gateways. In actual operation, associated gateways whose network distance from the terminal exceeds a preset distance threshold and whose data transmission load is less than a preset load threshold are preferentially selected as all gateways that intercept the attack data stream. This allows the attack data stream to be accurately intercepted before it reaches the terminal at the very least, effectively reducing the attack data stream interception pressure on the terminal. In addition, the data flow interception omission rate of all gateways that intercept attack data flows is compared with the preset interception omission rate. If the data flow interception omission rate exceeds the preset interception omission rate, the corresponding gateway will be determined as a gateway that cannot effectively intercept the attack data flow. Based on the relative network position information of all gateways that cannot effectively intercept the attack data flow and the terminal, the data flow transmission path of the terminal is adjusted so that the adjusted data transmission path can effectively intercept the attack data flow, thereby improving the reliability of intrusion detection and protection and the security of network operation.

[0075] See Figure 2 , is a schematic diagram of the framework of a data stream-based network intrusion detection and security protection system provided by an embodiment of the present invention. The data stream-based network intrusion detection and security protection system includes:

[0076] The terminal monitoring module is used to monitor all terminals connected to the network and obtain the application running logs of all terminals;

[0077] The application identification module is used to analyze the application operation log and determine the target application for data flow interaction within each terminal;

[0078] A data flow interaction prediction module is used to predict the expected interaction feature information of the data flow of the target application in the future time interval based on the task running process information of the target application;

[0079] A data flow interaction actual monitoring module is used to monitor the target application based on the thread occupancy information of the target application on the terminal, and obtain the data flow actual interaction feature information of the target application;

[0080] an intrusion event judgment module, configured to judge whether an intrusion event occurs in the target application based on the actual interaction feature information of the data flow and the expected interaction feature information of the data flow;

[0081] The data flow attack path determination module is used to identify the data components of the target application where the intrusion event occurred, obtain the non-operational associated data transmission traceability information of the target application where the intrusion event occurred, and thereby determine the data flow attack path corresponding to the target application where the intrusion event occurred;

[0082] A data flow interception control module is used to determine all gateways in the network that intercept attack data flows to the terminal based on the data flow attack path;

[0083] The data flow transmission path adjustment module is used to adjust the data flow transmission path of the terminal based on the attack data flow interception status information of all gateways.

[0084] The beneficial effects of the above technical solution are: the data flow-based network intrusion detection and security protection system monitors and analyzes the application operation logs of all terminals connected to the network, determines the target application for data flow interaction within each terminal, and predicts the expected data flow interaction feature information of the target application in the future time interval; it also obtains the actual data flow interaction feature information of the target application based on the thread occupancy information of the target application in the terminal, and by comparing the two interaction feature information, identifies whether the target application has received an abnormally large amount of data flow, thereby judging whether an intrusion event has occurred in the target application, and identifies the non-operation-related data transmission tracing information therein, to achieve path positioning of the data flow attack; based on the data flow attack path, determines all gateways within the network that can intercept attack data flows, and based on the attack data flow interception status information of all gateways, adjusts the data flow transmission path of the terminal, reduces the dependence of data flow attack intrusion behavior detection on the terminal itself, and improves the reliability of intrusion detection and protection and the security of network operation.

[0085] Preferably, the terminal monitoring module is used to monitor all terminals accessing the network and obtain the application running logs of all terminals, including:

[0086] Obtain the access node distribution location information of all terminals accessing the network within the network, and determine the terminal access aggregation area within the network based on the access node distribution location information; based on the open node bandwidth upper limit information of the terminal access aggregation area, monitor all terminals within the terminal access aggregation area to obtain the application operation logs of all terminals;

[0087] The application identification module is used to analyze the application operation log and identify the target application for data flow interaction within each terminal, including:

[0088] Analyze the application operation log to obtain the data interaction transmission status information of all applications in each terminal; wherein, the data interaction transmission status information includes the time domain change information of the uplink data and downlink data traffic of the application; based on the data interaction transmission status information, determine the target application for data interaction in each terminal.

[0089] The beneficial effects of the above technical solution are as follows: all terminals connected to the network may be invaded by data traffic attacks, and the data traffic attacks and intrusions within the network are all achieved through the transmission of several gateways and other nodes within the network, and the data traffic attacks and intrusions are usually targeted at the applications within the terminal. Only when the applications within the terminal are started will the data traffic attacks and intrusions be received. In addition, the more terminals access a certain area within the network, the higher the probability that the area will be invaded by data traffic attacks. In order to accurately identify and locate the areas and terminals that may be invaded by data traffic attacks within the network, the distribution position information of the access gateway nodes within the network of all terminals accessing the network is obtained, thereby obtaining the terminal access density distribution within the network, and then based on the terminal access density distribution, the network is divided to determine the terminal access concentration area within the network, and the scope is delineated for subsequent network intrusion detection, avoiding global detection of the network and increasing the detection workload. Based on the maximum allowed data transmission bandwidth of the open gateway node (i.e., a gateway node that is idle and does not require an authenticated connection) within the clustered area accessed by the terminal, parallel monitoring is performed on all terminals within the clustered area accessed by the terminal, ensuring that the application operation logs of all terminals are obtained within the same time period. Furthermore, the application operation logs are analyzed to obtain the time-domain variation information of the uplink and downlink data traffic of all applications within each terminal, thereby quantifying the time-domain variation of the uplink and downlink data interaction traffic of the applications during operation. When the time-domain variation speed of the uplink data traffic of a certain application matches the time-domain variation speed of the downlink data traffic (i.e., the speed difference between the two is within a preset range), the application is determined to be the target application for data interaction within the terminal, facilitating subsequent intrusion detection targeting only the target application, effectively narrowing the scope of intrusion detection.

[0090] Preferably, the data flow interaction prediction module is used to predict the expected data flow interaction feature information of the target application in a future time interval based on the task running process information of the target application, including:

[0091] Determine the task execution process information of the target application based on the task execution instructions and task data received by the target application; determine the data processing process information of the target application in a future time interval based on the task execution process information, thereby predicting the expected data flow interaction characteristic information of the target application in the future time interval; wherein the expected data flow interaction characteristic information includes the data interaction traffic distribution characteristic information of all subintervals of the target application in the future time interval;

[0092] The data flow interaction actual monitoring module is used to monitor the target application based on the thread occupancy information of the target application in the terminal, and obtain the data flow actual interaction feature information of the target application, including:

[0093] Based on the thread occupancy position information of the target application on the terminal, the thread occupancy duration interval of the target application on the terminal is continuously monitored to obtain the actual interaction characteristic information of the data flow of the target application; wherein, the actual interaction characteristic information of the data flow includes the data interaction traffic distribution characteristic information corresponding to the continuous occupation interval of each thread of the target application during the actual operation process.

[0094] The beneficial effects of the above technical solution are as follows: the progress of the target application in the task execution process within the terminal is related to the task execution instructions and task data received by the target application, wherein the task execution instructions directly control the operation mode of the target application, while the task data affects the operation time of the target application. Generally speaking, the larger the task data volume, the longer the operation time of the target application. Based on the task execution instructions and task data received by the target application, the task execution process information of the target application is determined, thereby determining the data processing process information of the target application in the future time interval, thereby predicting the expected data flow interaction characteristics of the target application in the future time interval. In this way, the data interaction traffic distribution characteristics of all subintervals within the future time interval of the target application can be accurately distinguished, providing a benchmark for subsequent comparison with the data interaction traffic situation of the target application during actual operation. In addition, based on the thread occupancy position information of the target application in the terminal, the thread occupancy duration interval of the target application in the terminal is continuously monitored, and the data interaction traffic distribution characteristics information corresponding to each thread occupancy duration interval of the target application during actual operation is obtained, and the data interaction traffic size of the target application during actual operation is accurately determined.

[0095] Preferably, the intrusion event judgment module is used to judge whether an intrusion event occurs in the target application based on the actual interaction feature information of the data flow and the expected interaction feature information of the data flow, including:

[0096] Comparing the actual interaction characteristic information of the data flow with the expected interaction characteristic information of the data flow to determine the time-domain change rate of the data interaction flow difference between the two; comparing the time-domain change rate with a preset change rate threshold; if the time-domain change rate exceeds the preset change rate threshold, determining that an intrusion event has occurred in the target application; otherwise, determining that no intrusion event has occurred in the target application;

[0097] The data flow attack path determination module is used to identify the data components of the target application where the intrusion event occurred, obtain the non-operational associated data transmission traceability information of the target application where the intrusion event occurred, and thereby determine the data flow attack path corresponding to the target application where the intrusion event occurred, including:

[0098] Data sampling and code content identification are performed on the target application where the intrusion event occurs to obtain the non-operation-related data feature code received by the target application where the intrusion event occurs; the non-operation-related data feature code is inversely tracked to obtain the non-operation-related data transmission tracing information of the target application where the intrusion event occurs, thereby determining the data flow attack path corresponding to the target application where the intrusion event occurs.

[0099] The beneficial effects of the above technical solution are as follows: comparing the actual interaction characteristic information of the data flow with the expected interaction characteristic information of the data flow, determining the time domain change rate of the data interaction flow difference between the two, and performing a threshold comparison on the time domain change rate. If the time domain change rate exceeds the preset change rate threshold, it indicates that the target application receives a much larger data flow during actual operation than expected under normal circumstances, and it can be determined that an intrusion event has occurred in the target application; if the time domain change rate does not exceed the preset change rate threshold, it indicates that the data flow received by the target application during actual operation is equivalent to the expected normal situation, and it can be determined that no intrusion event has occurred in the target application. In addition, data sampling and code content identification are performed on the target application where the intrusion event occurred to obtain the non-operation-related data feature code received by the target application where the intrusion event occurred, and this is used for inverse tracing to obtain the non-operation-related data transmission traceability information of the target application where the intrusion event occurred, thereby determining the data flow attack path corresponding to the target application where the intrusion event occurred, facilitating the rapid and accurate determination of the source of the data flow attack suffered by the target application, and providing a reliable basis for subsequent interception of the attack data flow.

[0100] Preferably, the data flow interception control module is used to determine all gateways within the network that intercept attack data flows to the terminal based on the data flow attack path, including:

[0101] Obtain all associated gateways of the data flow attack path within the network, and select all gateways from all associated gateways that can intercept the attack data flow to the terminal based on the data transmission load of each associated gateway and the network distance between the gateway and the terminal;

[0102] The data flow transmission path adjustment module is used to adjust the data flow transmission path of the terminal based on the attack data flow interception status information of all gateways, including:

[0103] Based on the data flow interception omission rate of all gateways that intercept attack data flows, all gateways that cannot effectively intercept attack data flows are identified; based on the relative network position information of all gateways that cannot effectively intercept attack data flows and the terminal, the data flow transmission path of the terminal is adjusted.

[0104] The beneficial effect of the above technical solution is that, in order to avoid intercepting the attack data stream locally at the terminal after it reaches the terminal, which increases the terminal's operational load, the attack data stream can be accurately intercepted before it reaches the terminal based on the data stream attack path, thereby reducing the terminal's operational load. To this end, all associated gateways within the network of the data stream attack path are obtained, and based on the data transmission load of each associated gateway and the network distance from the terminal, all gateways that intercept the attack data stream for the terminal are screened from all associated gateways. In actual operation, associated gateways whose network distance from the terminal exceeds a preset distance threshold and whose data transmission load is less than a preset load threshold are preferentially selected as all gateways that intercept the attack data stream. This allows the attack data stream to be accurately intercepted before it reaches the terminal at the very least, effectively reducing the attack data stream interception pressure on the terminal. In addition, the data flow interception omission rate of all gateways that intercept attack data flows is compared with the preset interception omission rate. If the data flow interception omission rate exceeds the preset interception omission rate, the corresponding gateway will be determined as a gateway that cannot effectively intercept the attack data flow. Based on the relative network position information of all gateways that cannot effectively intercept the attack data flow and the terminal, the data flow transmission path of the terminal is adjusted so that the adjusted data transmission path can effectively intercept the attack data flow, thereby improving the reliability of intrusion detection and protection and the security of network operation.

[0105] From the contents of the above embodiments, it can be seen that the data flow-based network intrusion detection and security protection method and system monitor and analyze the application operation logs of all terminals connected to the network, determine the target application for data flow interaction within each terminal, and predict the expected data flow interaction feature information of the target application in the future time interval; it also obtains the actual data flow interaction feature information of the target application based on the thread occupancy information of the target application in the terminal, and by comparing the two interaction feature information, identifies whether the target application has received an abnormally large amount of data flow, thereby judging whether an intrusion event has occurred in the target application, and identifies the non-operation-related data transmission tracing information therein, to achieve path positioning of the data flow attack; based on the data flow attack path, determines all gateways within the network that can intercept the attack data flow, and based on the attack data flow interception status information of each gateway, adjusts the data flow transmission path of the terminal, reduces the dependence of the detection of data flow attack intrusion behavior on the terminal itself, and improves the reliability of intrusion detection and protection and the security of network operation.

[0106] Obviously, those skilled in the art may make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if such changes and modifications fall within the scope of the claims and their equivalents, the present invention is intended to include such changes and modifications.

Claims

1. A network intrusion detection and security protection method based on data flow, characterized in that: It includes the following steps: Step S1: monitor all terminals connected to the network to obtain the application running logs of all terminals; analyze the application running logs to determine the target application for data flow interaction within each terminal; Step S2: predicting expected data flow interaction characteristic information of the target application in a future time interval based on the task running process information of the target application; monitoring the target application based on the thread occupancy information of the target application on the terminal to obtain actual data flow interaction characteristic information of the target application; Step S3, judging whether an intrusion event occurs in the target application based on the actual interaction feature information of the data flow and the expected interaction feature information of the data flow; Identify data components of the target application where the intrusion event occurred, and obtain non-operational associated data transmission tracing information of the target application where the intrusion event occurred, thereby determining the data flow attack path corresponding to the target application where the intrusion event occurred; Step S4, based on the data flow attack path, determining all gateways within the network that intercept the attack data flow to the terminal; Based on the attack data flow interception status information of all gateways, the data flow transmission path of the terminal is adjusted.

2. The data stream-based network intrusion detection and security protection method according to claim 1, wherein: In step S1, all terminals connected to the network are monitored to obtain the application running logs of all terminals; the application running logs are analyzed to determine the target application for data flow interaction within each terminal, including: Obtaining access node distribution location information of all terminals accessing the network within the network, and determining a terminal access aggregation area within the network based on the access node distribution location information; monitoring all terminals within the terminal access aggregation area based on the upper bandwidth limit information of open nodes in the terminal access aggregation area to obtain application running logs for all terminals; Analyze the application operation log to obtain the data interaction transmission status information of all applications in each terminal; wherein, the data interaction transmission status information includes the time domain change information of the uplink data and downlink data traffic of the application; based on the data interaction transmission status information, determine the target application for data interaction in each terminal.

3. The data stream-based network intrusion detection and security protection method according to claim 2, wherein: In step S2, based on the task running process information of the target application, expected interaction characteristic information of the data flow of the target application in a future time interval is predicted; based on the thread occupancy information of the target application on the terminal, the target application is monitored to obtain actual interaction characteristic information of the data flow of the target application, including: Determine the task running process information of the target application based on the task running instructions and task data received by the target application; determine the data processing process information of the target application in a future time interval based on the task running process information, thereby predicting the expected data flow interaction characteristic information of the target application in the future time interval; wherein the expected data flow interaction characteristic information includes the data interaction traffic distribution characteristic information of all subintervals of the target application in the future time interval; Based on the thread occupancy position information of the target application on the terminal, the thread occupancy duration interval of the target application on the terminal is continuously monitored to obtain the actual interaction characteristic information of the data flow of the target application; wherein, the actual interaction characteristic information of the data flow includes the data interaction traffic distribution characteristic information corresponding to the continuous occupation interval of each thread during the actual operation of the target application.

4. The data stream-based network intrusion detection and security protection method according to claim 3, wherein: In step S3, based on the actual interaction feature information of the data flow and the expected interaction feature information of the data flow, it is determined whether an intrusion event occurs in the target application; Identify the data components of the target application where the intrusion event occurred, obtain the non-operation-related data transmission tracing information of the target application where the intrusion event occurred, and thereby determine the data flow attack path corresponding to the target application where the intrusion event occurred, including: Comparing the actual interaction characteristic information of the data flow with the expected interaction characteristic information of the data flow to determine a time-domain change rate of a difference in data interaction flow between the two; comparing the time-domain change rate with a preset change rate threshold; if the time-domain change rate exceeds the preset change rate threshold, determining that an intrusion event has occurred in the target application; otherwise, determining that no intrusion event has occurred in the target application; Data sampling and code content identification are performed on the target application where the intrusion event occurs to obtain the non-operation-related data feature code received by the target application where the intrusion event occurs; the non-operation-related data feature code is inversely traced to obtain the non-operation-related data transmission tracing information of the target application where the intrusion event occurs, thereby determining the data flow attack path corresponding to the target application where the intrusion event occurs.

5. The data stream-based network intrusion detection and security protection method according to claim 4, characterized in that: In the step S4, based on the data flow attack path, all gateways that intercept the attack data flow to the terminal within the network are determined; Adjusting the data flow transmission path of the terminal based on the attack data flow interception status information of all gateways includes: Obtaining all associated gateways of the data flow attack path within the network, and screening all gateways from all associated gateways for intercepting attack data flows to the terminal based on the data transmission loads of the associated gateways and their network distances from the terminal; Based on the data flow interception omission rate of all gateways that intercept attack data flows, all gateways that cannot effectively intercept attack data flows are identified; based on the relative network position information of all gateways that cannot effectively intercept attack data flows and the terminal, the data flow transmission path of the terminal is adjusted.

6. Network intrusion detection and security protection system based on data flow, characterized by: include: The terminal monitoring module is used to monitor all terminals connected to the network and obtain the application running logs of all terminals; An application identification module is used to analyze the application operation logs and determine the target application for data flow interaction within each terminal; A data flow interaction prediction module is used to predict expected data flow interaction feature information of the target application in a future time interval based on the task running process information of the target application; A data flow interaction actual monitoring module is used to monitor the target application based on thread occupancy information of the target application on the terminal, and obtain actual data flow interaction feature information of the target application; an intrusion event judgment module, configured to judge whether an intrusion event occurs in the target application based on the actual interaction feature information of the data flow and the expected interaction feature information of the data flow; A data flow attack path determination module is used to identify data components of the target application where the intrusion event occurs, obtain non-operational associated data transmission tracing information of the target application where the intrusion event occurs, and thereby determine the data flow attack path corresponding to the target application where the intrusion event occurs; A data flow interception control module is used to determine all gateways within the network that intercept attack data flows on the terminal based on the data flow attack path; The data flow transmission path adjustment module is used to adjust the data flow transmission path of the terminal based on the attack data flow interception status information of all gateways.

7. The data stream-based network intrusion detection and security protection system according to claim 6, characterized in that: The terminal monitoring module is used to monitor all terminals accessing the network and obtain the application running logs of all terminals, including: Obtaining access node distribution location information of all terminals accessing the network within the network, and determining a terminal access aggregation area within the network based on the access node distribution location information; monitoring all terminals within the terminal access aggregation area based on the upper bandwidth limit information of open nodes in the terminal access aggregation area to obtain application running logs for all terminals; The application identification module is used to analyze the application operation log to determine the target application for data flow interaction within each terminal, including: Analyze the application operation log to obtain the data interaction transmission status information of all applications in each terminal; wherein, the data interaction transmission status information includes the time domain change information of the uplink data and downlink data traffic of the application; based on the data interaction transmission status information, determine the target application for data interaction in each terminal.

8. The data stream-based network intrusion detection and security protection system according to claim 7, wherein: The data flow interaction prediction module is used to predict the expected data flow interaction feature information of the target application in a future time interval based on the task running process information of the target application, including: Determine the task running process information of the target application based on the task running instructions and task data received by the target application; determine the data processing process information of the target application in a future time interval based on the task running process information, thereby predicting the expected data flow interaction characteristic information of the target application in the future time interval; wherein the expected data flow interaction characteristic information includes the data interaction traffic distribution characteristic information of all subintervals of the target application in the future time interval; The data flow interaction actual monitoring module is used to monitor the target application based on the thread occupancy information of the target application in the terminal, and obtain the data flow actual interaction feature information of the target application, including: Based on the thread occupancy position information of the target application on the terminal, the thread occupancy duration interval of the target application on the terminal is continuously monitored to obtain the actual interaction characteristic information of the data flow of the target application; wherein, the actual interaction characteristic information of the data flow includes the data interaction traffic distribution characteristic information corresponding to the continuous occupation interval of each thread during the actual operation of the target application.

9. The data stream-based network intrusion detection and security protection system according to claim 8, characterized in that: The intrusion event judgment module is used to judge whether an intrusion event occurs in the target application based on the actual interaction feature information of the data flow and the expected interaction feature information of the data flow, including: Comparing the actual interaction characteristic information of the data flow with the expected interaction characteristic information of the data flow to determine a time-domain change rate of a difference in data interaction flow between the two; comparing the time-domain change rate with a preset change rate threshold; if the time-domain change rate exceeds the preset change rate threshold, determining that an intrusion event has occurred in the target application; otherwise, determining that no intrusion event has occurred in the target application; The data flow attack path determination module is used to identify data components of the target application where the intrusion event occurs, obtain non-operation-related data transmission tracing information of the target application where the intrusion event occurs, and thereby determine the data flow attack path corresponding to the target application where the intrusion event occurs, including: Data sampling and code content identification are performed on the target application where the intrusion event occurs to obtain the non-operation-related data feature code received by the target application where the intrusion event occurs; the non-operation-related data feature code is inversely traced to obtain the non-operation-related data transmission tracing information of the target application where the intrusion event occurs, thereby determining the data flow attack path corresponding to the target application where the intrusion event occurs.

10. The data stream-based network intrusion detection and security protection system according to claim 9, characterized in that: The data flow interception control module is used to determine all gateways within the network that intercept attack data flows on the terminal based on the data flow attack path, including: Obtaining all associated gateways of the data flow attack path within the network, and screening all gateways from all associated gateways for intercepting attack data flows to the terminal based on the data transmission loads of the associated gateways and their network distances from the terminal; The data stream transmission path adjustment module is used to adjust the data stream transmission path of the terminal based on the attack data stream interception status information of all gateways, including: Based on the data flow interception omission rate of all gateways that intercept attack data flows, all gateways that cannot effectively intercept attack data flows are identified; based on the relative network position information of all gateways that cannot effectively intercept attack data flows and the terminal, the data flow transmission path of the terminal is adjusted.

Images