Automatic identification and warning system for large-flow network information dissemination

Abstract

The invention belongs to the technical field of network information propagation, and particularly relates to a high-flow network information propagation automatic identification and warning system, which identifies whether the current network flow use of a certain communication coverage partition of a specified base station is abnormal or not through network flow detection data, and if the current network flow use is abnormal, gives an alarm. If yes, tracing the network flow path of each source IP in the current preset time period of the communication coverage partition, screening each review IP, retrieving the violation risk degree of the user operation behavior to the currently accessed software platform, and judging the violation risk level to carry out related warning work; omnibearing consideration is carried out from a macroscopic base station network coverage partition network use level to a microscopic software platform application level, so that the distribution and change trend of the overall network traffic is grasped, abnormal traffic behaviors on a specific software platform can be accurately positioned, the health condition of the network traffic is helped to be evaluated more comprehensively, and the network traffic evaluation efficiency is improved. Therefore, the efficiency, the precision and the safety protection capability of network traffic review are improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network information dissemination, and in particular relates to an automatic identification and warning system for large-flow network information dissemination. Background Art

[0002] In the digital age, the Internet has become the main channel for information dissemination. With the popularization of the Internet and the continuous advancement of technology, network traffic has exploded, and the speed and scope of information dissemination have expanded unprecedentedly. However, large-volume network information dissemination also brings many challenges, especially the emergence of abnormal network traffic behavior, which may indicate potential network security threats or the dissemination of bad information. Therefore, developing a system that can automatically identify and warn of abnormal network traffic behavior is of great significance to maintaining the health and security of the network environment.

[0003] In the prior art, there are also some related solutions involving network traffic anomaly detection and analysis. For example, China Patent Publication No. CN118631589B is a network traffic supervision anomaly identification and early warning method and system. It performs feature derivative processing on the first basic network data stream to generate a first derivative network data stream containing richer information and merges it with the first basic network data stream to form a hybrid network data stream. After detection and analysis of multiple anomaly identification tags, it generates anomaly warning data for the first derivative network data stream, which provides strong support for timely discovery and response to network security threats, and significantly improves the accuracy of network anomaly identification and the timeliness of early warning.

[0004] Another Chinese patent publication number is CN106453392A, which is a method for identifying abnormal flows in the entire network based on traffic feature distribution. It performs coarse-grained abnormal identification on the network data flow in the entire network, extracts node pairs with abnormal traffic from the entire network, and determines the feature category of the abnormal traffic. Then, it performs fine-grained abnormal identification based on the extracted feature category and abnormal node pairs, determines the abnormal traffic feature value, and finally collects abnormal flow sets from the abnormal node pairs based on the abnormal traffic feature value determined above. The hierarchical method is used to identify abnormal flows in the network data flow in the entire network, which not only improves the accuracy, but also does not bring huge measurement and calculation workload. It accurately locates the abnormal node pairs in the entire network, and obtains the traffic feature values ​​such as the IP address and port number of the abnormal traffic in the abnormal node pairs.

[0005] Although the above scheme proposes some solutions related to network traffic anomaly detection and analysis, the existing technology still has the following limitations, specifically: 1. The existing technology is limited to the source and analysis of network traffic data for base stations or individual platforms. From the perspective of the base station alone, it can only understand the overall inflow and outflow of network traffic in a specific area and some basic transmission characteristics, and it is difficult to gain in-depth insights into the specific application behaviors and potential risks behind the traffic. From the perspective of the software platform alone, it can only be limited to the traffic generated by user operations within the platform. It is impossible to know the transmission characteristics of the traffic at the network infrastructure level and the possible external influences, resulting in an inability to provide a comprehensive and multi-level understanding of network traffic, which makes the anomaly detection and analysis results unreliable.

[0006] 2. Existing technologies for network traffic anomaly detection and analysis do not effectively consider the network traffic data payload content and related user operation behaviors, and are limited to analyzing network packet header information such as source IP address, port and destination IP address. They are unable to deeply analyze the payload content to identify potential malicious activities or abnormal behaviors, making the network traffic anomaly detection and analysis results inaccurate. Summary of the invention

[0007] In order to overcome the shortcomings of the background technology, an embodiment of the present invention provides an automatic identification and warning system for large-volume network information transmission, which can effectively solve the problems involved in the above-mentioned background technology.

[0008] The purpose of the present invention can be achieved through the following technical solutions: a large-flow network information transmission automatic identification and warning system, including: a network traffic anomaly identification module, a suspicious source IP screening module, a user behavior risk assessment module, a warning work implementation module and a cloud database.

[0009] The network traffic anomaly identification module is connected to the suspicious source IP screening module, the suspicious source IP screening module is connected to the user behavior risk assessment module, the user behavior risk assessment module is connected to the warning work implementation module, and the cloud database is connected to the network traffic anomaly identification module and the suspicious source IP screening module respectively.

[0010] The network traffic anomaly identification module is used to collect the current network traffic detection data of a communication coverage partition of the specified base station, and identify whether there is any abnormality in the current network traffic usage of the communication coverage partition of the specified base station. If it is identified, the communication coverage partition of the specified base station will be recorded as an examination partition.

[0011] The suspicious source IP screening module is used to trace the network traffic path of each source IP within the current preset time period of the review partition, and screen the suspicious source IPs corresponding to the current abnormal network traffic in the review partition, which are recorded as each review IP.

[0012] The user behavior risk assessment module is used to extract the user operation behavior data of the authorized software platform corresponding to the target IP address currently accessed by each review IP, and retrieve the violation risk level of the user operation behavior of each review IP for the software platform currently accessed.

[0013] The warning work implementation module is used to judge the violation risk level of each audited IP user's operation behavior for the software platform they are currently accessing, and carry out relevant warning work accordingly.

[0014] The cloud database is used to store the historical network traffic detection logs of the communication coverage area of ​​the specified base station, and store the target IP address blacklist and high-risk port list.

[0015] Compared with the prior art, the embodiments of the present invention have at least the following advantages or beneficial effects: (1) The present invention takes into account everything from the macroscopic base station network coverage partition to the microscopic software platform application level, thereby grasping the distribution and changing trend of the overall network traffic and accurately locating the abnormal traffic behavior on the specific software platform, thereby more comprehensively evaluating the health of the network traffic.

[0016] (2) The present invention comprehensively examines the abnormality of the network traffic increase, the abnormality of the network traffic protocol, and the abnormality of the network traffic content in a certain communication coverage area of ​​the specified base station, so as to identify whether there is an abnormality in the current network traffic usage of the communication coverage area of ​​the specified base station. It not only pays attention to the changes in the quantity of network traffic, but also deeply analyzes the protocol and content of the traffic, thereby providing a more comprehensive anomaly detection perspective.

[0017] (3) The present invention traces the network traffic path of each source IP within the current preset time period of the review partition, conducts in-depth analysis of the initiating geographical location, ports passed, target IP addresses visited, and start and end timestamps of the traffic session window, and effectively screens the suspicious source IPs corresponding to the current abnormal network traffic in the review partition, thereby greatly improving the efficiency and security protection capabilities of network traffic review.

[0018] (4) The present invention examines the normative indicators corresponding to the operation text, operation image, and operation permission of each review IP for each operation on the authorized software platform corresponding to the current target IP address it accesses, analyzes the degree of violation risk of the user operation behavior of each review IP for the software platform it currently accesses, and judges the corresponding level. Based on this, warning work is carried out to achieve comprehensive monitoring and effective management of user operation behavior, thereby improving the efficiency of security management and enhancing users' compliance awareness. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The present invention is further described using the accompanying drawings, but the embodiments in the accompanying drawings do not constitute any limitation to the present invention. A person skilled in the art can obtain other drawings based on the following drawings without creative work.

[0020] Figure 1 It is a schematic diagram of module connection of the present invention.

[0021] Figure 2 A proportional bar graph is used for the present invention with reference to exemplary network protocol types.

[0022] Figure 3 A reference schematic diagram of the network traffic path of the source IP within the current preset time period of the review partition of the present invention. DETAILED DESCRIPTION

[0023] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0024] Reference Figure 1 As shown, the present invention provides a large-flow network information transmission automatic identification and warning system, including: a network traffic anomaly identification module, a suspicious source IP screening module, a user behavior risk assessment module, a warning work implementation module and a cloud database.

[0025] The network traffic anomaly identification module is connected to the suspicious source IP screening module, the suspicious source IP screening module is connected to the user behavior risk assessment module, the user behavior risk assessment module is connected to the warning work implementation module, and the cloud database is connected to the network traffic anomaly identification module and the suspicious source IP screening module respectively.

[0026] The network traffic anomaly identification module is used to collect the current network traffic detection data of a communication coverage partition of the designated base station, and identify whether there is an abnormal situation in the current network traffic usage of the communication coverage partition of the designated base station. If it is identified that there is an abnormal situation, the communication coverage partition of the designated base station will be recorded as a review partition.

[0027] Specifically, the network traffic detection data includes a network traffic usage change curve for a preset period of time, a network protocol type usage ratio bar chart, and network traffic data load content.

[0028] The user operation behavior data includes the operation text content, operation image content, operation result logic indication and operation object of each operation.

[0029] Specifically, the specific analysis process of the network traffic anomaly identification module includes: extracting the network traffic usage change curve of the same period as the current preset period in each historical day with the same schedule nature as the current season from the historical network traffic detection log of the communication coverage partition of the designated base station stored in the cloud database, recording it as each sampled network traffic usage change curve, and comparing it with the network traffic usage change curve of the preset period in the current network traffic detection data of the communication coverage partition of the designated base station, to evaluate the abnormal degree of the current network traffic increase of the communication coverage partition. .

[0030] It should be noted that the above The specific evaluation process is as follows: by importing the network traffic usage change curve of each sampled network traffic and the network traffic usage change curve of the communication coverage partition of the specified base station in the current preset period into the Matlab software to obtain the corresponding best fitting function, which is recorded as , ,in The number of the change curve used for each sampled network traffic, , import the network traffic usage change curve of the communication coverage partition of the specified base station in the current preset period into the second layer of the coordinate system of the Matlab software, import each sampled network traffic usage change curve into the first layer of the coordinate system of the Matlab software in sequence, and compare it with the network traffic usage change curve of the communication coverage partition of the specified base station in the current preset period in the second layer, retrieve the curve segments of the network traffic usage change curve of the communication coverage partition of the specified base station in the current preset period that are relatively higher than each sampled network traffic usage change curve, record them as each excess curve segment in the current relative sampled network traffic usage change curve, extract the start and end time points of a certain excess curve segment in the current relative sampled network traffic usage change curve, record them as , according to the formula Analyze the current network traffic usage increase relative to the excess curve segment in the sampled network traffic usage change curve, The best fitting function of the sampled network traffic usage change curve is used to obtain the current network traffic usage increase degree relative to each excess curve segment in each sampled network traffic usage change curve. , is the number of each super-amplitude curve segment, , according to the formula Analyze the increase in network traffic usage in the communication coverage area of ​​the specified base station during the current preset period, where The number of sampled network traffic usage change curves is used to best fit the network traffic usage change curve for the specified base station in the communication coverage area during the current preset period. Perform a first-order derivative, substitute each unit time point in the current preset period, and retrieve the maximum value as the increase in network traffic usage within the current preset period of the communication coverage area of ​​the specified base station , using the formula Calculate the abnormal degree of the current network traffic increase in the communication coverage area, where The preset permission thresholds are respectively the relative increase degree of network traffic usage and the internal increase degree of network traffic usage.

[0031] Reference Figure 2 As shown in the figure, extract the network protocol type usage ratio bar chart of the same period as the current preset period in the historical network traffic detection log of the communication coverage area of ​​the specified base station in the current season, and count the corresponding reference usage ratios of various network protocols in the current preset period of the communication coverage area in the current season , are the numbers of various network protocols. , and compare the network protocol type in the preset time period in the current network traffic detection data of the communication coverage partition using a proportional bar chart, introduce various network protocol change trend factors, and evaluate the current network traffic protocol abnormality of the communication coverage partition .

[0032] It should be noted that the above The specific evaluation process is as follows: the usage ratio of each type of network protocol in the preset time period of the network protocol type usage ratio bar chart in the current network traffic detection data of the communication coverage partition is subtracted from the corresponding reference usage ratio, and the difference result is recorded as , for the network protocol types in the same period as the current preset period in the current season, the usage ratio of each type of network protocol on the ratio bar chart is sampled, and the usage ratio change curve of each type of network protocol in the current season preset period is constructed and the corresponding best fitting function is generated. The time of the day is substituted into the best fitting function after the first-order derivative, thereby obtaining the change trend factors of various types of network protocols , according to the formula Analyze the current abnormality of the network traffic protocol in the communication coverage area, where is a preset constant to prevent the denominator from being 0.

[0033] It should also be noted that the reference usage ratio of each type of network protocol in the current preset time period of the above-mentioned communication coverage zone is obtained by calculating the average usage ratio of the corresponding type of network protocol in the network protocol type usage ratio bar chart of the historical network traffic detection log of the communication coverage zone of the specified base station for the same time period as the current preset time period on each historical day of the season.

[0034] Screen the network traffic data load content of the preset period in the current network traffic detection data of the communication coverage partition as encrypted content and non-encrypted content, and then evaluate the abnormality of the current network traffic content of the communication coverage partition .

[0035] Specifically, the specific analysis process of the network traffic anomaly identification module also includes: Analyze the current network traffic comprehensive usage abnormal indicators of the communication coverage area, including The preset network traffic increase rate abnormality degree, network traffic protocol abnormality degree, and network traffic content abnormality degree correspond to the permitted thresholds. If the current network traffic comprehensive usage abnormality index of the communication coverage partition is greater than or equal to the preset value, it is identified that the current network traffic usage of the communication coverage partition of the designated base station is abnormal, otherwise it is identified that there is no abnormality.

[0036] Specifically, the The specific evaluation process includes: extracting each keyword in the non-encrypted content of the network traffic data load of the communication coverage partition during the current preset period, comparing it with the preset standard malware-related keyword set and the preset standard sensitive information-related keyword set, retrieving the proportion of malware-related keywords and the proportion of sensitive information-related keywords in the non-encrypted content of the network traffic data load of the communication coverage partition during the current preset period, and taking the cumulative value of the two as the abnormality level of the current non-encrypted content of the network traffic of the communication coverage partition .

[0037] Verify the credibility of the encryption certificate used for the encrypted content of the network traffic data load in the current preset period of the communication coverage partition, and use its reciprocal as the abnormality level of the current network traffic encryption content in the communication coverage partition .

[0038] It should be noted that the specific verification process of the credibility of the encryption certificate used for the encrypted content of the network traffic data load in the current preset time period of the communication coverage partition is as follows: trace back the certificate chain of the encryption certificate used for the encrypted content of the network traffic data load in the current preset time period of the communication coverage partition to detect whether there is an interruption in the certificate chain, check the validity period of the encryption certificate used for the encrypted content of the network traffic data load in the current preset time period of the communication coverage partition to detect whether the current day is within the validity period; if the certificate chain is interrupted or the current day is outside the validity period, the credibility of the encryption certificate used for the encrypted content of the network traffic data load in the current preset time period of the communication coverage partition is output as 0; if the certificate chain is not interrupted and the current day is within the validity period, the credibility of the encryption certificate used for the encrypted content of the network traffic data load in the current preset time period of the communication coverage partition is output as 1. It should be noted in particular that the inverted process of the credibility of the encryption certificate used for the encrypted content of the network traffic data load in the current preset time period of the communication coverage partition requires adding a preset constant to the denominator to prevent the denominator from being 0.

[0039] Will , The products of the corresponding preset weights are respectively accumulated to obtain the abnormality level of the current network traffic content of the communication coverage partition.

[0040] The embodiment of the present invention comprehensively examines the abnormal degree of network traffic increase, the abnormal degree of network traffic protocol, and the abnormal degree of network traffic content in a communication coverage zone of a specified base station, so as to identify whether there is an abnormal situation in the current network traffic usage of the communication coverage zone of the specified base station. It not only pays attention to the changes in the quantity of network traffic, but also deeply analyzes the protocol and content of the traffic, thereby providing a more comprehensive anomaly detection perspective.

[0041] Reference Figure 3 As shown, the suspicious source IP screening module is used to trace the network traffic path of each source IP within the current preset time period of the review partition, and screen the suspicious source IPs corresponding to the current abnormal network traffic of the review partition, which are recorded as each review IP.

[0042] Specifically, the specific analysis process of the suspicious source IP screening module includes: obtaining the initiating geographic location, traversed ports, access target IP address and start and end timestamps of each traffic session window of each source IP within the current preset time period of the review partition.

[0043] According to the target IP address blacklist and high-risk port list stored in the cloud database, compare and review whether the target IP address accessed by each traffic session window of each source IP in the current preset time period belongs to the blacklist, and whether the port passed through belongs to the high-risk port list. If a traffic session window of a source IP corresponds to the blacklist to which the target IP address belongs or the high-risk port list to which the port passed through, the source IP will be directly listed as a risk source IP for warning.

[0044] It should be noted that the warning work for the above-mentioned risk source IP corresponds to the highest violation risk level.

[0045] If the target IP addresses accessed in each traffic session window of a source IP do not belong to the blacklist and the ports passed through do not belong to the high-risk port list, then the frequency of changing the port type passed through of the source IP and the total data transmission volume of the target IP addresses accessed in each traffic session window are further obtained, and the compliance coefficient of the ports passed through and the compliance coefficient of the access data of the source IP traffic session window are evaluated respectively. If the compliance coefficient of the ports passed through is less than the preset compliance coefficient threshold of the ports passed through or the compliance coefficient of the access data is less than the preset compliance coefficient threshold of the access data, then the source IP is used as the suspicious source IP corresponding to the current abnormal network traffic.

[0046] It should be noted that the evaluation process of the compliance coefficient of the port experienced by the source IP traffic session window is as follows: the difference between the change frequency of the port type experienced by the source IP and the preset reasonable change frequency of the port type experienced is calculated, and the calculated difference is recorded as , according to the formula Analyze the compliance coefficient of the ports traversed in the source IP traffic session window.

[0047] The evaluation process of the access data compliance coefficient of the source IP traffic session window is as follows: extract the total data transmission volume of each traffic session window of the source IP corresponding to the access target IP address, retrieve the average total data transmission volume of the traffic session windows of the source IP historically accessing each target IP address in the historical network traffic detection log of the communication coverage zone of the designated base station, and use this to retrieve the historical average total data transmission volume of each traffic session window of the source IP corresponding to the access target IP address, subtract the total data transmission volume of each traffic session window of the source IP corresponding to the access target IP address from the historical average total data transmission volume, and calculate the access data compliance coefficient of the source IP traffic session window in accordance with the calculation method of the compliance coefficient of the traversed ports of the source IP traffic session window.

[0048] Specifically, the specific analysis process of the suspicious source IP screening module also includes: calculating the duration of each traffic session window of each source IP within the current preset time period of the review partition, and the distance and interval duration between the initiating geographical location and the previous traffic session window, and respectively evaluating the position change compliance coefficient and interval duration compliance coefficient of each source IP traffic session window within the current preset time period of the review partition. If the position change compliance coefficient of a source IP traffic session window is less than the preset position change compliance coefficient compliance threshold or the interval duration compliance coefficient is less than the preset interval duration compliance threshold, then the source IP is used as the suspicious source IP corresponding to the current abnormal network traffic.

[0049] It should be noted that the specific evaluation process of the position change compliance coefficient and interval duration compliance coefficient of each source IP traffic session window within the current preset time period of the above-mentioned review partition is as follows: extract the initiating geographical location distance between each traffic session window of each source IP within the current preset time period of the review partition and the previous traffic session window; if the initiating geographical location distance between a traffic session window and the previous traffic session window is greater than the preset reasonable distance threshold, it means that there is a high-amplitude change in the source IP position in this traffic session window; retrieve the cumulative number of high-amplitude change phenomena of each source IP within the current preset time period of the review partition And the highest number of consecutive high-amplitude fluctuations ,in To review the number of each source IP in the current preset time period of the partition, , according to the formula Analyze and review the position change compliance coefficient of each source IP traffic session window within the current preset time period of the partition, where The first The number of source IP traffic session windows.

[0050] Extract the duration of each traffic session window of each source IP in the current preset time period of the review partition The interval between the window and the previous traffic session window , is the number of each traffic session window, , according to the formula Analyze and review the compliance coefficient of the interval length of each source IP traffic session window within the current preset period of the partition, where is the preset reasonable interval time threshold of adjacent traffic session windows. It is the preset reasonable reference duration of the traffic session window. Its data comes from the reasonable duration interval of the traffic session window provided as a reference in the specified base station network practice guide. The upper and lower limits of the interval are averaged and obtained. is the preset reasonable deviation duration of the traffic session window, and its data comes from the calculated difference between the preset reasonable reference duration of the traffic session window and the lower limit of the reasonable duration interval of the traffic session window. is the number of traffic session windows.

[0051] It should be noted that, when analyzing the compliance coefficient of the interval duration of each source IP traffic session window within the current preset time period of the review partition, the basis for the proportional relationship between the interval duration of each traffic session window of each source IP within the current preset time period of the review partition and the previous traffic session window is that: if the interval duration between adjacent traffic session windows is too short, or even a session window is opened before the previous window ends, it means that the source IP is frequently operated, which is an abnormal phenomenon, and the opening of the session window is usually determined by the user's operating intention. If the interval duration between adjacent traffic session windows is generally longer, the possibility of frequent operation can be ruled out, and thus a proportional relationship is present.

[0052] In summary, the current abnormal network traffic in the screening and review partition uses the corresponding suspicious source IPs.

[0053] The embodiment of the present invention traces back the network traffic path of each source IP within the current preset time period of the review partition, and conducts in-depth analysis of the initiating geographical location, traversed ports, access target IP addresses and start and end timestamps of the traffic session window, thereby achieving effective screening of each suspicious source IP corresponding to the current abnormal network traffic usage in the review partition, thereby greatly improving the efficiency and security protection capabilities of network traffic review.

[0054] The user behavior risk assessment module is used to extract the user operation behavior data of the authorized software platform corresponding to the target IP address currently accessed by each review IP, and retrieve the violation risk level of the user operation behavior of each review IP for the software platform currently accessed.

[0055] Specifically, the specific analysis process of the user behavior risk assessment module includes: extracting the operation text content and operation image content of each operation in the user operation behavior data of the authorized software platform corresponding to the target IP address currently visited by each review IP, performing string conversion on the operation text content, and combining the defined regular expression library provided by the authorized software platform corresponding to the target IP address currently visited by each review IP, verifying and outputting the operation text normative indicators of each review IP for each operation of the authorized software platform corresponding to the target IP address currently visited by it ,in is the number of each review IP, , is the number of each operation, .

[0056] It should be noted that the above The verification output can be specifically achieved by importing the operation text content after string conversion and the defined regular expression library into the text processing software, and using the preset rules in the defined regular library to verify the operation text content one by one. If the operation text content matches a preset rule, the output of the preset rule matching status indicator is 1; if the operation text content does not match a preset rule, the output of the preset rule matching status indicator is 0, and the preset weights of the preset rules in the defined regular library are extracted. The matching status indicators of the operation text content relative to the preset rules in the defined regular library are integrated and multiplied by the corresponding preset weights, and the operation text class normative indicators are accumulated to obtain the operation text class normative indicators, thereby obtaining the operation text class normative indicators of each operation of each review IP on the authorized software platform corresponding to the target IP address currently visited.

[0057] Exemplarily, the above-mentioned text processing software may specifically be UltraEdit, Notepad++, SPSS, or SAS.

[0058] It should be noted that the defined regular expression library provided by the above-mentioned authorized software platform refers to a series of regular expression rules for matching and verifying legal and standardized operation text formats, which are pre-formulated by the platform based on its own operating specifications, business logic, etc.

[0059] Image elements are collected based on the content of the operation images. Based on the definition and specification image element library provided by the authorized software platform corresponding to the target IP address currently accessed by each review IP, the operation image specification indicators of each operation performed by each review IP on the authorized software platform corresponding to the target IP address currently accessed are verified and output. .

[0060] It should be noted that the above The verification output process is as follows: compare each image element in the operation image content of a certain operation on the authorized software platform corresponding to the target IP address currently visited by a review IP with each image element in the defined standard image element library provided by the authorized software platform corresponding to the target IP address currently visited by the review IP one by one, count the number of image elements in the defined standard image element library provided by the authorized software platform corresponding to the target IP address currently visited by the review IP, perform ratio analysis with the total number of image elements collected in the operation image content of the operation, obtain the operation image type normative indicators of the operation of the authorized software platform corresponding to the target IP address currently visited by the review IP, and thereby verify the operation image type normative indicators of each review IP for each operation on the authorized software platform corresponding to the target IP address currently visited.

[0061] Extract the logical indications and operation objects of the operation results of each operation in the user operation behavior data of the authorized software platform corresponding to the target IP address currently accessed by each review IP, verify and output the normative indicators of the operation permissions of each review IP for each operation of the authorized software platform corresponding to its current target IP address. .

[0062] It should be noted that the above The verification output process is as follows: the operation result logic indicator takes a value of 1 or 0, where 1 indicates a successful operation and 0 indicates a failed operation. The user identity and corresponding user authority scope of the authorized software platform corresponding to the target IP address currently accessed by each review IP are obtained. The user operation behavior data of the authorized software platform corresponding to the target IP address currently accessed by each review IP is detected to see whether the operation object of each operation is within the corresponding user authority scope. If the operation object of a certain operation is within the corresponding user authority scope, the normative indicator of the operation authority class assigned to the operation is If the operation object of an operation is outside the scope of the corresponding user's authority and the logical indicator of the operation result is 0, the normative indicator of the operation authority class assigned to the operation is If the operation object of an operation is outside the scope of the corresponding user's authority and the operation result logical indicator is 1, the normative indicator of the operation authority class assigned to the operation is ,in , thereby outputting the normative indicators of the operation permissions of each review IP for each operation on the authorized software platform corresponding to its current access target IP address.

[0063] Specifically, the specific analysis process of the user behavior risk assessment module also includes: Analyze the violation risk level of each IP user's operation behavior based on the software platform they are currently accessing. Preset weights for normative indicators corresponding to the operation text category, operation image category, and operation authority category. is the number of operations.

[0064] For example, the above The specific value can be .

[0065] The warning work implementation module is used to judge the violation risk level of each audited IP user's operation behavior for the software platform they are currently accessing, and carry out relevant warning work accordingly.

[0066] Specifically, the specific analysis process of the warning work implementation module includes: performing a ratio analysis on the violation risk level of each audited IP user's operation behavior for the software platform currently accessed and the preset benchmark violation risk level, taking the integer of the ratio analysis result as the violation risk level of each audited IP user's operation behavior for the software platform currently accessed, and specifying the base station to issue warnings and restrict the activities of each audited IP according to the level.

[0067] The embodiment of the present invention examines the normative indicators corresponding to the operation text, operation image, and operation permission of each review IP for each operation on the authorized software platform corresponding to the current target IP address it accesses, analyzes the degree of violation risk of the user operation behavior of each review IP for the current software platform it accesses, and judges the corresponding level, and carries out warning work based on this, thereby achieving comprehensive monitoring and effective management of user operation behavior, thereby improving the efficiency of security management and enhancing users' compliance awareness.

[0068] The cloud database is used to store the historical network traffic detection log of the communication coverage zone of the designated base station, and store the target IP address blacklist list and the high-risk port list.

[0069] The embodiment of the present invention takes into account everything from the macroscopic base station network coverage partition to the microscopic software platform application level, so as to grasp the distribution and change trend of the overall network traffic and accurately locate the abnormal traffic behavior on the specific software platform, thereby more comprehensively evaluating the health of the network traffic.

[0070] The above contents are merely examples and explanations of the structure of the present invention. The technicians in this technical field may make various modifications or additions to the specific embodiments described or replace them in a similar manner. As long as they do not deviate from the structure of the invention or exceed the scope defined by the present invention, they should all fall within the protection scope of the present invention.

Claims

1. A high-volume network information transmission automatic identification and warning system, characterized in that: The system includes: The network traffic anomaly identification module is used to collect the current network traffic detection data of a communication coverage zone of the specified base station, identify whether there is an abnormality in the current network traffic usage of the communication coverage zone of the specified base station, and if so, record the communication coverage zone of the specified base station as a review zone; The suspicious source IP screening module is used to trace the network traffic path of each source IP in the current preset time period of the review partition, and screen the suspicious source IPs corresponding to the current abnormal network traffic in the review partition, which are recorded as each review IP; The user behavior risk assessment module is used to extract the user operation behavior data of the authorized software platform corresponding to the target IP address currently accessed by each review IP, and retrieve the violation risk level of each review IP user operation behavior for the software platform currently accessed; The warning work implementation module is used to judge the violation risk level of each audited IP user's operation behavior for the software platform they are currently accessing, and carry out relevant warning work accordingly; The cloud database is used to store the historical network traffic detection logs of the communication coverage area of ​​the specified base station, and store the target IP address blacklist and high-risk port list.

2. According to claim 1, a high-volume network information transmission automatic identification and warning system is characterized by: The network traffic detection data includes a network traffic usage change curve for a preset period, a network protocol type usage ratio bar chart, and network traffic data load content; The user operation behavior data includes the operation text content, operation image content, operation result logic indication and operation object of each operation.

3. According to claim 2, a high-volume network information transmission automatic identification and warning system is characterized by: The specific analysis process of the network traffic anomaly identification module includes: extracting the network traffic usage change curve of the same period as the current preset period in the historical days with the same schedule nature as the current season from the historical network traffic detection log of the communication coverage partition of the designated base station stored in the cloud database, and comparing it with the network traffic usage change curve of the preset period in the current network traffic detection data of the communication coverage partition of the designated base station, and evaluating the abnormal degree of the current network traffic increase of the communication coverage partition ; Extract the network protocol type usage ratio bar chart of the same period as the current preset period in the historical network traffic detection log of the communication coverage partition of the specified base station, and count the corresponding reference usage ratios of various network protocols in the current preset period of the season in the communication coverage partition, and compare them with the network protocol type usage ratio bar chart of the preset period in the current network traffic detection data of the communication coverage partition, introduce various network protocol change trend factors, and evaluate the current abnormality of the network traffic protocol in the communication coverage partition ; Screen the network traffic data load content of the preset period in the current network traffic detection data of the communication coverage partition as encrypted content and non-encrypted content, and then evaluate the abnormality of the current network traffic content of the communication coverage partition .

4. According to claim 3, a high-volume network information transmission automatic identification and warning system is characterized by: The specific analysis process of the network traffic anomaly identification module also includes: Analyze the current network traffic comprehensive usage abnormal indicators of the communication coverage area, including The preset network traffic increase rate abnormality degree, network traffic protocol abnormality degree, and network traffic content abnormality degree correspond to the permitted thresholds. If the current network traffic comprehensive usage abnormality index of the communication coverage partition is greater than or equal to the preset value, it is identified that the current network traffic usage of the communication coverage partition of the designated base station is abnormal, otherwise it is identified that there is no abnormality.

5. According to claim 3, a high-volume network information transmission automatic identification and warning system is characterized by: Said The specific evaluation process includes: extracting each keyword in the non-encrypted content of the network traffic data load of the communication coverage partition during the current preset period, comparing it with the preset standard malware-related keyword set and the preset standard sensitive information-related keyword set, retrieving the proportion of malware-related keywords and the proportion of sensitive information-related keywords in the non-encrypted content of the network traffic data load of the communication coverage partition during the current preset period, and taking the cumulative value of the two as the abnormality level of the current non-encrypted content of the network traffic of the communication coverage partition ; Verify the credibility of the encryption certificate used for the encrypted content of the network traffic data load in the current preset period of the communication coverage partition, and use its reciprocal as the abnormality level of the current network traffic encryption content in the communication coverage partition ; Will , The products of the corresponding preset weights are respectively accumulated to obtain the abnormality level of the current network traffic content of the communication coverage partition.

6. According to claim 1, a high-volume network information transmission automatic identification and warning system is characterized by: The specific analysis process of the suspicious source IP screening module includes: obtaining the initiating geographical location, traversed ports, access target IP address and start and end timestamps of each flow session window of each source IP within the current preset time period of the review partition; According to the target IP address blacklist and high-risk port list stored in the cloud database, compare and review whether the target IP address corresponding to each traffic session window of each source IP in the current preset period belongs to the blacklist, and whether the port passed through belongs to the high-risk port list. If a traffic session window of a source IP corresponds to the blacklist to which the target IP address belongs or the high-risk port list to which the port passed through belongs, the source IP is directly listed as a risk source IP for warning; If the target IP addresses accessed in each traffic session window of a source IP do not belong to the blacklist and the ports passed through do not belong to the high-risk port list, then the frequency of changing the port type passed through of the source IP and the total data transmission volume of the target IP addresses accessed in each traffic session window are further obtained, and the compliance coefficient of the ports passed through and the compliance coefficient of the access data of the source IP traffic session window are evaluated respectively. If the compliance coefficient of the ports passed through is less than the preset compliance coefficient threshold of the ports passed through or the compliance coefficient of the access data is less than the preset compliance coefficient threshold of the access data, then the source IP is used as the suspicious source IP corresponding to the current abnormal network traffic.

7. The automatic identification and warning system for large-volume network information transmission according to claim 6 is characterized by: The specific analysis process of the suspicious source IP screening module also includes: calculating the duration of each flow session window of each source IP in the current preset time period of the review partition, and the distance and interval duration between the initiating geographical location of the window and the previous flow session window, respectively evaluating the position change compliance coefficient and the interval compliance coefficient of each source IP flow session window in the current preset time period of the review partition, if the position change compliance coefficient of a source IP flow session window is less than the preset position change compliance coefficient compliance threshold or the interval compliance coefficient is less than the preset interval compliance coefficient compliance threshold, then the source IP is used as the suspicious source IP corresponding to the current abnormal network traffic; In summary, the current abnormal network traffic in the screening and review partition uses the corresponding suspicious source IPs.

8. The automatic identification and warning system for large-volume network information transmission according to claim 2 is characterized by: The specific analysis process of the user behavior risk assessment module includes: extracting the operation text content and operation image content of each operation in the user operation behavior data of the authorized software platform corresponding to the target IP address currently visited by each review IP, performing string conversion on the operation text content, and combining the definition regular expression library provided by the authorized software platform corresponding to the target IP address currently visited by each review IP, verifying and outputting the operation text normative indicators of each review IP for each operation of the authorized software platform corresponding to the target IP address currently visited by it ,in is the number of each review IP, , is the number of each operation, ; Image elements are collected based on the content of the operation images. Based on the definition and specification image element library provided by the authorized software platform corresponding to the target IP address currently accessed by each review IP, the operation image specification indicators of each operation performed by each review IP on the authorized software platform corresponding to the target IP address currently accessed are verified and output. ; Extract the logical indications and operation objects of the operation results of each operation in the user operation behavior data of the authorized software platform corresponding to the target IP address currently accessed by each review IP, verify and output the normative indicators of the operation permissions of each review IP for each operation of the authorized software platform corresponding to its current target IP address. .

9. The automatic identification and warning system for large-volume network information transmission according to claim 8 is characterized by: The specific analysis process of the user behavior risk assessment module also includes: Analyze the violation risk level of each IP user's operation behavior against the software platform they are currently accessing. Preset weights for normative indicators corresponding to the operation text category, operation image category, and operation authority category. is the number of operations.

10. The automatic identification and warning system for large-volume network information transmission according to claim 1 is characterized by: The specific analysis process of the warning work implementation module includes: conducting a ratio analysis of the violation risk level of each audited IP user's operation behavior for the software platform currently accessed and the preset benchmark violation risk level, taking the integer of the ratio analysis result as the violation risk level of each audited IP user's operation behavior for the software platform currently accessed, and specifying the base station to issue warnings and restrict the activities of each audited IP according to the level.

Images