Network data security monitoring method and system

Abstract

The invention relates to the technical field of network data security, and discloses a network data security monitoring method and system. The network data security monitoring method comprises the following steps: enhancing information and data encryption; constructing a boundary defense system; establishing a data monitoring and auditing system; the security monitoring system based on network data comprises a data monitoring and auditing system, a big data auxiliary module; a network abnormal behavior real-time alarm module; a network information security prediction module; according to the invention, a data monitoring and auditing system is combined with big data, association analysis is carried out on train network data information safety factors, then network data information safety abnormal behaviors are determined, and on the basis, the train network data information safety state is monitored in real time based on the big data technology. Therefore, the network data information security real-time monitoring precision is effectively improved, and the network data information security real-time monitoring time is shortened.

Description

Technical Field

[0001] The present invention belongs to the technical field of network data security, and in particular relates to a network data security monitoring method and system. Background Art

[0002] The train communication network is the "brain and nerve" of rail transit vehicles. It is currently in the stage of transitioning from MVB / WTB bus to real-time Ethernet communication. The bandwidth has also increased from 1.5Mbps to 100Mbps or 1Gbps. The large bandwidth provides a channel foundation for the information and intelligent application of rail transit trains. As a result, the risk of network security has also extended from the external Internet to the internal communication network of the train. Improving the network security protection capability of the train network system has become a key and basic issue that needs to be solved urgently. The application of high-bandwidth Ethernet and big data technology has significantly enhanced the data processing and application of the internal network of the train, providing data support for information and intelligent applications. However, with the continuous development of technology, it can bring advantages and certain security risks. The current network information security issues have been seriously challenged. The information data in the network is facing the risk of being stolen. The security vulnerabilities of network equipment, computer systems, and even intelligent networked devices are serious, and the repair progress has not kept up. Therefore, the protection of information security is particularly important. The train communication network is related to the safety of train operation. These key and basic issues need to be studied to ensure the network information security of the train on-board network system; therefore, in view of the current situation, it needs to be improved. Summary of the invention

[0003] In view of the above situation, in order to overcome the defects of the prior art, the present invention provides a network data security monitoring method and system, which effectively solves the problem that with the upgrade of the train communication network, the network information security problem has been seriously challenged, the information data in the network is facing the risk of being stolen, the network equipment, computer systems, and even smart networking devices have serious security vulnerabilities, and the repair progress has not kept up with the pace.

[0004] To achieve the above object, the present invention provides the following technical solution: a network data security monitoring method, characterized in that it includes the following steps:

[0005] Step 1: Strengthen information and data encryption. For the wireless communication between vehicles and ground, use mathematical algorithms to encrypt information and use serial numbers to encrypt data. According to the confidentiality level of the information, multiple layers of secret keys are superimposed to increase the confidentiality effect. For computers used for maintenance, use digital signature technology to identify the identity through the signature, and ensure that the recipient of the information can check whether the document has been modified through the digital signature, thereby ensuring the security and privacy of the information data.

[0006] Step 2: Build a border defense system to filter and identify information security attacks and abnormal network behaviors, analyze the attack path of the train communication network, set up access control and isolation protection security firewalls for terminal equipment, wireless access equipment, and debugging and maintenance interfaces. When an attack is detected, record the attack source IP, attack type, attack target, and attack time, and provide an alarm when a serious intrusion occurs. For debugging and maintenance equipment, use 802.1X and ACL access authentication methods to control illegal debugging equipment access. Unauthenticated debugging equipment cannot access the on-board network to ensure that the train network is not affected by illegal equipment access.

[0007] Step 3: Establish a data monitoring and auditing system, deploy monitoring and auditing products in the bypass of the marshaling network switch at the front and rear of the train, mirror all interactive data traffic in the train communication network passing through the switch to the monitoring and auditing platform through the switch mirror port configuration, and monitor in real time through the monitoring and auditing equipment, security audit and event lake source, professional leakage identification, and unknown device monitoring. When deploying auditing equipment, security audits should be conducted at the network boundary and important network nodes. The audit covers each user, and important user behaviors and important security events are audited. The audit records should include the date and time of the event, the user, the event type, whether the event was successful, and other audit-related information. The audit records should be protected and backed up regularly to avoid unexpected deletion, modification or overwriting. It should be possible to conduct separate behavioral audits and data analysis on remote access user behaviors and user behaviors accessing the Internet.

[0008] A network data security monitoring system, characterized in that: the network data security monitoring system includes a data monitoring and auditing system, and the data monitoring and auditing system comprehensively analyzes and audits all interactive data flows in a train communication network;

[0009] A big data auxiliary module, which is based on the premise that the data monitoring and auditing system completes the abnormal behavior detection of network information security data. After the determined abnormal network data information security behavior is obtained, the network data information security status is monitored in real time based on big data technology, and the basic parameters of network data information and its network environment are collected by big data, and the utilization rate of each security factor is weighted and processed, which is the relevant security factor of the collected network data information. Then, false network data information is selected and used as the target node for injection attack, and the dependency relationship between the node and its node in the network data information is constructed to obtain the security parameters of the network data information;

[0010] A real-time alarm module for abnormal network behavior. The real-time alarm module for abnormal network behavior is based on the premise that the data monitoring and auditing system completes abnormal behavior detection of network information security data, reads the detection results transmitted to the module, and responds according to the specific content of the detection results. When abnormal network behavior is read, the real-time alarm module will push an alarm to the station remote intelligent terminal;

[0011] A network information security prediction module uses known abnormal network information security behaviors as a raw data set and uses a prediction formula to predict real-time data in a network information operating environment.

[0012] Preferably, the proposed data monitoring and auditing system has comprehensive intelligent collection and classification functions, continuous connection checks and complete component checks, and customizable caching functions to ensure that the system receives all data and monitors each link of the transmission chain, and configures filtering and aggregation functions to eliminate irrelevant data; various security event logs (attacks, intrusions, anomalies), various behavioral event logs (internal controls, violations), various weakness scanning logs (weaknesses, vulnerabilities), various status monitoring logs (availability, performance, status), event descriptions from a security perspective: event target object classification, event behavior classification, event feature classification, event result classification, attack classification, and detection equipment classification.

[0013] Preferably, the proposed data monitoring and auditing system adopts multi-level parsing function and dynamic programming algorithm to realize flexible unparsed log event processing, built-in regular, JON, Grok, delimiter enriched parsing rules, combined with mind mapping mode, the parsing rules are visualized, support drag and sort editing of rules, real-time display of parsing time, number of successes and number of failures information.

[0014] Preferably, the calculation formula for weighted processing of the security factor utilization rate of the proposed network environment basic parameters is: In the formula, Z1 is the weighted result of the network data information security factor; the dependency relationship formula between nodes and network data information is: Where V is the dependency relationship between nodes in the network data information.

[0015] Preferably, the proposed network information security prediction formula is: In the formula, Fg is the predicted value of the network information security status, g represents the time node in the prediction process, Fg and Mg represent the predicted data value at time g and the reference value of the indicator in the original data set, respectively, and is the number of indicators in the prediction process.

[0016] Compared with the prior art, the beneficial effects of the present invention are: 1. The present invention can ensure the recipient of the information by strengthening information and data encryption, and can check whether the document has been modified through digital signature, thereby ensuring the security and privacy of the information data; by building a border defense system, the internal network can be protected when it is connected to the external network and external maintenance computer, so that the network's virus recognition effect is improved, and external viruses are effectively isolated. For debugging and maintenance equipment, 802.1X and ACL access authentication methods can be used to control illegal debugging equipment access. Debugging equipment that has not passed the authentication cannot access the on-board network, ensuring that the train network is not affected by illegal equipment access.

[0017] 2. The present invention combines the data monitoring and auditing system with big data, conducts correlation analysis on train network data information security factors, determines abnormal network data information security behavior, and on this basis, monitors the train network data information security status in real time based on big data technology, thereby effectively improving the accuracy of real-time monitoring of network data information security and shortening the time of real-time monitoring of network data information security.

[0018] 3. The present invention, through the real-time alarm module for abnormal network behavior, can enable managers and users to promptly obtain alarm information on attacks on network information security, meet the real-time requirements of network information security monitoring, and cooperate with the network information security prediction module to predict the real-time data in the network information operation environment, which can improve the alarm speed of network information security monitoring and enhance the real-time nature of its monitoring process. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention.

[0020] In the attached picture:

[0021] Figure 1 This is a block diagram of the network data security monitoring method and system of the present invention;

[0022] Figure 2 This is a block diagram of the network data security monitoring system based on the present invention. DETAILED DESCRIPTION

[0023] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments; based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0024] See also Figure 1-Figure 2 The present invention provides a network data security monitoring method, comprising the following steps:

[0025] Step 1: Strengthen information and data encryption. For the wireless communication between vehicles and ground, use mathematical algorithms to encrypt information and use serial numbers to encrypt data. According to the confidentiality level of the information, multiple layers of secret keys are superimposed to increase the confidentiality effect. For computers used for maintenance, use digital signature technology to identify the identity through the signature, and ensure that the recipient of the information can check whether the document has been modified through the digital signature, thereby ensuring the security and privacy of the information data.

[0026] Step 2: Build a border defense system to filter and identify information security attacks and abnormal network behaviors, analyze the attack path of the train communication network, set up access control and isolation protection security firewalls for terminal equipment, wireless access equipment, and debugging and maintenance interfaces. When an attack is detected, record the attack source IP, attack type, attack target, and attack time, and provide an alarm when a serious intrusion occurs. For debugging and maintenance equipment, use 802.1X and ACL access authentication methods to control illegal debugging equipment access. Unauthenticated debugging equipment cannot access the on-board network to ensure that the train network is not affected by illegal equipment access.

[0027] Step 3: Establish a data monitoring and auditing system, deploy monitoring and auditing products in the bypass of the marshaling network switch at the front and rear of the train, mirror all interactive data traffic in the train communication network passing through the switch to the monitoring and auditing platform through the switch mirror port configuration, and monitor in real time through the monitoring and auditing equipment, security audit and event lake source, professional leakage identification, and unknown device monitoring. When deploying auditing equipment, security audits should be conducted at the network boundary and important network nodes. The audit covers each user, and important user behaviors and important security events are audited. The audit records should include the date and time of the event, the user, the event type, whether the event was successful, and other audit-related information. The audit records should be protected and backed up regularly to avoid unexpected deletion, modification or overwriting. It should be possible to conduct separate behavioral audits and data analysis on remote access user behaviors and user behaviors accessing the Internet.

[0028] A network data security monitoring system, comprising a data monitoring and auditing system, wherein the data monitoring and auditing system comprehensively analyzes and audits all interactive data flows within a train communication network;

[0029] A big data auxiliary module, which is based on the premise that the data monitoring and auditing system completes the abnormal behavior detection of network information security data. After the determined abnormal network data information security behavior is obtained, the network data information security status is monitored in real time based on big data technology, and the basic parameters of network data information and its network environment are collected by big data, and the utilization rate of each security factor is weighted and processed, which is the relevant security factor of the collected network data information. Then, false network data information is selected and used as the target node for injection attack, and the dependency relationship between the node and its node in the network data information is constructed to obtain the security parameters of the network data information;

[0030] A real-time alarm module for abnormal network behavior. The real-time alarm module for abnormal network behavior is based on the premise that the data monitoring and auditing system completes abnormal behavior detection of network information security data, reads the detection results transmitted to the module, and responds according to the specific content of the detection results. When abnormal network behavior is read, the real-time alarm module will push an alarm to the station remote intelligent terminal;

[0031] A network information security prediction module uses known abnormal network information security behaviors as a raw data set and uses a prediction formula to predict real-time data in a network information operating environment.

[0032] Among them, the proposed data monitoring and auditing system has comprehensive intelligent collection and classification functions, continuous connection checks and complete piece checks, and customizable cache functions to ensure that the system receives all data, monitors each link of the transmission chain, and configures filtering and aggregation functions to eliminate irrelevant data; for various security event logs (attacks, intrusions, anomalies), various behavior event logs (internal control, violations), various weakness scanning logs (weaknesses, vulnerabilities), various status monitoring logs (availability, performance, status), event descriptions from a security perspective: event target object classification, event behavior classification, event feature classification, event result classification, attack classification, and detection equipment classification; the proposed data monitoring and auditing system adopts multi-level parsing functions and dynamic programming algorithms to achieve flexible unparsed log event processing, built-in regular, JON, Grok, delimiter enriched parsing rules, combined with mind map mode, the parsing rules are graphically visualized, support drag and sort editing rules, and real-time display of parsing time, number of successes and number of failures; the proposed calculation formula for weighted processing of security factor utilization of basic parameters of the network environment is: In the formula, Z1 is the weighted result of the network data information security factor; the dependency relationship formula between nodes and network data information is: In the formula, V is the dependency relationship between nodes in network data information; the proposed network information security prediction formula is In the formula, Fg is the predicted value of the network information security status, g represents the time node in the prediction process, Fg and Mg represent the predicted data value at time g and the reference value of the indicator in the original data set, respectively, and is the number of indicators in the prediction process.

[0033] By strengthening information and data encryption, the recipient of the information can be ensured. Through digital signatures, it can be checked whether the document has been modified, thereby ensuring the security and privacy of information data; by building a border defense system, the internal network can be protected when it is connected to the external network and external maintenance computers, so that the network's virus recognition effect is improved and external viruses are effectively isolated. For debugging and maintenance equipment, 802.1X and ACL access authentication methods can be used to control illegal debugging equipment access. Unauthenticated debugging equipment cannot access the on-board network, ensuring that the train network is not affected by illegal equipment access; combining data monitoring and auditing systems with big data, through The train network data information security factors are correlated and analyzed to determine abnormal network data information security behaviors. On this basis, the train network data information security status is monitored in real time based on big data technology, thereby effectively improving the accuracy of real-time monitoring of network data information security and shortening the real-time monitoring time of network data information security. The real-time alarm module for network abnormal behavior can enable managers and users to promptly obtain alarm information on attacks on network information security, meet the real-time requirements of network information security monitoring, and cooperate with the network information security prediction module to predict real-time data in the network information operation environment, which can improve the alarm speed of network information security monitoring and enhance the real-time nature of the monitoring process.

[0034] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0035] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A network data security monitoring method, characterized in that: The following steps are involved: Step 1: Strengthen information and data encryption. For the wireless communication between vehicles and ground, use mathematical algorithms to encrypt information and use serial numbers to encrypt data. According to the confidentiality level of the information, multiple layers of secret keys are superimposed to increase the confidentiality effect. For computers used for maintenance, use digital signature technology to identify the identity through the signature, and ensure that the recipient of the information can check whether the document has been modified through the digital signature, thereby ensuring the security and privacy of the information data. Step 2: Build a border defense system to filter and identify information security attacks and abnormal network behaviors, analyze the attack path of the train communication network, set up access control and isolation protection security firewalls for terminal equipment, wireless access equipment, and debugging and maintenance interfaces. When an attack is detected, record the attack source IP, attack type, attack target, and attack time, and provide an alarm when a serious intrusion occurs. For debugging and maintenance equipment, use 802.1X and ACL access authentication methods to control illegal debugging equipment access. Unauthenticated debugging equipment cannot access the on-board network to ensure that the train network is not affected by illegal equipment access. Step 3: Establish a data monitoring and auditing system, deploy monitoring and auditing products in the bypass of the marshaling network switch at the front and rear of the train, mirror all interactive data traffic in the train communication network passing through the switch to the monitoring and auditing platform through the switch mirror port configuration, and monitor in real time through the monitoring and auditing equipment, security audit and event lake source, professional leakage identification, and unknown device monitoring. When deploying auditing equipment, security audits should be conducted at the network boundary and important network nodes. The audit covers each user, and important user behaviors and important security events are audited. The audit records should include the date and time of the event, the user, the event type, whether the event was successful, and other audit-related information. The audit records should be protected and backed up regularly to avoid unexpected deletion, modification or overwriting. It should be possible to conduct separate behavioral audits and data analysis on remote access user behaviors and user behaviors accessing the Internet.

2. A network data security monitoring system according to claim 1, characterized in that: The network data security monitoring system includes a data monitoring and auditing system, which comprehensively analyzes and audits all interactive data flows within the train communication network; A big data auxiliary module, which is based on the premise that the data monitoring and auditing system completes the abnormal behavior detection of network information security data. After the determined abnormal network data information security behavior is obtained, the network data information security status is monitored in real time based on big data technology, and the basic parameters of network data information and its network environment are collected by big data, and the utilization rate of each security factor is weighted and processed, which is the relevant security factor of the collected network data information. Then, false network data information is selected and used as the target node for injection attack, and the dependency relationship between the node and its node in the network data information is constructed to obtain the security parameters of the network data information; A real-time alarm module for abnormal network behavior. The real-time alarm module for abnormal network behavior is based on the premise that the data monitoring and auditing system completes abnormal behavior detection of network information security data, reads the detection results transmitted to the module, and responds according to the specific content of the detection results. When abnormal network behavior is read, the real-time alarm module will push an alarm to the station remote intelligent terminal; A network information security prediction module uses known abnormal network information security behaviors as a raw data set and uses a prediction formula to predict real-time data in a network information operating environment.

3. A network data security monitoring system according to claim 2, characterized in that: The proposed data monitoring and auditing system has comprehensive intelligent collection and classification functions, continuous connection checks and complete piece checks, and customizable caching functions to ensure that the system receives all data and monitors all links in the transmission chain, and configures filtering and aggregation functions to eliminate irrelevant data; For various security event logs (attacks, intrusions, anomalies), various behavioral event logs (internal controls, violations), various weakness scanning logs (weaknesses, vulnerabilities), various status monitoring logs (availability, performance, status), event descriptions from a security perspective: event target object classification, event behavior classification, event feature classification, event result classification, attack classification, and detection equipment classification.

4. A network data security monitoring system according to claim 2, characterized in that: The proposed data monitoring and auditing system adopts multi-level parsing function and dynamic programming algorithm to realize flexible processing of unparsed log events. It has built-in parsing rules enriched with regular, JON, Grok, and delimiters. Combined with the mind mapping mode, the parsing rules are visualized, and the editing of rules in the form of dragging and sorting is supported. The parsing time, number of successes and number of failures can be displayed in real time.

5. A network data security monitoring system according to claim 2, characterized in that: The calculation formula for weighted processing of security factor utilization rate of basic parameters of network environment is proposed as follows: In the formula, Z1 is the weighted result of the network data information security factor; the dependency relationship formula between nodes and network data information is: Where V is the dependency relationship between nodes in the network data information.

6. A network data security monitoring system according to claim 2, characterized in that: The proposed network information security prediction formula is: In the formula, Fg is the predicted value of the network information security status, g represents the time node in the prediction process, Fg and Mg represent the predicted data value at time g and the reference value of the indicator in the original data set, respectively, and is the number of indicators in the prediction process.

Images